------------------ OPCODE.LST ---------------------------- This is DOC 'bout undocument command and document command of any last processors. And 'bout some registers and Chips specific stuffs. ----------------------------------------------------------- (C) (P) Potemkin's Hackers Group 1994...1999 ----------------------------------------------------------- Revision 4.51 15 Oct 1999 ----------------------------------------------------------- Latest versions available on Web: http://www.chat.ru/~phg Our contact E-mail: avp@gdev.msk.ru ICQ UIN: 20570214 ------------------------------------------------------------ [New In revision 4.50] o AMD 3DNow! Extentions and Athlon CPU o Update CPUID features summary o Update OPCODE tables o Update CPU revisions ------------------------------------------------------------- --------------------------------------------------- OPCODE AAA - ASCII adjust AX after addition CPU: 8086+ Type of Instruction: User Instruction: AAA ; (no operands) Description: IF ((( AL and 0FH ) > 9 ) or (AF==1) THEN { IF CPU<286 THEN { AL <- AL+6 } ELSE { AX <- AX+6 } AH <- AH+1 CF <- 1 AF <- 1 } ELSE { CF <- 0 AF <- 0 } AL <- AL and 0Fh Note: This istruction incorrectly documented in Intel's materials. See description field. Flags Affected: AF,CF (modified) OF,SF,ZF,PF (undefined) Faults: RM PM V86 VME None CPU mode: RM,PM,VM,SMM +++++++++++++++++++++++ Physical Form: COP (Code of Operation) : 37H Clocks: AAA 8086: 4 8088: 4 80186: 8 80286: 3 80386: 4 i486: 3 Pentium: 3 Cx486SLC: 4 Cx486DX: 4 IBM 486BL3X: 4 UMC U5S: 1 --------------------------------------------------- OPCODE AAD - ASCII adjust AX before Division CPU: 8086+ Type of Instruction: User Instruction: AAD basen Description: AL <- (AH*basen) + AL AH <- 0 Flags Affected: SF,ZF,PF (modified) OF,AF,CF (undefined) Faults: RM PM V86 VME SMM None CPU mode: RM,PM,VM,SMM Note: AAD without operands means AAD with operand 0AH. Note: NECs understand only AAD 0AH form. +++++++++++++++++++++++ Physical Form: AAD imm8 COP (Code of Operation) : D5H imm8 Clocks: AAD 0AH 8086: 60 80186: 15 80286: 14 80386: 19 i486: 14 Pentium: 10 Cx486SLC: 4 Cx486DX: 4 IBM 486BL3X: 15 UMC U5S: 11 --------------------------------------------------- OPCODE AAM - ASCII adjust AX after Multiply CPU: 8086+ Type of Instruction: User Instruction: AAM basen Description: AH <- AL / basen AL <- AL MOD basen Flags Affected: SF,ZF,PF (modified) OF,AF,CF (undefined) Faults: RM PM V86 VME SMM None CPU mode: RM,PM,VM,SMM Note: AAM without operands means AAM with operand 0AH. WARNING: NECs understand only AAM 0Ah form. +++++++++++++++++++++++ Physical Form: AAM imm8 COP (Code of Operation) : D4H imm8 Clocks: AAM 0AH 8086: 83 80186: 19 80286: 16 80386: 17 i486: 15 Pentium: 18 Cx486SLC: 16 Cx486DX: 16 IBM 486BL3X: 17 UMC U5S: 12 --------------------------------------------------- OPCODE ADD4S - Addition for packed BCD strings CPU: all NECs V-series Type of Instruction: User Instruction: ADD4S Description: BCD STRING (ADDRESS=ES:DI,LENGTH=CL) <- BCD STRING (ADDRESS=DS:SI,LENGTH=CL) + BCD STRING (ADDRESS=ES:DI,LENGTH=CL); Note: si,di, other registers not changed Flags Affected: OF,CF,ZF ;; ZF set if both strings are zeros. ;; CF,OF set as result of operation with most ;; signification BCDs. CPU mode: RM +++++++++++++++++++++++ Physical Form: ADD4S COP (Code of Operation) : 0FH 20H Clocks: ADD4S NEC V20: ~19*(CL/2)+7 ----------------------------------------------------------------- ADDPS - Packed Single-FP Add CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: ADDPS dest,src Description: dest[<0>] = dest[<0>] + src[<0>]; dest[<1>] = dest[<1>] + src[<1>]; dest[<2>] = dest[<2>] + src[<2>]; dest[<3>] = dest[<3>] + src[<3>]; addition is F.P. <0> = 31..0 <2> = 95..64 <1> = 63..32 <3> = 127..96 Physical Form and Timing: ADDPS xmm1,xmm2/m128 ---- 0F 58 /r ---- 2 ----------------------------------------------------------------- ADDSS - Scalar Single-FP Add CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: ADDSS dest,src Description: dest[<0>] = dest[<0>] + src[<0>]; addition is F.P. <0> = 31..0 <2> = 95..64 <1> = 63..32 <3> = 127..96 Physical Form and Timing: ADDSS xmm1,xmm2/m32 ---- F3 0F 58 /r ---- 1 ----------------------------------------------------------------- ANDNPS - Bit-wise Logical And Not For Single-FP CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: ANDNPS dest,src Description: dest = NOT( dest AND src ); // Bitwize Physical Form and Timing: ANDNPS xmm1,xmm2/m128 ---- 0F 55 /r ---- 2 ----------------------------------------------------------------- ANDPS - Bit-wise Logical And For Single-FP CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: ANDPS dest,src Description: dest = dest AND src; // Bitwize Physical Form and Timing: ANDPS xmm1,xmm2/m128 ---- 0F 54 /r ---- 2 --------------------------------------------------- OPCODE BOUND - Chack Array Index Against Bounds CPU: 80186+,NECs Type of Instruction: User - HLL support Instruction: BOUND index,bound_array Description: IF (index < (opsize ptr [bound_array])) OR (index > (opsize ptr [bound_array+opsize])) THEN INT 5; Flags Affected: No Flags Affected CPU mode: RM,PM,VM,SMM Faults: RM PM V86 VME SMM #GP(0) if result is nonwritable seg. #GP(0) illegal memory operand in CS..GS (exc. SS) #SS(0) illegal memory operand in SS #PF #PF #UD #UD #UD if 2nd operand is register #13 if any part of operand lie outside of 0..FFFFh #AC #AC if CPL=3 and enable AC. Note: (186s&NECs) saved CS:IP BOUND interrupt as pointer to following instruction that self. (286+) saved as pointer to BOUND instruction. +++++++++++++++++++++++ Physical Form: BOUND reg16,mem32 BOUND reg32,mem64 COP (Code of Operation) : 62H Postbyte Note: for 32bit op. add Pfix 66h if in 16bit mode Clocks: BOUND reg16,mem16 In Range Out Range 80186: 33-35 80286: 13 int+13 80386: 10 i486: 7 Pentium: 8 int+32 Cx486SLC: 11 int+11 Cx486DX: 11 int+11 --------------------------------------------------- OPCODE BRKCS - Break with Contex Switch CPU: NEC V25,V35,V25 Plus,V35 Plus,V25 Software Guard Type of Instruction: System Instruction: BRKCS bank Description: Perform a High-Speed Software Interrupt with contex-switch to register bank indicated by the lower 3-bits of 'bank'. Info: NEC V25/V35/V25 Plus/V35 Plus Bank System This Chips have 8 32bytes register banks, which placed in Internal chip RAM by addresses: xxE00h..xxE1Fh Bank 0 xxE20h..xxE3Fh Bank 1 ......... xxEC0h..xxEDFh Bank 6 xxEE0h..xxEFFh Bank 7 xxF00h..xxFFFh Special Functions Register Where xx is Value of IDB register. IBD is Byte Register contained Internal data area base IBD addresses is FFFFFh and xxFFFh where xx is data in IBD. Format of Bank: +0 Reserved +2 Vector PC +4 Save PSW +6 Save PC +8 DS0 ;DS +A SS ;SS +C PS ;CS +E DS1 ;ES +10 IY ;DI +11 IX ;SI +14 BP ;BP +16 SP ;SP +18 BW ;BX +1A DW ;DX +1C CW ;CX +1E AW ;AX Format of V25 etc. PSW (FLAGS): Bit Description 15 1 14 RB2 \ 13 RB1 > Current Bank Number 12 RB0 / 11 V ;OF 10 DIR ;DF 9 IE ;IF 8 BRK ;TF 7 S ;SF 6 Z ;ZF 5 F1 General Purpose user flag #1 (accessed by Flag Special Function Register) 4 AC ;AF 3 F0 General purpose user flag #0 (accessed by Flag Special Function Register) 2 P ;PF 1 BRKI I/O Trap Enable Flag 0 CY ;CF Flags Affected: None CPU mode: RM +++++++++++++++++++++++ Physical Form: BRKCS reg16 COP (Code of Operation) : 0Fh 2Dh <1111 1RRR> Clocks: 15 --------------------------------------------------- OPCODE BRKEM - Break for Emulation CPU: NEC/Sony V20/V30/V40/V50 Type of Instruction: System Instruction: BRKEM intnum Description: PUSH FLAGS PUSH CS PUSH IP MOV CS,0:[intnum*4+2] MOV IP,0:[intnum*4] MD <- 0; // Enable 8080 emulation Note: BRKEM instruction do software interrupt and then New CS,IP loaded it switch to 8080 mode i.e. CPU will execute 8080 code. Mapping Table of Registers in 8080 Mode 8080 Md. A B C D E H L SP PC F native. AL CH CL DH DL BH BL BP IP FLAGS(low) For Return of 8080 mode use CALLN instruction. Note: I.e. 8080 addressing only 64KB then "Real Address" is CS*16+PC Flags Affected: MD CPU mode: RM +++++++++++++++++++++++ Physical Form: BRKEM imm8 COP (Code of Operation) : 0FH FFH imm8 Clocks: BRKEM imm8 NEC V20: 38 --------------------------------------------------- OPCODE BRKN - Break to Native Mode CPU: NEC (V25/V35) Software Guard only Type of Instruction: System Instruction: BRKN int_vector Description: [sp-1,sp-2] <- PSW ; PSW EQU FLAGS [sp-3,sp-4] <- PS ; PS EQU CS [sp-5,sp-6] <- PC ; PC EQU IP SP <- SP -6 IE <- 0 BRK <- 0 MD <- 1 PC <- [int_vector*4 +0,+1] PS <- [int_vector*4 +2,+3] Note: The BRKN instruction switches operations in Native Mode from Security Mode via Interrupt call. In Normal Mode Instruction executed as mPD70320/70322 (V25) operation mode. Flags Affected: None CPU mode: RM +++++++++++++++++++++++ Physical Form: BRKN imm8 COP (Code of Operation) : 63h imm8 Clocks: 56+10T [44+10T] --------------------------------------------------- OPCODE BRKS - Break to Security Mode CPU: NEC (V25/V35) Software Guard only Type of Instruction: System Instruction: BRKS int_vector Description: [sp-1,sp-2] <- PSW ; PSW EQU FLAGS [sp-3,sp-4] <- PS ; PS EQU CS [sp-5,sp-6] <- PC ; PC EQU IP SP <- SP -6 IE <- 0 BRK <- 0 MD <- 0 PC <- [int_vector*4 +0,+1] PS <- [int_vector*4 +2,+3] Note: The BRKS instruction switches operations in Security Mode via Interrupt call. In Security Mode the fetched operation code is executed after conversion in accordance with build-in translation table Flags Affected: None CPU mode: RM +++++++++++++++++++++++ Physical Form: BRKS imm8 COP (Code of Operation) : F1h imm8 Clocks: 56+10T [44+10T] --------------------------------------------------- OPCODE BRKXA - Break to Expansion Address CPU: NEC V33/V53 only Type of Instruction: System Instruction: BRKXA int_vector Description: [sp-1,sp-2] <- PSW ; PSW EQU FLAGS [sp-3,sp-4] <- PS ; PS EQU CS [sp-5,sp-6] <- PC ; PC EQU IP SP <- SP -6 IE <- 0 BRK <- 0 MD <- 0 PC <- [int_vector*4 +0,+1] PS <- [int_vector*4 +2,+3] Enter Expansion Address Mode. Note: In NEC V53 Memory Space dividing into 1024 16K pages. The programming model is Same as in Normal mode. Mechanism is: 20 bit Logical Address: 19..14 Page Num 13..0 Offset page Num convertin by internal table to 23..14 Page Base tHE pHYSICAL ADDRESS is both Base and Offset. Address Expansion Registers: logical Address A19..A14 I/O Address 0 FF00h 1 FF02h ... ... 63 FF7Eh Register XAM aliased with port # FF80h indicated current mode of operation. Format of XAM register (READ ONLY): 15..1 reserved 0 XA Flag, if=1 then in XA mode. Format of V53 PSW: 15..12 1 11 V 10 DIR 9 IE 8 BRK 7 S 6 Z 5 0 4 AC 3 0 2 P 1 1 0 CY Flags Affected: None CPU mode: RM +++++++++++++++++++++++ Physical Form: BRKXA imm8 COP (Code of Operation) : 0Fh E0h imm8 Clocks: 12 --------------------------------------------------- OPCODE BSWAP - Bytes Swap CPU: I486 + Type of Instruction: User Instruction: BSWAP dwordr Description: XCHG BYTE dwordr[31:24],dwordr[7:0] XCHG BYTE dwordr[23:16],dwordr[15:8] ; Need Good Picture to Show It Notes: This instruction used for converting big-endian (Intel) format to little-endian (Motorolla etc.) format. Flags Affected: None CPU mode: RM,PM,VM,SMM Physical Form: BSWAP r32 COP (Code of Operation): 0FH 11001rrr (For 32bit segment) Clocks: Cyrix Cx486SLC : 4 i486 : 1 Pentium : 1 Cyrix Cx486DX : 4 UMC U5S : 2 IBM 486BL3X : 9 --------------------------------------------------- OPCODE BTCLR - Bit Test, If it True Clear and Branch CPU: NEC V25,V35,V25 Plus,V35 Plus,V25 Software Guard Type of Instruction: User Instruction: BTCLR var,bitnumber,Short_Label Description: IF BIT(bitnumber OF var) =1 THEN { PC <- PC + ext - disp8; BIT(bitnumber OF var) <-0 } Flags Affected: None CPU mode: RM +++++++++++++++++++++++ Physical Form: BTCLR reg/mem8,imm3, short_label COP (Code of Operation) : 0Fh 9Ch PostByte imm3 Short_Label (Total=5 bytes) Clocks: 29 --------------------------------------------------- OPCODE CALLN - Call Native Mode Routine CPU: NEC/Sony V20/V30 etc Type of Instruction: System Instruction: CALLN intnum Description: CALLN instruction call (interrupt service in Native Mode) from 8080 emulation mode: PUSH FLAGS PUSH CS PUSH IP IF <- 0 TF <- 0 MD <- 1 MOV CS,0:[intnum*4+2] MOV IP,0:[intnum*4] Flags Affected: IF,TF,MD CPU mode: 8080 Emulation +++++++++++++++++++++++ Physical Form: CALLN imm8 COP (Code of Operation) : EDH EDH imm8 Clocks: NEC V20/V30: 38-58 --------------------------------------------------- OPCODE CLEAR1 - Clear one bit CPU: NEC/Sony all V-series. Type of Instruction: User Instruction: CLEAR1 dest,bitnumb Description: BIT bitnumb OF dest <- 0; Flags Affected: None CPU mode: RM +++++++++++++++++++++++ Physical Form: CLEAR1 reg/mem8,CL COP (Code of Operation) : 0FH 12H Postbyte Physical Form: CLEAR1 reg/mem8,imm8 COP (Code of Operation) : 0FH 1AH Postbyte imm8 Physical Form: CLEAR1 reg/mem16,CL COP (Code of Operation) : 0FH 13H Postbyte Physical Form: CLEAR1 reg/mem16,imm8 COP (Code of Operation) : 0FH 1BH Postbyte imm8 Clocks: CLEAR1 r/m8,CL r/m8,i8 r/m16,CL r/m16,i8 NEC V20: 5/14 6/15 5/14 6/15 --------------------------------------------------- OPCODE CMOVcc - Conditional Move CPU: P6 Type of Instruction: User Instruction: CMOVcc dest,sorc Description: IF condition(cc) is true THEN dest <- sorc; Flags Affected: None CPU mode: RM,PM,VM,SMM +++++++++++++++++++++++ Physical Form & COPs: CMOVO reg,reg/mem 0FH 40H Postbyte CMOVNO reg,reg/mem 0FH 41H Postbyte CMOVC reg,reg/mem 0FH 42H Postbyte CMOVNC reg,reg/mem 0FH 43H Postbyte CMOVZ reg,reg/mem 0FH 44H Postbyte CMOVNZ reg,reg/mem 0FH 45H Postbyte CMOVNA reg,reg/mem 0FH 46H Postbyte CMOVA reg,reg/mem 0FH 47H Postbyte CMOVS reg,reg/mem 0FH 48H Postbyte CMOVNS reg,reg/mem 0FH 49H Postbyte CMOVP reg,reg/mem 0FH 4AH Postbyte CMOVNP reg,reg/mem 0FH 4BH Postbyte CMOVL reg,reg/mem 0FH 4CH Postbyte CMOVNL reg,reg/mem 0FH 4DH Postbyte CMOVNG reg,reg/mem 0FH 4EH Postbyte CMOVG reg,reg/mem 0FH 4FH Postbyte Clocks: ~1 (~pairing with other instructions) --------------------------------------------------- OPCODE CMP4S - Compare for packed BCD strings CPU: NEC/Sony all V-series Type of Instruction: User Instruction: CMP4S Description: SetFlaGS( BCD STRING (ADDRESS=ES:DI,LENGTH=CL) - BCD STRING (ADDRESS=DS:SI,LENGTH=CL) ); Note: si,di, other registers not changed Flags Affected: OF,CF,ZF ;; ZF set if RESULT of subtraction is zero. ;; CF,OF set as result of operation with most ;; signification BCDs. CPU mode: RM +++++++++++++++++++++++ Physical Form: CMP4S COP (Code of Operation) : 0FH 26H Clocks: CMP4S NEC V20: ~7+19*CL ----------------------------------------------------------------- CMPPS - Packed Single FP-Compare CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: CMPPS dest,src,predicate Description: operation predicate EQ equal (dest == src) 0 LT less-than (dest < src) 1 LE less-equal (dest <= src) 2 UNORD unordered (dest ? src) 3 NEQ not-equal (dest <> src) 4 NLT not-less-that (dest => src) 5 NLE not-less-equal (dest > src) 6 ORD ordered !(dest ? src) 7 par for i = 0 to 3 do cmp = dest[] operation(predicate) src[]; if cmp = true then dest[] = 0xffffffff; else dest[] = 0x00000000; endif endfor endpar <0> = 31..0 <2> = 95..64 <1> = 63..32 <3> = 127..96 Note: Compilers may implement additional instructions: CMPEQPS xmm1,xmm2 <=> CMPPS xmm1,xmm2,0 CMPLTPS xmm1,xmm2 <=> CMPPS xmm1,xmm2,1 CMPLEPS xmm1,xmm2 <=> CMPPS xmm1,xmm2,2 CMPUNORDPS xmm1,xmm2 <=> CMPPS xmm1,xmm2,3 CMPNEQPS xmm1,xmm2 <=> CMPPS xmm1,xmm2,4 CMPNLTPS xmm1,xmm2 <=> CMPPS xmm1,xmm2,5 CMPNLEPS xmm1,xmm2 <=> CMPPS xmm1,xmm2,6 CMPORDPS xmm1,xmm2 <=> CMPPS xmm1,xmm2,7 Physical Form and Timing: CMPPS xmm1,xmm2/m128,imm8 ---- 0F C2 /r imm8 ---- 1-2 ----------------------------------------------------------------- CMPSS - Scalar Single FP-Compare CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: CMPSS dest,src,predicate Description: operation predicate EQ equal (dest == src) 0 LT less-than (dest < src) 1 LE less-equal (dest <= src) 2 UNORD unordered (dest ? src) 3 NEQ not-equal (dest <> src) 4 NLT not-less-that (dest => src) 5 NLE not-less-equal (dest > src) 6 ORD ordered !(dest ? src) 7 cmp = dest[<0>] operation(predicate) src[<0>]; if cmp = true then dest[<0>] = 0xffffffff; else dest[<0>] = 0x00000000; endif <0> = 31..0 <2> = 95..64 <1> = 63..32 <3> = 127..96 Note: Compilers may implement additional instructions: CMPEQSS xmm1,xmm2 <=> CMPSS xmm1,xmm2,0 CMPLTSS xmm1,xmm2 <=> CMPSS xmm1,xmm2,1 CMPLESS xmm1,xmm2 <=> CMPSS xmm1,xmm2,2 CMPUNORDSS xmm1,xmm2 <=> CMPSS xmm1,xmm2,3 CMPNEQSS xmm1,xmm2 <=> CMPSS xmm1,xmm2,4 CMPNLTSS xmm1,xmm2 <=> CMPSS xmm1,xmm2,5 CMPNLESS xmm1,xmm2 <=> CMPSS xmm1,xmm2,6 CMPORDSS xmm1,xmm2 <=> CMPSS xmm1,xmm2,7 Physical Form and Timing: CMPSS xmm1,xmm2/m128,imm8 ---- F3 0F C2 /r imm8 ---- 1-2 --------------------------------------------------- OPCODE CMPXCHG8B - Compare and exchange 8 bytes CPU: Pentium (tm), Pentium Pro(tm), AMD Am5k86 Type of Instruction: Operation Instruction: CMPXCHG8B dest Note: dest is memory operand: QWORD PTR [memory] Description: IF ( QWORD(EDX:EAX) = dest) THEN { ZF <- 1; dest <- QWORD(ECX:EBX); } ELSE { ZF <- 0; EDX:EAX <- dest } END Flags Affected: ZF CPU mode: RM,PM,VM,SMM Physical Form: CMPXCHG8B mem64 COP (Code of Operation) : 0FH C7H Postbyte Clocks: Pentium : 10 Note: Postbyte MMRRRMMM: MM<>11 if (==) then INT 6 --------------------------------------------------- OPCODE CMPXCHG - Compare and exchange CPU: i486+ Type of Instruction: User Instruction: CMPXCHG dest,sorc Description: Acc = if OperationSize(8) -> AL OperationSize(16) -> AX OperationSize(32) -> EAX IF ( Acc = dest) THEN { ZF <- 1; dest <- sorc; } ELSE { ZF <- 0; Acc <- dest; } END Note: This instruction used to support semaphores Flags Affected: ZF ( see description) OF,SF,AF,PF,CF ( like CMP instruction ) ( see description) CPU mode: RM,PM,VM,SMM +++++++++++++++++++++++ Physical Form: CMPXCHG r/m8,r8 COP (Code of Operation) : 0FH A6H Postbyte ; i486 (A-B0 step) : 0FH B0H Postbyte ; i486 (B1+ step clones ; and upgrades) Clocks: Intel i486 : 6/7 if compare OK : 6/10 if compare FAIL Cyrix Cx486SLC : 5/7 Pentium (tm) : 6 Penalty if cache miss : Intel i486 : 2 Cyrix Cx486SLC : 1 +++++++++++++++++++++ Physical Form: CMPXCHG r/m16,r16 CMPXCHG r/m32,r32 COP (Code of Operation) : 0FH A7H Postbyte ; i486 (A-B0 step) : 0FH B1H Postbyte ; i486 (B1+ step clones ; and upgrades) Clocks: Intel i486 : 6/7 if compare OK : 6/10 if compare FAIL Cyrix Cx486SLC : 5/7 Pentium (tm) : 6 Penalty if cache miss : Intel i486 : 2 Cyrix Cx486SLC : 1 ----------------------------------------------------------------- COMISS - Scalar Ordered Single-FP Compare and Set EFLAGS CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: COMISS dest,src Description: OF <- 0; SF <- 0; AF <- 0; if (dest[<0>] UNORD src[<0>]) then ZF <- 1; PF <- 1; CF <- 1; elif (dest[<0>] > src[<0>]) then ZF <- 0; PF <- 0; CF <- 0; elif (dest[<0>] < src[<0>]) then ZF <- 0; PF <- 0; CF <- 1; else ZF <- 1; PF <- 0; CF <- 0; endif <0> is 31..0 Physical Form and Timing: COMISS xmm1,xmm2/m32 ---- 0F 2F /r ---- ? --------------------------------------------------- OPCODE CPUID - CPU Identification CPU: Intel 486DX/SX/DX2 SL Enhanced and all later Intel processors include ( IntelDX4, IntelSX2, Pentium etc.), UMC microprocessors: U5S,U5SD,U5S-VL. Cyrix M1, AMD K5, Intel P6, and AMD Ehnanced Am486 CPU, such as A80486DX4-100SV8B. Note: i.e. 1993+ years processors produced by Intel Note: To know if your CPU support CPUID instruction try to set ID flag ( bit 21 of EFLAGS ) to 1, and if it sets this mean that CPUID support.(Soft). Or If Your CPU is Intel Look for '&E' signature on Top side of Chip.(Hard) Type of Instruction: Operation Instruction: CPUID Description: IF (EAX=0) THEN // All { EAX <- Maximum value of EAX to CALL CPUID instruction 1 for all processors (date 1 September 1994) may be >1 in future microprocessors ;; EBX,EDX and ECX contain a OEM name string ;; for Intel this string is 'GenuineIntel' EBX <- 756E6547H i.e. 'Genu' EDX <- 49656E69H i.e. 'ineI' ECX <- 6C65746EH i.e. 'ntel' ;; for UMC this string is 'UMC UMC UMC ' EBX <- 20434D55H i.e. 'UMC ' EDX <- 20434D55H i.e. 'UMC ' ECX <- 20434D55H i.e. 'UMC ' ;; for Cyrix this string is 'CyrixInstead' (Cx6x86,Cx5x86 steps B+) ;; for AMD this string is 'AuthenticAMD' (K6,K5,486 Enhanced CPUs) ;; for last NexGen is 'NexGenDriven' (Nx5x86 latest models) ;; for Centaur Technology is 'CentaurHauls' (IDT) ;; for Rise Technology is 'RiseRiseRise' } ELSEIF (EAX=1) THEN // All { EAX[3:0] <- Stepping ID EAX[7:4] <- Model EAX[11:8] <- Family ; 3 - 386 family ; 4 - i486 family ; 5 - Pentium family ; 6 - Pentium Pro family EAX[15:12] <- Reserved ; 0 - Original OEM processor ; 1 - OverDrive ; 2 - Dual Processor Note: Pentium P54C have pin CPUTYPE which define is this CPU First or Second e.t.c in System. So, if this chip set in "First" socket it return for example 0425h, but THIS chip return 2425h if we insert it in "Second" socket. Note: Refer to Appendix B for more information. EAX[31:16] <- Reserved and set to 0s now Note: This value in EAX[31:0] is upper 32-bit of 96-bit processor serial number. EDX <- Compability flags ;; below all info if bit flag =1 EDX[0] <- FPU: FPU on Chip EDX[1] <- VME: Virtual Mode Extention present EDX[2] <- DE: Debbuging Extentions EDX[3] <- PSE: CPU support 4MB size pages EDX[4] <- TSC: TSC present (See RDTSC command) EDX[5] <- MSR: CPU have Pentium Compatible MSRs EDX[6] <- PAE: Physical Address Extension (Intel) EDX[6] <- PTE: Support PTE (Cyrix) When set in PTE TLB will not be flushed when CR3 is written. EDX[7] <- MCE: Machine Check exception EDX[8] <- CX8: Support CMPXCHG8B instruction EDX[9] <- APIC: Local APIC on Chip (Intel) PGE: Page Global Extension (K5) EDX[10]<- reserved EDX[11]<- SEP: Fast System Call feature (Pentium Pro) EDX[12]<- MTRR: CPU support Memory Type Range Register (MTRR) EDX[13]<- PGE: Page Global Feature support EDX[14]<- MCA: Machine Check Architecture EDX[15]<- CMOV: CPU support CMOV instruction EDX[16]<- PAT: Page Attribute Table EDX[17]<- PSE36: CPU support 4MB Pages for access memory higher that 2GB. EDX[18]<- SN: CPU Support Processor Serial Number EDX[22..19] <- Reserved EDX[23] <- MMX: CPU support IA MMX EDX[24] <- FXSR: CPU Support Fast Save/Restore (IA MMX-2) EDX[25] <- SIMD: Streaming SIMD Extension (IA MMX-2) EDX[31:26] <- Reserved and set to 0s now } ELSEIF (EAX=2) { AL = 1 (Pentium Pro, Pentium II) remainder of EAX and EBX,ECX,EDX contain bytes which described cache architecture on this chip. Description of this bytes is: Value Description 00h None 01h Instruction TLB, 4K page, 4way, 64 entry 02h Instruction TLB, 4M page, 4way, 4 entry 03h Data TLB, 4K page, 4way, 64 entry 04h Data TLB, 4M page, 4way, 8 entry 06h Instruction Cache, 8K, 4 way, 32 byte per line 08h Instruction Cache, 16K, 4 way, 32 byte per line 0Ah Data cache, 8K, 2 way, 32 byte per line 0Ch Data cache, 16K, 4 way, 32 byte per line 40h No L2 cache 41h Unifed L2 cache, 32 byte per line, 4 way, 128KB 42h Unifed L2 cache, 32 byte per line, 4 way, 256KB 43h Unifed L2 cache, 32 byte per line, 4 way, 512KB 44h Unifed L2 cache, 32 byte per line, 4 way, 1MB 45h Unifed L2 cache, 32 byte per line, 4 way, 2MB (Cyrix MediaGX MMX Enhanced) 70h TLB 32-bit entry, 4 way, 4K cache 80h L1 cache 4-way associative, 16byte/line } ELSEIF (EAX = 3) // Pentium III { EDX:ECX <- Lower 64-bit of 96-bit processor serial number. } ELSEIF (EAX = 80000000h) // (K5 not SSA/5),K6, Cyrix GXm { EBX,ECX,EDX <- Undefined EAX <- Largest Extended function value recognized by CPUID. (Note: Extended CPUID functions started with 80000000h) (Example: For AMD 5k86 (K5) = 80000005h ) } ELSEIF (EAX = 80000001h) // K5,K6,Cyrix GXm,IDT Winchip 2 { EAX <- AMD Processor Signature 0000051Xh - for AMD 5k86 (K5 not SSA/5) 0000066Xh - for AMD 6k86 (K6) EBX,ECX <- Undefined EDX <- Extended Feature Flags EDX[0] <- FPU: FPU on Chip EDX[1] <- VME: Virtual Mode Extention present EDX[2] <- DE: Debbuging Extentions EDX[3] <- PSE: CPU support 4MB size pages EDX[4] <- TSC: TSC present (See RDTSC command) EDX[5] <- MSR: CPU have K5 Compatible MSRs or Cyrix Compatible MSRs EDX[6] <- PAE: Page Address Extensions EDX[7] <- MCE: Machine Check exception EDX[8] <- CX8: Support CMPXCHG8B instruction EDX[9] <- APIC: CPU have local APIC (must be enabled) EDX[10] <- Reserved EDX[11] <- SYSCALL and SYSRET Instructions (!) EDX[12]<- MTRR: Memory Type Range Registers EDX[13]<- Global Paging Extensions (PTE-PGE) EDX[14]<- MCA: Machine Check Architecture EDX[15]<- CMOV: CPU support CMOV instruction (!) EDX[16]<- FCMOV: CPU support FP. FCMOV (!) EDX[17]<- PSE: Page Size Extention EDX[21..18] <- Reserved EDX[22] <- MMXE: CPU Support Extended MMX instructions (AMD Athlon) EDX[23] <- MMX: CPU support IA MMX EDX[24] <- (Cyrix) Cyrix Extended MMX support EDX[24] <- (AMD) FXSAVE/FXRSTOR instruction support EDX[29..24] <- Reserved EDX[30] <- CPU support Extended 3DNow! Instructions EDX[31] <- AMD 3DNow! support ;Note: For AMD K5 = 000021BFh For AMD K6 = 008005BFh } ELSEIF (EAX = 80000002h,80000003h,80000004h) // AMD K5,K6, Cyrix GXm { // IDT Winchip 2 EAX, EBX, ECX ,EDX = CPU Name // Note: for AMD K5 (Don't forget x86 is BIG-Endian!!) // CPUID(EAX) EAX EBX ECX EDX // 80000002h 2D444D41 7428354B 5020296D 65636F72 // AMD- K5(r m) P roce // 80000003h 726F7373 00000000 00000000 00000000 // ssor // 80000004h 00000000 00000000 00000000 00000000 } ELSEIF (EAX = 80000005h) // AMD K5,K6,Cyrix GXm { // L1 TLB and Cache information EAX <- TLB Information (for 2M/4M pages): see format of EBX. EBX <- TLB Information (for 4K pages): EBX[31..24] <- Data TLB: Associativity (if Full assocuiativity = FFh) see CPUID 80000006h for more datails EBX[23..16] <- Data TLB: Number of Entryes EBX[15..8] <- Instruction TLB: Associativity (if Full assocuiativity = FFh) EBX[7..0] <- Instruction TLB: Number of Entryes ECX <- L1 Data Cache Information ECX[31..24] <- Size in KB ECX[23..16] <- Associativity (if full = FFh) ECX[15..8] <- Lines per Tag ECX[7..0] <- Line size in Bytes EDX <- L1 Instruction Cache Information ECX[31..24] <- Size in KB ECX[23..16] <- Associativity (if full = FFh) ECX[15..8] <- Lines per Tag ECX[7..0] <- Line size in Bytes // Note: after execution CPUID with EAX = 80000005h // reg AMD K5 AMD K6 // EBX 04800000 02800140 // ECX 08040120 20020220 // EDX 10040120 20020220 } ELSE THEN (EAX = 80000006h) // K6-III model-9, AMD Athlon { // L2 cache and TLB information EAX = 2M/4M Pages and L2 TLB Info bits description 31..28 Associativity (L2 Data TLB) 0000 L2 off 0001 Direct Mapped 0010 2-Way 0100 4-Way 0110 8-Way 1000 16-Way 1111 Full 27..16 Number of Entries (L2 Data TLB) 15..12 Associativity (L2 Instruction or Unifed TLB) 11..0 Number of entries (L2 Instruction or Unifed TLB) EBX = 4K Pages and L2 TLB Info bits description 31..28 Associativity (L2 Data TLB) 27..16 Number of Entries (L2 Data TLB) 15..12 Associativity (L2 Instruction or Unifed TLB) 11..0 Number of entries (L2 Instruction or Unifed TLB) ECX = L2 Unifed Cache Info (K6-III: only this field) bits description 31..16 Size (KB) 15..12 Associativity 11..8 Lines per tag 7..0 Line size (bytes) EDX = reserved } ELSE THEN { EAX,EBX,ECX,EDX <- Undefined } END. ------------------------------------------------------ Notes: In Tables Below, you may see that Your CPU return other features values, so in this tables, values writed on maximal. So possibly some features exists on Your CPU, but not activated in time You test, so CPUID return less functions that processor really can support ------------------------------------------------------ Table of STANDART Features (CPUID/EAX=1) by Different Vendors Media (Cyrix) 6x86 6x86L GX 6x86MX MII GXm EDX[0] <- FPU: + + + + + + EDX[1] <- VME: - - - - - - EDX[2] <- DE: - + - + + - EDX[3] <- PSE: - - - - - - EDX[4] <- TSC: - - - + + + EDX[5] <- MSR: - - - + + + EDX[6] <- PAE: - - - - - EDX[6] <- PTE: ? EDX[7] <- MCE: - - - - - - EDX[8] <- CX8: - + - + + + EDX[9] <- APIC: - - - - - EDX[10]<- res - - - - - - EDX[11]<- SEP: - - - - - - EDX[12]<- MTRR: - - - - - - EDX[13]<- PGE: - - - + + - EDX[14]<- MCA: - - - - - - EDX[15]<- CMOV: - - - + + + EDX[16]<- PAT: - - - - - - EDX[17]<- PSE36:- - - - - - EDX[18]<- SN: - - - - - - EDX[23]<- MMX: - - - + + + EDX[24]<- FXSR: - - - - - - EDX[25]<- SIMD: - - - - - - IDT IDT AMD AMD AMD AMD AMD (IDT/AMD) C6 C2 K5 K6 K6-2 K6-III Athlon EDX[0] <- FPU: + + + + + + + EDX[1] <- VME: - - + + + + + EDX[2] <- DE: + + + + + + + EDX[3] <- PSE: - - + + + + + EDX[4] <- TSC: + + + + + + + EDX[5] <- MSR: + + + + + + + EDX[6] <- PAE: - - - - - - + EDX[7] <- MCE: + + + + + + + EDX[8] <- CX8: + + + + + + + EDX[9] <- APIC: - - - - - x EDX[9] <- GPE + EDX[10]<- res - - - - - - - EDX[11]<- SEP: - - - - - - + EDX[12]<- MTRR: - - - - - - + EDX[13]<- PGE: - - - - - - + EDX[14]<- MCA: - - - - - - + EDX[15]<- CMOV: - - - - - - + EDX[16]<- PAT: - - - - - - + EDX[17]<- PSE36:- - - - - - - EDX[18]<- SN: - - - - - - - EDX[23]<- MMX: + + - + + + + EDX[24]<- FXSR: - - - - - - - EDX[25]<- SIMD: - - - - - - - Pentium Pentium Pentium Pentium (Intel) Pentium w/MMX Pro II III Celeron EDX[0] <- FPU: + + + + + + EDX[1] <- VME: + + + + + + EDX[2] <- DE: + + + + + + EDX[3] <- PSE: + + + + + + ------------------------------------------------------- EDX[4] <- TSC: + + + + + + EDX[5] <- MSR: + + + + + + EDX[6] <- PAE: - - + + + + EDX[7] <- MCE: + + + + + + ------------------------------------------------------- EDX[8] <- CX8: + + + + + + EDX[9] <- APIC: (1) (1) (1) (1) (1) (1) EDX[10]<- res - - - - ? - EDX[11]<- SEP: - - + + + + ------------------------------------------------------- EDX[12]<- MTRR: - - + + + + EDX[13]<- PGE: - - + + + + EDX[14]<- MCA: - - + + + + EDX[15]<- CMOV: - - + + + + ------------------------------------------------------- EDX[16]<- PAT: - - - (2) + + EDX[17]<- PSE36:- - - (2) + + EDX[18]<- SN: - - - - + - EDX[23]<- MMX: - + - + + + EDX[24]<- FXSR: - - - (2) + + EDX[25]<- SIMD: - - - - + - (1) = Intel produce chips with APIC and w/o APIC. (2) = It start to support since "Deschutes" core SL_enh SL_enh WB_Enh Intel Pentium UMC AMD i486SX DX/DX2 i486DX2 DX4 OVDR U5S 5x86 EDX[0] <- FPU: - + + + + - + EDX[1] <- VME: + + + + + - - EDX[2] <- DE: - - - - + - - EDX[3] <- PSE: - - + + + - - ------------------------------------------------------- EDX[4] <- TSC: - - - - + - - EDX[5] <- MSR: - - - - + - - EDX[6] <- PAE: - - - - - - - EDX[7] <- MCE: - - - - - - - ------------------------------------------------------- EDX[8] <- CX8: - - - - + - - EDX[9] <- APIC: - - - - - - - no need to look higher flags, theys is 0s. ------------------------------------------------------ Table of EXTENDED Features (CPUID/EAX=80000001) by Different Vendors Cyrix IDT IDT AMD AMD AMD AMD GXm C6 C2 K6 K6-2 K6-III Athlon EDX[0] <- FPU: + + + + + + + EDX[1] <- VME: - - - + + + + EDX[2] <- DE: - + + + + + + EDX[3] <- PSE: - - - + + + + EDX[4] <- TSC: + + + + + + + EDX[5] <- MSR: + + + + + + + EDX[6] <- PAE: - - - - - - + EDX[7] <- MCE: - + + + + + + EDX[8] <- CX8: + + + + + + + EDX[9] <- APIC: - - - - - - * EDX[10]<- res - - - + - - - EDX[11]<- SCL - - - - + + + EDX[12]<- MTRR - - - - - - + EDX[13]<- GPE - - - - + + + EDX[14]<- MCE - - - - - - + EDX[15]<- CMOV + - - - - - + EDX[16]<- PAT ? - - - - - + EDX[17]<- PSE36 - - - - - - - EDX[22]<- AMMX - - - - - - + EDX[23]<- MMX + + + + + + + EDX[24]<- EMMX + - - - - - - EDX[30]<- E3D! - - - - - - + EDX[31]<- 3D! - - + - + + + Refer to: Appendix B for more informations about CPU codes. Note: On IDT C6 CPU we may set any Identification string and family/model/ stepping info. (See MSRs 108h,109h for More Details). Here is 3 examples of Information we can may get from CPUID instruction: 1) UMC U5S Note: All UMC Chips: U5S,U5SD, 3V chips never have FPU on-chip, and never support VME Maximum Available of CPUID info entrys:1 Vendor string is : "UMC UMC UMC " Model Info : Stepping ID is : 3 Model : 2 Family : 4 M field : 0 Compability Flags: FPU on Chip :- Virtual Mode Extensions present :- CPU support I/O breakpoints :- CPU support 4MB pages :- Time Stamp Counter Presents :- CPU have Pentium compatible MSRs :- Machine Check Exception Presents :- CMPXCHG8B instruction support :- APIC on Chip :- 2) Intel 486 Note: All SL Enhanced 486: { i486SX,i486DX,i486DX2 marked '&E' on chip surface }, IntelSX2,IntelDX4 support VME !!!! But: Sxs never have FPU on chip. Maximum Available of CPUID info entrys:1 Vendor string is : "GenuineIntel" Model Info : Stepping ID is : 0 Model : 8 Family : 4 M field : 0 Compability Flags: FPU on Chip :+ Virtual Mode Extensions present :+ CPU support I/O breakpoints :- CPU support 4MB pages :- Time Stamp Counter Presents :- CPU have Pentium compatible MSRs :- Machine Check Exception Presents :- CMPXCHG8B instruction support :- APIC on Chip :- 3) Pentium Note: P54C may say that build-in APIC not present if it not supported by external hardware !!!!! (This data from P54C in single processor configuration) Maximum Available of CPUID info entrys:1 Vendor string is : "GenuineIntel" Model Info : Stepping ID is : 1 Model : 2 Family : 5 M field : 0 Compability Flags: FPU on Chip :+ Virtual Mode Extensions present :+ CPU support I/O breakpoints :+ CPU support 4MB pages :+ Time Stamp Counter Presents :+ CPU have Pentium compatible MSRs :+ Machine Check Exception Presents :+ CMPXCHG8B instruction support :+ APIC on Chip :- 4) Pentium OverDrive Note: P24T never have Machine Check Exception Maximum Available of CPUID info entrys:1 Vendor string is : "GenuineIntel" Model Info : Stepping ID is : 1 Model : 3 Family : 5 M field : 1 Compability Flags: FPU on Chip :+ Virtual Mode Extensions present :+ CPU support I/O breakpoints :+ CPU support 4MB pages :+ Time Stamp Counter Presents :+ CPU have Pentium compatible MSRs :+ Machine Check Exception Presents :- CMPXCHG8B instruction support :+ APIC on Chip :- 5) AMD Am5x86 (also AMD Enhanced 486). Maximum Available of CPUID info entrys:1 Vendor string is : "AuthenticAMD" Model Info : Stepping ID is : 4 Model : 15 Family : 4 M field : 0 Compability Flags: FPU on Chip :+ Virtual Mode Extensions present :- CPU support I/O breakpoints :- CPU support 4MB pages :- Time Stamp Counter Presents :- CPU have Pentium compatible MSRs :- P6 Flag: n/a :- Machine Check Exception Presents :- CMPXCHG8B instruction support :- 6) Pentium Pro (P6) Maximum Available of CPUID info entrys:2 <<-------------- !!!! Vendor string is : "GenuineIntel" Model Info : Stepping ID is : 1 Model : 1 Family : 6 M field : 0 Compability Flags: FPU on Chip :+ Virtual Mode Extensions present :+ CPU support I/O breakpoints :+ CPU support 4MB pages :+ Time Stamp Counter Presents :+ CPU have Pentium compatible MSRs :+ P6 Flag: n/a :+ Machine Check Exception Presents :+ CMPXCHG8B instruction support :+ APIC on Chip :+ Reserved :- ; bit 10 Fast System Call feature :+ Memory Type Range Regs. support :+ Page Global Feature support :+ Machine Check Architecture :+ CMOVxx instructions support :+ IA MMX support :+ 7) Maximum Available of CPUID info entrys:1 Vendor string is : "CyrixInstead" Compability Flags: FPU on Chip :+ Virtual Mode Extensions present :- CPU support I/O breakpoints :+ CPU support 4MB pages :- Time Stamp Counter Presents :+ CPU have Pentium compatible MSRs :+ P6 Flag: n/a :+ Machine Check Exception Presents :- CMPXCHG8B instruction support :+ APIC on Chip :- Reserved :- Reserved :- Memory Type Range Regs. support :- Page Global Feature support :+ Machine Check Architecture :- CMOVxx instructions support :+ IA MMX support :+ Note: Some Last NexGen Nx586 support CPUID instruction, but never support ID flag in EFALGS, so check it with #UD hook. Note: On Cyrix CPUs need to Enable CPUID instruction, setting CPUIDEN bit in CCR4. Note: Cyrix Cx6x86 return on CPUID(1) in EAX next data: YYYYXXMMh - where YYYY - normally 0s. XX - value of control register 0FCh (usually 05h, may be changed to any other value by user). MM - Model Unical Revision (according to DIR0) Note: Cyrix 486s never support CPUID. Flags Affected: None CPU mode: RM,PM,VM,SMM Physical Form: CPUID COP (Code of Operation): 0FH A2H Clocks: 486s & Pentium (EAX=1) : 14 486s & Pentium (EAX=0 or EAX>1) : 9 ----------------------------------------------------------------- CVTPI2PS - Packed Signed INT32 to Packed Single-FP Conversion CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: CVTPI2PS dest,src Description: dest[<0>] <- (float) src[<0>]; dest[<1>] <- (float) src[<1>]; <0> is 31..0 <1> is 63..32 Physical Form and Timing: CVTPI2PS xmm,mm/m64 ---- 0F 2A /r ---- ?? ----------------------------------------------------------------- CVTPS2PI - Packed Single-FP to Packed INT32 Conversion CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: CVTPS2PI dest,src Description: dest[<0>] <- (int) src[<0>]; dest[<1>] <- (int) src[<1>]; src is in Single F.P. format <0> is 31..0 <1> is 63..32 Physical Form and Timing: CVTPS2PI mm,xmm/m64 ---- 0F 2D /r ---- ?? ----------------------------------------------------------------- CVTSI2SS - Scalar Signed INT32 to Single-FP Conversion CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: CVTSI2SS dest,src Description: dest[<0>] <- (float) src[<0>]; <0> is 31..0 Physical Form and Timing: CVTSI2SS xmm,r/m32 ---- F3 0F 2A /r ---- ?? ----------------------------------------------------------------- CVTSS2SI - Scalae Single-FP to Signed INT32 Conversion CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: CVTSS2SI dest,src Description: dest[<0>] <- (int) src[<0>]; src is in Single F.P. format <0> is 31..0 Physical Form and Timing: CVTSS2SI r32,xmm/m32 ---- F3 0F 2D /r ---- ?? ----------------------------------------------------------------- CVTTPS2PI - Packed Single-FP to Packed INT32 Conversion (Truncate) CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: CVTTPS2PI dest,src Description: dest[<0>] <- (int) src[<0>]; dest[<1>] <- (int) src[<1>]; <0> is 31..0 <1> is 63..32 Physical Form and Timing: CVTTPS2PI mm,xmm/m64 ---- 0F 2C /r ---- ?? ----------------------------------------------------------------- CVTTSS2SI - Scalar Single-FP to Signed INT32 Conversion (Truncate) CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: CVTTSS2SI dest,src Description: dest[<0>] <- (int) src[<0>] if conversion is unexact returning truncate value, if result > maximal 32-bit value, result will be 0x80000000 Physical Form and Timing: CVTTSS2SI r32,xmm/m32 ---- F3 0F 2C /r ---- ?? ----------------------------------------------------------------- DIVPS - Packed Single-FP Divide CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: DIVPS dest,src Description: dest[<0>] = dest[<0>] / src[<0>]; dest[<1>] = dest[<1>] / src[<1>]; dest[<2>] = dest[<2>] / src[<2>]; dest[<3>] = dest[<3>] / src[<3>]; Physical Form and Timing: DIVPS xmm1,xmm2/m128 ---- 0F 5E /r ---- 24-106 ----------------------------------------------------------------- DIVSS - Scalar Single-FP. Divide CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: DIVSS dest,src Description: dest[<0>] = dest[<0>] / src[<0>]; Physical Form and Timing: DIVSS xmm1,xmm2/r32 ---- F3 0F 5E /r ---- 7-?? --------------------------------------------------- OPCODE EMMS - Empty MMX State CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: EMMS Description: FloatPointTagWord <- FFFFh Note: The EMMS instruction sets the values of the floating-point (FP) tag word to empty (all ones). EMMS marks the registers as available, so they can subsequently be used by floating-point instructions. If a floating-point instruction loads into one of the registers before it has been reset by the EMMS instruction, a floating-point stack overflow can occur, which results in a FP exception or incorrect result. All other MMX instructions validate the entire FP tag word (all zeros). This instruction must be used to dear the MMX state at the end of all MMX routines, and before calling other routines that may execute floating-point instructions. Flags affected: None Exceptions: RM PM VM SMM Description #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception ++++++++++++++++++++++++++++++++++++++ COP & Times: EMMS 0FH 77H P55C: n/a future P6: n/a --------------------------------------------------- OPCODE ESC - Escape Extrnal Cooprocessors CPU: 8086...80386, any Hybrid 486. Type of Instruction: User Instruction: ESC Number,R/M Description: This Instruction uses for Link with External Coprocessors Such as NPX. External Coprocessors look at command sequence at get ESC. CPU give Memory Operand sending to A-bus EA doing pseudo-read operation. { If 2nd Operand is Register then Do Nothing, If 2nd Operand is Memory then set EA (Effective Address) in Address Bus } First operand is Part of Command that Ext. coprocessors get. Flags Affected: None Example: ESC 0Fh,DX means FSQRT Note: ESC mnemonic was used for 8086 CPU, later all were used alternative mnemonic for cooprocessor instructions, such as FSQRT. CPU mode: RM,PM,VM,SMM +++++++++++++++++++++++ Physical Form: COP (Code of Operation) : <1101 1xxx> Postbyte Clocks: ESC n,Reg ESC n,Mem8/Mem16 8088: 2 8/12+EA 286: 9-20 9-20 386: N/A N/A 486: N/A N/A --------------------------------------------------- OPCODE EXT - Extract Bit Field CPU: NEC/Sony all V-series Type of Instruction: User Instruction: EXT start,len Description: AX <- BitField [ BASE = DS:SI START BIT OFFSET = start LENGTH = len ]; Note: si and start automatically UPDATE Flags Affected: None CPU mode: RM +++++++++++++++++++++++ Physical Form : EXT reg8,reg8 COP (Code of Operation) : 0FH 33H PostByte Clocks: EXT reg8,reg8 NEC V20: 26-55 --------------------------------------------------- OPCODE F4X4 - FPU: Multiplicate vector on Matrix 4x4 FPU: IIT FPUs. Type of Instruction: FPU instruction Instruction: F4X4 Description: ; This Instruction Multiplicate vector on ; Matrix 4X4 _ _ _ _ _ _ | | | | | | | Xn | | A00 A01 A02 A03 | | X0 | | Yn | = | A10 A11 A12 A13 | X | Y0 | | Zn | | A20 A21 A22 A23 | | Z0 | | Wn | | A30 A31 A31 A33 | | W0 | |_ _| |_ _| |_ _| ; Data fetches/stores from/to FPU registers: # of F E T C H E S STORE Register Bank0 Bank1 Bank2 Bank0 ST X0 A33 A31 Xn ST(1) Y0 A23 A21 Yn ST(2) Z0 A13 A11 Zn ST(3) W0 A03 A01 Wn ST(4) A32 A30 ST(5) A22 A20 ST(6) A12 A10 ST(7) A02 A00 Note: See FSBP0,FSBP1,FSBP2 for more information FPU Flags Affected: S FPU mode: Any Physical Form: F4X4 COP (Code of Operation): DBH F1H Clocks: IIT 2c87 : 242 IIT 3c87 : 242 IIT 3c87SX : 242 --------------------------------------------------- OPCODE FCMOVcc - Floating Point Conditional Move CPU: P6 Type of Instruction: User Instruction: FCMOVcc dest,sorc Description: IF condition(cc) is true THEN dest <- sorc; Flags Affected: Int: None Fp : None Note: Testing Integer flags: cc Meaning Test Flags Description B Below CF=1 < NB Not Below CF=0 >= E Equal ZF=1 = NE Not Equal ZF=0 != BE Below Equal (CF=1 .OR. ZF=1) <= NBE Not BelowEqual (CF=0 .AND. ZF=0) > U Unordered PF=1 NU Not Unordered PF!=1 CPU mode: RM,PM,VM,SMM +++++++++++++++++++++++ Physical Form & COPs: FCMOVB ST,STi DA C0+i FCMOVE ST,STi DA C8+i FCMOVBE ST,STi DA D0+i FCMOVU ST,STi DA D8+i FCMOVNB ST,STi DB C0+i FCMOVNE ST,STi DB C8+i FCMOVNBE ST,STi DB D0+i FCMOVNU ST,STi DB D8+i Clocks: N/A --------------------------------------------------- OPCODE FCOMI - Floating Point Compare setting Integer Flags CPU: P6 Type of Instruction: User Instruction: FuCOMIp ST0,STi Description: CASE ( result (compare(ST0,STi) ) OF { ; ZF PF CF Not Comparable: 1 1 1 ST0 > STi : 0 0 0 ST0 < STi : 0 0 1 ST0 = STi : 1 0 0 } CASE ( FP_stack_status ) OF { ; SF Overflow : 1 Underflow : 0 Otherwize : 0 } CASE ( instruction ) OF { FCOMI,FUCOMI : No FP stack adjustment; FCOMIP,FUCOMIP : POP ST; } Flags Affected: Int: CF,ZF,PF,SF Fp : None Note: In any case Sign of zero Ignored , so +0.0 = -0.0 CPU mode: RM,PM,VM,SMM +++++++++++++++++++++++ Physical Form & COPs: FCOMI ST0,STi DB F0+i FCOMIP ST0,STi DF F0+i FUCOMI ST0,STi DB E8+i FUCOMIP ST0,STi DF E8+i Clocks: N/A ----------------------------------------------- OPCODE FEMMS - Faster Enter/Exit of MMX of F.P. state CPU: AMD-3D Type of Instruction: User Instruction: FEMMS (no operands) Description: Clear MMX state after MMX instructions. (FPU.TAG <- FFFFh). Faster version of EMMS. Flags Affected: None ++++++++++++++++++++++++++++++++++ COP & Times: FEMMS 0FH 0EH --------------------------------------------------- OPCODE FINT - Finished Interrupt CPU: NEC V25,V35,V25 Plus,V35 Plus,V25 Software Guard Type of Instruction: System Instruction: FINT Description: Inticate to Internal Interrupt controller that interrupt service Routine is completed. (EOI) Flags Affected: None CPU mode: RM +++++++++++++++++++++++ Physical Form: FINT COP (Code of Operation) : 0Fh 92h Clocks: 2 --------------------------------------------------- OPCODE FNDISI - Disable NPX Interrupt FPU: i8087 only Type of Instruction: FPU instruction Instruction: FNDISI Description: CW.IEM <- 1; // Enable NPX interrupt Note: IEM is 7 of FPU.CW FPU Flags Affected: None CPU mode: 8087 support just real mode Physical Form: FNDISI COP (Code of Operation): DBH E1H Clocks: i8087 5 --------------------------------------------------- OPCODE FNENI - Enable NPX Interrupt FPU: i8087 only Type of Instruction: FPU instruction Instruction: FNENI Description: CW.IEM <- 0; // Enable NPX interrupt Note: IEM is 7 of FPU.CW FPU Flags Affected: None CPU mode: 8087 support just real mode Physical Form: FNENI COP (Code of Operation): DBH E0H Clocks: i8087 5 --------------------------------------------------- OPCODE FNSTDW - FPU Not wait Store Device Word register FPU: i387SL Mobile Type of Instruction: FPU instruction Instruction: FNSTDW dest Description: dest <- Device Word Format of Device word: bit(s) Description 0-7 Reserved 8 S - Status bit: if S=1 then FP device is a static design and OS or APM Bios may set CLK slow to 0 Mhz without lost any data. 9-15 Reserved Note: Device word register valid only after FNINIT FPU Flags Affected: None CPU mode: Any Physical Form: FNSTDW AX COP (Code of Operation): DFH E1H Clocks: i387SL Mobile: 13 --------------------------------------------------- OPCODE FNSTSG - FPU Not wait Store Signature Word register FPU: i387SL Mobile Type of Instruction: FPU instruction Instruction: FNSTSG dest Description: dest <- Signature Word Format of Signature word: bit(s) Description 3-0 Revision 7-4 Steppin 11-8 Family 15-12 Version Note: For i387(tm) SL Mobile Signature is: Version = 2 Family = 3 ; 387 Stepping = 1 ; Ax step Revision = 0 ; x0 step i.e i387(tm) SL is A0 step Note: This FPU is out of life Note: Signature word register valid only after FNINIT FPU Flags Affected: None CPU mode: Any Physical Form: FNSTSG AX COP (Code of Operation): DFH E2H Clocks: i387SL Mobile: 13 --------------------------------------------------- OPCODE FPO2 - Floating Point Operations 2nd Way CPU: NEC/Sony all V-series Type of Instruction: User Instruction: FPO2 fp_op,mem Description: This instruction was building for sending FP commands to NEC NPX which never be realized Flags Affected: None CPU mode: RM +++++++++++++++++++++++ Physical Form : FPO2 imm4,reg/mem COP (Code of Operation) : If imm4 in range 0-7 then 66H mmFFFMMM there FFF is imm4. If imm4 in range 7-F then 67H mmFFFMMM there FFF is imm4. Clocks: FPO2 imm4,reg/mem NEC V20: 2/11 --------------------------------------------------- OPCODE FRICHOP - FPU: Round to Integer chop method FPU: Cyrix FPUs and 486s with FPU on chip Type of Instruction: FPU instruction Instruction: FRICHOP Description: ST <- ROUND ( ST,CHOP ) Note: This instruction calculate rounding ST toward zero i.e. ignoring part righter that decimal . Examples: 1.2 -> 1.0 -1.2 -> -1.0 3.0 -> 3.0 0.0 -> 0.0 1.5 -> 1.0 -2.0 -> -2.0 FPU Flags Affected: S,P,D,I,C1 FPU mode: Any Physical Form: FRICHOP COP (Code of Operation): DDH FCH Clocks: Cx83D87 : 15 Cx83S87 : 15 CxEMC87 : 15 Cx487DLC : --------------------------------------------------- OPCODE FRINEAR - FPU: Round to Integer Nearest method FPU: Cyrix FPUs and 486s with FPU on chip Type of Instruction: FPU instruction Instruction: FRINEAR Description: ST <- ROUND ( ST,NEAREST ) Note: This instruction calculate rounding ST toward nearest Examples: 1.2 -> 1.0 -1.2 -> -1.0 3.0 -> 3.0 0.0 -> 0.0 1.5 -> 1.0 1.8 -> 2.0 -2.0 -> -2.0 FPU Flags Affected: S,P,D,I,C1 FPU mode: Any Physical Form: FRINEAR COP (Code of Operation): DFH FCH Clocks: Cx83D87 : 15 Cx83S87 : 15 CxEMC87 : 15 Cx487DLC : --------------------------------------------------- OPCODE FRINT2 - FPU: Round to Integer FPU: Cyrix FPUs and 486s with FPU on chip Type of Instruction: FPU instruction Instruction: FRINT2 Description: IF ( exact half ) THEN { ST <- SIGN(ST) * ROUND(ABS(ST)+0.5,NEAREST) } ELSE { ST <- ROUND ( ST,NEAREST ) } END Note: This instruction calculate rounding ST toward nearest, but if number is exact half then this instruction round it toward signed infinity. Sign of this infinity is same with sign of number. Examples: 1.2 -> 1.0 -1.2 -> -1.0 3.0 -> 3.0 0.0 -> 0.0 1.5 -> 2.0 1.8 -> 2.0 -2.0 -> -2.0 -1.5 -> -2.0 FPU Flags Affected: S,P,D,I,C1 FPU mode: Any Physical Form: FRINT2 COP (Code of Operation): DBH FCH Clocks: Cx83D87 : 15 Cx83S87 : 15 CxEMC87 : 15 Cx487DLC : --------------------------------------------------- OPCODE FRSTPM - FPU Reset Protected Mode FPU: i287XL i287XLT Type of Instruction: FPU instruction Instruction: FRSTPM Description: Reset Cooprocessor from Protected Mode to Real Address mode. FPU Flags Affected: None CPU mode:Any ??? Physical Form: FRSTPM COP (Code of Operation): DBH E5H Clocks: i287XL : 12 i287XLT : 12 --------------------------------------------------- OPCODE FSBP0 - FPU: Set Bank pointer to Bank # 0 FPU: IIT FPUs. Type of Instruction: FPU instruction Instruction: FSBP0 Description: ; This Instruction set current bank pointer to ; Bank # 0. ; Each bank contain eight 80bit registers ; There are 3 banks (0,1,2) in Chip ; After initialization FPU select bank # 0. FPU Flags Affected: None FPU mode: Any Physical Form: FSBP0 COP (Code of Operation): DBH E8H Clocks: IIT 2c87 : 6 IIT 3c87 : 6 IIT 3c87SX : 6 --------------------------------------------------- OPCODE FSBP1 - FPU: Set Bank pointer to Bank # 1 FPU: IIT FPUs. Type of Instruction: FPU instruction Instruction: FSBP1 Description: ; This Instruction set current bank pointer to ; Bank # 1. ; Each bank contain eight 80bit registers ; There are 3 banks (0,1,2) in Chip ; After initialization FPU select bank # 0. FPU Flags Affected: None FPU mode: Any Physical Form: FSBP1 COP (Code of Operation): DBH EBH Clocks: IIT 2c87 : 6 IIT 3c87 : 6 IIT 3c87SX : 6 --------------------------------------------------- OPCODE FSBP2 - FPU: Set Bank pointer to Bank # 2 FPU: IIT FPUs. Type of Instruction: FPU instruction Instruction: FSBP2 Description: ; This Instruction set current bank pointer to ; Bank # 2. ; Each bank contain eight 80bit registers ; There are 3 banks (0,1,2) in Chip ; After initialization FPU select bank # 0. FPU Flags Affected: None FPU mode: Any Physical Form: FSBP2 COP (Code of Operation): DBH EAH Clocks: IIT 2c87 : 6 IIT 3c87 : 6 IIT 3c87SX : 6 --------------------------------------------------- OPCODE FSETPM - FPU Set Protected Mode Adressing FPU: 80287, i287XL i287XLT Type of Instruction: FPU instruction Instruction: FRSTPM Description: Setup Coprocessor for addressing in Protected mode FPU Flags Affected: None CPU mode:Any ??? Physical Form: FSETPM COP (Code of Operation): DBH E4H Clocks: i287XL : 12 i287XLT : 12 --------------------------------------------------- OPCODE FXRSTOR - Fast Restore F.P. Context CPU: Katmai/Deschutes (IA MMX-2) Type of Instruction: User Instruction: FXRSTOR src Description: Fast Restore 94 (16-bit mode) or 108 (32-bit mode) byte of F.P. context to memory. Format of context as in standart x86 instruction: FSAVE. Note: Check CPUID, EAX=1, bit 24 for knew CPU support this feature. And then look at CR4.bit9. Note: See FXSAVE for more information Flags Affected: None CPU mode: any +++++++++++++++++++++++ Physical Form & COPs: FXRSTOR mem512byte 0F AE mm001mmm Clocks: n/a --------------------------------------------------- OPCODE FXSAVE - Fast Save F.P. Context CPU: Pentium II (Deschutes) + Type of Instruction: User Instruction: FXSAVE dest Description: Fast Save 94 (16-bit mode) or 108 (32-bit mode) byte of F.P. context to memory. Format of context as in standart x86 instruction: FSAVE. Note: Check CPUID, EAX=1, bit 24 for knew CPU support this feature. And then look at CR4.bit9. Format of F.P./MMX Save Area: Offset (hex) Size Description +00 WORD FCW (Control word) +02 WORD FSW (Status word) +04 WORD FTW (Tag word) +06 WORD FOP (lower 11-bit F.P. opcode) +08 DWORD IP (F.P. Instruction pointer) +0C WORD CS +10 DWORD DP (F.P. Data pointer) +14 WORD DS +18 DWORD MXCSR (Pentium III+) see LDMXCSR instruction for more info +20 TBYTE ST0/MM0 +30 TBYTE ST1/MM1 +40 TBYTE ST2/MM2 +50 TBYTE ST3/MM3 +60 TBYTE ST4/MM4 +70 TBYTE ST5/MM5 +80 TBYTE ST6/MM6 +90 TBYTE ST7/MM7 +A0 16BYTE XMM0 (Pentium III+) +B0 16BYTE XMM1 (Pentium III+) +C0 16BYTE XMM2 (Pentium III+) +D0 16BYTE XMM3 (Pentium III+) +E0 16BYTE XMM4 (Pentium III+) +F0 16BYTE XMM5 (Pentium III+) +100 16BYTE XMM6 (Pentium III+) +110 16BYTE XMM7 (Pentium III+) All other fields are reserved. Full length of Save/Restore area is 512 byte. (200h) Flags Affected: None CPU mode: any +++++++++++++++++++++++ Physical Form & COPs: FXSAVE mem512byte 0F AE mm000mmm Clocks: n/a --------------------------------------------------- OPCODE IBTS - Insert Bits String CPU: 80386 step A0-B0 only Type of Instruction: User Instruction: IBTS base,bitoffset,len,sorc Description: Write bit string length bits from [bits .. 0 ] (lowest bits) to bitfield, defined by and bitsoffset from this base to start of the field to write. String write from this start field bit to higher memory addresses or register bits. Flags Affected: None CPU mode: RM,PM,VM +++++++++++++++++++++++ Physical Form: IBTS r/m16,AX,CL,r16 IBTS r/m32,EAX,CL,r32 COP (Code of Operation) : 0FH A7H Postbyte Clocks: IBTS 80386: 12/19 --------------------------------------------------- OPCODE ICEBP - PWI Mode BreakPoint, ICE address space CPU: IBM 486SLC2 Type of Instruction: System Instruction: ICEBP Description: IF (condition) THEN ; see condition below { SAVE STATUS OF EXECUTION TO ICE space; ENTER SMM; } ELSE { INT 1; } END Note: This condition can be set before execution this instruction: CPL=0 MSR1000H.EPCEA=1 MSR1000H.EPWI=1 See Appendix X for more info. Flags Affected: None CPU mode: RM,PM0 Physical Form: ICEBP COP (Code of Operation): F1H Clocks: IBM 486SLC2 : 460 --------------------------------------------------- OPCODE ICEBP - In-Circuit Emulator Breakpoint CPU: some models of i486, i386, Pentium, Pentium Pro Type of Instruction: System Instruction: ICEBP Description: IF (condition) THEN ; see condition below { CHANGED TO THE ICE instruction mode; } ELSE { INT 1; } END Note: 386/486: Condition is DR7.bit12=1 (CPU must be supported ICE). Note: This instruction very usefull to debbuging as Single-Byte Interrupt but it generate never int 3, but int 1. Note: On Pentium Interrupt redirection initiately disabled on PMCR (Probe Mode Control Register), which is only accessable via debug port i.e. Need external hardware for enable normal ICEBP execution. Note: On Pentium Pro situation is the same. But in Pentium Pro Intel named this instruction INT01. Flags Affected: None CPU mode: RM,PM0 Physical Form: ICEBP COP (Code of Operation): F1H Clocks: : N/A --------------------------------------------------- OPCODE ICERET - Return from PWI mode, ICE space CPU: IBM 486SLC2 Type of Instruction: System Operation (Work only then CPL=0) Instruction: ICERET Description: Load All Registers (Include Shadow Registers) from Table Which Begin on place pointed ES:EDI, and return from PWI mode. Format of ICERET Table: Offset Len Description 0H 4 CR0 4H 4 EFLAGS 8H 4 EIP CH 4 EDI 10H 4 ESI 14H 4 EBP 18H 4 ESP 1CH 4 EBX 20H 4 EDX 24H 4 ESX 28H 4 EAX 2CH 4 DR6 30H 4 DR7 34H 4 TR (16 bit, zero filled up) 38H 4 LDT --------- 3CH 4 GS --------- 40H 4 FS --------- 44H 4 DS --------- 48H 4 SS --------- 4CH 4 CS --------- 50H 4 ES --------- 54H 4 TSS.attrib 58H 4 TSS.base 5CH 4 TSS.limit 60H 4 Reserved 64H 4 IDT.base 68H 4 IDT.limit 6CH 4 REP OUTS overrun flag 70H 4 GDT.base 74H 4 GDT.limit 78H 4 LDT.attrib 7CH 4 LDT.base 80H 4 LDT.limit 84H 4 GS.attrib 88H 4 GS.base 8CH 4 GS.limit 90H 4 FS.attrib 94H 4 FS.base 98H 4 FS.limit 9CH 4 DS.attrib A0H 4 DS.base A4H 4 DS.limit A8H 4 SS.attrib ACH 4 SS.base B0H 4 SS.limit B4H 4 CS.attrib B8H 4 CS.base BCH 4 CS.limit C0H 4 ES.attrib C4H 4 ES.base C8H 4 ES.limit Unknown Unusable area ;; Temporary registers: 100H 4 TST 104H 4 IDX 108H 4 TMPH 10CH 4 TMPG 110H 4 TMPF 114H 4 TMPE 118H 4 TMPD 11CH 4 TMPC 120H 4 TMPB 124H 4 TMPA 128H 4 CR2 12CH 4 CR3 130H 4 MSR1001H (31-0) 134H 4 MSR1001H (63-32) 138H 4 MSR1000H (15-0) 13CH 4 DR0 140H 4 DR1 144H 4 DR2 148H 4 DR3 14CH 4 PEIP Length of table is 150H bytes. see Appendix X for more info. Note: For descriptor format refer to LOADALL and RES3 instructions. Flags Affected: All (FLAGS Register Reload) CPU mode: SMM Physical Form: ICERET COP (Code of Operation): 0FH 07H Note: Code is same with Intel's LOADALL Clocks: IBM 486SLC2 : 440 --------------------------------------------------- OPCODE INS - Insert Bit String CPU: NEC/Sony all V-series Type of Instruction: User Instruction: INS start,len Description: BitField [ BASE = ES:DI START BIT OFFSET = start LENGTH = len ] <- AX [ bits= (len-1)..0] Note: di and start automatically UPDATE Note: Alternative Name of this instruction is NECINS Flags Affected: None CPU mode: RM +++++++++++++++++++++++ Physical Form : INS reg8,reg8 COP (Code of Operation) : 0FH 31H PostByte Clocks: INS reg8,reg8 NEC V20: 31-117 --------------------------------------------------- OPCODE INVD - Invalidate Cache Buffer CPU: I486 + Type of Instruction: System Instruction: INVD Description: FLUSH INTERNAL CACHE ( It means that all lines of internal caches sets as invalid ) SIGNAL EXTERNAL CACHE TO FLUSH Notes: This instruction not work in Real Mode and in Protected mode work only in ring 0 ; Flags Affected: None CPU mode: PM0,SMM? Physical Form: INVD COP (Code of Operation): 0FH 08H Clocks: Cyrix Cx486SLC : 4 i486 : 4 Pentium : 15 --------------------------------------------------- OPCODE INVLPG - Invalidate Page Entry In TLB CPU: I486 + Type of Instruction: System Instruction: INVLPG mem Description: IF found in data or code (if both) (or common if single) TLB entry with linear address (page part) same as memory operand then mark this entry as Invalid; Notes: This instruction not work in Real Mode and in Protected mode work only in ring 0 ; Flags Affected: None CPU mode: RM,PM,VM,SMM Physical Form: INVLPG mem COP (Code of Operation): 0FH 01H mm111mmm Clocks: Cyrix Cx486SLC : 4 i486 : 12 if hit : 11 if not hit Pentium : 25 --------------------------------------------------- OPCODE JMPE - Jump and change to 64-bit ISA. CPU: Merced Type of Instruction: User Instruction: JMPX dest_addr Description: This instruction make jump to specified address, and change execution mode from IA-32 to IA-64. (So address must be 16-byte aligned). Note: The other method to cnange execution mode to IA-64 is interrupt to 64-bit code or IRET in IA-32 routine, which will be called from IA-64. back to IA-32 mode using commands: br.ia, rti and via interrupt. Flags Affected: None CPU mode: IA-32 Physical Form: JMPX rel16/rel32 0F B8 rel16/rel32 JMPX r/m(16/32) 0F 00 /6 COP (Code of Operation): Clocks: Merced : ----------------------------------------------------------------- LDMXCSR - Load Streaming SIMD Extension Control/Status CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: LDMXCSR src Description: MXCSR <- src; Format of MXCSR: Bits Description 31..16 Reserved 15 FZ (Flush to Zero) 14..13 RC (Round Control) 00 Round to nearest (even) 01 Round down (to minius infinity) 10 Round up (to positive infinity) 11 Round toward zero (Truncate) 12 PM (SIMD numeric exception masks) 11 UM 10 OM 9 ZM 8 DM 7 IM 6 Reserved 5 PE (SIMD numeric exceptions) 4 UE 3 OE 2 ZE 1 DE 0 IE Physical Form and Timing: LDMXCSR m32 ---- 0F AE /2 ---- ?? --------------------------------------------------- OPCODE LOADALL - Load All Registers CPU: Intel 386+ +all clones Type of Instruction: System (Work only then CPL=0) Instruction: LOADALL Description: Load All Registers (Include Shadow Registers) from Table Which Begin on place pointed ES:EDI Format of LOADALL Table: Offset Len Description 0H 4 CR0 4H 4 EFLAGS 8H 4 EIP CH 4 EDI 10H 4 ESI 14H 4 EBP 18H 4 ESP 1CH 4 EBX 20H 4 EDX 24H 4 ESX 28H 4 EAX 2CH 4 DR6 30H 4 DR7 34H 4 TR (16 bit, zero filled up) 38H 4 LDT --------- 3CH 4 GS --------- 40H 4 FS --------- 44H 4 DS --------- 48H 4 SS --------- 4CH 4 CS --------- 50H 4 ES --------- 54H 4 TSS.attrib 58H 4 TSS.base 5CH 4 TSS.limit 60H 4 0s 64H 4 IDT.base 68H 4 IDT.limit 6CH 4 0s 70H 4 GDT.base 74H 4 GDT.limit 78H 4 LDT.attrib 7CH 4 LDT.base 80H 4 LDT.limit 84H 4 GS.attrib 88H 4 GS.base 8CH 4 GS.limit 90H 4 FS.attrib 94H 4 FS.base 98H 4 FS.limit 9CH 4 DS.attrib A0H 4 DS.base A4H 4 DS.limit A8H 4 SS.attrib ACH 4 SS.base B0H 4 SS.limit B4H 4 CS.attrib B8H 4 CS.base BCH 4 CS.limit C0H 4 ES.attrib C4H 4 ES.base C8H 4 ES.limit CCH 4 Length of table D0H 30h Unused,not loaded 100H 4 Temporary Register IST 104H 4 Temporary Register I 108H 4 Temporary Register H 10CH 4 Temporary Register G 110H 4 Temporary Register F 114H 4 Temporary Register E 118H 4 Temporary Register D 11CH 4 Temporary Register C 120H 4 Temporary Register B 124H 4 Temporary Register A Format of Attrib field: Byte Description 0 0s 1 AR (Access Right) byte in the Descriptor format Note: P bit is a valid bit if valid bit=0 then Shadow Register is invalid and INT 0DH - General Protection Fault call DPL of SS,CS det. CPL 2-3 0s Flags Affected: All (FLAGS Register Reload) CPU mode: RM,PM0 Physical Form: LOADALL COP (Code of Operation): 0FH 07H Clocks: i386XX : n/a i486XX : n/a Note: This operation used 102 data transfer cycles on 32bit bus Typical clocks: i386SX: ~350 i386DX: ~290 i486XX: ~220 --------------------------------------------------- OPCODE LOADALL - Load All Registers From Table CPU: Intel 80286 and all its clones Type of Instruction: System (Work only then CPL=0) Instruction: LOADALL Description: Load All Registers (Include Shadow Registers) from Table Which Begin on 000800H Address, Len of this table is 66H Format of LOADALL Table: Address Len Description 800H 6 None 806H 2 MSW 808H 14 None 816H 2 TR 818H 2 FLAGS 81AH 2 IP 81CH 2 LDTR 81EH 2 DS 820H 2 SS 822H 2 CS 824H 2 ES 826H 2 DI 828H 2 SI 82AH 2 BP 82CH 2 SP 82EH 2 BX 830H 2 DX 832H 2 CX 834H 2 AX 836H 6 ES Shadow Descriptor 83CH 6 CS Shadow Descriptor 842H 6 SS Shadow Descriptor 848H 6 DS Shadow Descriptor 84EH 6 GDTR 854H 6 LDT Shadow Descriptor 85AH 6 IDTR 860H 6 TSS Shadow Descriptor Format of Shadow Descriptor: Byte Description 0-2 24bit Phisical Address 3 AR (Access Right) byte 4-5 16bit Segment Limit Format of GDTR and IDTR: Byte Description 0-2 24bit Phisical Address 3 0s 4-5 16bit Segment Limit Note: Using this instruction we may turn on "Big Real Mode" i.e. mode then PG=1,PE=0,cpl=0. This mode very usefull,But Pentium never support this instruction. Flags Affected: All (FLAGS Register Reload) CPU mode: RM,PM0 Physical Form: LOADALL COP (Code of Operation): 0FH 05H Clocks: 80286 : 195 ----------------------------------------------------------------- MASKMOVQ - Byte Mask Write CPU: Pentium III+ (KNI/MMX2), Athlon+ (AMD EMMX) Type of instruction: User Instruction: MASKMOVQ src,mask Description: #define MOVE_BYTE(check_bit,move_bits) if (mask[check_bit] == 1) mem64[EDI][move_bits] = src[move_bits]; else mem64[EDI][move_bits] = 0; endif; #enddef MOVE_BYTE(7 , 7..0); MOVE_BYTE(15, 15..8); MOVE_BYTE(23, 23..16); MOVE_BYTE(31, 31..24); MOVE_BYTE(39, 39..32); MOVE_BYTE(47, 47..40); MOVE_BYTE(55, 55..48); MOVE_BYTE(63, 63..56); Physical Form and Timing: MASKMOVQ mm1,mm2 ---- 0F F7 /r ---- ?? ----------------------------------------------------------------- MAXPS - Packed Single-FP Maximum CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: MAXPS dest,src Description: par for i=0 to 3 do if dest[] is NaN then dest[] <- src[]; if src[] is NaN then dest[] <- src[]; if src[] >= dest[] then dest[] <- src[]; endfor; <0> = 31..0 <2> = 95..64 <1> = 63..32 <3> = 127..96 Physical Form and Timing: MAXPS xmm1,xmm2/m128 ---- 0F 5F /r ---- 2 ----------------------------------------------------------------- MAXSS - Scalar Single-FP Maximum CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: MAXSS dest,src Description: if dest[<0>] is NaN then dest[<0>] <- src[<0>]; if src[<0>] is NaN then dest[<0>] <- src[<0>]; if src[<0>] >= dest[<0>] then dest[<0>] <- src[<0>]; Physical Form and Timing: MAXSS xmm1,xmm2/m32 ---- F3 0F 5F /r ---- 1 ----------------------------------------------------------------- MINPS - Packed Single-FP Minimum CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: MINPS dest,src Description: par for i=0 to 3 do if dest[] is NaN then dest[] <- src[]; if src[] is NaN then dest[] <- src[]; if src[] < dest[] then dest[] <- src[]; endfor; <0> = 31..0 <2> = 95..64 <1> = 63..32 <3> = 127..96 Physical Form and Timing: MINPS xmm1,xmm2/m128 ---- 0F 5D /r ---- 2 ----------------------------------------------------------------- MINSS - Scalar Single-FP Manimum CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: MINSS dest,src Description: if dest[<0>] is NaN then dest[<0>] <- src[<0>]; if src[<0>] is NaN then dest[<0>] <- src[<0>]; if src[<0>] < dest[<0>] then dest[<0>] <- src[<0>]; Physical Form and Timing: MINSS xmm1,xmm2/m32 ---- F3 0F 5D /r ---- 1 ----------------------------------------------------------------- MOVAPS - Move Aligned Four Packed Single-FP CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: MOVAPS dest,src Description: dest <- src; Note: This instruction moved 16-byte (128-bit) total size 4x 32-bit FP. from/to memory. Address of this F.P. block must be 16-bytes aligned Physical Form and Timing: MOVAPS xmm1,xmm2/m128 ---- 0F 28 /r ---- ?? MOVAPS xmm2/m128,xmm1 ---- 0F 29 /r ---- ?? --------------------------------------------------- OPCODE MOVD - Move Dwords CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: MOVD dest,src Description: IF dest is MMi register THEN { dest[63..32] <- 0 dest[31..0] <- src } ELSE ; If dest is DWORD dest <- src [31..0] Note: This instruction moved DWORDs to/from MMX registers Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If result in Non-Writable segment #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception ++++++++++++++++++++++++++++++++++++++ COP & Times: MOVD mm,r/m32 0FH 6EH PostByte MOVD r/m32,mm 0Fh 7Eh PostByte mm,r/m32 r/m32,mm P55C: n/a (~1) (~1) future P6: n/a (~1) (~1) ----------------------------------------------------------------- MOVHLPS - Move High to Low Packed Single-F.P. CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: MOVHLPS dest,src Description: dest[<1>] <- src[<3>]; dest[<0>] <- src[<2>]; <0> = 31..0 <2> = 95..64 <1> = 63..32 <3> = 127..96 Physical Form and Timing: MOVHLPS xmm1,xmm2 ---- 0F 12 /r ---- 1 ----------------------------------------------------------------- MOVHPS - Move High Packed Single FP. CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: MOVHPS dest,src Description: if (dest is mem64) then dest[<1>] <- src[<3>]; dest[<0>] <- src[<2>]; endif if (src is mem64) then dest[<3>] <- src[<1>]; dest[<2>] <- src[<0>]; endif <0> = 31..0 <2> = 95..64 <1> = 63..32 <3> = 127..96 Physical Form and Timing: MOVHPS xmm,m64 ---- 0F 16 /r ---- 1 MOVHPS m64,xmm ---- 0F 17 /r ---- 1 ----------------------------------------------------------------- MOVLHPS - Move Low to High Packed Single-F.P. CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: MOVLHPS dest,src Description: dest[<3>] <- src[<1>]; dest[<2>] <- src[<0>]; <0> = 31..0 <2> = 95..64 <1> = 63..32 <3> = 127..96 Physical Form and Timing: MOVLHPS xmm1,xmm2 ---- 0F 16 /r ---- 1 ----------------------------------------------------------------- MOVLPS - Move Low Packed Single FP. CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: MOVLPS dest,src Description: dest[<1>] <- src[<1>]; dest[<0>] <- src[<0>]; <0> = 31..0 <2> = 95..64 <1> = 63..32 <3> = 127..96 Physical Form and Timing: MOVLPS xmm,m64 ---- 0F 12 /r ---- 1 MOVLPS m64,xmm ---- 0F 13 /r ---- 1 ----------------------------------------------------------------- MOVMSKPS - Move Mask to Integer CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: MOVMSKPS dest,src Description: dest[0] <- src[31]; // Single Bits, not bit groups dest[1] <- src[63]; dest[2] <- src[95]; dest[3] <- src[127]; dest[31..4] <- 0; Physical Form and Timing: MOVMSKPS r32,xmm ---- 0F 50 /m ---- ?? ----------------------------------------------------------------- MOVNTPS - Move Aligned Four Packed Single-FP Non Temporal CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: MOVNTPS dest,src Description: dest <- src; // This store mimimize cache pollution // storing XMM 128-bit register Physical Form and Timing: MOVNTPS m128,xmm ---- 0F 2B /r ---- ?? ----------------------------------------------------------------- MOVNTQ - Move 64 bits non temporal CPU: Pentium III+ (KNI/MMX2), AMD Athlon (AMD EMMX) Type of instruction: User Instruction: MOVNTQ dest,src Description: dest <- src; // This store minimize cache pollution // storing MM (MMX) 64-bit register Physical Form and Timing: MOVNTQ m64,mm ---- 0F E7 /r ---- ?? --------------------------------------------------- OPCODE MOVQ - Move Qwords CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: MOVQ dest,src Description: dest <- src Note: This instruction moved QWORDs to/from MMX registers Of course, IA support Big-endian QWORDS. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If result in Non-Writable segment #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception ++++++++++++++++++++++++++++++++++++++ COP & Times: MOVQ mm,mm/m64 0FH 6FH PostByte MOVQ mm/m64,mm 0Fh 7Fh PostByte Note: In PostByte instead IU registers used MMX registers, 0Fh 6Fh C0h means MOVQ MM0,MM0 mm,r/m32 r/m32,mm P55C: n/a (~1) (~1) future P6: n/a (~1) (~1) --------------------------------------------------- OPCODE MOVSPA - Move Stack Pointer After Bank Switched CPU: NEC V25,V35,V25 Plus,V35 Plus,V25 Software Guard Type of Instruction: System Instruction: MOVSPA Description: This instruction transfer both SS and SP of the old register bank to new register bank after the bank has been switched by interrupt or BRKCS instruction. Flags Affected: None CPU mode: RM +++++++++++++++++++++++ Physical Form: MOVSPA COP (Code of Operation) : 0Fh 25h Clocks: 16 --------------------------------------------------- OPCODE MOVSPB - Move Stack Pointer Before Bamk Switching CPU: NEC V25,V35,V25 Plus,V35 Plus,V25 Software Guard Type of Instruction: System Instruction: MOVSPB Number_of_bank Description: The MOVSPB instruction transfers the current SP and SS before the bank switching to new register bank. Note: New Register Bank Number indicated by lower 3bit of Number_of_ _bank. Note: See BRKCS instruction for more info about banks. Flags Affected: None CPU mode: RM +++++++++++++++++++++++ Physical Form: MOVSPB reg16 COP (Code of Operation) : 0Fh 95h <1111 1RRR> Clocks: 11 ----------------------------------------------------------------- MOVSS - Move Scalar Single-FP CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: MOVSS dest,src Description: dest[<0>] <- src[<0>]; <0> = 31..0 <2> = 95..64 <1> = 63..32 <3> = 127..96 Physical Form and Timing: MOVSS xmm1,xmm2/m32 ---- F3 0F 10 /r ---- ?? MOVSS xmm2/m32,xmm1 ---- F3 0F 11 /r ---- ?? ----------------------------------------------------------------- MOVUPS - Move Unaligned Four Packed Single-FP CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: MOVUPS dest,src Description: dest <- src // Analigned move of XMM 128-bit register Physical Form and Timing: MOVUPS xmm1,xmm2/m128 ---- 0F 10 /r ---- ?? MOVUPS xmm2/m128,xmm1 ---- 0F 11 /r ---- ?? ----------------------------------------------------------------- MULPS - Packed Single-FP Multiply CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: MULPS dest,src Description: dest[<0>] = dest[<0>] * src[<0>]; dest[<1>] = dest[<1>] * src[<1>]; dest[<2>] = dest[<2>] * src[<2>]; dest[<3>] = dest[<3>] * src[<3>]; Physical Form and Timing: MULPS xmm1,xmm2/m128 ---- 0F 59 /r ---- 2 ----------------------------------------------------------------- MULSS - Scalar Single-FP Multiply CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: MULPS dest,src Description: dest[<0>] = dest[<0>] * src[<0>]; Physical Form and Timing: MULSS xmm1,xmm2/m32 ---- F3 0F 59 /r ---- 2 --------------------------------------------------- OPCODE NOT1 - Invert a Specified bit CPU: NEC/Sony all V-series Type of Instruction: User Instruction: NOT1 dest,bitnumb Description: (BIT bitnumb OF dest) <- NOT (BIT bitnumb OF dest); Flags Affected: None CPU mode: RM +++++++++++++++++++++++ Physical Form: NOT1 reg/mem8,CL COP (Code of Operation) : 0FH 16H Postbyte Physical Form: NOT1 reg/mem8,imm8 COP (Code of Operation) : 0FH 1EH Postbyte imm8 Physical Form: NOT1 reg/mem16,CL COP (Code of Operation) : 0FH 17H Postbyte Physical Form: NOT1 reg/mem16,imm8 COP (Code of Operation) : 0FH 1FH Postbyte imm8 Clocks: NOT1 r/m8,CL r/m8,i8 r/m16,CL r/m16,i8 NEC V20: 4/18 5/19 4/18 5/19 -------------------------------------------------- OPCODE OIO - Official Undefined Opcode CPU: Cyrix Cx6x86 (same code on AMD Am5k86) Logical Form: OIO Description: Caused #UD exception Flags Affected: No Flags Affected CPU Mode : RM,PM,VM,VME,SMM Exceptions : RM PM V86 VME SMM #UD #UD #UD #UD #UD Undefined Instruction No more Exceptions Note : This instruction caused #UD. AMD guaranteed that in future AMD's CPUs this instruction will caused #UD. Of course all previous CPUs (186+) caused #UD on this opcode. This instruction used by software writers for testing #UD exception servise routine. ++++++++++++++++++++++++++++++ Physical Form : UD COP (Code of Operation) : 0Fh FFh Clocks : UD 8088: Not supported NEC V20: Not supported 80186: ~int 80286: ~int 80386: ~int Cx486SLC: ~int i486: ~int Cx486DX: ~int Cx5x86: ~int Pentium: ~int Nx5x86: ~int Cx6x86: ~int Am5k86: ~int Pentium Pro: ~int ++++++++++++++++++++++++++++++ ----------------------------------------------------------------- ORPS - Bit-wise Logical OR For Single-FP CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: ORPS dest,src Description: dest = dest OR src; // Bitwize 128-bit Physical Form and Timing: ORPS xmm1,xmm2/m128 ---- 0F 56 /r ---- 2 --------------------------------------------------- OPCODE PACKSSDW - Pack with Signed Saturation dword to word CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PACKSSDW dest,src Description: dest[15..0] <- SaturateSignedDWordToSignedWord dest[31..0] dest[31..16] <- SaturateSignedDWordToSignedWord dest[63..32] dest[47..32] <- SaturateSignedDWordToSignedWord src[31..0] dest[63..46] <- SaturateSignedDWordToSignedWord src[63..32] Note: This instruction packs and saturates signed data from src and dest to dest. If signed value of word larger or smaller that the range of signed byte value is saturated (in case of overflow to 7Fh, in underflow to 80h). Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception ++++++++++++++++++++++++++++++++++++++ COP & Times: PACKSSDW mm,mm/m64 0FH 6BH PostByte P55C: n/a future P6: n/a --------------------------------------------------- OPCODE PACKSSWB - Pack with Signed Saturation word to Byte CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PACKSSWB dest,src Description: dest[7..0] <- SaturateSignedWordToSignedByte dest[15..0] dest[15..8] <- SaturateSignedWordToSignedByte dest[31..16] dest[23..16] <- SaturateSignedWordToSignedByte dest[47..32] dest[31..24] <- SaturateSignedWordToSignedByte dest[63..48] dest[39..32] <- SaturateSignedWordToSignedByte src[15..0] dest[47..40] <- SaturateSignedWordToSignedByte src[31..16] dest[55..48] <- SaturateSignedWordToSignedByte src[47..32] dest[63..56] <- SaturateSignedWordToSignedByte src[63..48] Note: This instruction packs and saturates signed data from src and dest to dest Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception ++++++++++++++++++++++++++++++++++++++ COP & Times: PACKSSWB mm,mm/m64 0FH 63H PostByte P55C: n/a future P6: n/a --------------------------------------------------- OPCODE PACKUSWB - Pack with Unsigned Saturation word to Byte CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PACKUSWB dest,src Description: dest[7..0] <- SaturateSignedWordToUnSignedByte dest[15..0] dest[15..8] <- SaturateSignedWordToUnSignedByte dest[31..16] dest[23..16] <- SaturateSignedWordToUnSignedByte dest[47..32] dest[31..24] <- SaturateSignedWordToUnSignedByte dest[63..48] dest[39..32] <- SaturateSignedWordToUnSignedByte src[15..0] dest[47..40] <- SaturateSignedWordToUnSignedByte src[31..16] dest[55..48] <- SaturateSignedWordToUnSignedByte src[47..32] dest[63..56] <- SaturateSignedWordToUnSignedByte src[63..48] Note: If signed value of word larger or smaller that the range of unsigned byte, value is saturated (if overflow to FFh, if underflow to 0h). Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception ++++++++++++++++++++++++++++++++++++++ COP & Times: PACKUSWB mm,mm/m64 0FH 67H PostByte P55C: n/a future P6: n/a --------------------------------------------------- OPCODE PADDB - Packed Add Bytes CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PADDB dest,src Description: dest[7..0] <- dest[7..0] + src[7..0] dest[15..8] <- dest[15..8] + src[15..8] dest[23..16] <- dest[23..16] + src[23..16] dest[31..24] <- dest[31..24] + src[31..24] dest[39..32] <- dest[39..32] + src[39..32] dest[47..40] <- dest[47..40] + src[47..40] dest[55..48] <- dest[55..48] + src[55..48] dest[63..56] <- dest[63..56] + src[63..56] Note: This instruction adds the bytes of the source to the bytes of the destination and writes the results to the MMX register. When the result is too large to be represented in a packed byte (overflow), the result wraps around and the lower 8 bits are writen to the destination register. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PADDB mm,mm/m64 0FH FCH PostByte P55C: n/a future P6: n/a --------------------------------------------------- OPCODE PADDD - Packed Add Dwords CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PADDD dest,src Description: dest[31..0] <- dest[31..0] + src[31..0] dest[63..32] <- dest[63..32] + src[63..32] Note: This instruction adds the dwords of the source to the dwords of the destination and writes the results to the MMX register. When the result is too large to be represented in a packed dword (overflow), the result wraps around and the lower 32 bits are writen to the destination register. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PADDW mm,mm/m64 0FH FEH PostByte P55C: n/a future P6: n/a --------------------------------------------------- OPCODE PADDSB - Packed Add with Saturation Bytes CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PADDSB dest,src Description: dest[7..0] <- SaturateToSignedByte(dest[7..0] + src[7..0]) dest[15..8] <- SaturateToSignedByte(dest[15..8] + src[15..8]) dest[23..16] <- SaturateToSignedByte(dest[23..16] + src[23..16]) dest[31..24] <- SaturateToSignedByte(dest[31..24] + src[31..24]) dest[39..32] <- SaturateToSignedByte(dest[39..32] + src[39..32]) dest[47..40] <- SaturateToSignedByte(dest[47..40] + src[47..40]) dest[55..48] <- SaturateToSignedByte(dest[55..48] + src[55..48]) dest[63..56] <- SaturateToSignedByte(dest[63..56] + src[63..56]) Note: This instruction adds the signed bytes of the source to the bytes of the destination and writes the results to the MMX register. If the result is larger or smaller than the range of a signed byte, the value is saturated (in the case of a overflow - to 7FH, and in the case of an underflow - to 80H). Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PADDSB mm,mm/m64 0FH ECH PostByte P55C: n/a future P6: n/a ----------------------------------------------- OPCODE PADDSIW - Packed Add with Saturation, using Implied Destination CPU: Cyrix with Extended MMX Instruction Set Type of Instruction: User Instruction: PADDSIW dest, src Description: dest[15..0] <- SaturateToSignedWord(dest[15..0] + src[15..0] dest[31..16] <- SaturateToSignedWord(dest[31..16] + src[31..16] dest[47..32] <- SaturateToSignedWord(dest[47..32] + src[47..32] dest[63..48] <- SaturateToSignedWord(dest[63..48] + src[63..48] Notes: This instruction adds the signed words of the source operand to the signed words of the destination operand and writes the results to the implied MMX register. The purpose of this instruction is the same as the PADDSW instruction, except that it preserves both source operands. The DEST must be an MMX register. The SRC can be either an MMX register or a 64-bit memory operand. The destination is an MMX register which depends on the DEST. Flags Affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operands EA in CS,DS,ES,FS,GS #SS(0) If Illegal memory operands EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++ COP & Times: PADDSIW mm,mm/m64 0FH 51H PostByte --------------------------------------------------- OPCODE PADDSW - Packed Add with Saturation Words CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PADDSW dest,src Description: dest[15..0] <- SaturateToSignedWord(dest[15..0] + src[15..0]) dest[31..16] <- SaturateToSignedWord(dest[31..16] + src[31..16]) dest[47..32] <- SaturateToSignedWord(dest[47..32] + src[47..32]) dest[63..48] <- SaturateToSignedWord(dest[63..48] + src[63..48]) Note: This instruction adds the signed words of the source to the words of the destination and writes the results to the MMX register. If the result is larger or smaller than the range of a signed word, the value is saturated (in the case of a overflow - to 7FFFH, and in the case of an underflow - to 8000H). Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PADDSW mm,mm/m64 0FH EDH PostByte P55C: n/a future P6: n/a --------------------------------------------------- OPCODE PADDUSB - Packed Add Unsigned with Saturation Bytes CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PADDUSB dest,src Description: dest[7..0] <- SaturateToUnsignedByte(dest[7..0] + src[7..0]) dest[15..8] <- SaturateToUnsignedByte(dest[15..8] + src[15..8]) dest[23..16] <- SaturateToUnsignedByte(dest[23..16] + src[23..16]) dest[31..24] <- SaturateToUnsignedByte(dest[31..24] + src[31..24]) dest[39..32] <- SaturateToUnsignedByte(dest[39..32] + src[39..32]) dest[47..40] <- SaturateToUnsignedByte(dest[47..40] + src[47..40]) dest[55..48] <- SaturateToUnsignedByte(dest[55..48] + src[55..48]) dest[63..56] <- SaturateToUnsignedByte(dest[63..56] + src[63..56]) Note: This instruction adds the unsigned bytes of the source to the unsigned bytes of the destination operand and writes the results to the MMX register. When the result is larger than the range of an unsigned byte (overflow), the value is saturated to FFH. When the result is smaller than the range of an unsigned byte (underflow), the value is saturated to 00H. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PADDUSB mm,mm/m64 0FH DCH PostByte P55C: n/a future P6: n/a --------------------------------------------------- OPCODE PADDUSW - Packed Add Unsigned with Saturation Words CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PADDUSW dest,src Description: dest[15..0] <- SaturateToUnsignedWord(dest[15..0] + src[15..0]) dest[31..16] <- SaturateToUnsignedWord(dest[31..16] + src[31..16]) dest[47..32] <- SaturateToUnsignedWord(dest[47..32] + src[47..32]) dest[63..48] <- SaturateToUnsignedWord(dest[63..48] + src[63..48]) Note: This instruction adds the unsigned words of the source to the unsigned words of the destination operand and writes the results to the MMX register. When the result is larger than the range of an unsigned word (overflow), the value is saturated to FFFFH. When the result is smaller than the range of an unsigned byte (underflow), the value is saturated to 0000H. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PADDUSW mm,mm/m64 0FH DDH PostByte P55C: n/a future P6: n/a --------------------------------------------------- OPCODE PADDW - Packed Add Words CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PADDW dest,src Description: dest[15..0] <- dest[15..0] + src[15..0] dest[31..16] <- dest[31..16] + src[31..16] dest[47..32] <- dest[47..32] + src[47..32] dest[63..48] <- dest[63..48] + src[63..48] Note: This instruction adds the words of the source to the words of the destination and writes the results to the MMX register. When the result is too large to be represented in a packed word (overflow), the result wraps around and the lower 16 bits are writen to the destination register. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PADDW mm,mm/m64 0FH FDH PostByte P55C: n/a future P6: n/a --------------------------------------------------- OPCODE PAND - Bitwise Logical And CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PAND dest,src Description: dest <- dest AND src Note: AND 64 bits from MMXregister/memory to MMX register. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PAND mm,mm/m64 0FH DBH PostByte P55C: n/a future P6: n/a --------------------------------------------------- OPCODE PANDN - Bitwise Logical And Not CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PANDN dest,src Description: dest <- (NOT dest) AND src Note: Invert the 64 bits in MMX register, AND inverted MMX register with MMXregister/memory. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PANDN mm,mm/m64 0FH DFH PostByte P55C: n/a future P6: n/a ----------------------------------------------- OPCODE PAVEB - Packed Average CPU: Cyrix with Extended MMX Instruction Set Type of Instruction: User Instruction: PAVEB dest, src Description: dest[7..0] <- (dest[7..0] + src[7..0]) >> 1 dest[15..8] <- (dest[15..8] + src[15..8]) >> 1 dest[23..16] <- (dest[23..16] + src[23..16]) >> 1 dest[31..24] <- (dest[31..24] + src[31..24]) >> 1 dest[39..32] <- (dest[39..32] + src[39..32]) >> 1 dest[47..40] <- (dest[47..40] + src[47..40]) >> 1 dest[55..48] <- (dest[55..48] + src[55..48]) >> 1 dest[63..56] <- (dest[63..56] + src[63..56]) >> 1 Notes: The PAVEB insruction calculates the average of the unsigned bytes of the source operand and the unsigned bytes of the destination operand and writes the result to the MMX register. The PAVEB instruction cannot overflow. M2 hardware versions before v1.3 interpret values as signed bytes on this instruction. Flags Affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operands EA in CS,DS,ES,FS,GS #SS(0) If Illegal memory operands EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++ COP & Times: PAVEB mm,mm/m64 0FH 50H PostByte ----------------------------------------------------------------- PAVGB - Packed Average Byte CPU: Pentium III+ (KNI/MMX2), AMD Athlon (AMD EMMX) Type of instruction: User Instruction: PAVGB dest,src Description: define AVERAGE(bits) // This is Unsigned operation :)) dest[bits] <- (size(8bits,(src[bits] + dest[bits])) + 1) >> 1; enddef AVERAGE(7..0); AVERAGE(15..8); AVERAGE(23..16); AVERAGE(31..24); AVERAGE(39..32); AVERAGE(47..40); AVERAGE(55..48); AVERAGE(63..56); Physical Form and Timing: PAVGB mm1,mm2/m64 ---- 0F E0 /r ---- ?? ----------------------------------------------- OPCODE PAVGUSB - Avarage of Unsigned packed 8-bit Values CPU: AMD-3D Type of Instruction: User Instruction: PAVGUSB dest,src Description: dest[7..0] <- (dest[7..0] + src[7..0]) / 2; dest[15..8] <- (dest[15..8] + src[15..8]) / 2; dest[23..16] <- (dest[23..16] + src[23..16]) / 2; dest[31..24] <- (dest[31..24] + src[31..24]) / 2; dest[39..32] <- (dest[39..32] + src[39..32]) / 2; dest[47..40] <- (dest[47..40] + src[47..40]) / 2; dest[55..48] <- (dest[55..48] + src[55..48]) / 2; dest[63..56] <- (dest[63..56] + src[63..56]) / 2; Note: so, saturation rounding: (FFH + FFH) / 2 => FFh Flags Affected: None ++++++++++++++++++++++++++++++++++ COP & Times: PAVGUSB mm,mm/m64 0FH 0FH BFH Postbyte ----------------------------------------------------------------- PAVGW - Packed Average Word CPU: Pentium III+ (KNI/MMX2), AMD Athlon (AMD EMMX) Type of instruction: User Instruction: PAVGW dest,src Description: define AVERAGE(bits) // This is Unsigned operation dest[bits] <- (size(16bits,(src[bits] + dest[bits])) + 1) >> 1; enddef AVERAGE(15..0); AVERAGE(31..16); AVERAGE(47..32); AVERAGE(63..48); Physical Form and Timing: PAVGW mm1,mm2/m64 ---- 0F E3 /r ---- ?? --------------------------------------------------- OPCODE PCMPEQB - Packed Compare for Equal Bytes CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PCMPEQB dest,src Description: IF dest[7..0] = src[7..0] THEN dest[7..0] <- FFH ELSE dest[7..0] <- 00H IF dest[15..8] = src[15..8] THEN dest[15..8] <- FFH ELSE dest[15..8] <- 00H IF dest[23..16] = src[23..16] THEN dest[23..16] <- FFH ELSE dest[23..16] <- 00H IF dest[31..24] = src[31..24] THEN dest[31..24] <- FFH ELSE dest[31..24] <- 00H IF dest[39..32] = src[39..32] THEN dest[39..32] <- FFH ELSE dest[39..32] <- 00H IF dest[47..40] = src[47..40] THEN dest[47..40] <- FFH ELSE dest[47..40] <- 00H IF dest[55..48] = src[55..48] THEN dest[55..48] <- FFH ELSE dest[55..48] <- 00H IF dest[63..56] = src[63..56] THEN dest[63..56] <- FFH ELSE dest[63..56] <- 00H Note: Compare packed byte in MMXregister/memory with packed byte in MMX register for equality. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PCMPEQB mm,mm/m64 0FH 74H PostByte P55C: n/a future P6: n/a --------------------------------------------------- OPCODE PCMPEQD - Packed Compare for Equal Dwords CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PCMPEQD dest,src Description: IF dest[31..0] = src[31..0] THEN dest[31..0] <- FFFFFFFFH ELSE dest[31..0] <- 00000000H IF dest[63..32] = src[63..32] THEN dest[63..32] <- FFFFFFFFH ELSE dest[63..32] <- 00000000H Note: Compare packed dword in MMXregister/memory with packed dword in MMX register for equality. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PCMPEQW mm,mm/m64 07H 76H PostByte P55C: n/a future P6: n/a --------------------------------------------------- OPCODE PCMPEQW - Packed Compare for Equal Words CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PCMPEQW dest,src Description: IF dest[15..0] = src[15..0] THEN dest[15..0] <- FFFFH ELSE dest[15..0] <- 0000H IF dest[31..16] = src[31..16] THEN dest[31..16] <- FFFFH ELSE dest[31..16] <- 0000H IF dest[47..32] = src[47..32] THEN dest[47..32] <- FFFFH ELSE dest[47..32] <- 0000H IF dest[63..48] = src[63..48] THEN dest[63..48] <- FFFFH ELSE dest[63..48] <- 0000H Note: Compare packed word in MMXregister/memory with packed word in MMX register for equality. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PCMPEQW mm,mm/m64 07H 75H PostByte P55C: n/a future P6: n/a --------------------------------------------------- OPCODE PCMPGTB - Packed Compare for Greater Than Bytes CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PCMPGTB dest,src Description: IF dest[7..0] > src[7..0] THEN dest[7..0] <- FFH ELSE dest[7..0] <- 00H IF dest[15..8] > src[15..8] THEN dest[15..8] <- FFH ELSE dest[15..8] <- 00H IF dest[23..16] > src[23..16] THEN dest[23..16] <- FFH ELSE dest[23..16] <- 00H IF dest[31..24] > src[31..24] THEN dest[31..24] <- FFH ELSE dest[31..24] <- 00H IF dest[39..32] > src[39..32] THEN dest[39..32] <- FFH ELSE dest[39..32] <- 00H IF dest[47..40] > src[47..40] THEN dest[47..40] <- FFH ELSE dest[47..40] <- 00H IF dest[55..48] > src[55..48] THEN dest[55..48] <- FFH ELSE dest[55..48] <- 00H IF dest[63..56] > src[63..56] THEN dest[63..56] <- FFH ELSE dest[63..56] <- 00H Note: Compare packed byte in MMX register with packed byte in MMXregister/ /memory for greater value. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PCMPGTB mm,mm/m64 0FH 64H PostByte P55C: n/a future P6: n/a --------------------------------------------------- OPCODE PCMPGTD - Packed Compare for Greater Than Dwords CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PCMPGTD dest,src Description: IF dest[31..0] > src[31..0] THEN dest[31..0] <- FFFFFFFFH ELSE dest[31..0] <- 00000000H IF dest[63..32] > src[63..32] THEN dest[63..32] <- FFFFFFFFH ELSE dest[63..32] <- 00000000H Note: Compare packed dword in MMX register with packed dword in MMXregister/ /memory for greater value. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PCMPGTW mm,mm/m64 0FH 66H PostByte P55C: n/a future P6: n/a --------------------------------------------------- OPCODE PCMPGTW - Packed Compare for Greater Than Words CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PCMPGTW dest,src Description: IF dest[15..0] > src[15..0] THEN dest[15..0] <- FFFFH ELSE dest[15..0] <- 0000H IF dest[31..16] > src[31..16] THEN dest[31..16] <- FFFFH ELSE dest[31..16] <- 0000H IF dest[47..32] > src[47..32] THEN dest[47..32] <- FFFFH ELSE dest[47..32] <- 0000H IF dest[63..48] > src[63..48] THEN dest[63..48] <- FFFFH ELSE dest[63..48] <- 0000H Note: Compare packed word in MMX register with packed word in MMXregister/ memory for greater value. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PCMPGTW mm,mm/m64 0FH 65H PostByte P55C: n/a future P6: n/a ----------------------------------------------- OPCODE PDISTIB - Packed Distance and Accumulate with Implied Register CPU: Cyrix with Extended MMX Instruction Set Type of Instruction: User Instruction: PDISTIB dest, src Description: dest[7..0] <- SaturateToUnsignedByte(dest[7..0] + abs(dest[7..0] - src[7..0])) dest[15..8] <- SaturateToUnsignedByte(dest[15..8] + abs(dest[15..8] - src[15..8])) dest[23..16] <- SaturateToUnsignedByte(dest[23..16] + abs(dest[23..16] - src[23..16])) dest[31..24] <- SaturateToUnsignedByte(dest[31..24] + abs(dest[31..24] - src[31..24])) dest[39..32] <- SaturateToUnsignedByte(dest[39..32] + abs(dest[39..32] - src[39..32])) dest[47..40] <- SaturateToUnsignedByte(dest[47..40] + abs(dest[47..40] - src[47..40])) dest[55..48] <- SaturateToUnsignedByte(dest[55..48] + abs(dest[55..48] - src[55..48])) dest[63..56] <- SaturateToUnsignedByte(dest[63..56] + abs(dest[63..56] - src[63..56])) Notes: The PDISTIB instruction calculates the distance between the unsigned bytes of two source operands, adds the result to the unsigned byte in the implied destination operand, and saturates the result. The result is written to the implied MMX register. The DEST must be an MMX register. The SRC must be a 64-bit memory operand. The accumulator and destination is an MMX register which depends on the DEST. Flags Affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operands EA in CS,DS,ES,FS,GS #SS(0) If Illegal memory operands EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++ COP & Times: PDISTIB mm,m64 0FH 54H PostByte ----------------------------------------------------------------- PEXTRW - Extract Word CPU: Pentium III+ (KNI/MMX2), AMD Athlon (AMD EMMX) Type of instruction: User Instruction: PEXTRW dest,src,which_word Description: word TMP = which_word AND 0x3; word MM_TMP = (src >> (TMP * 16)) AND 0xffff; dest[15..0] <- MM_TMP; dest[31..16] <- 0; Physical Form and Timing: PEXTRW r32,mm,imm8 ---- 0F C5 /r imm8 ---- ?? ----------------------------------------------- OPCODE PF2ID - Convert Packed F.P. to 32-bit Integer CPU: AMD-3D Type of Instruction: User Instruction: PF2ID dest,src Description: if (src[31..0] > 2^31) then dest[31..0] <- 7FFFFFFFh; if (src[31..0] <= -2^31) then dest[31..0] <- 80000000h; dest[31..0] <- truncate(src[31..0]); if (src[63..32] > 2^31) then dest[63..32] <- 7FFFFFFFh; if (src[63..32] <= -2^31) then dest[63..32] <- 80000000h; dest[63..32] <- truncate(src[63..32]); Flags Affected: None ++++++++++++++++++++++++++++++++++ COP & Times: PF2ID mm,mm/m64 0FH 0FH 1DH Postbyte ----------------------------------------------- OPCODE PF2IW - Packed FP to Integer Word conversion with sign extend CPU: 3DNow! extension (Athlon CPU) Type of Instruction: User Instruction: PF2IW dest,src Description: if (src[31:0] >= 2^15) dest[31:0] = 00007fffh; elseif (src[31:0] <= -2^15) dest[31:0] = ffff8000h; else dest[31:0] <- int(src[31:0]); if (src[63:32] >= 2^15) dest[63:32] = 00007fffh; elseif (src[63:32] <= -2^15) dest[63:32] = ffff8000h; else dest[63:32] <- int(src[63:32]); Note: Flags Affected: None ++++++++++++++++++++++++++++++++++ COP & Times: PF2IW mm,mm/m64 0F 0F 1C Postbyte ----------------------------------------------- OPCODE PFACC - F.P. Accumulate CPU: AMD-3D Type of Instruction: User Instruction: PFACC dest,src Description: dest[31..0] <- dest[31..0] + dest[63..32]; dest[63..32] <- src[31..0] + src [63..32]; Flags Affected: None ++++++++++++++++++++++++++++++++++ COP & Times: PFACC mm,mm/m64 0FH 0FH AEH Postbyte ----------------------------------------------- OPCODE PFADD - Packed F.P. Addition CPU: AMD-3D Type of Instruction: User Instruction: PFADD dest,src Description: dest[31..0] <- dest[31..0] + src[31..0]; dest[63..32] <- dest[63..32] + src[63..32]; Flags Affected: None ++++++++++++++++++++++++++++++++++ COP & Times: PFADD mm,mm/m64 0FH 0FH 9EH Postbyte ----------------------------------------------- OPCODE PFCMPEQ - Packed F.P. comparson, equal to CPU: AMD-3D Type of Instruction: User Instruction: PFCMPEQ dest,src Description: if dest[31..0] == src[31..0] then dest[31..0] <- FFFFFFFFh else dest[31..0] <- 00000000h if dest[63..32] == src[63..32] then dest[63..32] <- FFFFFFFFh else dest[63..32] <- 00000000h Flags Affected: None ++++++++++++++++++++++++++++++++++ COP & Times: PFCMPEQ mm,mm/m64 0FH 0FH B0H Postbyte ----------------------------------------------- OPCODE PFCMPGE - Packed F.P. comparison, greater or equal to CPU: AMD-3D Type of Instruction: User Instruction: PFCMPGE dest,src Description: if dest[31..0] >= src[31..0] then dest[31..0] <- FFFFFFFFh else dest[31..0] <- 00000000h if dest[63..32] >= src[63..32] then dest[63..32] <- FFFFFFFFh else dest[63..32] <- 00000000h Flags Affected: None ++++++++++++++++++++++++++++++++++ COP & Times: PFCMPGE mm,mm/m64 0FH 0FH 90H Postbyte ----------------------------------------------- OPCODE PFCMPGT - Packed F.P. compariason, greater to CPU: AMD-3D Type of Instruction: User Instruction: PFCMPGT dest,src Description: if dest[31..0] > src[31..0] then dest[31..0] <- FFFFFFFFh else dest[31..0] <- 00000000h if dest[63..32] > src[63..32] then dest[63..32] <- FFFFFFFFh else dest[63..32] <- 00000000h Flags Affected: None ++++++++++++++++++++++++++++++++++ COP & Times: PFCMPGT mm,mm/m64 0FH 0FH A0H Postbyte ----------------------------------------------- OPCODE PFMAX - Packed F.P. Maximum CPU: AMD-3D Type of Instruction: User Instruction: PFMAX dest,src Description: if src[31..0] > dest[31..0] then dest[31..0] <- src[31..0]; if src[63..32] > dest[63..32] then dest[63..32] <- src[63..32]; Note: Flags Affected: None ++++++++++++++++++++++++++++++++++ COP & Times: PFMAX mm,mm/m64 0FH 0FH A4H ----------------------------------------------- OPCODE PFMIN - Packed F.P. Minimum CPU: AMD-3D Type of Instruction: User Instruction: PFMIN dest,src Description: if src[31..0] < dest[31..0] then dest[31..0] <- src[31..0]; if src[63..32] < dest[63..32] then dest[63..32] <- src[63..32]; Note: Flags Affected: None ++++++++++++++++++++++++++++++++++ COP & Times: PFMIN mm,mm/m64 0FH 0FH 94H ----------------------------------------------- OPCODE PFMUL - Packed F.P. Multiplication CPU: AMD-3D Type of Instruction: User Instruction: PFMUL dest,src Description: dest[31..0] <- dest[31..0] * src[31..0]; dest[63..32] <- dest[63..32] * src[63..32]; Flags Affected: None ++++++++++++++++++++++++++++++++++ COP & Times: PFMUL mm,mm/m64 0FH 0FH B4H Postbyte ----------------------------------------------- OPCODE PFNACC - Packed Floating Point negative accumulate CPU: 3DNow! extension (Athlon CPU) Type of Instruction: User Instruction: PFNACC dest,src Description: dest[31:0] <- dest[31:0] - dest[63:32]; dest[63:32] <- src[31:0] - src[63:32] Note: Flags Affected: None ++++++++++++++++++++++++++++++++++ COP & Times: PFNACC mm,mm/m64 0F 0F 8A Postbyte ----------------------------------------------- OPCODE PFPNACC - Packed Floating Point Mixed Positive-Negative Accumulate CPU: 3DNow! extension (Athlon CPU) Type of Instruction: User Instruction: PFPNACC dest,src Description: dest[31:0] <- dest[31:0] - dest[63:32]; dest[63:32] <- src[31:0] + src[63:32]; Note: Flags Affected: None ++++++++++++++++++++++++++++++++++ COP & Times: PFPNACC mm,mm/m64 0F 0F 8E Postbyte ----------------------------------------------- OPCODE PFRCP - F.P. Reciprocal Approximation CPU: AMD-3D Type of Instruction: User Instruction: PFRCP dest,src Description: dest[31..0] <- Reciprocal(src[31..0]); dest[63..32] <- Reciprocal(src[63..32]); Note: Newton-Raphson algorithm: Division ---------- q = a/b; X(i+1) = X(i) * (2 - b * X(i)); X0 = RFRCP(b); X1 = RFRCPIT1(b,X0); X2 = RFRCPIT2(X1,X0); q = PFMUL(a,X2); Square Root -------------- X(i+1) = 1/2 * X(i) * (3 - b * X(i)^2); X0 = PFRSQRT(b); X1 = PFMUL(X0,X0); X2 = PFRSQIT(b,X1); X3 = PFRCPIT2(X2,X0); X4 = PFMUL(b,X3); Flags Affected: None ++++++++++++++++++++++++++++++++++ COP & Times: PFRCP mm,mm/m64 0FH 0FH 96H Postbyte ----------------------------------------------- OPCODE PFRCPIT1 - Packed F.P. Reciprocal, first iteration Step CPU: AMD-3D Type of Instruction: User Instruction: PFRCIT1 dest,src Description: dest[31..0] <- First_Step_Reciprocal(src[31..0]); dest[63..32] <- First_Step_Reciprocal(src[63..32]); Note: see PFRCP for more info. Flags Affected: None ++++++++++++++++++++++++++++++++++ COP & Times: PFRCIT1 mm,mm/m64 0FH 0FH A6H Postbyte ----------------------------------------------- OPCODE PFRCPIT2 - Packed F.P. Reciprocal, second iteration Step CPU: AMD-3D Type of Instruction: User Instruction: PFRCIT2 dest,src Description: dest[31..0] <- Second_Step_Reciprocal(src[31..0]); dest[63..32] <- Second_Step_Reciprocal(src[63..32]); Note: see PFRCP for more info. Flags Affected: None ++++++++++++++++++++++++++++++++++ COP & Times: PFRCIT2 mm,mm/m64 0FH 0FH B6H Postbyte ----------------------------------------------- OPCODE PFRSQIT1 - Packed F.P. Reciprocal Square Root, 1st iteration step CPU: AMD-3D Type of Instruction: User Instruction: PFRSQIT1 dest,src Description: dest[31..0] <- First_Step_Reciprocal_Square_Root(src[31..0]); dest[63..32] <- First_Step_Reciprocal_Square_Root(src[63..32]); Note: see RFRCP for more info Flags Affected: None ++++++++++++++++++++++++++++++++++ COP & Times: PFRSQIT1 mm,mm/m64 0FH 0FH A7H Postbyte ----------------------------------------------- OPCODE PFRSQRT - F.P. Reciprocal Square Root Approximation CPU: AMD-3D Type of Instruction: User Instruction: PFRSQRT dest,src Description: dest[31..0] <- Reciprocal_Square_Root(src[31..0]); dest[63..32] <- Reciprocal_Square_Root(src[63..32]); Note: see RFRCP for more info Flags Affected: None ++++++++++++++++++++++++++++++++++ COP & Times: PFRSQRT mm,mm/m64 0FH 0FH 97H Postbyte ----------------------------------------------- OPCODE PFSUB - Packed F.P. Subtraction CPU: AMD-3D Type of Instruction: User Instruction: PFSUB dest,src Description: dest[31..0] <- dest[31..0] - src[31..0]; dest[63..32] <- dest[63..32] - src[63..32]; Flags Affected: None ++++++++++++++++++++++++++++++++++ COP & Times: PFSUB mm,mm/m64 0FH 0FH 9AH Postbyte ----------------------------------------------- OPCODE PFSUBR - Packed F.P. Reverse Subtraction CPU: AMD-3D Type of Instruction: User Instruction: PFSUBR dest,src Description: dest[31..0] <- src[31..0] - dest[31..0]; dest[63..32] <- src[63..32] - dest[63..32]; Flags Affected: None ++++++++++++++++++++++++++++++++++ COP & Times: PFSUBR mm,mm/m64 0FH 0FH AAH Postbyte ----------------------------------------------- OPCODE PI2FD - Packed 32-bit Integer to F.P. conversion CPU: AMD-3D Type of Instruction: User Instruction: PI2FD dest,src Description: dest[31..0] <- float(src[31..0]); dest[63..32] <- float(src[63..32]); Flags Affected: None ++++++++++++++++++++++++++++++++++ COP & Times: PI2FD mm,mm/m64 0FH 0FH 0DH Postbyte ----------------------------------------------- OPCODE PI2FW - Packed 16-bit Integer to FP Conversion CPU: 3DNow! extension (Athlon CPU) Type of Instruction: User Instruction: PI2FW dest,src Description: dest[31:0] <- float(src[15:0]); dest[63:32] <- float(src[47:32]); Note: Flags Affected: None ++++++++++++++++++++++++++++++++++ COP & Times: PI2FW mm,mm/m64 0F 0F 0C Postbyte ----------------------------------------------------------------- PINSRW - Insert Word CPU: Pentium III+ (KNI/MMX2), AMD Athlon (AMD EMMX) Type of instruction: User Instruction: PINSRW dest,src,which_word Description: word TMP = which_word AND 0x3; switch (TMP) case 0: word MASK = 0x000000000000FFFF case 1: word MASK = 0x00000000FFFF0000 case 2: word MASK = 0x0000FFFF00000000 case 4: word MASK = 0xFFFF000000000000 endswitch dest <- (dest and NOT(MASK)) OR ((src << (TMP * 16)) AND MASK); Physical Form and Timing: PINSRW mm,r32/m16,imm8 ---- 0F C4 /r imm8 ---- ?? ----------------------------------------------- OPCODE PMACHRIW - Packed Multiply and Accumulate with Rounding CPU: Cyrix with Extended MMX Instruction Set Type of Instruction: User Instruction: PMACHRIW dest, src Description: dest[15..0] <- dest[15..0] + (dest[15..0]*src[15..0] + 00004000H)[30..15] dest[31..16] <- dest[31..16] + (dest[31..16]*src[31..16] + 00004000H)[30..15] dest[47..32] <- dest[47..32] + (dest[47..32]*src[47..32] + 00004000H)[30..15] dest[63..48] <- dest[63..48] + (dest[63..48]*src[63..48] + 00004000H)[30..15] Notes: The PMACHRIW multiplies the two source operands using the method described for PMULHRW, and then accumulates the result with the value in the implied destination register using wrap-around arithmetic. The final result is placed in the implied DEST register. The DEST must be an MMX register. The SRC must be a 64-bit memory operand. The destination operand is an implied MMX register that depends on the DEST. Flags Affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operands EA in CS,DS,ES,FS,GS #SS(0) If Illegal memory operands EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++ COP & Times: PMACHRIW mm,m64 0FH 5EH PostByte --------------------------------------------------- OPCODE PMADDWD - Packed Multiply and Add Dwords CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PMADDWD dest,src Description: dest[31..0] <- dest[15..0] * src[15..0] + dest[31..16] * src[31..16] dest[63..32] <- dest[47..32] * src[47..32] + dest[63..48] * src[63..48] Note: Multiply the packed word in MMX register by the packed word in MMXregister/memory. Add the 32-bit results pairwise and store in MMX register as dword. This instruction wraps around to 80000000H only when all four words of both the source and destination operands are 8000H. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PMADDWD mm,mm/m64 0FH F5H PostByte P55C: n/a future P6: n/a ----------------------------------------------- OPCODE PMAGW - Packed Magnitude CPU: Cyrix with Extended MMX Instruction Set Type of Instruction: User Instruction: PMAGW dest, src Description: IF abs(src[15..0]) > abs(dest[15..0]) THEN dest[15..] <-src[15..0] IF abs(src[31..16]) > abs(dest[31..16]) THEN dest[31..16]<-src[31..16] IF abs(src[47..32]) > abs(dest[47..32]) THEN dest[47..32]<-src[47..32] IF abs(src[63..56]) > abs(dest[63..56]) THEN dest[63..56]<-src[63..56] Notes: The PMAGW instruction compares the absolute value of the packed words in the destination operand and sets the destination words to the value that has the larger magnitude. The PMAGW instruction does not change the sign of the value with the larger magnitude and it does not saturate. The DEST must be an MMX register. The SRC can be either an MMX register or a 64-bit memory operand. Flags Affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operands EA in CS,DS,ES,FS,GS #SS(0) If Illegal memory operands EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++ COP & Times: PMAGW mm,mm/m64 0FH 52H PostByte ----------------------------------------------------------------- PMAXSW - Packed Signed Integer Word Maximum CPU: Pentium III+ (KNI/MMX2), AMD Athlon (AMD EMMX) Type of instruction: User Instruction: PMAXSW dest,src Description: if (dest[] < src[]) then dest[] <- src[]; // Signed Integer <0> = 0..15 <2> = 47..32 <1> = 31..16 <3> = 63..48 Physical Form and Timing: PMAXSW mm1,mm2/m64 ---- 0F EE /r ---- ?? ----------------------------------------------------------------- PMAXUB - Packed Unsigned Integer Byte Maximum CPU: Pentium III+ (KNI/MMX2), AMD Athlon (AMD EMMX) Type of instruction: User Instruction: PMAXUB dest,src Description: for i=0 to 7 do if (dest[] < src[]) then dest[] <- src[]; // Unsigned int endfor <0> = 0..7 <4> = 39..32 <1> = 15..8 <5> = 47..40 <2> = 23..16 <6> = 55..48 <3> = 31..24 <7> = 63..56 Physical Form and Timing: PMAXUB mm1,mm2/m64 ---- 0F DE /r ---- ?? ----------------------------------------------------------------- PMINSW - Packed Signed Integer Word Minimum CPU: Pentium III+ (KNI/MMX2), AMD Athlon (AMD EMMX) Type of instruction: User Instruction: PMINSW dest,src Description: if (dest[] > src[]) then dest[] <- src[]; // Signed Integer <0> = 0..15 <2> = 47..32 <1> = 31..16 <3> = 63..48 Physical Form and Timing: PMINSW mm1,mm2/m64 ---- 0F EA /r ---- ?? ----------------------------------------------------------------- PMINUB - Packed Unsigned Integer Byte Minimum CPU: Pentium III+ (KNI/MMX2), AMD Athlon (AMD EMMX) Type of instruction: User Instruction: PMINUB dest,src Description: for i=0 to 7 do if (dest[] > src[]) then dest[] <- src[]; // Unsigned int endfor <0> = 0..7 <4> = 39..32 <1> = 15..8 <5> = 47..40 <2> = 23..16 <6> = 55..48 <3> = 31..24 <7> = 63..56 Physical Form and Timing: PMIN UB mm1,mm2/m64 ---- 0F DA /r ---- ?? ----------------------------------------------------------------- PMOVMSKB - Move Byte Mask to Integer CPU: Pentium III+ (KNI/MMX2), AMD Athlon (AMD EMMX) Type of instruction: User Instruction: PMOVMSKB dest,src Description: dest[31..8] <- 0; dest[7] <- src[63]; dest[6] <- src[55]; dest[5] <- src[47]; dest[4] <- src[39]; dest[3] <- src[31]; dest[2] <- src[23]; dest[1] <- src[15]; dest[0] <- src[7]; Physical Form and Timing: PMOVMSKB r32,mm ---- 0F D7 /r ---- ? ----------------------------------------------- OPCODE PMULHRIW - Packed Multiply High with Rounding, result to Implied Register CPU: Cyrix with Extended MMX Instruction Set Type of Instruction: User Instruction: PMULHRIW dest, src Description: mmi[15..0] <- (dest[15..0]*src[15..0] + 00004000H)[30..15] mmi[31..16] <- (dest[31..16]*src[31..16] + 00004000H)[30..15] mmi[47..32] <- (dest[47..32]*src[47..32] + 00004000H)[30..15] mmi[63..48] <- (dest[63..48]*src[63..48] + 00004000H)[30..15] Notes: The PMULHRIW instruction are intended to give a result of the form a 16x16 bit multiply with the LSB rounded before truncating to 16 bits. The SRC can be either an MMX register or a 64-bit memory operand. The destination is an MMX register, depending on the SRC. The intent of the PMULHRIW instruction is the same as the PMULHRW instrucction except that both sources are preserved Flags Affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operands EA in CS,DS,ES,FS,GS #SS(0) If Illegal memory operands EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++ COP & Times: PMULHRIW mm,mm/m64 0FH 5DH PostByte ----------------------------------------------- OPCODE PMULHRW - Packed Multiply High with Rounding CPU: Cyrix with Extended MMX Instruction Set Type of Instruction: User Instruction: PMULHRW dest, src Description: dest[15..0] <- (dest[15..0]*src[15..0] + 00004000H)[30..15] dest[31..16] <- (dest[31..16]*src[31..16] + 00004000H)[30..15] dest[47..32] <- (dest[47..32]*src[47..32] + 00004000H)[30..15] dest[63..48] <- (dest[63..48]*src[63..48] + 00004000H)[30..15] Notes: The PMULHRW instruction are intended to give a result of the form a 16x16 bit multiply with the LSB rounded before truncating to 16 bits. This is in contrast to the PMULHW instruction which gives a resultof the form ss.14 with no rounding. as the PADDSW instruction, except that it preserves both source operands. The SRC can be either an MMX register or a 64-bit memory operand. The destination is an MMX register. Flags Affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operands EA in CS,DS,ES,FS,GS #SS(0) If Illegal memory operands EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++ COP & Times: PMULHRW mm,mm/m64 0FH 59H PostByte ----------------------------------------------- OPCODE PMULHRW - Multiply Signed Packed 16-bits with rounding and store to 16bit CPU: AMD-3D Type of Instruction: User Instruction: PMULHRW dest,src Description: dest[15..0] <- dest[15..0] * src[15..0]; dest[31..16] <- dest[31..16] * src[31..16]; dest[47..32] <- dest[47..32] * src[47..32]; dest[63..48] <- dest[63..48] * src[63..48]; Note: Saturation arithmetic. This is not F.P. instruction Flags Affected: None ++++++++++++++++++++++++++++++++++ COP & Times: PMULHRW mm,mm/m64 0FH 0FH B7H Postvyte ----------------------------------------------------------------- PMULHUW - Packed Multiply high unsignde word CPU: Pentium III+ (KNI/MMX2), AMD Athlon (AMD EMMX) Type of instruction: User Instruction: PMULHUW dest,src Description: temp1 <- dest[15:0] * src[15:0]; temp2 <- dest[31:16] * src[31:16]; temp3 <- dest[47:32] * src[47:32]; temp4 <- dest[63:48] * src[63:48]; dest[15:0] <- temp1[31:16]; dest[31:16] <- temp2[31:16]; dest[47:32] <- temp3[31:16]; dest[63:48] <- temp4[31:16]; Physical Form and Timing: PMULHUW mm,mm/m64 0Fh E4h Postbyte --------------------------------------------------- OPCODE PMULHW - Packed Multiply High by Words CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PMULHW dest,src Description: dest[15..0] <- (dest[15..0] * src[15..0]) (31..16) dest[31..16] <- (dest[31..16] * src[31..16]) (31..16) dest[47..32] <- (dest[47..32] * src[47..32]) (31..16) dest[63..48] <- (dest[63..48] * src[63..48]) (31..16) Note: Multiply the signed packed word in MMX register with the signed packed word in MMXregister/memory, then store the high-order 16 bits of the results in MMX register. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PMULHW mm,mm/m64 0FH E5H PostByte P55C: n/a future P6: n/a --------------------------------------------------- OPCODE PMULLW - Packed Multiply Low by Words CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PMULLW dest,src Description: dest[15..0] <- (dest[15..0] * src[15..0]) (15..0) dest[31..16] <- (dest[31..16] * src[31..16]) (15..0) dest[47..32] <- (dest[47..32] * src[47..32]) (15..0) dest[63..48] <- (dest[63..48] * src[63..48]) (15..0) Note: Multiply the packed word in MMX register with the packed word in MMXregister/memory, then store the low-order 16 bits of the results in MMX register. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PMULLW mm,mm/m64 0FH D5H PostByte P55C: n/a future P6: n/a ----------------------------------------------- OPCODE PMVGEZB - Packed Conditional Move CPU: Cyrix with Extended MMX Instruction Set Type of Instruction: User Instruction: PMVGEZB dest, src Description: if mmi[7..0] >= 0 then dest[7..0] <- src[7..0]; if mmi[15..8] >= 0 then dest[15..8] <- src[15..8]; if mmi[23..16] >= 0 then dest[23..16] <- src[23..16]; if mmi[31..24] >= 0 then dest[31..24] <- src[31..24]; if mmi[39..32] >= 0 then dest[39..32] <- src[39..32]; if mmi[47..40] >= 0 then dest[47..40] <- src[47..40]; if mmi[55..48] >= 0 then dest[55..48] <- src[55..48]; if mmi[63..56] >= 0 then dest[63..56] <- src[63..56]; Note: mmi is implied MMX register. Flags Affected: None ++++++++++++++++++++++++++++++++++ COP & Times: PMVGEZB mm,mm/m64 0FH 5CH PostByte ----------------------------------------------- OPCODE PMVLZB - Packed Conditional Move CPU: Cyrix with Extended MMX Instruction Set Type of Instruction: User Instruction: PMVLZB dest, src Description: if mmi[7..0] < 0 then dest[7..0] <- src[7..0]; if mmi[15..8] < 0 then dest[15..8] <- src[15..8]; if mmi[23..16] < 0 then dest[23..16] <- src[23..16]; if mmi[31..24] < 0 then dest[31..24] <- src[31..24]; if mmi[39..32] < 0 then dest[39..32] <- src[39..32]; if mmi[47..40] < 0 then dest[47..40] <- src[47..40]; if mmi[55..48] < 0 then dest[55..48] <- src[55..48]; if mmi[63..56] < 0 then dest[63..56] <- src[63..56]; Note: mmi is implied MMX register. Flags Affected: None ++++++++++++++++++++++++++++++++++ COP & Times: PMVLZB mm,mm/m64 0FH 5BH PostByte ----------------------------------------------- OPCODE PMVNZB - Packed Conditional Move CPU: Cyrix with Extended MMX Instruction Set Type of Instruction: User Instruction: PMVNZB dest, src Description: if mmi[7..0] <> 0 then dest[7..0] <- src[7..0]; if mmi[15..8] <> 0 then dest[15..8] <- src[15..8]; if mmi[23..16] <> 0 then dest[23..16] <- src[23..16]; if mmi[31..24] <> 0 then dest[31..24] <- src[31..24]; if mmi[39..32] <> 0 then dest[39..32] <- src[39..32]; if mmi[47..40] <> 0 then dest[47..40] <- src[47..40]; if mmi[55..48] <> 0 then dest[55..48] <- src[55..48]; if mmi[63..56] <> 0 then dest[63..56] <- src[63..56]; Note: mmi is implied MMX register. Flags Affected: None ++++++++++++++++++++++++++++++++++ COP & Times: PMVNZB mm,mm/m64 0FH 5AH PostByte ----------------------------------------------- OPCODE PMVZB - Packed Conditional Move CPU: Cyrix with Extended MMX Instruction Set Type of Instruction: User Instruction: PMVZB dest, src Description: if mmi[7..0] == 0 then dest[7..0] <- src[7..0]; if mmi[15..8] == 0 then dest[15..8] <- src[15..8]; if mmi[23..16] == 0 then dest[23..16] <- src[23..16]; if mmi[31..24] == 0 then dest[31..24] <- src[31..24]; if mmi[39..32] == 0 then dest[39..32] <- src[39..32]; if mmi[47..40] == 0 then dest[47..40] <- src[47..40]; if mmi[55..48] == 0 then dest[55..48] <- src[55..48]; if mmi[63..56] == 0 then dest[63..56] <- src[63..56]; Note: mmi is implied MMX register. Flags Affected: None ++++++++++++++++++++++++++++++++++ COP & Times: PMVZB mm,mm/m64 0FH 58H PostByte --------------------------------------------------- OPCODE POR - Bitwise Logical Or CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: POR dest,src Description: dest <- dest OR src Note: OR 64 bits from MMXregister/memory with MMX register. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: POR mm,mm/m64 0FH EBH PostByte P55C: n/a future P6: n/a ----------------------------------------------------------------- PREFETCHxx - Prefetch CPU: Pentium III+ (KNI/MMX2), AMD Athlon (AMD EMMX) Type of instruction: User Instruction: PREFETCHxx src Description: Prefetch src memory into cache. PREFETCH0 src - Temporal Data Prefetch into all caches levels PREFETCH1 src - Prefetch to all caches, except L1 PREFETCH2 src - Prefetch to all caches, except L1 and L2 PREFETCHNTA src - Non Temporal with respect to all cache levels - prefetch to non-temporal cache structure Physical Form and Timing: PREFETCHNTA mem ---- 0F 18 /0 ---- ? PREFETCH0 mem ---- 0F 18 /1 ---- ? PREFETCH1 mem ---- 0F 18 /2 ---- ? PREFETCH2 mem ---- 0F 18 /3 ---- ? ----------------------------------------------- OPCODE PREFETCH - Prefetch CPU cache line into L1 data cache CPU: AMD-3D Type of Instruction: User Instruction: PREFETCH mem Description: PRELOAD_L1_DATA_CACHE_LINE(mem); SET_LINE_STATE_TO_EXCLUSIVE; (MESI) Note: If cache hit, then do nothing. mem - is address of any cache-line byte. Flags Affected: None ++++++++++++++++++++++++++++++++++ COP & Times: PREFETCH mem8 0FH 0DH mm000xxx ----------------------------------------------- OPCODE PREFETCHW - Prefetch CPU cache line into L1 data cache CPU: AMD-3D Type of Instruction: User Instruction: PREFETCHW mem Description: PRELOAD_L1_DATA_CACHE_LINE(mem); SET_LINE_STATE_TO_MODIFIED; (MESI) Note: If cache hit, then do nothing. mem - is address of any cache-line byte. Flags Affected: None ++++++++++++++++++++++++++++++++++ COP & Times: PREFETCHW mem8 0FH 0DH mm001xxx ----------------------------------------------------------------- PSADBW - Packed Sum of Absolute Differenses CPU: Pentium III+ (KNI/MMX2), AMD Athlon (AMD EMMX) Type of instruction: User Instruction: PSADBW dest,src Description: SUM = 0; for i = 1 to 7 do SUM[15..0] = SUM[15..0] + ABS(dest[] - src[]); endfor dest[15..0] <- SUM[15..0]; dest[63..16] <- 0; <0> = 0..7 <4> = 39..32 <1> = 15..8 <5> = 47..40 <2> = 23..16 <6> = 55..48 <3> = 31..24 <7> = 63..56 Physical Form and Timing: PSADBW mm1,mm2/m64 ---- 0F F6 /r ---- ? ----------------------------------------------------------------- PSHUFW - Packed Shuffle Word CPU: Pentium III+ (KNI/MMX2), AMD Athlon (AMD EMMX) Type of instruction: User Instruction: PSHUFW dest,src,sc Description: Changed order of words to another: dest[15..0] <- (src >> (sc[1..0] * 16)) [15..0]; dest[31..16] <- (src >> (sc[3..2] * 16)) [15..0]; dest[47..32] <- (src >> (sc[5..4] * 16)) [15..0]; dest[63..48] <- (src >> (sc[7..6] * 16)) [15..0]; Physical Form and Timing: PSHUFW mm1,mm2/m64,imm8 ---- 0F 70 /r imm8 ---- ? --------------------------------------------------- OPCODE PSLLD - Packed Shift Left Logical Dwords CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PSLLD dest,src Description: temp <- src dest[31..0] <- dest[31..0] << temp dest[63..32] <- dest[63..32] << temp Note: Shift dwords in MMX register left by Imm8 or amount specified in MMX register/memory, while shifting in zeros. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PSLLD mm,mm/m64 0FH F2H PostByte PSLLD mm,Imm8 0FH 72H/6 PostByte ImmData P55C: n/a future P6: n/a --------------------------------------------------- OPCODE PSLLQ - Packed Shift Left Logical Qwords CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PSLLQ dest,src Description: temp <- src dest <- dest << temp Note: Shift MMX register left by Imm8 or amount specified in MMXregister/ /memory, while shifting in zeros. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PSLLQ mm,mm/m64 0FH F3H PostByte PSLLQ mm,Imm8 0FH 73H/6 PostByte ImmData P55C: n/a future P6: n/a --------------------------------------------------- OPCODE PSLLW - Packed Shift Left Logical Words CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PSLLW dest,src Description: temp <- src dest[15..0] <- dest[15..0] << temp dest[31..16] <- dest[31..16] << temp dest[47..32] <- dest[47..32] << temp dest[63..48] <- dest[63..48] << temp Note: Shift words in MMX register left by Imm8 or amount specified in MMX register/memory, while shifting in zeros. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PSLLW mm,mm/m64 0FH F1H PostByte PSLLW mm,Imm8 0FH 71H/6 PostByte ImmData P55C: n/a future P6: n/a --------------------------------------------------- OPCODE PSRAD - Packed Shift Right Arithmetic Dwords CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PSRAD dest,src Description: temp <- src dest[31..0] <- SignExtend(dest[31..0]) >> temp dest[63..32] <- SignExtend(dest[63..32]) >> temp Note: Shift dwords in MMX register right by Imm8 or amount specified in MMX register/memory, while shifting in sign bits. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PSRAD mm,mm/m64 0FH E2H PostByte PSRAD mm,Imm8 0FH 72H/4 PostByte ImmData P55C: n/a future P6: n/a --------------------------------------------------- OPCODE PSRAW - Packed Shift Right Arithmetic Words CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PSRAW dest,src Description: temp <- src dest[15..0] <- SignExtend(dest[15..0]) >> temp dest[31..16] <- SignExtend(dest[31..16]) >> temp dest[47..32] <- SignExtend(dest[47..32]) >> temp dest[63..48] <- SignExtend(dest[63..48]) >> temp Note: Shift words in MMX register right by Imm8 or amount specified in MMX register/memory, while shifting in sign bits. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PSRAW mm,mm/m64 0FH E1H PostByte PSRAW mm,Imm8 0FH 71H/4 PostByte ImmData P55C: n/a future P6: n/a --------------------------------------------------- OPCODE PSRLD - Packed Shift Right Logical Dwords CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PSRLD dest,src Description: temp <- src dest[31..0] <- dest[31..0] >> temp dest[63..32] <- dest[63..32] >> temp Note: Shift dwords in MMX register right by Imm8 or amount specified in MMX register/memory, while shifting in zeros. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PSRLD mm,mm/m64 0FH D2H PostByte PSRLD mm,Imm8 0FH 72H/2 PostByte ImmData P55C: n/a future P6: n/a --------------------------------------------------- OPCODE PSRLQ - Packed Shift Right Logical Qwords CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PSRLQ dest,src Description: temp <- src dest <- dest >> temp Note: Shift MMX register right by Imm8 or amount specified in MMXregister/ /memory, while shifting in zeros. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PSRLQ mm,mm/m64 0FH D3H PostByte PSRLQ mm,Imm8 0FH 73H/2 PostByte ImmData P55C: n/a future P6: n/a --------------------------------------------------- OPCODE PSRLW - Packed Shift Right Logical Words CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PSRLW dest,src Description: temp <- src dest[15..0] <- dest[15..0] >> temp dest[31..16] <- dest[31..16] >> temp dest[47..32] <- dest[47..32] >> temp dest[63..48] <- dest[63..48] >> temp Note: Shift words in MMX register right by Imm8 or amount specified in MMX register/memory, while shifting in zeros. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PSRLW mm,mm/m64 0FH D1H PostByte PSRLW mm,Imm8 0FH 71H/2 PostByte ImmData P55C: n/a future P6: n/a --------------------------------------------------- OPCODE PSUBB - Packed Subtract Bytes CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PSUBB dest,src Description: dest[7..0] <- dest[7..0] - src[7..0] dest[15..8] <- dest[15..8] - src[15..8] dest[23..16] <- dest[23..16] - src[23..16] dest[31..24] <- dest[31..24] - src[31..24] dest[39..32] <- dest[39..32] - src[39..32] dest[47..40] <- dest[47..40] - src[47..40] dest[55..48] <- dest[55..48] - src[55..48] dest[63..56] <- dest[63..56] - src[63..56] Note: This instruction subtract packed byte in MMXregister/memory from packed byte in MMX register. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PSUBB mm,mm/m64 0FH F8H PostByte P55C: n/a future P6: n/a --------------------------------------------------- OPCODE PSUBD - Packed Subtract Dwords CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PSUBD dest,src Description: dest[31..0] <- dest[31..0] - src[31..0] dest[63..32] <- dest[63..48] - src[63..32] Note: This instruction subtract packed dword in MMXregister/memory from packed dword in MMX register. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PSUBD mm,mm/m64 0FH FAH PostByte P55C: n/a future P6: n/a --------------------------------------------------- OPCODE PSUBSB - Packed Subtract with Saturation Bytes CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PSUBSB dest,src Description: dest[7..0] <- SaturateToSignedByte(dest[7..0] - src[7..0]) dest[15..8] <- SaturateToSignedByte(dest[15..8] - src[15..8]) dest[23..16] <- SaturateToSignedByte(dest[23..16] - src[23..16]) dest[31..24] <- SaturateToSignedByte(dest[31..24] - src[31..24]) dest[39..32] <- SaturateToSignedByte(dest[39..32] - src[39..32]) dest[47..40] <- SaturateToSignedByte(dest[47..40] - src[47..40]) dest[55..48] <- SaturateToSignedByte(dest[55..48] - src[55..48]) dest[63..56] <- SaturateToSignedByte(dest[63..56] - src[63..56]) Note: This instruction subtract signed packed byte in MMXregister/memory from signed packed byte in MMX register and saturate. If the result is larger or smaller than the range of a signed byte, the value is saturated; in the case of an overflow - to 7FH, and the case of an underflow - to 80H Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PSUBSB mm,mm/m64 0FH E8H PostByte P55C: n/a future P6: n/a ----------------------------------------------- OPCODE PSUBSIW - Packed Subtract with Saturation, using Implied Destination CPU: Cyrix with Extended MMX Instruction Set Type of Instruction: User Instruction: PSUBSIW dest, src Description: mmi[15..0] <- SaturateToSignedWord(dest[15..0] - src[15..0]); mmi[31..16] <- SaturateToSignedWord(dest[31..16] - src[31..16]); mmi[47..32] <- SaturateToSignedWord(dest[47..32] - src[47..32]); mmi[63..48] <- SaturateToSignedWord(dest[63..48] - src[63..48]); Note: mmi is implied MMX register. Flags Affected: None ++++++++++++++++++++++++++++++++++ COP & Times: PSUBSIW mm,mm/m64 0FH 55H PostByte --------------------------------------------------- OPCODE PSUBSW - Packed Subtract with Saturation Words CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PSUBSW dest,src Description: dest[15..0] <- SaturateToSignedWord(dest[15..0] - src[15..0]) dest[31..16] <- SaturateToSignedWord(dest[31..16] - src[31..16]) dest[47..32] <- SaturateToSignedWord(dest[47..32] - src[47..32]) dest[63..48] <- SaturateToSignedWord(dest[63..48] - src[63..48]) Note: This instruction subtract signed packed word in MMXregister/memory from signed packed word in MMX register and saturate. If the result is larger or smaller than the range of a signed word, the value is saturated; in the case of an overflow - to 7FFFH, and the case of an underflow - to 8000H Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PSUBSW mm,mm/m64 0FH E9H PostByte P55C: n/a future P6: n/a --------------------------------------------------- OPCODE PSUBUSB - Packed Subtract Unsigned with Saturation Bytes CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PSUBUSB dest,src Description: dest[7..0] <- SaturateToUnsignedByte(dest[7..0] - src[7..0]) dest[15..8] <- SaturateToUnsignedByte(dest[15..8] - src[15..8]) dest[23..16] <- SaturateToUnsignedByte(dest[23..16] - src[23..16]) dest[31..24] <- SaturateToUnsignedByte(dest[31..24] - src[31..24]) dest[39..32] <- SaturateToUnsignedByte(dest[39..32] - src[39..32]) dest[47..40] <- SaturateToUnsignedByte(dest[47..40] - src[47..40]) dest[55..48] <- SaturateToUnsignedByte(dest[55..48] - src[55..48]) dest[63..56] <- SaturateToUnsignedByte(dest[63..56] - src[63..56]) Note: This instruction subtract unsigned packed byte in MMXregister/memory from unsigned packed byte in MMX register and saturate. If the result element is less than zero (a negative value), it is saturated to 00H Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PSUBUSB mm,mm/m64 0FH D8H PostByte P55C: n/a future P6: n/a --------------------------------------------------- OPCODE PSUBUSW - Packed Subtract Unsigned with Saturation Bytes CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PSUBUSW dest,src Description: dest[15..0] <- SaturateToUnsignedWord(dest[15..0] - src[15..0]) dest[31..16] <- SaturateToUnsignedWord(dest[31..16] - src[31..16]) dest[47..32] <- SaturateToUnsignedWord(dest[47..32] - src[47..32]) dest[63..48] <- SaturateToUnsignedWord(dest[63..48] - src[63..48]) Note: This instruction subtract unsigned packed word in MMXregister/memory from unsigned packed word in MMX register and saturate. If the result element is less than zero (a negative value), it is saturated to 0000H Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PSUBUSW mm,mm/m64 0FH D9H PostByte P55C: n/a future P6: n/a --------------------------------------------------- OPCODE PSUBW - Packed Subtract Words CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PSUBW dest,src Description: dest[15..0] <- dest[15..0] - src[15..0] dest[31..16] <- dest[31..16] - src[31..16] dest[47..32] <- dest[47..32] - src[47..32] dest[63..48] <- dest[63..48] - src[63..48] Note: This instruction subtract packed word in MMXregister/memory from packed word in MMX register. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PSUBW mm,mm/m64 0FH F9H PostByte P55C: n/a future P6: n/a ----------------------------------------------- OPCODE PSWAPD - Packed Swap Doubleword CPU: 3DNow! extension (Athlon CPU) Type of Instruction: User Instruction: PSWAPD dest, src Description: dest[63:32] <- src[31:0]; dest[31:0] <- src[63:32]; Note: Flags Affected: None ++++++++++++++++++++++++++++++++++ COP & Times: PSWAPD mm,mm/m64 0Fh 0Fh BBh Postbyte --------------------------------------------------- OPCODE PUNPCKHBW - Unpack High Bytes to Words CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PUNPCKHBW dest,src Description: dest[63..56] <- src[63..56] dest[55..48] <- dest[63..56] dest[47..40] <- src[55..48] dest[39..32] <- dest[55..48] dest[31..24] <- src[47..40] dest[23..16] <- dest[47..40] dest[15..8] <- src[39..32] dest[7..0] <- dest[39..32] Note: This instruction unpack and interleave the high-order data elements of the destination and source operands into the destination operand. The low-order data elements are ignored. When unpacking from a memory operand, the full 64-bit operand is accessed from memory. The instruction uses only the high-order 32 bits. If the source operand is all zeros, the result is a zero extension of the high-order elements of the destination operand. When using PUNPCKHBW instruction the bytes are zero extended, or unpacked into unsigned words. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PUNPCKHBW mm,mm/m64 0FH 68H PostByte P55C: n/a future P6: n/a --------------------------------------------------- OPCODE PUNPCKHDQ - Unpack High Dwords to Qwords CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PUNPCKHDQ dest,src Description: dest[63..32] <- src[63..32] dest[31..0] <- dest[63..32] Note: This instruction unpack and interleave the high-order data elements of the destination and source operands into the destination operand. The low-order data elements are ignored. When unpacking from a memory operand, the full 64-bit operand is accessed from memory. The instruction uses only the high-order 32 bits. If the source operand is all zeros, the result is a zero extension of the high-order elements of the destination operand. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PUNPCKHDQ mm,mm/m64 0FH 6AH PostByte P55C: n/a future P6: n/a --------------------------------------------------- OPCODE PUNPCKHWD - Unpack High Words to Dwords CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PUNPCKHWD dest,src Description: dest[63..56] <- src[63..48] dest[47..32] <- dest[63..48] dest[31..16] <- src[47..32] dest[15..0] <- dest[47..32] Note: This instruction unpack and interleave the high-order data elements of the destination and source operands into the destination operand. The low-order data elements are ignored. When unpacking from a memory operand, the full 64-bit operand is accessed from memory. The instruction uses only the high-order 32 bits. If the source operand is all zeros, the result is a zero extension of the high-order elements of the destination operand. When using PUNPCKHWD instruction the words are zero extended, or unpacked into unsigned doublewords. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PUNPCKHWD mm,mm/m64 0FH 69H PostByte P55C: n/a future P6: n/a --------------------------------------------------- OPCODE PUNPCKLBW - Unpack Low Bytes to Words CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PUNPCKLBW dest,src Description: dest[63..56] <- src[31..24] dest[55..48] <- dest[31..24] dest[47..40] <- src[23..16] dest[39..32] <- dest[23..16] dest[31..24] <- src[15..8] dest[23..16] <- dest[15..8] dest[15..8] <- src[7..0] dest[7..0] <- dest[7..0] Note: This instruction unpack and interleave the low-order data elements of the destination and source operands into the destination operand. The high-order data elements are ignored. When the source data comes from 64-bit registers, the upper 32 bits are ignored. When unpacking from a memory operand, only 32 bits are accessed. The instruction uses all 32 bits. If the source operand is all zeros, the result is a zero extension of the low-order elements of the destination operand. When using PUNPCKLBW instruction the bytes are zero extended, or unpacked into unsigned words. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PUNPCKLBW mm,mm/m32 0FH 60H PostByte P55C: n/a future P6: n/a --------------------------------------------------- OPCODE PUNPCKLDQ - Unpack Low Dwords to Qwords CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PUNPCKLDQ dest,src Description: dest[63..32] <- src[31..0] dest[31..0] <- dest[31..0] Note: This instruction unpack and interleave the low-order data elements of the destination and source operands into the destination operand. When the source data comes from 64-bit registers, the upper 32 bits are ignored. When unpacking from a memory operand, only 32 bits are accessed. The instruction uses all 32 bits. If the source operand is all zeros, the result is a zero extension of the low-order elements of the destination operand. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PUNPCKLDQ mm,mm/m32 0FH 62H PostByte P55C: n/a future P6: n/a --------------------------------------------------- OPCODE PUNPCKLWD - Unpack Low Words to Dwords CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PUNPCKLWD dest,src Description: dest[63..48] <- src[31..16] dest[47..32] <- dest[31..16] dest[31..16] <- src[15..0] dest[15..0] <- dest[15..0] Note: This instruction unpack and interleave the low-order data elements of the destination and source operands into the destination operand. When the source data comes from 64-bit registers, the upper 32 bits are ignored. When unpacking from a memory operand, only 32 bits are accessed. The instruction uses all 32 bits. If the source operand is all zeros, the result is a zero extension of the low-order elements of the destination operand. When using PUNPCKLWD instruction the words are zero extended, or unpacked into unsigned doublewords. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PUNPCKLWD mm,mm/m32 0FH 61H PostByte P55C: n/a future P6: n/a --------------------------------------------------- OPCODE PXOR - Bitwise Logical Exclusive OR CPU: all which supported IA MMX: Pentium (P55C only), Pentium (tm) Pro (P6) future models Type of Instruction: User Instruction: PXOR dest,src Description: dest <- dest XOR src Note: XOR 64 bits from MMXregister/memory to MMX register. Flags affected: None Exceptions: RM PM VM SMM Description #GP(0) If Illegal memory operand's EA in CS,DS,ES,FS,GS #SS(0) If illegal memory operand's EA in SS #PF(fcode) If page fault #AC #AC If unaligned memory reference then alignment check enabled and in ring 3. #UD #UD #UD #UD If CR0.EM = 1 #NM #NM #NM #NM If CR0.TS = 1 #MF #MF #MF #MF If pending FPU Exception #13 #13 If any part of the the operand lies outside of the EA space from 0 to FFFFH ++++++++++++++++++++++++++++++++++++++ COP & Times: PXOR mm,mm/m64 0FH EFH PostByte P55C: n/a future P6: n/a ----------------------------------------------------------------- RCPPS - Packed Single-FP Reciprocal CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: RCPPS dest,src Description: for i = 0 to 3 do dest[] = APPROX(1.0 / src[]); endfor <0> = 31..0 <2> = 95..64 <1> = 63..32 <3> = 127..96 Physical Form and Timing: RCPPS xmm1,xmm2/m128 ---- 0F 53 /r ---- 1 ----------------------------------------------------------------- RCPSS - Scalar Single-FP Reciprocal CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: RCPSS dest,src Description: dest[31..0] = APPROX(1.0 / src[31..0]); Physical Form and Timing: RCPSS xmm1,xmm2/m32 ---- F3 0F 53 /r ---- 1 --------------------------------------------------- OPCODE RDMSR - Read From Model Specified Register CPU: Pentium (tm), IBM 386SLC,486SLC,486SLC2 Type of Instruction: System Instruction: RDMSR Description: IF (ECX is valid number of MSR) and (CPL=0) THEN { EDX:EAX <- MSR [ECX]; } ELSE { General Protection Fault INT 0DH (0) } END Refer to Appendix W for more info. Flags Affected: None CPU mode: RM,PM0,SMM Physical Form: RDMSR COP (Code of Operation): 0FH 32H Clocks: Pentium : 20-24 --------------------------------------------------- OPCODE RDPMC - Read Perfomance Monitoring Counters CPU: Pentium (tm) Pro (P6) Type of Instruction: User Instruction: RDPMC Description: IF ((CPL<>0) AND (CR4.PCE==0)) THEN { INT D (0) ; GENERAL PROTECTION FAULT } ELSE { EDX:EAX <- PERFOMANCE_MONITORING_REGISTER[ECX] } Note: Valid ECX values is 0,1. Invalid ECX values call INT D(0) Note: CR4.PSE = bit 8 of CR4 Note: Perfomance Monitoring Registers (PMR) are aliases to some Perfomance Monitoring MSRs: MSR 12h is Counter #0 (Read/Write) (Perfomance Monitoring Counter # 0) bits Description 63..40 Reserved 39..0 Current counter value MSR 13h is Counter #1 (Read/Write) (Perfomance Monitoring Counter # 1) bits Description 63..40 Reserved 39..0 Current counter value ++++++++++++++++++++++++++++++++++++++ COP & Times: RDPMC 0FH 33H P6: n/a --------------------------------------------------- OPCODE RDSHR - Read SMM Header Pointer Register CPU: Cyrix Cx6x86MX Type of Instruction: SMM mode only Instruction: RDSHR dest Description: dest <- SMHR (SMM Header pointer Register) Note: Format of SMHR: Bits Description 31..2 SMM Header pointer address 1 Reserved 0 (Valid) if =1, then address valid Note: SMHR pointed to phisical address SMM space area, where will be saved non-SMM contex when entered SMM. Format of SMM Header (for Cx6x86MX): Address Size Description (Relative (bit) to SMH pointer) +00 32 DR7 -04h 32 EFLAGS -08h 32 CR0 -0Ch 32 current EIP -10h 32 next EIP -14h 16 CS selector -16h 16 Reserved -18h 64 CS descriptor -20h 16 Context all reserved , but 22..21 CPL -22h 16 Context all reserved, but 15 N (Nested SMI indicator) if = 1, current SMI serviced from SMM. 13 IS (Internal SMI indicator) if = 1, current SMI is result of internal SMI event. if = 0, current SMI result of external event 4 H (SMI during CPU HALT state indicator) if = 1, CPU was in halt or shutdown state, before SMI. 3 S (Software SMM entry indicator) if = 1, SMM is result of SMINT instruction 2 P (REP INSx/REP OUTSx indicator) if = 1, current instruction have REP pfix. 1 I (IN,INSx,OUT,OUTx indicator) if = 1, current instruction perform I/O read/write 0 C (Code segment writable indicator) if = 1, current code segment is writable, if = 0, ---//---- is not writable. -24h 16 I/O Data Size -26h 16 I/O Write Address -28h 32 I/O Write Data -2Ch 32 ESI or EDI total size of SMM header = 30h Flags Affected: None CPU mode: SMM ++++++++++++++++ Physical Form: RDSHR reg/mem32 COP (Code of Operation) : 0FH 36H Postbyte Clocks Cx6x86MX: n/a --------------------------------------------------- OPCODE RDTSC - Read From Time Stamp Counter CPU: Pentium (tm), Pentium Pro, AMD Am5k86 Type of Instruction: System/User Instruction: RDTSC Description: IF (CR4.TSD=0) or ((CR4.TSD=1) and (CPL=0)) THEN { EDX:EAX <- TSC; } ELSE { General Protection Fault INT 0DH (0) } END Note: TSC is one of MSR and after global hardware reset (not SRESET , but RESET ) it clear to 0000000000000000H. TSC is MSR index 10h. TSC may set using WRMSR instruction. TSC incremented every CPU core clock cycle. Flags Affected: None CPU mode: RM,PM0,SMM ; PM,VM if enable Physical Form: RDTSC COP (Code of Operation): 0FH 31H Clocks: Pentium : n/a [20-24] --------------------------------------------------- OPCODE REPC - Repeat While Carry Flag CPU: NEC/Sony all V-series Type of Instruction: Prefix Instruction: REPC Description: DO CX=CX-1; SERVICE_PENDING_INTERRUPT; STRING_INSTRUCTION; LOOPWHILE ((CX<>0) AND (CF==1)); Flags Affected: None CPU Mode: RM 8086 Physical Form: REPC COP (Code of Operation): 65H Clocks: NEC V20 : 2 NEC V30 : 2 --------------------------------------------------- OPCODE REPNC - Repeat While Not Carry Flag CPU: NEC/Sony all V-series Type of Instruction: Prefix Instruction: REPNC Description: DO CX=CX-1; SERVICE_PENDING_INTERRUPT; STRING_INSTRUCTION; LOOPWHILE ((CX<>0) AND (CF<>1)); Flags Affected: None CPU mode: RM 8086 Physical Form: REPNC COP (Code of Operation): 64H Clocks: NEC V20 : 2 NEC V30 : 2 --------------------------------------------------- OPCODE RES3 - Restore All CPU Registers CPU: AMD Am386SXLV, Am386DXLV Type of Instruction: System Operation (Work only then CPL=0) Instruction: RES3 Description: Load All Registers (Include Shadow Registers) from Table Which Begin on place pointed ES:EDI Note: This instruction is AMD analog Intel's LOADALL instruction but it's more i.c. return from SMM used this instruction. Then in SMM table is in SMRAM, then non SMM then table is in main memory. Format of RES3 Table: Offset Len Description 0H 4 CR0 4H 4 EFLAGS 8H 4 EIP CH 4 EDI 10H 4 ESI 14H 4 EBP 18H 4 ESP 1CH 4 EBX 20H 4 EDX 24H 4 ESX 28H 4 EAX 2CH 4 DR6 30H 4 DR7 34H 4 TR (16 bit, zero filled up) 38H 4 LDT --------- 3CH 4 GS --------- 40H 4 FS --------- 44H 4 DS --------- 48H 4 SS --------- 4CH 4 CS --------- 50H 4 ES --------- 54H 4 TSS.attrib 58H 4 TSS.base 5CH 4 TSS.limit 60H 4 Reserved 64H 4 IDT.base 68H 4 IDT.limit 6CH 4 REP OUTS overrun flag 70H 4 GDT.base 74H 4 GDT.limit 78H 4 LDT.attrib 7CH 4 LDT.base 80H 4 LDT.limit 84H 4 GS.attrib 88H 4 GS.base 8CH 4 GS.limit 90H 4 FS.attrib 94H 4 FS.base 98H 4 FS.limit 9CH 4 DS.attrib A0H 4 DS.base A4H 4 DS.limit A8H 4 SS.attrib ACH 4 SS.base B0H 4 SS.limit B4H 4 CS.attrib B8H 4 CS.base BCH 4 CS.limit C0H 4 ES.attrib C4H 4 ES.base C8H 4 ES.limit Unknown Unusable area 100H 4 Temporary register 104H 4 ------------- 108H 4 ------------- 10CH 4 ------------- 110H 4 ------------- 114H 4 ------------- 118H 4 ------------- 11CH 4 ------------- 120H 4 ------------- 124H 4 Last EIP (Last instruction EIP for Restart) See APPENDIX X for more info. Format of Attrib field: Byte Description 0 0s 1 AR (Access Right) byte in the Descriptor format Note: P bit is a valid bit if valid bit=0 then Shadow Register is invalid and INT 0DH - General Protection Fault call DPL of SS,CS det. CPL 2-3 0s Flags Affected: All (FLAGS Register Reload) CPU mode: RM,PM0,SMM Physical Form: RES3 COP (Code of Operation): 0FH 07H Note: Code is same with Intel's LOADALL Clocks: Am386SXLV : 366 Am386DXLV : 291 --------------------------------------------------- OPCODE RES4 - Restore All CPU Registers CPU: AMD Am486SXLV, Am486DXLV Type of Instruction: System Operation (Work only then CPL=0) Instruction: RES3 Description: Load All Registers (Include Shadow Registers) from Table Which Begin on place pointed ES:EDI Note: This instruction is AMD analog Intel's LOADALL instruction but it's more i.c. return from SMM used this instruction. Then in SMM table is in SMRAM, then non SMM then table is in main memory. Format of RES3 Table: Offset Len Description 0H 4 CR0 4H 4 EFLAGS 8H 4 EIP CH 4 EDI 10H 4 ESI 14H 4 EBP 18H 4 ESP 1CH 4 EBX 20H 4 EDX 24H 4 ESX 28H 4 EAX 2CH 4 DR6 30H 4 DR7 34H 4 TR (16 bit, zero filled up) 38H 4 LDT --------- 3CH 4 GS --------- 40H 4 FS --------- 44H 4 DS --------- 48H 4 SS --------- 4CH 4 CS --------- 50H 4 ES --------- 54H 4 TSS.attrib 58H 4 TSS.base 5CH 4 TSS.limit 60H 4 Reserved 64H 4 IDT.base 68H 4 IDT.limit 6CH 4 REP OUTS overrun flag 70H 4 GDT.base 74H 4 GDT.limit 78H 4 LDT.attrib 7CH 4 LDT.base 80H 4 LDT.limit 84H 4 GS.attrib 88H 4 GS.base 8CH 4 GS.limit 90H 4 FS.attrib 94H 4 FS.base 98H 4 FS.limit 9CH 4 DS.attrib A0H 4 DS.base A4H 4 DS.limit A8H 4 SS.attrib ACH 4 SS.base B0H 4 SS.limit B4H 4 CS.attrib B8H 4 CS.base BCH 4 CS.limit C0H 4 ES.attrib C4H 4 ES.base C8H 4 ES.limit Unknown Unusable area 100H 4 Temporary register 104H 4 ------------- 108H 4 ------------- 10CH 4 ------------- 110H 4 ------------- 114H 4 ------------- 118H 4 ------------- 11CH 4 ------------- 120H 4 ------------- 124H 4 Last EIP (Last instruction EIP for Restart) 128H 4 PEIP - Previous SRAM space instruction pointer 12EH 36 Unused 150H 22 Floating Pointer Internal Registers (Am486DXLV) See Appendix X for more info. Format of Attrib field: Byte Description 0 0s 1 AR (Access Right) byte in the Descriptor format Note: P bit is a valid bit if valid bit=0 then Shadow Register is invalid and INT 0DH - General Protection Fault call DPL of SS,CS det. CPL 2-3 0s Flags Affected: All (FLAGS Register Reload) CPU mode: RM,PM0,SMM Physical Form: RES4 COP (Code of Operation): 0FH 07H Note: Code is same with Intel's LOADALL Clocks: Am486SXLV : N/A --------------------------------------------------- OPCODE RETRBI - Return from Register Bank Context Switch Interrupt. CPU: NEC V25,V35,V25 Plus,V35 Plus,V25 Software Guard Type of Instruction: System Instruction: RETRBI Description: PC <- Save PC; PSW <- Save PSW; Flags Affected: All CPU mode: RM +++++++++++++++++++++++ Physical Form: RETRBI COP (Code of Operation) : 0Fh 91h Clocks: 12 --------------------------------------------------- OPCODE RETXA - Return from Expansion Address CPU: NEC V33/V53 only Type of Instruction: System Instruction: RETXA int_vector Description: [sp-1,sp-2] <- PSW ; PSW EQU FLAGS [sp-3,sp-4] <- PS ; PS EQU CS [sp-5,sp-6] <- PC ; PC EQU IP SP <- SP -6 IE <- 0 BRK <- 0 MD <- 0 PC <- [int_vector*4 +0,+1] PS <- [int_vector*4 +2,+3] Disable EA mode. Flags Affected: None CPU mode: RM +++++++++++++++++++++++ Physical Form: RETXA imm8 COP (Code of Operation) : 0Fh F0h imm8 Clocks: 12 --------------------------------------------------- OPCODE ROL4 - Rotate left 4 bits CPU: NEC/Sony all V-series Type of Instruction: User Instruction: ROL4 dest Description: AL dest bits 7 4 3 0 7 4 3 0 ------------- ------------- | | o <--------| <-|-o |<--\ ---------|---- ------------- | | | \---------------------------/ Note: This instruction Rotates (4bits) left out of dest through low 4bits of AL Flags Affected: None CPU mode: RM +++++++++++++++++++++++ Physical Form : ROL4 reg/mem8 COP (Code of Operation) : 0FH 28H PostByte Clocks: ROL4 reg/mem8 NEC V20: 25/28 --------------------------------------------------- OPCODE ROR4 - Rotate right 4 bits CPU: NEC/Sony all V-series Type of Instruction: User Instruction: ROL4 dest Description: AL dest bits 7 4 3 0 7 4 3 0 ------------- ------------- | | o--|------>| o-|-> o-|--\ ---------^---- ------------- | | | \---------------------------/ Note: This instruction Rotates (4bits) right out of dest through low 4bits of AL Flags Affected: None CPU mode: RM +++++++++++++++++++++++ Physical Form : ROR4 reg/mem8 COP (Code of Operation) : 0FH 2AH PostByte Clocks: ROR4 reg/mem8 NEC V20: 29/33 --------------------------------------------------- OPCODE RSDC - Restore Register and Descriptor CPU: Cyrix Cx486S/S2/D/D2/DX/DX2/DX4 IBM BL486DX/DX2 TI 486SLC/DLC/e TI 486SXL/SXL2/SXLC TI Potomac Type of Instruction: System Instruction: RSDC sreg,sorc Description: sreg [selector,shadow_descriptor] <- sorc ; sorc is register and descriptor structure (see below) ; Note: This instruction load segment register ; include shadow descriptor Format or Register and Descriptor Structure: +00 Limit (15-0) +02 Base (15-0) +04 Base (23-16) +05 AR byte +06 AR2/Limit (19-16) +07 Base (31-24) +08 Selector Length of structure is 0Ah Flags Affected: None CPU mode: (1) and (2) and (3) and [(4A) or (4B)] 1) CPL=0 2) CCR1.bit1=1 ; SMI enable 3) SMAR size > 0 4A) in SMM 4B) CCR1.bit2=1 ; SMAC is on ++++++++++++++++ Physical Form: RSDC sgeg,mem80 COP (Code of Operation) : 0FH 79H [mm sreg3 mmm] Clocks IBM BL486DX: 10 TI 486SXL : 14 Note: sreg3 is: 000 ES 001 CS 010 SS 011 DS 100 FS 101 GS --------------------------------------------------- OPCODE RSLDT - Restore LDTR and Descriptor CPU: Cyrix Cx486S/S2/D/D2/DX/DX2/DX4 IBM BL486DX/DX2 TI 486SLC/DLC/e TI 486SXL/SXL2/SXLC TI Potomac Type of Instruction: System Instruction: RSLDT sorc Description: LDTR [selector,shadow_descriptor] <- sorc ; sorc is register and descriptor structure (see below) Format or Register and Descriptor Structure: +00 Limit (15-0) +02 Base (15-0) +04 Base (23-16) +05 AR byte +06 AR2/Limit (19-16) +07 Base (31-24) +08 Selector Length of structure is 0Ah Flags Affected: None CPU mode: (1) and (2) and (3) and [(4A) or (4B)] 1) CPL=0 2) CCR1.bit1=1 ; SMI enable 3) SMAR size > 0 4A) in SMM 4B) CCR1.bit2=1 ; SMAC is on ++++++++++++++++ Physical Form: RSLDT mem80 COP (Code of Operation) : 0FH 7BH [mm 000 mmm] Clocks IBM BL486DX: 10 TI 486SXL : 14 --------------------------------------------------- OPCODE RSM - Resume from System Managment Mode CPU: I486 SL Enhanced+,i486SL,i386CX,i386EX Type of Instruction: System Instruction: RSM Description: Restore execution state from SMRAM and return to previous CPU mode CPU mode: SMM only ( INT 6 - Undefined Opcode in all other mode ) Flags Affected: All Note: CPU state restored from dump created entrance to SMM. The CPU leave SMM and return to previous mode. If CPU detect any invalid state it enters shutdown. This invalid states is: * The value stored in State Dump Base field is not 32K aligned address * Any Reserved bit of CR4 is set to 1 (Pentium only) * Any illegal Combination of CR0: ** (PG=1 and PE=0) ** (NW=1 and CD=0) Format of Execution State in SMRAM: Offset Register 7FFCh CR0 7FF8h CR3 7FF4h EFLAGS 7FF0h EIP 7FECh EDI 7FE8h ESI 7FE4h EBP 7FE0h ESP 7FDCh EBX 7FD8h EDX 7FD4h ECX 7FD0h EAX 7FCCh DR7 7FC4h TR, upper 2 bytes reserved 7FC0h LDTR, upper 2 bytes reserved 7FBCh GS, upper 2 bytes reserved 7FB8h FS, upper 2 bytes reserved 7FB4h DS, upper 2 bytes reserved 7FB0h SS, upper 2 bytes reserved 7FACh CS, upper 2 bytes reserved 7FA8h ES, upper 2 bytes reserved 7F98h Reserved 7F94h IDT base (4 bytes) 7F8Ch Reserved 7F88h GDT base (4 bytes) 7F04h Reserved 7F02h Auto HALT Restart Slot (2 bytes) Bits 15..2 are reserved Bit 1 Bit 0 Description 0 0 Resume to next instruction in interrupted program 0 1 Unpredictable 1 0 Return to next instruction after HALT 1 1 Return to HALT state 7F00h I/O Restart Slot (2 bytes) When RSM execution if I/O restart slot = 0FFh then EIP modified to instruction immediate preceding the SMI# request i.e. CPU automatically reexecute I/O instruction which be trapped by SMI. 7EFCh SMM Revision Identificator (4 bytes) Bits Description 31..18 Reserved 17 If=1 Processor support SMBASE relocation else not support 16 If =1 Processor support I/O Instruction Restart 15..0 SMM Revision Identificator P5,486s = 0000h P54C when I/O Restarts enable = 0002h 7EF8h SMBASE Slot (4 bytes) SMBASE is 32KB aligned 32bit dword which contained a base address for SMRAM. Default value is 30000h Starting Address for for jump in SMM is: SMBASE+8000h Starting address for State Save area is SMBASE+[8000h+7FFFh] 7E00h Reserved Note: In fields marked Reserved saved and restores next registers: CR1,CR2,CR3, hidden descriptors for CS,DS,ES,FS,SS,GS. Never saved registers: DR5-DR0,TR7-TR3,all FPU registers. More Information Not available Yet. Physical Form: RSM COP (Code of Operation) : 0FH AAH Clocks: i386CX : 338 i486 SL Enhanced : ??? IntelDX4 : 452 ; SMBASE relocation : 456 ; AutoHALT restart : 465 ; I/O Trap restart Pentium : 83 --------------------------------------------------- OPCODE RSM - Resume from SMM CPU: Cyrix Cx486S/S2/D/D2/DX/DX2/DX4 IBM BL486DX/DX2 TI 486SLC/DLC/e TI 486SXL/SXL2/SXLC TI Potomac Type of Instruction: System Instruction: RSM Description: RESTORE CPU STATE FROM SMM HEADER AT THE TOP OF SMM SPACE (defined by SMAR register); EXIT SMM; Format of SMM Header: Offset Length Description -00h - Nothing (Top of SMM space) (Not accessable) -04h 32 DR7 -08h 32 EFLAGS -0Ch 32 CR0 -10h 32 Current EIP -14h 32 Next instruction EIP -16h 16 Reserved -18h 16 CS selector -1Ch 32 CS descriptor(63-32) -20h 32 CS descriptor(31-0) -24h 32 SMM Flags [ ALL BITS are Not available in Cx486S/S2/D/D2] Bit Description 1 I (IN/INSx/OUT/OUTx Indicator) If =0 current instruction performed I/O read =1 I/O write 2 P (REP INSx/OUTx Prefix) If =1 current instruction has REP pfix. =0 not has REP pfix 3 S (Software SMI) If =1 current SMM is result of execution SMINT instruction =0 current SMM is result of hardware SMI Note: TI 486SXL/SXL2 support only bits 1,2. -26h 16 I/O Write Data size [ Not available in Cx486S/S2/D/D2] [ Not available in TI486SXL/SXL2] [ Not available in TI486SLC/DLC/e] 1h = byte 3h = word fh = dword -28h 16 I/O Write Address [ Not avaliable in Cx486S/S2/D/D2] [ Not available in TI486SXL/SXL2] [ Not available in TI486SLC/DLC/e] -2Ch 32 I/O Write Data [ Not avaliable in Cx486S/S2/D/D2] [ Not available in TI486SXL/SXL2] [ Not available in TI486SLC/DLC/e] -30h 32 ESI or EDI This field saved value of source/destination for restart INSx/OUTSx instruction [ Not avaliable in Cx486S/S2/D/D2] Flags Affected: All CPU mode: SMM ++++++++++++++++ Physical Form: RSM COP (Code of Operation) : 0FH AAH Clocks IBM BL486DX: 76 TI 486SXL : 58 ----------------------------------------------------------------- RSQRTPS - Packed Single-FP Square Root Reciprocal CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: RSQRTPS dest,src Description: for i = 0 to 3 do dest[] = APPROX(1.0 / SQRT(src[])); endfor <0> = 31..0 <2> = 95..64 <1> = 63..32 <3> = 127..96 Physical Form and Timing: RSQRTPS xmm1,xmm2/m128 ---- 0F 52 /r ---- 2 ----------------------------------------------------------------- RSQRTSS - Scalar Single-FP Square Root Reciprocal CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: RSQRTPS dest,src Description: dest[31..0] = APPROX(1.0 / SQRT(src[31..0])); Physical Form and Timing: RSQRTSS xmm1,xmm2/m128 ---- F3 0F 52 /r ---- 1 --------------------------------------------------- OPCODE RSTS - Restore TR and Descriptor CPU: Cyrix Cx486S/S2/D/D2/DX/DX2/DX4 TI 486SLC/DLC/e TI 486SXL/SXL2/SXLC IBM BL486DX/DX2 Type of Instruction: System Instruction: RSTS sorc Description: TR [selector,shadow_descriptor] <- sorc ; sorc is register and descriptor structure (see below) Format or Register and Descriptor Structure: +00 Limit (15-0) +02 Base (15-0) +04 Base (23-16) +05 AR byte +06 AR2/Limit (19-16) +07 Base (31-24) +08 Selector Length of structure is 0Ah Flags Affected: None CPU mode: (1) and (2) and (3) and [(4A) or (4B)] 1) CPL=0 2) CCR1.bit1=1 ; SMI enable 3) SMAR size > 0 4A) in SMM 4B) CCR1.bit2=1 ; SMAC is on ++++++++++++++++ Physical Form: RSTS mem80 COP (Code of Operation) : 0FH 7DH [mm 000 mmm] Clocks IBM BL486DX: 10 TI 486SXL : 14 --------------------------------------------------- OPCODE SET1 - Set a Specified Bit CPU: NEC/Sony V-series Type of Instruction: User Instruction: SET1 dest,bitnumb Description: BIT bitnumb OF dest <- 1; Flags Affected: None CPU mode: RM +++++++++++++++++++++++ Physical Form: SET1 reg/mem8,CL COP (Code of Operation) : 0FH 14H Postbyte Physical Form: SET1 reg/mem8,imm8 COP (Code of Operation) : 0FH 1CH Postbyte imm8 Physical Form: SET1 reg/mem16,CL COP (Code of Operation) : 0FH 15H Postbyte Physical Form: SET1 reg/mem16,imm8 COP (Code of Operation) : 0FH 1DH Postbyte imm8 Clocks: SET1 r/m8,CL r/m8,i8 r/m16,CL r/m16,i8 NEC V20: 4/13 5/14 4/13 5/14 --------------------------------------------------- OPCODE SETALC - Set AL to Carry Flag CPU: Intel 8086 and all its clones and upward compatibility chips. Type of Instruction: User Instruction: SETALC Description: IF (CF=0) THEN AL:=0 ELSE AL:=FFH; Flags Affected: None CPU mode: RM,PM,VM,SMM Physical Form: SETALC COP (Code of Operation): D6H Clocks: 80286 : n/a [3] 80386 : n/a [3] Cx486SLC : n/a [2] i486 : n/a [3] Pentium : n/a [3] Note: n/a is Time that Intel etc not say. [3] is real time it executed. ----------------------------------------------------------------- SFENCE - Store Fence CPU: Pentium III+ (KNI/MMX2), AMD Athlon (AMD EMMX) Type of instruction: User Instruction: SFENCE Description: Guranteed that every store instruction that precedes in program order the store fence instruction is globally visible before any store instruction follows the fence is globally visible. Physical Form and Timing: SFENCE ---- 0F AE F8 ---- ? ----------------------------------------------------------------- SHUFPS - Shuffle Single-FP CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: SHUFPS dest,src,sc Description: for i=0 to 3 do SEL = (sc >> (i*2)) AND 3; dest[] <- src[]; endfor Physical Form and Timing: SHUFPS xmm1,xmm2/m128,imm8 ---- 0F C6 /r imm8 ---- ? --------------------------------------------------- OPCODE SMI - System Managment Interrupt CPU: AMD Am386SXLV,Am386DXLV AMD 486s Type of Instruction: System Instruction: SMI Description: IF (SMIE=1) THEN { SAVE STATUS OF EXECUTION TO SMRAM; ENTER SMM; SMMS <- 1; } ELSE { INT 1; } END Notes: SMIE is (DR7.bit12) =1 Enable soft SMI =0 Disable soft SMI SMMS is (DR6.bit12) =1 SMM was entered =0 SMM status cleared Flags Affected: None CPU mode: RM?,PM0 Physical Form: SMI COP (Code of Operation): F1H Clocks: Am386SXLV : 357 Am386DXLV : 325 Am486xxxx : Don't know, do you? --------------------------------------------------- OPCODE SMINT - Software SMM Interrupt CPU: Cyrix Cx486DX/DX2/DX4 IBM BL486DX/DX2 Note: Never in Cx486S/S2/D/D2 Never in any TI's chips. Type of Instruction: System Instruction: SMINT Description: SAVE CPU STATE TO SMM HEADER AT THE TOP OF SMM SPACE (defined by SMAR register); ENTER SMM MODE; Format of SMM Header: Refer to Cyrix/IBM SMI Instruction Flags Affected: None CPU mode: CPL=0, CCR1.bit1=1, SMAR size >= 30h. ++++++++++++++++ Physical Form: SMINT COP (Code of Operation) : 0FH 7EH Clocks IBM BL486DX: 24 ----------------------------------------------------------------- SQRTPS - Packed Single-FP Square Root CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: SQRTPS dest,src Description: for i = 0 to 3 do dest[] = SQRT(src[]); endfor <0> = 31..0 <2> = 95..64 <1> = 63..32 <3> = 127..96 Physical Form and Timing: SQRTPS xmm1,xmm2/m128 ---- 0F 51 /r ---- 56-114 ----------------------------------------------------------------- SQRTSS - Scalar Single-FP Square Root CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: SQRTSS dest,src Description: dest[31..0] = SQRT(src[31..0]); Physical Form and Timing: SQRTSS xmm1,xmm2/m32 ---- F3 0F 51 /r ---- 8-?? ----------------------------------------------------------------- STMXCSR - Store Streaming SIMD Extension Control/Status CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: STMXCSR dest Description: dest <- MXCSR For format of MXCSR look LDMXCSR instruction Physical Form and Timing: STMXCSR m32 ---- 0F AE /3 ---- ? --------------------------------------------------- OPCODE STOP - Stop CPU CPU: NEC V25,V35,V25 Plus,V35 Plus,V25 Software Guard Type of Instruction: System Instruction: STOP Description: PowerDown instruction, Stop Oscillator, Halt CPU. Flags Affected: None CPU mode: RM +++++++++++++++++++++++ Physical Form: STOP COP (Code of Operation) : 0Fh BEh Clocks: N/A --------------------------------------------------- OPCODE SUB4S - Subtraction of packed BCD strings CPU: NEC/Sony all V-series Type of Instruction: User Instruction: SUB4S Description: BCD STRING (ADDRESS=ES:DI,LENGTH=CL) <- BCD STRING (ADDRESS=DS:SI,LENGTH=CL) - BCD STRING (ADDRESS=ES:DI,LENGTH=CL); Length of BCD string in CL; Note: si,di,cl and other registers not changed Flags Affected: OF,CF,ZF ;; ZF set if result is zero. ;; CF,OF set as result of operation with most ;; signification BCDs. CPU mode: RM +++++++++++++++++++++++ Physical Form: SUB4S COP (Code of Operation) : 0FH 22H Clocks: SUB4S NEC V20: ~7+19*CL ----------------------------------------------------------------- SUBPS - Packed Single-FP Subtract CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: SUBPS dest,src Description: for i = 0 to 3 do dest[] = dest[] - src[]; endfor <0> = 31..0 <2> = 95..64 <1> = 63..32 <3> = 127..96 Physical Form and Timing: SUBPS xmm1,xmm2/m128 ---- 0F 5C /r ---- 2 ----------------------------------------------------------------- SUBSS - Scalar Single-FP Subtract CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: SUBSS dest,src Description: dest[31..0] = dest[31..0] - src[31..0]; Physical Form and Timing: SUBSS xmm1,xmm2/m32 ---- F3 0F 5C /r ---- 1 --------------------------------------------------- OPCODE SVDC - Save Register and Descriptor CPU: Cyrix Cx486S/S2/D/D2/DX/DX2/DX4 IBM BL486DX/DX2 TI 486SLC/DLC/e TI 486SXL/SXL2/SXLC TI Potomac Type of Instruction: System Instruction: SVDC dest,sreg Description: dest <- sreg [selector,shadow_descriptor] ; dest is register and descriptor structure (see below) Format or Register and Descriptor Structure: +00 Limit (15-0) +02 Base (15-0) +04 Base (23-16) +05 AR byte +06 AR2/Limit (19-16) +07 Base (31-24) +08 Selector Length of structure is 0Ah Flags Affected: None CPU mode: (1) and (2) and (3) and [(4A) or (4B)] 1) CPL=0 2) CCR1.bit1=1 ; SMI enable 3) SMAR size > 0 4A) in SMM 4B) CCR1.bit2=1 ; SMAC is on ++++++++++++++++ Physical Form: SVDC mem80,sreg COP (Code of Operation) : 0FH 78H [mm sreg3 mmm] Clocks IBM BL486DX: 18 TI 486SXL : 22 Note: sreg3 is: 000 ES 001 CS 010 SS 011 DS 100 FS 101 GS --------------------------------------------------- OPCODE SVLDT - Save LDTR and Descriptor CPU: Cyrix Cx486S/S2/D/D2/DX/DX2/DX4 IBM BL486DX/DX2 TI 486SLC/DLC/e TI 486SXL/SXL2/SXLC TI Potomac Type of Instruction: System Instruction: SVLDT dest Description: dest <- LDTR [selector,shadow_descriptor] ; dest is register and descriptor structure (see below) Format or Register and Descriptor Structure: +00 Limit (15-0) +02 Base (15-0) +04 Base (23-16) +05 AR byte +06 AR2/Limit (19-16) +07 Base (31-24) +08 Selector Length of structure is 0Ah Flags Affected: None CPU mode: (1) and (2) and (3) and [(4A) or (4B)] 1) CPL=0 2) CCR1.bit1=1 ; SMI enable 3) SMAR size > 0 4A) in SMM 4B) CCR1.bit2=1 ; SMAC is on ++++++++++++++++ Physical Form: SVLDT mem80 COP (Code of Operation) : 0FH 7AH [mm 000 mmm] Clocks IBM BL486DX: 18 TI 486SXL : 22 --------------------------------------------------- OPCODE SVTS - Save TR and Descriptor CPU: Cyrix Cx486S/S2/D/D2/DX/DX2/DX4 IBM BL486DX/DX2 TI 486SLC/DLC/e TI 486SXL/SXL2/SXLC TI Potomac Type of Instruction: System Instruction: SVTS dest Description: dest <- TR [selector,shadow_descriptor] ; dest is register and descriptor structure (see below) Format or Register and Descriptor Structure: +00 Limit (15-0) +02 Base (15-0) +04 Base (23-16) +05 AR byte +06 AR2/Limit (19-16) +07 Base (31-24) +08 Selector Length of structure is 0Ah Flags Affected: None CPU mode: (1) and (2) and (3) and [(4A) or (4B)] 1) CPL=0 2) CCR1.bit1=1 ; SMI enable 3) SMAR size > 0 4A) in SMM 4B) CCR1.bit2=1 ; SMAC is on ++++++++++++++++ Physical Form: SVTS mem80 COP (Code of Operation) : 0FH 7CH [mm 000 mmm] Clocks IBM BL486DX: 18 TI 486SXL : 22 --------------------------------------------------- OPCODE SYSCALL - Call Operating System CPU: AMD K6-2,K6-3 Type of Instruction: User Instruction: SYSCALL Description: if EFER.SCE = 1 then { ECX <- EIP EIP <- STAR[31..0] IF <- 0 VM <- 0 CS.selector <- STAR[47..32] SS.selector <- (STAR[47..32]) + 8 CS.base <- 0 SS.base <- 0 CS.limit <- 4G SS.limit <- 4G CS.attr <- ReadOnly SS.attr <- R/W, Expand-Up CPL <- 0 } else #UD; Note: Passing control to fixed entry point for faster OS calls. see RDMSR for description of STAR (SYSCALL Target Address register) Note: Command opcode equal to 286 LOADALL undocument instruction. ++++++++++++++++++++++++++++++++++++++ COP & Times: SYSCALL 0FH 05H Am6k86: n/a --------------------------------------------------- OPCODE SYSENTER - Call Operating System CPU: Intel Pentium II Type of Instruction: System Instruction: SYSENTER Description: if CR.0.PE == 0 then #GP(0); if SYSENTER_CS_MSR == 0 then #GP(0); EFLAGS.VM <- 0; EFLAGS.IF <- 0; CS.SEL <- SYSENTER_CS_MSR; CPL <- 0; CS.BASE <- 0; CS.LIMIT <- 0xffff; CS.ATTR.G <- 1; CS.ATTR.S <- 1; CS.ATTR.TYPE <- 1011b; CS.ATTR.D <- 1; CS.ATTR.DPL <- 0; CS.RPL <- 0; CS.ATTR.P <- 1; SS.SEL <- CS.SEL+8; SS.BASE <- 0; SS.LIMIT <- 0xffff; SS.ATTR.G <- 1; SS.ATTR.S <- 1; SS.ATTR.TYPE <- 0011b; SS.ATTR.D <- 1; SS.ATTR.DPL <- 0; SS.RPL <- 0; SS.ATTR.P <- 1; ESP <- SYSENTER_ESP_MSR; EIP <- SYSENTER_EIP_MSR; Note: How to check if this instruction present: CPUID.SEP bit must be set. AND CPUID.FAMILY == 6 AND (CPUID.MODEL >=3) AND (CPUID.STEP >= 3) Note: See MSR List for more Info. (MSRs 174h,175h,176h) Note: Passing control to fixed entry point for faster OS calls. ++++++++++++++++++++++++++++++++++++++ COP & Times: SYSENTER 0FH 34H P6: n/a --------------------------------------------------- OPCODE SYSEXIT - Return from Operation System CPU: Intel Pentium II Type of Instruction: Privelege (CPL =0) Instruction: SYSRET Description: if CR.0.PE == 0 then #GP(0); if SYSENTER_CS_MSR == 0 then #GP(0); EFLAGS.VM <- 0; EFLAGS.IF <- 0; CS.SEL <- SYSENTER_CS_MSR + 16; CPL <- 0; CS.BASE <- 0; CS.LIMIT <- 0xffff; CS.ATTR.G <- 1; CS.ATTR.S <- 1; CS.ATTR.TYPE <- 1011b; CS.ATTR.D <- 1; CS.ATTR.DPL <- 0; CS.RPL <- 0; CS.ATTR.P <- 1; SS.SEL <- CS.SEL+8; SS.BASE <- 0; SS.LIMIT <- 0xffff; SS.ATTR.G <- 1; SS.ATTR.S <- 1; SS.ATTR.TYPE <- 0011b; SS.ATTR.D <- 1; SS.ATTR.DPL <- 0; SS.RPL <- 0; SS.ATTR.P <- 1; ESP <- SYSENTER_ESP_MSR; EIP <- SYSENTER_EIP_MSR; Note: See SYSENTER for more Info. ++++++++++++++++++++++++++++++++++++++ COP & Times: SYSEXIT 0FH 35H P6: n/a --------------------------------------------------- OPCODE SYSRET - Return from Operation System CPU: AMD K6-2,K6-3 Type of Instruction: Privelege (CPL =0) Instruction: SYSRET Description: if EFER.SCE == 1 { if CPL == 0 { EIP <- ECX IF <- 1 CS.selector <- STAR[47..32] OR 3H CS.base <- 0 CS.limit <- 4GB CS.attr <- ReadOnly SS <- (STAR[47..32]) + 16) OR 3H } else #GP(0); } else #UD; Note: Passing control from OS entry point back to ring 3 client. see RDMSR for description of STAR (SYSCALL Target Address register) Note: Command opcode equal to 386/486 LOADALL undocument instruction. ++++++++++++++++++++++++++++++++++++++ COP & Times: SYSRET 0FH 07H Am6k86: n/a --------------------------------------------------- OPCODE TEST1 - Test a Specified bit CPU: NEC/Sony all V-series Type of Instruction: User Instruction: NOT1 dest,bitnumb Description: IF dest IS 8BIT THEN bitn <- bitnumb AND 7; IF dest IS 16BIT THEN bitn <- bitnumb AND Fh; IF (BIT bitn OF dest) = 0 THEN { ZF <- 1; } ELSE { ZF <- 0; } ENDIF Flags Affected: ZF CPU mode: RM +++++++++++++++++++++++ Physical Form: TEST1 reg/mem8,CL COP (Code of Operation) : 0FH 10H Postbyte Physical Form: TEST1 reg/mem8,imm8 COP (Code of Operation) : 0FH 18H Postbyte imm8 Physical Form: TEST1 reg/mem16,CL COP (Code of Operation) : 0FH 11H Postbyte Physical Form: TEST1 reg/mem16,imm8 COP (Code of Operation) : 0FH 19H Postbyte imm8 Clocks: TEST1 r/m8,CL r/m8,i8 r/m16,CL r/m16,i8 NEC V20: 3/12 4/13 3/12 4/13 --------------------------------------------------- OPCODE TSKSW - Task Switch CPU: NEC V25,V35,V25 Plus,V35 Plus,V25 Software Guard Type of Instruction: System Instruction: TSKSW reg16 Description: Perform a High-Speed task switch to the register bank indicated by lower 3 bits of reg16. The PC and PSW are saved in the old banks. PC and PSW save Registers and the new PC and PSW values are retrived from the new register bank's save area. Note: See BRKCS instruction for more Info about banks. Flags Affected: All CPU mode: RM +++++++++++++++++++++++ Physical Form: TSCSW reg16 COP (Code of Operation) : 0Fh 94h <1111 1RRR> Clocks: 11 ----------------------------------------------------------------- UCOMISS - Unordered Scalar Single-FP compare and Set EFLAGS CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: UCOMISS dest,src Description: OF <- 0; SF <- 0; AF <- 0; if (dest[31..0] UNORD src[31..0]) then ZF <- 1; PF <- 1; CF <- 1; else if (dest[31..0] > src[31..0]) then ZF <- 0; PF <- 0; CF <- 0; else if (dest[31..0] < src[31..0]) then ZF <- 0; PF <- 0; CF <- 1; else // Equal ZF <- 1; PF <- 0; CF <- 0; endif Physical Form and Timing: UCOMISS xmm1,xmm2/m32 ---- 0F 2E /r ---- ? ----------------------------------------------------------------- UNPCKHPS - Unpack High Packed Single-FP Data CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: UNPCKHPS dest,src Description: dest[<0>] <- dest[<2>]; dest[<1>] <- src[<2>]; dest[<2>] <- dest[<3>]; dest[<3>] <- src[<3>]; <0> = 31..0 <2> = 95..64 <1> = 63..32 <3> = 127..96 Physical Form and Timing: UNPCKHPS xmm1,xmm2/m128 ---- 0F 15 /r ---- 2 ----------------------------------------------------------------- UNPCKLPS - Unpack Low Packed Single-FP Data CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: UNPCKLPS dest,src Description: dest[<0>] <- dest[<0>]; dest[<1>] <- src[<0>]; dest[<2>] <- dest[<1>]; dest[<3>] <- src[<1>]; <0> = 31..0 <2> = 95..64 <1> = 63..32 <3> = 127..96 Physical Form and Timing: UNPCKLPS xmm1,xmm2/m128 ---- 0F 14 /r ---- 2 -------------------------------------------------- OPCODE UD - Undefined Instruction CPU: AMD Am5k86 (SSA/5, K5) Logical Form: UD Description: Caused #UD exception Flags Affected: No Flags Affected CPU Mode : RM,PM,VM,VME,SMM Exceptions : RM PM V86 VME SMM #UD #UD #UD #UD #UD Undefined Instruction No more Exceptions Note : This instruction caused #UD. AMD guaranteed that in future AMD's CPUs this instruction will caused #UD. Of course all previous CPUs (186+) caused #UD on this opcode. This instruction used by software writers for testing #UD exception servise routine. ++++++++++++++++++++++++++++++ Physical Form : UD COP (Code of Operation) : 0Fh FFh Clocks : UD 8088: Not supported NEC V20: Not supported 80186: ~int 80286: ~int 80386: ~int Cx486SLC: ~int i486: ~int Cx486DX: ~int Cx5x86: ~int Pentium: ~int Nx5x86: ~int Cx6x86: ~int Am5k86: ~int Pentium Pro: ~int ++++++++++++++++++++++++++++++ -------------------------------------------------- OPCODE UD2 - Undefined Instruction CPU: Pentium Pro+ and all other Logical Form: UD2 Description: Caused #UD exception Flags Affected: No Flags Affected CPU Mode : RM,PM,VM,VME,SMM Exceptions : RM PM V86 VME SMM #UD #UD #UD #UD #UD Undefined Instruction No more Exceptions Note : This instruction caused #UD. Intel guaranteed that in future Intel's CPUs this instruction will caused #UD. Of course all previous CPUs (186+) caused #UD on this opcode. This instruction used by software writers for testing #UD exception servise routine. ++++++++++++++++++++++++++++++ Physical Form : UD2 COP (Code of Operation) : 0Fh 0Bh Clocks : UD2 8088: Not supported NEC V20: Not supported 80186: ~int 80286: ~int 80386: ~int Cx486SLC: ~int i486: ~int Cx486DX: ~int Cx5x86: ~int Pentium: ~int Nx5x86: ~int Cx6x86: ~int Am5k86: ~int Pentium Pro: ~int ++++++++++++++++++++++++++++++ --------------------------------------------------- OPCODE UMOV - Mov Data to Main (User) Memory CPU: AMD Am386SXLV,Am386DXLV AMD 486s IBM 486SLC2 Type of Instruction: Special System Instruction: UMOV dest,sorc Description: dest <- sorc; Note!!!!!: But all memory operands placed in Main memory only ! ( i.e. not in SMRAM then in SMM ) WARNING: UMC's CPUs hang on execution this instruction !!!!!! check that CPU is none UMC's before Note: On Cyrix's CPUs UMOV opcodes do nothing. This way used to determination of Cyrix Microprocessors. Note: Pentium P54C never support this instruction Flags Affected: None CPU mode: RM?,PM?,VM?,SMM +++++++++++++++++++++++ Physical Form: UMOV r/m8,r8 COP (Code of Operation) : 0FH 10H Postbyte Clocks: Am386SXLV or AM386DXLV: 2/2 IBM 486SLC2 : 4 +++++++++++++++++++++ Physical Form: UMOV r/m16,r16 UMOV r/m32,r32 COP (Code of Operation) : 0FH 11H Postbyte Clocks: Am386SXLV or AM386DXLV: 2/2 IBM 486SLC2 : 4 +++++++++++++++++++++++ Physical Form: UMOV r8,r/m8 COP (Code of Operation) : 0FH 12H Postbyte Clocks: Am386SXLV or AM386DXLV: 2/4 IBM 486SLC2 : 4 +++++++++++++++++++++ Physical Form: UMOV r16,r/m16 UMOV r32,r/m32 COP (Code of Operation) : 0FH 13H Postbyte Clocks: Am386SXLV or AM386DXLV: 2/4 IBM 486SLC2 : 4 --------------------------------------------------- OPCODE WBINVD - Write Back and Invalidate Cache CPU: I486 + Type of Instruction: System Instruction: WBINVD Description: IF (internal cache is WB and in WB mode) THEN { Write Back Internal Cache; } Flush internal cache; Signal external cache to Write Back; Signal external cache to Flush; Notes: This instruction not work in Real Mode and in Protected mode work only in ring 0 ; Flags Affected: None CPU mode: PM0,SMM Physical Form: INVD COP (Code of Operation): 0FH 09H Clocks: Cyrix Cx486SLC : 4 i486 : 5 Pentium : 2000+ --------------------------------------------------- OPCODE WRMSR - Write to Model Specified Register CPU: Pentium (tm), IBM 486SLC2 Type of Instruction: System Instruction: WRMSR Description: IF (ECX is valid number of MSR) and (CPL=0) THEN { MSR [ECX] <- EDX:EAX; } ELSE { General Protection Fault INT 0DH (0) } END Flags Affected: None Note: Refer to RDMSR for more Info. CPU mode: RM,PM0,SMM Physical Form: WRMSR COP (Code of Operation): 0FH 30H Clocks: Pentium : 30-45 --------------------------------------------------- OPCODE WRSHR - Write SMM Header Pointer Register CPU: Cyrix Cx6x86MX Type of Instruction: SMM mode only Instruction: WRSHR src Description: SMHR <- src Note: See RDSHR for more details Flags Affected: None CPU mode: SMM ++++++++++++++++ Physical Form: RDSHR reg/mem32 COP (Code of Operation) : 0FH 37H Postbyte Clocks Cx6x86MX: n/a --------------------------------------------------- OPCODE XADD - Exchange and addition CPU: i486+ Type of Instruction: User Instruction: XADD dest,sorc Description: Temporary <- dest; dest <- dest + sorc; sorc <- Temporary; Flags Affected: ZF,OF,SF,AF,PF,CF ( like ADD instruction ) ( see description) CPU mode: RM,PM,VM,SMM +++++++++++++++++++++++ Physical Form: XADD r/m8,r8 COP (Code of Operation) : 0FH C0H Postbyte Clocks: Intel i486 : 3/4 Cyrix Cx486SLC : 3/6 Pentium (tm) : 3/4 Penalty if cache miss : Intel i486 : 6/2 ; Unlocked/Locked Cyrix Cx486SLC : 0 ; N/A +++++++++++++++++++++ Physical Form: XADD r/m16,r16 XADD r/m32,r32 COP (Code of Operation) : 0FH C1H Postbyte Clocks: Intel i486 : 3/4 Cyrix Cx486SLC : 3/6 Pentium (tm) : 3/4 Penalty if cache miss : Intel i486 : 6/2 ; Unlocked/Locked Cyrix Cx486SLC : 1 ; N/A --------------------------------------------------- OPCODE XBTS - Extract Bits String CPU: 80386 step A0-B0 only Type of Instruction: User Instruction: XBTS dest,base,bitoffset,len Description: Write bit string length bits from bitfield, defined by and bitsoffset from this base to start of the field to read. String read from this start field bit to higher memory addresses or register bits. And after it string placed to operand, lowest bit of register or memory to bit 0 of . Note: Use SHLD/SHRD instructions for extract bits strings. On 80386 steps B1+ this opcode generation INT 6, and on some of 486 other instruction replace this instruction opcode. Flags Affected: None CPU mode: RM,PM,VM +++++++++++++++++++++++ Physical Form: XBTS r16,r/m16,AX,CL XBTS r32,r/m32,EAX,CL COP (Code of Operation) : 0FH A6H Postbyte Clocks: XBTS 80386: 6/13 ----------------------------------------------------------------- XORPS - Bit-wise Logical XOR For Single-FP CPU: Pentium III+ (KNI/MMX2) Type of instruction: User Instruction: XORPS dest,src Description: dest = dest XOR src; // Bitwize 128-bit Physical Form and Timing: XORPS xmm1,xmm2/m128 ---- 0F 57 /r ---- 2 ----------------------------------------------------- APPENDIX A0 Cyrix Cx486SLC/DLC configuration Registers for Cx486DLC: Register Full Register Name Index size(bits) CCR0 Configuration Control Register #0 C0H 8 CCR1 Configuration Control Register #1 C1H 8 NCR1 Non-cacheble Region #0 C4H-C6H 24 NCR2 Non-cachable Region #1 C7H-C9H 24 NCR3 Non-cacheble Region #2 CAH-CCH 24 NCR4 Non-cacheble Region #4 CDH-CFH 24 for Cx486SLC: Register Full Register Name Index size(bits) CCR0 Configuration Control Register #0 C0H 8 CCR1 Configuration Control Register #1 C1H 8 NCR1 Non-cacheble Region #0 C5H-C6H 16 NCR2 Non-cachable Region #1 C8H-C9H 16 NCR3 Non-cacheble Region #2 CBH-CCH 16 NCR4 Non-cacheble Region #4 CEH-CFH 16 For access to this register You need to do: A) write INDEX_OF_REGISTER to I/O port #22H B) wait 5-6 clocks D) read/write DATA from/to register via I/O port #23 Note: If Index of register not in range C0H..CFH then Cyrix CPU generated external bus cycle. If You try to read I/O port #22H CPU will generated external bus cycle too. Then index is out of range all operations with port #23H will generate external bus cycle. State After Reset: CCR0 00H CCR1 xxxx xxx0B NCR1 000Fh NCR2 0 NCR3 0 NCR4 0 format of registers: CCR0: Bit Name Description 7 SUSPEND If =1 then enable SUSP# and SUSPA# pins, which used for put CPU in PowerSave mode. If =0 disable 6 CO (Cache Organisation) If =0 2ways set associative If =1 Dirrect Mapped 5 BARB If =1 then enable flushing internal cache when begining HOLD state. IF =0 disable. 4 FLUSH If =1 enable input pin FLUSH# if =0 disable 3 KEN If =1 enable input pin KEN# if =0 disable 2 A20M If =1 enable input pin A20M# if =0 disable 1 NC1 If=1 then 640KB-1MB area never caching If=0 caching (but see NCRi) 0 NC0 If=1 then first 64K of each 1MB bounds not caching, when in Real or Virtual8086 mode If =0 caching CCR1: Bit Name Description 7-1 Reserved 0 RPL If =1 then enable RPLSET,RPLVAL# pins If =0 this pins are disable and float. NCRi: Byte Bits Description 0 7-0 Address bits A31-A24 of non-cacheble region start (Reserved for Cx486SLC) 1 7-0 Address bits A23-A16 of non-cachable region start 2 7-4 Address bits A15-A12 of non-cacheble region start 2 3-0 Size of non-cacheble block: 0000 Disable NCRi 0001 4K 0010 8K 0011 16K 0100 32K 0101 64K 0110 128K 0111 256K 1000 512K 1001 1M 1010 2M 1011 4M 1100 8M 1101 16M 1110 32M 1111 4G NCRi bytes: Byte NCRi 0 1 2 NCR1 C4H C5H C6H NCR2 C7H C8H C9H NCR3 CAH CBH CCH NCR4 CDH CEH CFH --------------------------------------------------- APPENDIX A1 Cyrix Cx486S/S2/D/D2/DX/DX2/DX4 IBM BL486DX/DX2 configuration Registers Register Full Register Name Index size(bits) CCR1 Configuration Control Register #1 C1H 8 CCR2 Configuration Control Register #2 C2H 8 CCR3 Configuration Control Register #3 C3H 8 SMAR SMM Address Region CDH-CFH 24 DIR0 Device Identification register #0 FEH 8 DIR1 Device Identification register #1 FFH 8 For access to this register You need to do: A) write INDEX_OF_REGISTER to I/O port #22H B) wait 5-6 clocks D) read/write DATA from/to register via I/O port #23 Note: If Index of register not in range C0H..CFH,FEH,FFH then Cyrix CPU generated external bus cycle. If You try to read I/O port #22H CPU will generated external bus cycle too. Then index is out of range all operations with port #23H will generate external bus cycle. State After Reset: CCR1 00H CCR2 00H CCR3 00H SMAR 0 DIR0 see DIR0 description DIR1 see DIR1 description format of registers: CCR1: Bit Name Description 7..5 Reserved 4 NO_LOCK (Negate LOCK#) 3 MMAC (Main Memory Access) If =1 then all data access which occur within SMI routine (when SMAC=1) accessing main memory instead SMM space =0 No affects on access 2 SMAC (System Managment Memory Access) If =1 Any access within SMM memory space issued with SMAADS# output active, SMI# ignored =0 No affects on access 1 SMI (Enable SMM pins) If =1 then enable SMI# i/o pin and SMADS# output pin =0 Float it 0 RPL (Enable RPL pins) If=1 then enable output pins RPLSET(1-0) and RPLVAL# =0 Float it CCR2: Bit Name Description 7 SUSP (Enable Suspend pins) If =1 SUSP# input and SUSPA# output pins enabled =0 Float 6 BWRT (Enable Burst Write Cycle) If =1 enable use of 16byte burst WB cycle =0 disable 5 BARB (Enable cache coherency on Bus Arbitration) If =1 enable write back of all dirty cache data when HOLD is requered and prior to asserting HLDA. =0 isable 4 WT1 (Write-Through Region 1) If =1 Forces all writes to the 640KB-1MB region that hit in cache issued on the external bus 3 HALT (Suspend on HALT) If =1 CPU enters suspend mode following execution HLT instruction. 2 LOCK_NW (Lock NW bit) If =1 Prohibits changing the state of NW bit in CR0 1 WBAK (Enable WB Cache Interface pins) If =1 then enable INVAL,WM_RST and HITM# pins =0 float it 0 COP?? Reserved (Award BIOS used this bit during coprocessor Test, in Cx486S, Cx486S2 only) (may be turn coprocessor on :))) CCR3: Note: Cyrix Cx486S/D never have CCR3 register. Bit Name Description 7..2 Reserved 1 NMIEN (NMI Enable) If =1 then NMI enable during SMM If =0 NMI don't recognizing during SMM 0 SMI_LOCK (SMM Register Lock) If =1 the following SMM control bits can not be modified: CCR1: bits 1,2,3 CCR3: bit 1 But this bit may be changed in SMM. This bit (SMI_LOCK) clearing RESET only. SMAR: (Index CDh) Bit Description 7..0 A31..A24 bits of starting adress of SMM region (Index CEh) Bit Description 7..0 A23..A16 bits of starting adress of SMM region (Index CFh) Bit Description 7..4 A15..A12 bits of starting adress of SMM region 3..0 Size of SMM region: 0000 SMM region disabled 0001 4K 0010 8K 0011 16K 0100 32K 0101 64K 0110 128K 0111 256K 1000 512K 1001 1M 1010 2M 1011 4M 1100 8M 1101 16M 1110 32M 1111 4K DIR0: Bit Description 7..0 (Device Identification) ------------------------------------------- for Cx486SLC/e = 00h for Cx486DLC = 01h for Cx486SLC2 = 02h for Cx486DLC2 = 03h for Cx486SRx = 04h for Cx486DRx = 05h for Cx486SRx2 = 06h for Cx486DRx2 = 07h for Cx486SRu = 08h for Cx486DRu = 09h for Cx486SRu2 = 0Ah for Cx486DRu2 = 0Bh for Cx486S = 10h ; B Step for Cx486S2 = 11h ; B Step for Cx486Se = 12h or 14h or 16h ; 12h - B step for Cx486S2e = 13h or 15h or 17h ; 12h - B step for Cx486DX/BL486DX = 1Ah for Cx486DX2/BL486DX2 = 1Bh for ST486DX2 = 1Bh for TI486DX2 = 1Bh ------------------------------------------- for Cx486DX4 (x2 mode)= 1Bh (x2 mode) Note: DIR1 = 36h for DX4 1Fh (x3 mode) ------------------------------------------- for Cx5x86 (M1sc) = 28h (x1,S) = 29h (x2,S) = 2Ah (x1,P) = 2Bh (x2,P) = 2Ch (x4,S) = 2Dh (x3,S) = 2Eh (x4,P) = 2Fh (x3,P) ------------------------------------------- for Cyrix Cx6x86 (M1) = 20h,30h (1x,S) [DIR1 < 20h] = 21h,31h (2x,S) [DIR1 < 20h] = 22h,32h (1x,P) [DIR1 < 20h] = 23h,33h (2x,P) [DIR1 < 20h] = 24h,34h (4x,S) [DIR1 < 20h] = 25h,35h (3x,S) [DIR1 < 20h] = 26h,36h (4x,P) [DIR1 < 20h] = 27h,37h (3x,P) [DIR1 < 20h] ------------------------------------------- for Cyrix Cx6x86L(M1) = 30h (1x) [DIR1 > 21h] = 31h (2x) [DIR1 > 21h] = 35h (3x) [DIR1 > 21h] = 34h (4x) [DIR1 > 21h] ------------------------------------------- for Cyrix MediaGX = 41h (3x) [DIR1: 00h-2Fh] = 44h (4x,S) [DIR1: 00h-2Fh] = 45h (3x,S) [DIR1: 00h-2Fh] = 46h (4x,P) [DIR1: 00h-2Fh] = 47h (3x,P) [DIR1: 00h-2Fh] ------------------------------------------- cor/PCI for Cyrix GXm = 40h x4 = 41h [DIR1: 50h-FFh] x10 [DIR1: 30h-4Fh] x6 = 42h x4 = 43h x6 = 44h [DIR1: 50h-FFh] x9 [DIR1: 30h-4Fh] x7 = 45h [DIR1: 50h-FFh] x5 [DIR1: 30h-4Fh] x8 = 46h x7 = 47h [DIR1: 30h-4Fh] x5 [DIR1: 50h-FFh] x8 ------------------------------------------- for Cyrix 6x86MX (M2) [DIR1: 00h-07h or 80h-8Fh] and Cyrix MII (M2) [DIR1: 08h-7Fh] = 50h (1.5x,S) = 51h (2x,S) = 52h (2.5x,S) = 53h (3x,S) = 54h (3.5x,S) = 55h (4x,S) = 56h (4.5x,S) = 57h (5x,S) = 58h (1,5x,P) = 59h (2x,P) = 5Ah (2.5x,P) = 5Bh (3x,P) = 5Ch (3.5x,P) = 5Dh (4x,P) = 5Eh (4.5x,P) = 5Fh (5x,P) ------------------------------------------- for TI486DX4 = 81h for Cyrix OverDrive = FDh for TI Potomac's = FFh ;; None connections Important Note: The original Cx486SLC never have DIRi registers. DIR1: Note: Cyrix Cx486S/D never have DIR1 register. Bit Name Description 7..4 SID Stepping Identificator 3..0 RID Revision Identification See Appendix A3 for more information CPU DIR0 DIR1 NOTE Cx486DX-40 1Ah 05h Cx486DX-50 1Ah 05h Cx486DX2-50 1Bh 08h Cx486DX2-50 1Bh 08h Marked 001 on pin side of chip ST486DX2-66 1Bh 0Bh ST486DX2-66 1Bh 0Bh Cx486DX2-v80 1Bh 31h 3 VOLT Cx486DX4-v100 1Fh 36h 3 VOLT Cx5x86-100 2Dh 13h 3 VOLT TI486DX2-66,80 1Bh 32h stepping eA0 TI486DX2-66,80 1Bh B2h stepping eB0 TI486DX4-100 81h 91h ----------------------------------------------------- APPENDIX A2 TI486SXLC/SXL configuration Registers for TI486SXL -------------- Register Full Register Name Index size(bits) CCR0 Configuration Control Register #0 C0H 8 CCR1 Configuration Control Register #1 C1H 8 ARR1 Address Region #1 C4H-C6H 24 ARR2 Address Region #2 C7H-C9H 24 ARR3 Address Region #3 CAH-CCH 24 ARR4 Address Region #4 CDH-CFH 24 for TI486SXLC -------------- Register Full Register Name Index size(bits) CCR0 Configuration Control Register #0 C0H 8 CCR1 Configuration Control Register #1 C1H 8 ARR1 Address Region #1 C5H-C6H 16 ARR2 Address Region #2 C8H-C9H 16 ARR3 Address Region #3 CBH-CCH 16 ARR4 Address Region #4 CEH-CFH 16 For access to this register You need to do: A) write INDEX_OF_REGISTER to I/O port #22H B) wait 5-6 clocks D) read/write DATA from/to register via I/O port #23 Note: If Index of register not in range C0H..CFH then Cyrix CPU generated external bus cycle. If You try to read I/O port #22H CPU will generated external bus cycle too. Then index is out of range all operations with port #23H will generate external bus cycle. State After Reset: CCR0 00H CCR1 xxxx xxx0B ARR1 000Fh ; 4Gbyte Non-Caching Region ARR2 0 ARR3 0 ARR4 0 format of registers: CCR0: Bit Name Description 7 SUS If =1 then enable SUSP# and SUSPA# pins, which used for put CPU in PowerSave mode. If =0 disable 6 CKD (Clock Double) If =0 Disable Clock-double mode If =1 Enable Clock-Double mode 5 BARB If =1 then enable flushing internal cache when begining HOLD state. IF =0 disable. 4 FLUSH If =1 enable input pin FLUSH# if =0 disable 3 KEN If =1 enable input pin KEN# if =0 disable 2 A20M If =1 enable input pin A20M# if =0 disable 1 NC1 If=1 then 640KB-1MB area never caching If=0 caching (but see NCRi) 0 NC0 If=1 then first 64K of each 1MB bounds not caching, when in Real or Virtual8086 mode If =0 caching CCR1: Bit Name Description 7 SM4 Access Region 4 Control If=1 then Region 4 is non-cachable SMM Memory Space If=0 Region 4 is non-cachable. SMI# input ignored. 6 WP3 Access Region 3 Control If=1 then Region 3 is write-protected and cachable If=0 Region 3 is non-cachable. 5 WP2 Access Region 2 Control If=1 then Region 2 is write-protected and cachable If=0 Region 2 is non-cachable. 4 WP1 Access Region 1 Control If=1 then Region 1 is write-protected and cachable If=0 Region 1 is non-cachable. 3 NMAC Main Memory Access If=1 All data accesses which occur within SMI service routine (or then SMAC=1) will access main memory instead of SMM Memory space If=0 No changes in access 2 SMAC System Managment memory access If=1 Any access to addresses within SMM memory space cause external bus cycles to be issued with SMADS# output active. SMI# input is ignored. 1 SMI Enable SMM Pins If=1 SMI# input/output pin and SMADS# output pin are enabled If=0 Disabled 0 Reserved ARRi: Byte Bits Description 0 7-0 Address bits A31-A24 of non-cacheble region start (Reserved for TI486SXLC) 1 7-0 Address bits A23-A16 of non-cachable region start 2 7-4 Address bits A15-A12 of non-cacheble region start 2 3-0 Size of non-cacheble block: 0000 Disable NCRi 0001 4K 0010 8K 0011 16K 0100 32K 0101 64K 0110 128K 0111 256K 1000 512K 1001 1M 1010 2M 1011 4M 1100 8M 1101 16M 1110 32M 1111 4G ARRi bytes: Byte ARRi 0 1 2 ARR1 C4H C5H C6H ARR2 C7H C8H C9H ARR3 CAH CBH CCH ARR4 CDH CDH CEH --------------------------------------------------- APPENDIX A3 Texas Instruments TI486DX2,TI486DX4 configuration Registers Register Full Register Name Index size(bits) CCR1 Configuration Control Register #1 C1H 8 CCR2 Configuration Control Register #2 C2H 8 CCR3 Configuration Control Register #3 C3H 8 SMAR SMM Address Region CDH-CFH 24 DIR0 Device Identification register #0 FEH 8 DIR1 Device Identification register #1 FFH 8 For access to this register You need to do: A) write INDEX_OF_REGISTER to I/O port #22H B) wait 5-6 clocks D) read/write DATA from/to register via I/O port #23 Note: If Index of register not in range C0H..CFH,FEH,FFH then Cyrix CPU generated external bus cycle. If You try to read I/O port #22H CPU will generated external bus cycle too. Then index is out of range all operations with port #23H will generate external bus cycle. State After Reset: CCR1 00H CCR2 00H CCR3 00H SMAR 0 DIR0 see DIR0 description DIR1 see DIR1 description format of registers: CCR1: Bit Name Description 7..5 Reserved 4 NO_LOCK (Negate LOCK#) If =0 Usuall scheme If =1 previously noncachable locked cycles will be executed as unlocked, result is higher perfomanse. 3 MMAC (Main Memory Access) If =1 then all data access which occur within SMI routine (when SMAC=1) accessing main memory instead SMM space =0 No affects on access 2 SMAC (System Managment Memory Access) If =1 Any access within SMM memory space issued with SMAADS# output active, SMI# ignored =0 No affects on access 1 SMI (Enable SMM pins) If =1 then enable SMI# i/o pin and SMADS# output pin =0 Float it 0 RPL (Enable RPL pins) If=1 then enable output pins RPLSET(1-0) and RPLVAL# =0 Float it CCR2: Bit Name Description 7 SUSP (Enable Suspend pins) If =1 SUSP# input and SUSPA# output pins enabled =0 Float 6 BWRT (Enable Burst Write Cycle) If =1 enable use of 16byte burst WB cycle =0 disable 5 BARB (Enable cache coherency on Bus Arbitration) If =1 enable write back of all dirty cache data when HOLD is requered and prior to asserting HLDA. =0 isable 4 WT1 (Write-Through Region 1) If =1 Forces all writes to the 640KB-1MB region that hit in cache issued on the external bus 3 HALT (Suspend on HALT) If =1 CPU enters suspend mode following execution HLT instruction. 2 LOCK_NW (Lock NW bit) If =1 Prohibits changing the state of NW bit in CR0 1 WBAK (Enable WB Cache Interface pins) If =1 then enable INVAL,WM_RST and HITM# pins =0 float it 0 Reserved CCR3: Note: Cyrix Cx486S/D never have CCR3 register. Bit Name Description 7..4 Reserved 3 SM_MODE (SMM Mode Select) If =0 then Normal SMM mode (Cyrix style) If =1 then SL-compatible mode (but SMI_LOCK MUST BE 0) Note: For more info refer to "TI486DX2 Microprocessor SM Mode Programming Guide" // Texas Instruments 1995 (literature number SRZU019) 2 Reserved 1 NMIEN (NMI Enable) If =1 then NMI enable during SMM If =0 NMI don't recognizing during SMM 0 SMI_LOCK (SMM Register Lock) If =1 the following SMM control bits can not be modified: CCR1: bits 1,2,3 CCR3: bit 1 Any SMAR bits But this bit may be changed in SMM. This bit (SMI_LOCK) clearing RESET only. SMAR: (Index CDh) Bit Description 7..0 A31..A24 bits of starting adress of SMM region (Index CEh) Bit Description 7..0 A23..A16 bits of starting adress of SMM region (Index CFh) Bit Description 7..4 A15..A12 bits of starting adress of SMM region 3..0 Size of SMM region: 0000 SMM region disabled 0001 4K 0010 8K 0011 16K 0100 32K 0101 64K 0110 128K 0111 256K 1000 512K 1001 1M 1010 2M 1011 4M 1100 8M 1101 16M 1110 32M 1111 4K DIR0: Bit Description 7..0 (Device Identification) for TI486DX2 = 1Bh (compare with Cyrix's DIR0) for TI486DX4 = 81h DIR1: Bit Name Description 7 MID Manafacturer ID 0 = Cyrix 1 = Texas Instruments (support starting TI486DX2 eB0 steping) 6..4 SID Stepping Identificator 3..0 RID Revision Identification see Appendix A1 for more info about identification. --------------------------------------------------- APPENDIX A4 Cyrix Cx5x86, IBM 5x86 configuration Registers for access Register Full Register Name Index size(bits) MAPEN(3..0) PCR0 Perfomance Control register 20h 8 1 CCR1 Configuration Control Register #1 C1H 8 x CCR2 Configuration Control Register #2 C2H 8 x CCR3 Configuration Control Register #3 C3H 8 x CCR4 Configuration Control Register #4 E8h 8 1 SMAR SMM Address Region CDH-CFH 24 x PMR Power Managment register F0h 8 1 DIR0 Device Identification register #0 FEH 8 x DIR1 Device Identification register #1 FFH 8 x For access to this register You need to do: A) write INDEX_OF_REGISTER to I/O port #22H B) wait 5-6 clocks D) read/write DATA from/to register via I/O port #23 Note: If Index of register not in range C0H..CFH,FEH,FFH then Cyrix CPU generated external bus cycle. If You try to read I/O port #22H CPU will generated external bus cycle too. Then index is out of range all operations with port #23H will generate external bus cycle. State After Reset: CCR1 00H CCR2 00H CCR3 00H SMAR 0 DIR0 see DIR0 description DIR1 see DIR1 description format of registers: PCR0: Bit Name Description 7 LSSER If set, all memory reads/writes will occur in execution order 6..3 Reserved 2 LOOP_EN If set, enables faster support for loops. 1 BTB_EN If set, enables the Branch Target Buffer for branch prediction 0 RSTK_EN If se, enables call return stack CCR1: Bit Name Description 7..4 Reserved 3 MMAC (Main Memory Access) If =1 then all data access which occur within SMI routine (when SMAC=1) accessing main memory instead SMM space =0 No affects on access 2 SMAC (System Managment Memory Access) If =1 Any access within SMM memory space issued with SMAADS# output active, SMI# ignored =0 No affects on access 1 SMI (Enable SMM pins) If =1 then enable SMI# i/o pin and SMADS# output pin =0 Float it 0 Reserved CCR2: Bit Name Description 7 SUSP (Enable Suspend pins) If =1 SUSP# input and SUSPA# output pins enabled =0 Float 6 BWRT (Enable Burst Write Cycle) If =1 enable use of 16byte burst WB cycle =0 disable 5 Reserved 4 WT1 (Write-Through Region 1) If =1 Forces all writes to the 640KB-1MB region that hit in cache issued on the external bus 3 HALT (Suspend on HALT) If =1 CPU enters suspend mode following execution HLT instruction. 2 LOCK_NW (Lock NW bit) If =1 Prohibits changing the state of NW bit in CR0 1 WBAK (Enable WB Cache Interface pins) If =1 then enable INVAL,WM_RST and HITM# pins =0 float it 0 Reserved CCR3: Bit Name Description 7..4 MAPEN(3-0) (Register Mapping Enable) If set to 0001b all register accessible, else 0000h then accessed only (C0j-CFh,FEh,FFh) 3 SMM_MODE If =1, then CPU hardware interface pins are redefined to function like SMM hardware interface on SL Enhanced Intel's CPUs 2 LINBRST If =1, CPU will use linear address sequence when performing burst cycle, If =0 CPU will used 1+4 address sequence. 1 NMIEN (NMI Enable) If =1 then NMI enable during SMM If =0 NMI don't recognizing during SMM 0 SMI_LOCK (SMM Register Lock) If =1 the following SMM control bits can not be modified: CCR1: bits 1,2,3 CCR3: bit 1 But this bit may be changed in SMM. This bit (SMI_LOCK) clearing RESET only. SMAR: (Index CDh) Bit Description 7..0 A31..A24 bits of starting adress of SMM region (Index CEh) Bit Description 7..0 A23..A16 bits of starting adress of SMM region (Index CFh) Bit Description 7..4 A15..A12 bits of starting adress of SMM region 3..0 Size of SMM region: 0000 SMM region disabled 0001 4K 0010 8K 0011 16K 0100 32K 0101 64K 0110 128K 0111 256K 1000 512K 1001 1M 1010 2M 1011 4M 1100 8M 1101 16M 1110 32M 1111 4K CCR4: Bit Name Description 7 CPUIDEN (Enable CPUID instruction) If =1 bit 21 of EFLAGS (ID) may changed, and CPUID instruction enabled, else bit 21 of EFLAGS =0 forever and CPUID caused INT 6 - Invalid Opcode 6 Reserved 5 FP_FAST If =1, FPU execution reporting enabled 4 DTE If =1, Directory Table Entry cache is enabled 3 MEM_BYP If =1, Enabled memory read bypassing 2..0 IORT[2..0] Specify minimum number of bus clocks between two I/O accesses (I/O recovery time) 000 - No Delay 001 - 2 clk 010 - 4 clk 011 - 8 clk 100 - 16 clk 101 - 32 clk (Default Value) 110 - 64 clk 111 - 128 clk PMR: Bit Name Description 7..3 Reserved 2..0 CLK[2..0] Select Bus/Core Operation Frequency CLK2 CLK1 CLK0 Core/Bus 1 x x 1/2 0 0 0 1/1 0 0 1 2/1 0 1 0 3/1 0 1 1 reserved DIR0: Bit Description 7..0 (Device Identification) Value Description Core/Bus clk 29h or 2Bh Cx/IBM/ST 5x86 2/1 2Dh or 2Fh Cx/IBM/ST 5x86 3/1 DIR1: Bit Name Description 7..4 SID Stepping Identificator 3..0 RID Revision Identification Note: 5x86 Cyrix/IBM/ST Stepping Revision 0 0 EDX after reset = [15:8]=DIR1, [7:0]=DIR0 0 1 EDX after reset = [15:8]=DIR1, [7:0]=DIR0 0 2 EDX after reset = [15:8]=04h [7:0]=90h 0 5 1 3 see Appendix A1 for more info about identification. --------------------------------------------------- APPENDIX A5 Cyrix Cx6x86 (M1), IBM 6x86 configuration Registers for access Register Full Register Name Index size(bits) MAPEN(3..0) DBR0 30H 8 ? ??? 31H 8 ? ??? 32H 8 ? ??? 33H 8 ? ??? 34H 8 ? ??? 38H 8 ? ??? 3CH 8 ? CCR0 Configuration Control Register #0 C0H 8 x CCR1 Configuration Control Register #1 C1H 8 x CCR2 Configuration Control Register #2 C2H 8 x CCR3 Configuration Control Register #3 C3H 8 x ARR0 Address Region Register #0 C4H-C6H 24 x ARR1 Address Region Register #1 C7H-C9H 24 x ARR2 Address Region Register #2 CAH-CCH 24 x ARR3 Address Region Register #3 CDH-CFH 24 x ARR4 Address Region Register #4 D0H-D2H 24 1 ARR5 Address Region Register #5 D3H-D5H 24 1 ARR6 Address Region Register #6 D6H-D8H 24 1 ARR7 Address Region Register #7 D9H-DBH 24 1 RCR0 Region Configuration Register #0 DCh 8 1 RCR1 Region Configuration Register #1 DDh 8 1 RCR2 Region Configuration Register #2 DEh 8 1 RCR3 Region Configuration Register #3 DFh 8 1 RCR4 Region Configuration Register #4 E0h 8 1 RCR5 Region Configuration Register #5 E1h 8 1 RCR6 Region Configuration Register #6 E2h 8 1 RCR7 Region Configuration Register #7 E3h 8 1 CCR4 Configuration Control Register #4 E8h 8 1 CCR5 Configuration Control Register #5 E9h 8 1 DIR0 Device Identification register #0 FEH 8 x DIR1 Device Identification register #1 FFH 8 x For access to this register You need to do: A) write INDEX_OF_REGISTER to I/O port #22H B) wait 5-6 clocks D) read/write DATA from/to register via I/O port #23 Note: If Index of register not in range C0H..CFH,FEH,FFH then Cyrix CPU generated external bus cycle. If You try to read I/O port #22H CPU will generated external bus cycle too. Then index is out of range all operations with port #23H will generate external bus cycle. State After Reset: CCR1 00H CCR2 00H CCR3 00H SMAR 0 DIR0 see DIR0 description DIR1 see DIR1 description format of registers: DBR0: Note: This Register is Undocumented Bit Name Description 7 ? ???? 6 ? BTB TR access enabled if = 1 MOV to/from TR1/2 enabled 5 ? Data bypassing and forwarding Enable (default set to 1) 4-0 ? ??? Registers with Indexes 31h,32h,33h: Used for perfomance control or CPU pipeline debbuging. (Usually = 0). Registers with indexes 34h,38h,3Ch exist, but description ???? CCR0: Bit Name Description 7..2 Reserved 1 NC1 (Non-cachable 1MB) If =1 then area 640KM-1MB is non-cachable. CCR1: Bit Name Description 7 SM3 (System Managment Address Region 3) If =1 then ARR3 used as SMM address space region 6..5 Reserved 4 NO_LOCK (No Lock Cycles) If =1 all bus cycles are issued with LOCK# pin negated, except page tables access and INTA cycles. 3 Reserved 2 SMAC (System Managment Memory Access) If =1 Any access within SMM memory space issued with SMAADS# output active, SMI# ignored =0 No affects on access 1 SMI (Enable SMM pins) If =1 then enable SMI# i/o pin and SMADS# output pin =0 Float it 0 Reserved CCR2: Bit Name Description 7 SUSP (Enable Suspend pins) If =1 SUSP# input and SUSPA# output pins enabled =0 Float 6..5 Reserved 4 WPR1 (Write-Protected Region 1) If =1 then any cachable accesses in the 640KB-1MB region are Write-Protected 3 HALT (Suspend on HALT) If =1 CPU enters suspend mode following execution HLT instruction. 2 LOCK_NW (Lock NW bit) If =1 Prohibits changing the state of NW bit in CR0 1..0 Reserved CCR3: Bit Name Description 7..4 MAPEN(3-0) (Register Mapping Enable) If set to 0001b all register accessible, else 0000h then accessed only (C0h-CFh,FEh,FFh) 3 Reserved 2 LINBRST If =1, CPU will use linear address sequence when performing burst cycle, If =0 CPU will used 1+4 address sequence. 1 NMIEN (NMI Enable) If =1 then NMI enable during SMM If =0 NMI don't recognizing during SMM 0 SMI_LOCK (SMM Register Lock) If =1 the following SMM control bits can not be modified: CCR1: bits 1,2,3 CCR3: bit 1 ARR3: Starting address and Block size But this bit may be changed in SMM. This bit (SMI_LOCK) clearing RESET only. ARRi: -- Starting Address --- Region ARR # A31-A24 A23-A16 A15-A12 Block Size 7..0 7..0 7..4 3..0 (Bits) ARR0 C4h C5h C6h C6h (Index) ARR1 C7h C8h C9h C9h ARR2 CAh CBh CCh CCh ARR3 CDh CEh CFh CFh ARR4 D0h D1h D2h D2h ARR5 D3h D4h D5h D5h ARR6 D6h D7h D8h D8h ARR7 D9h DAh DBh DBh (ARRi^) (index) (Index ARRi+0) Bit Description 7..0 A31..A24 bits of starting adress of region #i (Index ARRi+1) Bit Description 7..0 A23..A16 bits of starting adress of region #i (Index ARRi+2) Bit Description 7..4 A15..A12 bits of starting adress of region #i 3..0 Size of region #i : Value ARR0-ARR6 ARR7 0000 **** region disabled **** 0001 4K 256K 0010 8K 512K 0011 16K 1M 0100 32K 2M 0101 64K 4M 0110 128K 8M 0111 256K 16M 1000 512K 32M 1001 1M 64M 1010 2M 128M 1011 4M 256M 1100 8M 512M 1101 16M 1G 1110 32M 2G 1111 4K 4G RCRi: Bit Name ARR# Description 7..6 any Reserved 5 NBL any If =1 LBA# pin is negated for corresponding region 4 WT any If =1 Write-Throught caching is enable for region 3 WG any If =1 Write Gathering enabled for region 2 WL any If =1 Weak Locking enable for region 1 WWO any If =1 weak write ordering enable for region 0 RCD 0..6 If =1 address region is non-cachable 0 RCE 7 If=1 region is cachable and implies thet address space outside of region is non-cachable. CCR4: Bit Name Description 7 CPUIDEN (Enable CPUID instruction) If =1 bit 21 of EFLAGS (ID) may changed, and CPUID instruction enabled, else bit 21 of EFLAGS =0 forever and CPUID caused INT 6 - Invalid Opcode 6..5 Reserved 4 DTE If =1, Directory Table Entry cache is enabled 3 Reserved 2..0 IORT[2..0] Specify minimum number of bus clocks between two I/O accesses (I/O recovery time) (base modeL) (some later models) 000 - No Delay 000 - fast 001 - 2 clk 010 - 4 clk 011 - 8 clk ....... 100 - 16 clk 101 - 32 clk (Default Value) 110 - 64 clk 111 - 128 clk 111 - no delay CCR5: Bit Name Description 7 Reserved 6 VIPERM If = 1 then prevents any access to contol registers outside of range C0..CF if MAPEN in CCR3 has the other value that 1. Note: This is effect of Disable CPU identification via DIR0 and DIR1 (reads FFh while VIPERM=1 and MAPEN != 1). 5 ARREN (Address region registers Enable) If =1 then Enable all ARRs, If =0 all ARRs disable, but if SM3=1 then ARR3 enable. 4 LBR1 If =1 LBA# pin asserted for all accesses to the 640KB-1MB region 3..2 Reserved 1 SLOP (Slow Loop Instruction) Slow Loop instruction make CPU more compatible with Pentium for critical-timing rootining. 0 WT_ALLOC If =1 new cache lines allocated for both read misses and write misses, else only on read misses. DIR0: Bit Description 7..0 (Device Identification) Value Description Core/Bus clk Note 20h or 22h 6x86 (M1) 1/1 Early 6x86 21h or 23h 6x86 (M1) 2/1 25h or 27h 6x86 (M1) 4/1 24h or 26h 6x86 (M1) 3/1 30h or 32h 6x86 (M1) 1/1 Modern 6x86 31h or 33h 6x86 (M1) 2/1 35h or 37h 6x86 (M1) 4/1 34h or 36h 6x86 (M1) 3/1 DIR1: Bit Name Description 7..4 SID Stepping Identificator 3..0 RID Revision Identification Value Description 0xh - Old Cyrix Samplers of 6x86 ??? 1xh - Normal 6x86. 10h,11h,12h - Early 6x86s (with DIR0 = 2xh) 14h - v2.4 15h - v2.5 16h - v2.6 17h - v2.7 or 3.7 (first with no NT problems, with SLOP bit). 2xh - 6x86L (Dual Voltage,Lower Power) 20h,21h - Samplers 22h - v4.0 (no SLOP support) Note: Register with Index FCh contains CPU family. Initialized by 05h, but may be changed by USER, look CPUID instruction for more info. see Appendix A1 for more info about identification ----------------------------- Format of TR1,TR2 registers: Note: Need to Enable MOV to/from TR1/2 using DBR0 register in processor control space. TR1: Bits Description 31..5? ????? 5..3 Index of register in BTB Control space. (Register will be accesable via TR2) 2..0 ???? TR2: Data, which will be written/reading from/to register Registers in BTB control space: Reg 4 - ??????? Reg 5: Bits Description 0 BTB Disable 1 Far BTB COF hits enable. If =1 enable BTB to predict intersegment jumps. 2 Return Stack Enable 3 ???? (used) 4..31 ????? --------------------------------------------------- APPENDIX A6 Cyrix Cx6x86MX (M2) for access Register Full Register Name Index size(bits) MAPEN(3..0) CCR0 Configuration Control Register #0 C0H 8 x CCR1 Configuration Control Register #1 C1H 8 x CCR2 Configuration Control Register #2 C2H 8 x CCR3 Configuration Control Register #3 C3H 8 x ARR0 Address Region Register #0 C4H-C6H 24 x ARR1 Address Region Register #1 C7H-C9H 24 x ARR2 Address Region Register #2 CAH-CCH 24 x ARR3 Address Region Register #3 CDH-CFH 24 x ARR4 Address Region Register #4 D0H-D2H 24 1 ARR5 Address Region Register #5 D3H-D5H 24 1 ARR6 Address Region Register #6 D6H-D8H 24 1 ARR7 Address Region Register #7 D9H-DBH 24 1 RCR0 Region Configuration Register #0 DCh 8 1 RCR1 Region Configuration Register #1 DDh 8 1 RCR2 Region Configuration Register #2 DEh 8 1 RCR3 Region Configuration Register #3 DFh 8 1 RCR4 Region Configuration Register #4 E0h 8 1 RCR5 Region Configuration Register #5 E1h 8 1 RCR6 Region Configuration Register #6 E2h 8 1 RCR7 Region Configuration Register #7 E3h 8 1 CCR4 Configuration Control Register #4 E8h 8 1 CCR5 Configuration Control Register #5 E9h 8 1 CCR6 Configuration Control Register #6 EAh 8 1 DIR0 Device Identification register #0 FEH 8 x DIR1 Device Identification register #1 FFH 8 x For access to this register You need to do: A) write INDEX_OF_REGISTER to I/O port #22H B) wait 5-6 clocks D) read/write DATA from/to register via I/O port #23 Note: If Index of register not in range C0H..CFH,FEH,FFH then Cyrix CPU generated external bus cycle. If You try to read I/O port #22H CPU will generated external bus cycle too. Then index is out of range all operations with port #23H will generate external bus cycle. State After Reset: CCR1 00H CCR2 00H CCR3 00H SMAR 0 DIR0 see DIR0 description DIR1 see DIR1 description format of registers: CCR0: Bit Name Description 7..2 Reserved 1 NC1 (Non-cachable 1MB) If =1 then area 640KM-1MB is non-cachable. CCR1: Bit Name Description 7 SM3 (System Managment Address Region 3) If =1 then ARR3 used as SMM address space region 6..5 Reserved 4 NO_LOCK (No Lock Cycles) If =1 all bus cycles are issued with LOCK# pin negated, except page tables access and INTA cycles. 3 Reserved 2 SMAC (System Managment Memory Access) If =1 Any access within SMM memory space issued with SMAADS# output active, SMI# ignored =0 No affects on access 1 SMI (Enable SMM pins) If =1 then enable SMI# i/o pin and SMADS# output pin =0 Float it 0 Reserved CCR2: Bit Name Description 7 SUSP (Enable Suspend pins) If =1 SUSP# input and SUSPA# output pins enabled =0 Float 6..5 Reserved 4 WPR1 (Write-Protected Region 1) If =1 then any cachable accesses in the 640KB-1MB region are Write-Protected 3 HALT (Suspend on HALT) If =1 CPU enters suspend mode following execution HLT instruction. 2 LOCK_NW (Lock NW bit) If =1 Prohibits changing the state of NW bit in CR0 1 SADS If =1 CPU insert an idle cyce following the BRDY# and idle cycle prior to asserting ADS# 0 Reserved CCR3: Bit Name Description 7..4 MAPEN(3-0) (Register Mapping Enable) If set to 0001b all register accessible, else 0000h then accessed only (C0h-CFh,FEh,FFh) 3 Reserved 2 LINBRST If =1, CPU will use linear address sequence when performing burst cycle, If =0 CPU will used 1+4 address sequence. 1 NMIEN (NMI Enable) If =1 then NMI enable during SMM If =0 NMI don't recognizing during SMM 0 SMI_LOCK (SMM Register Lock) If =1 the following SMM control bits can not be modified: CCR1: bits 1,2,3 CCR3: bit 1 CCR6: bits 6,1,0 ARR3: Starting address and Block size But this bit may be changed in SMM. This bit (SMI_LOCK) clearing RESET only. ARRi: -- Starting Address --- Region ARR # A31-A24 A23-A16 A15-A12 Block Size 7..0 7..0 7..4 3..0 (Bits) ARR0 C4h C5h C6h C6h (Index) ARR1 C7h C8h C9h C9h ARR2 CAh CBh CCh CCh ARR3 CDh CEh CFh CFh ARR4 D0h D1h D2h D2h ARR5 D3h D4h D5h D5h ARR6 D6h D7h D8h D8h ARR7 D9h DAh DBh DBh (ARRi^) (index) (Index ARRi+0) Bit Description 7..0 A31..A24 bits of starting adress of region #i (Index ARRi+1) Bit Description 7..0 A23..A16 bits of starting adress of region #i (Index ARRi+2) Bit Description 7..4 A15..A12 bits of starting adress of region #i 3..0 Size of region #i : Value ARR0-ARR6 ARR7 0000 **** region disabled **** 0001 4K 256K 0010 8K 512K 0011 16K 1M 0100 32K 2M 0101 64K 4M 0110 128K 8M 0111 256K 16M 1000 512K 32M 1001 1M 64M 1010 2M 128M 1011 4M 256M 1100 8M 512M 1101 16M 1G 1110 32M 2G 1111 4G 4G RCRi: Bit Name ARR# Description 7 any Reserved 6 INV_RGN 0..6 If =1, then all memory outside specific memory region treated as RCR flags for this region (Inversion) 5 any Reserved 4 WT any If =1 Write-Throught caching is enable for region 3 WG any If =1 Write Gathering enabled for region 2 WL any If =1 Weak Locking enable for region 1 any Reserved 0 CD any If =1 address region is non-cachable CCR4: Bit Name Description 7 CPUIDEN (Enable CPUID instruction) If =1 bit 21 of EFLAGS (ID) may changed, and CPUID instruction enabled, else bit 21 of EFLAGS =0 forever and CPUID caused INT 6 - Invalid Opcode 6..3 Reserved 2..0 IORT[2..0] Specify minimum number of bus clocks between two I/O accesses (I/O recovery time) 000 - 1 clk 001 - 2 clk 010 - 4 clk 011 - 8 clk 100 - 16 clk 101 - 32 clk (Default Value) 110 - 64 clk 111 - no delay Note: 6x86 (M1), 000 - no delay, 111 - 128 clk CCR5: Bit Name Description 7..6 Reserved 5 ARREN (Address region registers Enable) If =1 then Enable all ARRs, If =0 all ARRs disable, but if SM3=1 then ARR3 enable. 4..1 Reserved 0 WT_ALLOC If =1 new cache lines allocated for both read misses and write misses, else only on read misses. CCR6: Bit Name Description 7 Reserved 6 N (Nested SMI Enable bit) If =1 enable nesting of SMI If = 0 disabled. (This bit automatically cleared when entered every SMI routine) 5..2 Reserved 1 WP_ARR3 (Write Protected Memory Region # 3) if =1 Memory region defined by ARR3 is write-protected, when operating outside SMM mode 0 SMM_MODE (SMM Mode) if = 1 Enable Cyrix Enhanced SMM if = 0 Disable Cyrix Enhanced SMM DIR0: Bit Description 7..0 (Device Identification) Value Description Core/Bus clk 5xh 6x86MX (see APPENDIX B for more details) DIR1: Bit Name Description 7..4 SID Stepping Identificator 3..0 RID Revision Identification see Appendix A1 for more info about identification Note: Try to test some Undocument Registers from Cx6x86. ---------------------------------------------- APPENDIX B Codes which returned after Reset in EDX DH DL Type of CPU Steppin Model ID Revision ------------------------------------------------------------ i386DX A (00h) ??? :Early Models B0-B10 03h 03h 04h :??? D0 05h D1-D2 08h E0,E1,F0 08h ------------------------------------------------------------ Am386DX/DXL A 03h 05h B 08h ------------------------------------------------------------ i386SX A0 23h 04h B 05h C,D,E 08h ------------------------------------------------------------ Am386SX/SXL A1 23h 05h B 08h ------------------------------------------------------------ Intel386CXSA A 23h 09h ------------------------------------------------------------ Intel386CXSB A 23h 09h ------------------------------------------------------------ i386EX A 23h 09h ------------------------------------------------------------ Intel386SXSA ? 23h 09h ------------------------------------------------------------ i376 A0 33h 05h B 08h ------------------------------------------------------------ i386SL A0-A3 43h 0xh (05H) B0-B1 1xh ------------------------------------------------------------ RapidCAD (tm) A 03h 40h B 41h ------------------------------------------------------------ IBM 386SLC A A3h xxh ------------------------------------------------------------ Cx486SLC A 04h 10h ------------------------------------------------------------ TI486SLC/DLC/e A 04h 10h B 11h ------------------------------------------------------------ TI486SXL/SXLC A 04h 10h B 11h ------------------------------------------------------------ i486DX A0/A1 04h 00h B2-B6 01h C0 02h C1 03h D0 04h cA2,cA3 10h cB0,cB1 11h cC0 13h aA0,aA1 14h : SL Enhanced aB0 15h : SL Enhanced ------------------------------------------------------------ Am486DX any 04h 12h ------------------------------------------------------------ UMC U5SD any 04h 1xh ------------------------------------------------------------ i486SX A0 04h 20h B0 22h bBx 23h : SL Enhanced gAx 24h cA0 27h cB0 28h aA0,aA1 2Ah : SL Enhanced aB0,aC0 2Bh : SL Enhanced ------------------------------------------------------------ i487SX A0 04h 20h B0 21h ------------------------------------------------------------ UMC U5S any 04h 23h ------------------------------------------------------------ UMC U5SX 486-A any 04h 23h ------------------------------------------------------------ UMC U5SD 04h 23h ------------------------------------------------------------ Cx5x86 0,rev 1- 04h 29h : core/bus clk=2/1 +clones 2Bh : core/bus clk=2/1 +clones 2Dh : core/bus clk=3/1 +clones 2Fh : core/bus clk=3/1 +clones ------------------------------------------------------------ i486DX2 & A0-A2 04h 32h OverDrive (tm) B1 33h aA0,aA1 34h : SL Enhanced aB0,aC0 35h : SL Enhanced ------------------------------------------------------------ Am486DX2 any 04h 32h : 66 and 80 MHz ------------------------------------------------------------ Am486DXL2 any 04h 32h ------------------------------------------------------------ Am486DX4 any 04h 32h : Original any 04h 84h : Enhanced in WT mode 04h 94h : Enhanced in WB mode ------------------------------------------------------------ UMC U486DX2 any 04h 3xh : ??? ------------------------------------------------------------ UMC U486SX2 any 04h 5xh : ??? ------------------------------------------------------------ i486SL A 04h 40h ?? 41h ------------------------------------------------------------ i486SX2 aC0 04h 5Bh : SL Enhanced ------------------------------------------------------------ IntelSX2 (tm) A 04h 5xh OverDrive (tm) ------------------------------------------------------------ WB Enh IntelDX2 A 04h 70h : in WB mode (P24D) 36h : in WT mode ------------------------------------------------------------ IBM BL486DX2 A 04h 80h ------------------------------------------------------------ IntelDX4 (tm) A 04h 80h ------------------------------------------------------------ TI TI486DX2 any 04h 80h ------------------------------------------------------------ TI TI486DX4 any 04h 81h ------------------------------------------------------------ IntelDX4 (tm) A 14h 80h : DX4ODPR (5V IntelDX4) OverDrive (tm) ------------------------------------------------------------ Cx5x86 0,rev 2+ 04h 90h ------------------------------------------------------------ Write-Back Enh. A 04h 83h : WT Mode IntelDX4 (tm) 90h : WB mode ------------------------------------------------------------ AMD Am5x86 A 04h 84h : x3, WT mode 94h : x3, WB mode E4h : x4, WT mode F4h : x4, WB mode ------------------------------------------------------------ IBM 486SLC A A4h 0xh ------------------------------------------------------------ IBM 486SLC2 Ax A4h 1xh Bx 2xh ?? 3xh ------------------------------------------------------------ IBM 486BLX3 A 84h xxh ------------------------------------------------------------ Cyrix M5 all 00h 05h (Cx486S/D) ------------------------------------------------------------ Cyrix M6 all 00h 06h (Cx486DX) ------------------------------------------------------------ Cyrix M7 all 00h 07h (Cx486DX2) ------------------------------------------------------------ Cyrix M8 all 00h 08h (Cx486DX4) ------------------------------------------------------------ Am5k86 (SSA/5) all 05h 0xh ; Model 0 E 05h 00h F 01h ------------------------------------------------------------ Am5k86 (K5) all 05h 1xh : (x1.5) ; Model 1 05h 2xh : (x1.75) ; Model 2 24h 05h 3xh : (x2) ; Model 3 ------------------------------------------------------------ AMD K6 05h 6xh ; Model 6 61h 7xh ; Model 7 ------------------------------------------------------------ AMD K6-2 05h 8xh ; Model 8 ------------------------------------------------------------ AMD K6-III 05h 9xh ; Model 9 ------------------------------------------------------------ Pentium (P5) Ax 05h 0xh : (FPU bug) B1 05h 13h : (FPU bug) B2 05h 14h : (FPU bug) C1 05h 15h : (FPU bug) D1 05h 17h ------------------------------------------------------------ Pentium (P54C) B1 05h 21h : (FPU bug) (P54CS) B3 05h 22h : (FPU bug) (P54CSQ) B5 05h 24h : (FPU bug) C1 05h 25h C2 25h E0 26h : 75,90,100,120 MHz cB1 2Bh : 120,133 MHz cC0 2Ch : 133,150,166,200 MHz ------------------------------------------------------------ Pentium mA1 05h 25h (P54LM) mcB1 2Bh (Mobile) mcC0 2Ch (Vcc=2.9V) mA4 70h ------------------------------------------------------------ Pentium Overdrive B1 15h 31h : PODP5V63, PODP5V83 (Vcc=5V)(P24T) B2 15h 31h : (Socket 3,6) C0 15h 32h ------------------------------------------------------------ Pentium OverDrive tA0 05h 1Ah : PODP5V120, PODP5V133 (P5T) : (Socket 4) ------------------------------------------------------------ Pentium OverDrive aC0 05h 2Ch : PODP3V125, PODP3V150 (P54T) : PODP3V166 : (Socket 5,7) ------------------------------------------------------------ NexGen Nx586 05h 0xh 04h : 120 MHz 06h : 133 MHz ------------------------------------------------------------ Cx6x86 05h 2xh : early models (M1) 30h : core/bus = 1/1 32h : core/bus = 1/1 31h : core/bus = 2/1 33h : core/bus = 2/1 34h : core/bus = 3/1 36h : core/bus = 3/1 35h : core/bus = 4/1 37h : core/bus = 4/1 ------------------------------------------------------------ Pentium w/MMX A1 05h 41h (P55C) A2 42h xB1/mxB1 43h xA3/mxA3 44h myA0 81h sB1 82h ------------------------------------------------------------ Pentium MMX oxA3 15h 44h OverDrive (P55CTP) ------------------------------------------------------------ Cyrix MediaGX 05h 4xh ------------------------------------------------------------ Cyrix MediaGX 05h 4xh MMX Enhanced ------------------------------------------------------------ IDT Winchip (C6) 05h 40h ------------------------------------------------------------ IDT Winchip 2 (C2) 05h 81h ------------------------------------------------------------ Cx6x86MX and MII 06h 51h : core/bus = x2 (M2) 06h 52h : core/bus = x2.5 06h 53h : core/bus = x3 06h 54h : core/bus = x3.5 06h 55h : core/bus = x4 06h 59h : core/bus = x2 06h 5Ah : core/bus = x2.5 06h 5Bh : core/bus = x3 06h 5Ch : core/bus = x3.5 06h 5Dh : core/bus = x4 ------------------------------------------------------------ Intel Pentium OverDrive 25h 2xh : will be Set as second CPU (P54M) ------------------------------------------------------------ Pentium Pro (P6) 06h 0xh ; Engineering Sample 133MHz 0.6mkm 06h 11h ; Engineering Sample 150MHz B0 06h 11h ; 150 MHz C0 06h 12h ; 150 MHz sA0 06h 16h ; 166,180,200 MHz sA1 06h 17h ; 166,180,200 MHz sB1 06h 19h ; 166,180,200 MHz ------------------------------------------------------------ AMD Athlon 06h 1xh ; Model 1 ------------------------------------------------------------ Pentium II C0 06h 33h C1 06h 34h (P6L,Klamath) dA0/mdA0/mmdA0 06h 50h dA1 06h 51h dB0/mdB0/mmdB0 06h 52h mdB0 06h 52h mmdB0 06h 52h dB1 06h 53h dB1 06h 62h mdbA0/mdxA0/mqbA1/mqpA1 06h 6Ah ------------------------------------------------------------ Pentium II Xeon B0 06h 52h B1 06h 53h ------------------------------------------------------------ Celeron dA0 06h 50h No-Cache dA1 06h 51h No-Cache dB0 06h 52h No-Cache mA0 06h 60h (128KB cache) [Mendocino] mB0 06h 65h (128KB cache) PPGA ------------------------------------------------------------ Pentium II TdB0 16h 32h Overdrive ------------------------------------------------------------ Pentium III kB0 06h 72h kC0 06h 73h ------------------------------------------------------------ Pentium III Xeon B0 06h 72h C0 06h 73h ------------------------------------------------------------ Note: For detection Cyrix's chips refer to APPENDIX A1. Note: Then Intel Pentium and higher chips, sometimes include build-in APIC and setup such chips on motherbard as second CPU, change id code from 0xxxh to 2xxxh. -------------------------------------------- APPENDIX C0 iCOMP index for Intel's Microprocessors i386SX-20 32 i386SX-25 39 i386SL-25 41 i386DX-25 49 i386DX-33 68 i486SX-20 78 i486SX-25 100 ; Base model for test iCOMP=100 by define i486DX-25 122 i486SX-33 136 i486DX-33 166 i486DX2-20/40 166 IntelSX2-25/50 180 i486DX2-25/50 231 i486DX-50 249 IntelDX4-20/60 258 i486DX2-33/66 297 Pentium OverDrive-20/50 314 ; P24T IntelDX4-25/75 319 ; P24C IntelDX4-33/100 435 ; P24C Pentium OverDrive-25/63 443 ; P24T Pentium-(510\60) 510 ; P5 Pentium-(567\66) 567 ; P5 Pentium OverDrive-33/83 581 ; P24T Pentium-(610\75) 610 ; P54C,P54LM Pentium-(735\90) 735 ; P54C,P54LM Pentium-(815\100) 815 ; P54C Pentium-(1000\120) 1000 ; P54CSQ Pentium-(133) 1110 ; P54CSQ iCOMP index 2.0 for Intel Microprocessors Pentium-75 67 Pentium-90 81 Pentium-100 90 Pentium-120 100 ; Base Model iCOMP 2.0 = 100 Pentium-133 111 Pentium-150 114 Pentium-166 127 Pentium-200 142 Pentium w/MMX-166 160 Pentium Pro-150-256 168 Pentium w/MMX-200 182 Pentium Pro-180-256 197 Pentium w/MMX-233 203 Pentium Pro-200-256 220 Celeron-266-0 213 Celeron-300-0 226 Pentium II-233 267 Celeron-300-128 296 Pentium II-266 303 Celeron-333-128 318 Pentium II-300 332 Pentium II-333 366 Pentium II-350 386 Pentium II-400 440 Pentium II-450 483 iCOMP index 3.0 for Intel Microprocessors Pentium II-300 1000 Pentium II-400 1130 Pentium II-450 1500 Pentium III-450 1500 Pentium III-500 1650 ---------------------------------------------- APPENDIX C1 Cyrix Microprocessors Relative Perfomance Cyrix Inc. Used for declaration of perfomance of theys microprocessors tests based on PC Bench 8.0 and normalization. CPU Perfomance Scores Cx486SLC-25 36 Cx486SLC-33 39 Cx486SLC2-50 40 Cx486DLC-33 69 Cx486DLC-40 83 Cx486DX-33 100 ; <--- Base Point Cx486DX-40 118 Cx486DX2-50 139 Cx486DX-50 148 Cx486DX2-66 179 Cx486DX2-V80 209 ---------------------------------------------- APPENDIX C2 CPU's perfomance Note: Data was get on different M/B and configurations, so treat this tables like simple numbers, which said perfomance is xxx +-10%. CPUMark 32 CPUMark 16 P-rating AMD Am5k86-75 (SSA/5) 154 AMD Am5k86-90 (SSA/5) 187 AMD Am5k86-100 (SSA/5) 208 AMD Am5k86-133 (K5) 271 247 AMD Am5k86-166 (K5) 306 303 Pentium-75 174 168 Pentium-90 210 201 Pentium-100 233 223 Pentium-120 257 247 Pentium-133 283 278 Pentium-150 286 296 Pentium-166 321 326 Pentium-200 358 Cyrix Cx6x86-P120+ 235 247 Cyrix Cx6x86-P133+ 260 Cyrix Cx6x86-P150+ 283 298 Cyrix Cx6x86-P166+ 316 329 Cyrix Cx6x86-P200+ 350 340 Pentium w/MMX-166 378 380 Pentium w/MMX-200 425 429 Pentium w/MMX-233 450 475 Pentium Pro-150-256 420 Pentium Pro-180-256 493 Pentium Pro-200-256 540 358 Pentium Pro-200-512 610 AMD K6-200 520 427 AMD K6-233 550 456 AMD K6-266 608 Pentium II-233 632 468 Pentium II-266 721 536 Pentium II-300 813 603 Pentium II-333 Pentium II-350 902 Pentium II-400 1030 Pentium II-450 1140 IDT Winchip C6-180 IDT Winchip C6-200 382 362 Cyrix Cx6x86MX/PR166 Cyrix Cx6x86MX/PR200 391 372 Cyrix Cx6x86MX/PR233 505 474 Cyrix Cx6x86MX/PR266 AMD K6-2-266 582 AMD K6-2-300 763 AMD K6-2-366 878 Cyrix MII-300 512 Cyrix MII-333 Celeron-266 Celeron-300 Celeron-300/128 Celeron-333/128 655 Celeron-366/128 685 Celeron-433/128 Celeron-466/128 PentII Xeon-400/512 PentII Xeon-450/512 1160 Pentium III-450 Pentium III-500 1260 PentIII Xeon-500/512 PentIII Xeon-550/512 ------------------------------------------------ APPENDIX D0 Pentium P54C+ Build-in APIC (Advanced programmable Interrupt Controller) Base Address of Build-in APIC in memory location is 0FEE00000H. Map of APIC REgisters: Offset (hex) Description Read/Write state 0 Reserved 10 Reserved 20 Local APIC ID R/W 30 Local APIC Version R 40-70 Reserved 80 Task Priority Register R/W 90 Arbitration Priority Register R A0 Processor Priority Register R B0 EOI Register W C0 Remote read R D0 Logical Destination R/W E0 Destination Format Register 0..27 R 28..31 R/W F0 Spurious Interrupt Vector Reg. 0..3 R 4..9 R/W 100-170 ISR 0-255 R 180-1F0 TMR 0-255 R 200-270 IRR 0-255 R 280 Error Status Register R 290-2F0 Reserved 300 Interrupt Command Reg. (0-31) R/W 310 Interrupt Command Reg. (32-63) R/W 320 Local Vector Table (Timer) R/W 330-340 Reserved 350 Local Vector Table (LINT0) R/W 360 Local Vector Table (LINT1) R/W 370 Local Vector Table (ERROR) R/W 380 Initial Count Reg. for Timer R/W 390 Current Count of Timer R 3A0-3D0 Reserved 3E0 Timer Divide Configuration Reg. R/W 3F0 Reserved Note: Pentium-120MHz (Step C2) Never have APIC --------------------------------------------------- APPENDIX D1 INTEL 386/486SL REGISTERS Note: Intel Chipset for SL microprocessors (i386SL,i486SL) contain self CPU and 82360SL chip. [i386SL] Note: address of register in Normal I/O space Name of Register Address Default Value Where placed Size CPUPWRMODE 22h 0 CPU 16 CFGSTAT 23h 0 82360SL 8 CFGINDEX 24h 0 82360SL 16 CFGDATA 25h xxh 82360SL 16 EMSCNTLREG 28h 0 CPU 8 EMSINDEXREG 2Ah 0 CPU 16 EMSDPREG 2Ch xxh CPU 16 PORT92 92h 0 CPU 8 PORT102 102h 0 CPU 8 FAIL SAFE NMI CTRL 461h 0 CPU 8 The followed ports visible only when they enabled, Any writes to this ports caused the action it named. FAST CPU RESET EFh N/A 82360SL 8 FAST A20 GATE EEh N/A 82360SL 8 SLOW CPU F4h N/A CPU 8 FAST CPU F5h N/A CPU 8 SFS DISABLE F9h N/A CPU 8 SFS ENABLE FBh N/A CPU 8 Format of CPUPWRMODE register (i386SL): Bits Name Description 15 DT If Unlock Status { // See bit 0 of this register if bit=0 then access to 82360SL if bit=1 then access to CPUPWRMODE register } If Lock Staus { // i.e.SB=1 (De-Turbo Select Bit) Selected clock speed If bit=0 then EFI/2 If bit=1 then EFI/4 } 14 0 Reserved 13..11 IMCPC (Idle MCP Clock) 13.12.11 Description 000 EFI 001 EFI/2 010 EFI/4 011 EFI/8 100 EFI/16 101 Reserved 110 Reserved 111 Stop Clock 10,9 SLC (Slow CPU clock) 10.9 Description 00 EFI 01 EFI/2 10 EFI/4 11 EFI?8 8 CPUCNFG If =1 CPU Lock. (Write Protect to CPUPMODE register) 7 FD (Flash Disk Enable) If bit=1 then phisical addresses D0000H - DFFFFh automatically never caching. 6 0 Reserved 5,4 FCC (Fast CPU clock) 5.4 Description 00 EFI 01 EFI/2 10 EFI/4 11 EFI/8 3,2 US (Unit Select) Select Unit of 82360SL which will be accessable through 23h-25h I/O Ports 3.2 Description 00 On-Board Memory Controller 01 Cache Unit 10 Internal Bus Unit 11 External Bus Unit 1 UE (Unit Enable) If =1 Enable to Access Units else enable to access System bus. 0 SB (Status Bit) If =0 Enable access to CPUPWRMODE register If =1 Disable Format of EMSCNTLREG: Bits Description 7 (Global Enable) If =1 EMS enable 6 Valid bit 5 EMSDP Status Bit (Read Only) 4..2 Reserved 1..0 Active EMS Set (0-3) Format of EMSINDEXREG: Bits Description 15..10 Reserved 9..8 EMS set (0-3) 7..6 Reserved 5..0 EMS Page Register Index (0-64) Format of EMSDPREG: Bits Description 15 This EMS Page Enable (i.e. page indexed by EMSINDEXREG) 14 EMS Valid bit 13..11 reserved 10..0 Address lines A24..A14 for page selected by EMSINDEXREG Important Note: i386SL have SIGNATURE register have index 30Eh in On-Board Memory Controller Configuration Space. This Register contain Stepping Info of i386SL. Stepping Signature Register DX register after reset A0 4300h 4310h A1 4300h 4310h A2 4301h 4310h A3 4302h 4310h B0 4310h 4311h B1 4311h 4311h [i486SL] Note: address of register in Normal I/O space Name of Register Address Default Value Where placed Size CPUPWRMODE 22h 100H CPU 16 CFGSTAT 23h 0 82360SL 8 CFGINDEX 24h 0 82360SL 16 CFGDATA 25h xxh 82360SL 16 PORT92 92h 0 CPU 8 PORT102 102h 0 CPU 8 FAIL SAFE NMI CTRL 461h 0 CPU 8 The followed ports visible only when they enabled FAST CPU RESET EFh N/A 82360SL 8 FAST A20 GATE EEh N/A 82360SL 8 SLOW CPU F4h N/A CPU 8 FAST CPU F5h N/A CPU 8 SFS DISABLE F9h N/A CPU 8 SFS ENABLE FBh N/A CPU 8 Format of CPUPWRMODE register (i486SL): Bits Name Description 15 DT If Unlock Status { // See bit 0 of this register if bit=0 then access to 82360SL if bit=1 then access to CPUPWRMODE register } If Lock Staus { // i.e.SB=1 (De-Turbo Select Bit) Selected clock speed If bit=0 then EFI/2 If bit=1 then EFI/4 } 14..13 0 Reserved 12 FPUERROR This bit controlled access to I/O port 0F0h, if =0 then access to internal F0h port, If =1 then access ISA bus. 11..9 0 Reserved 8 CPUCNFG If =1 CPU Lock. (Write Protect to CPUPMODE register) 7 0 RESERVED 6,5 FCC (Fast CPU clock) 5.4 Description 00 CPUCLK=definition=EFI/2 01 CPUCLK/2 10 CPUCLK/4 11 CPUCLK/8 4 0 Reserved 3,2 US (Unit Select) Select Unit of 82360SL which will be accessable through 23h-25h I/O Ports 3.2 Description 00 On-Board Memory Controller 01 Reserved 10 Internal Bus Unit 11 External Bus Unit 1 UE (Unit Enable) If =1 Enable to Access Units else enable to access System bus. 0 SB (Status Bit) If =0 Enable access to CPUPWRMODE register If =1 Disable Important Note: i486SL have SIGNATURE register have index 70Ah in On-Board Memory Controller Configuration Space. This Register contain Stepping Info of i486SL. Format Of this register provided below: Bits Description 15..12 Member of Family (4h - SL) 11..8 Family (4h - 486 family) 7..0 Revision Name (Not Same as in DX after reset) --------------------------------------------------- APPENDIX D2 NS486SXF REGISTERS Note: NS486SXF - Embedded 486-processor, which contain base (IBM PC/AT compatible I/O on-chip. I/O Port Range Desctription 0000h-001Fh DMA Controller 0020h-0021h Master PIC (Programmable Interrupt Controller) 0040h-0047h PS/2 Style PIT (with WATCHDOG timer) 0050h-0057h 3-Wire Interface 0070h-0071h Real Time Clock 0080h-008Fh DMA Controller 00A0h-00A1h Slave PIC 00C0h-00DFh DMA Controller 0278h-027Ah ECP (Option) 02E8h-02EFh COM4 (Option) 02F8h-02FFh COM2 (Option) 0378h-037Ah ECP (Option) 03BCh-03BEh ECP (Option) 03E0h-03E3h PCMCIA 03E8h-03EFh COM3 (Option) 03F8h-03FFh COM1 (Default) 0678h-067Dh ECP (Default) 0778h-077Dh ECP (Option) 07BCh-07C1h ECP (Option) EF00h-EF57h Bus Interface Unit EF70h-EF71h UART EF80h-EF8Bh DRAM Controller EF90h-EF93h Power Managment EFA0h-EFA3h LCD Controller EFB0h-EFBFh Interrupt Controller EFC0h-EFCFh RIO and Bus Interface Unit EFE0h-EFE1h DMA Controller --------------------------------------------- APPENDIX E Pentium (tm) Processor Pairing Instruction Pentium (tm) is superscalar microprocessor i.e. it may execute >1 instruction per CLK cycle. It may execute maximum 2 instruction per cycle.It have two integer pipes to execute instruction. This pipes not same, and some instruction may pairing (i.e. execute together) (only if not link with this 2 instruction) only in U pipe, some other only in V pipe, other in any pipe,other absolutely not pairing and they executed on U pipe only. ------ Integer Part Note: PU - is pairable if issued to U pipe PV - is pairable if issued to V pipe UV - pairable in either pipe ADC Reg,Reg PU Reg,Mem PU Reg,Imm PU Mem,Reg PU Mem,Imm PU ADD Reg,Reg UV Reg,Mem UV Reg,Imm UV Mem,Reg UV Mem,Imm UV AND Reg,Reg UV Reg,Mem UV Reg,Imm UV Mem,Reg UV Mem,Imm UV CALL direct PV CMP Reg,Reg UV Reg,Mem UV Reg,Imm UV Mem,Reg UV Mem,Imm UV DEC Reg UV Mem UV INC Reg UV Mem UV Jcc any PV JMP Short PV Direct PV LEA Reg,Mem UV MOV Reg,Reg/Mem/Imm UV Mem,Reg UV NOP UV OR Reg,Reg UV Reg,Mem UV Reg,Imm UV Mem,Reg UV Mem,Imm UV POP Reg UV PUSH Reg UV Imm UV Rotates/Shifts: Reg,1 PU Mem,1 PU Reg,Imm PU Mem,Imm PU SUB Reg,Reg UV Reg,Mem UV Reg,Imm UV Mem,Reg UV Mem,Imm UV TEST Reg,Reg UV Mem,Reg UV Acc,Imm UV XOR Reg,Reg UV Reg,Mem UV Reg,Imm UV Mem,Reg UV Mem,Imm UV _____ Floating Part Note: FX - Pairing with FXCH (All other never pairing) FABS FX FADD FX FADDP FX FCHS FX FCOM FX FCOMP FX FDIV/R/P/RP FX FLD m32,m64,ST(i) FX Note: FLD m80 not pairing FMUL/P FX FSUB/P/R/RP FX FTST FX FUCOM/P/PP FX For more information refer to: 1) Optimization for Intel's 32-Bit Processors (Application Note AP-500) Gary CArleton) // Intel Corp. 1993 // Order Number 241799 2) Supplement to the Pentium (tm) Processor User's Manual // Intel Corp. 1993. ------------------------------------------------------------ APPENDIX F0 NON FP OPCODES Base Format of opcodes: Format of Postbyte: MM RRR MMM MM - Memory addresing mode RRR - Register operand address MMM - Memory operand address RRR Register Names Fields 8bit 16bit 32bit 000 AL AX EAX 001 CL CX ECX 010 DL DX EDX 011 BL BX EBX 100 AH SP ESP 101 CH BP EBP 110 DH SI ESI 111 BH DI EDI 16bit memory (No 32 bit memory address prefix): MMM Default MM Field Field Sreg 00 01 10 11=MMM is reg 000 DS [BX+SI] [BX+SI+O8] [BX+SI+O16] 001 DS [BX+DI] [BX+DI+O8] [BX+SI+O16] 010 SS [BP+SI] [BP+SI+O8] [BP+SI+O16] 011 SS [BP+DI] [BP+DI+O8] [BP+DI+O16] 100 DS [SI] [SI+O8] [SI+O16] 101 DS [DI] [DI+O8] [DI+O16] 110 SS [O16] [BP+O8] [BP+O16] 111 DS [BX] [BX+O8] [BX+O16] Note: MMM=110,MM=00 Default Sreg is DS !!!! 32bit memory (Has 67h 32 bit memory address prefix): MMM Default MM Field Field Sreg 00 01 10 11=MMM is reg 000 DS [EAX] [EAX+O8] [EAX+O32] 001 DS [ECX] [ECX+O8] [ECX+O32] 010 DS [EDX] [EDX+O8] [EDX+O32] 011 DS [EBX] [EBX+O8] [EBX+O32] 100 see SIB [SIB] [SIB+O8] [SIB+O32] 101 SS [O32] [EBP+O8] [EBP+O32] 110 DS [ESI] [ESI+O8] [ESI+O32] 111 DS [EDI] [EDI+O8] [EDI+O32] Note: MMM=110,MM=00 Default Sreg is DS !!!! SIB is (Scale/Base/Index): SS BBB III Note: SIB address calculated as : =+*(2^(Scale)) Field Default Base BBB Sreg Register Note 000 DS EAX 001 DS ECX 010 DS EDX 011 DS EBX 100 SS ESP 101 DS O32 If MM=00 (Postbyte) SS EBP If MM<>00 (Postbyte) 110 DS ESI 111 DS EDI Field Index III register Note 000 EAX 001 ECX 010 EDX 011 EBX 100 Never Index SS can be 00 101 EBP 110 ESI 111 EDI Field Scale coefficient SS =2^(SS) 00 1 01 2 10 4 11 8 Note: this code are for 8086 and all other processors NEC V20+ : for NEC V-seria only 186+ : for 186/188 and higher 286+ : for 80286 and higher 386+ : for 80386 and higher 486+ : for i486 and higher Cyrix M5+ : for Cyrix only (Cx486S and higher) Pentium+ : for Pentium Pentium Pro+ : for Pentium Pro and higher Pentium II+ : for Pentium II and higher MMX : Intel MMX AMD 3D : AMD 3D MMX Extensions Cyrix EMMX : Cyrix Extended MMX KNI/MMX2 : Katmai New Instructions/Intel MMX2 : specified mem8 - Memory Operand 8 bit mem - Memory operand 16/32 or more bit (depends on operation size) m64 - Memory operand 64-bit m128 - Memory operand 128-bit reg8 - Register 8 bit reg - Register 16/32 bit mm - MMX register Integer (64-bit) xmm - MMX2 register F.P (128-bit) imm8 - Immediate 8 bit imm - Immediate 16/32 bit ----------------------- [TABLE00]: --------------------------- 00 ADD mem8,reg8 01 ADD mem,reg 02 ADD reg8,mem8 03 ADD reg,mem 04 ADD AL,imm8 05 ADD AX,imm 06 PUSH ES 07 POP ES 08 OR mem8,reg8 09 OR mem,reg 0A OR reg8,mem8 0B OR reg,mem 0C OR AL,imm8 0D OR AX,imm 0E PUSH CS 0F POP CS ; 8088 non CMOS versions >>> TABLE 01 ; NECs & 286+ Invalid Opcode ; 186/188 10 ADC mem8,reg8 11 ADC mem,reg 12 ADC reg8,mem8 13 ADC reg,mem 14 ADC AL,imm8 15 ADC AX,imm 16 PUSH SS 17 POP SS 18 SBB mem8,reg8 19 SBB mem,reg 1A SBB reg8,mem8 1B SBB reg,mem 1C SBB AL,imm8 1D SBB AX,imm 1E PUSH DS 1F POP DS 20 AND mem8,reg8 21 AND mem,reg 22 AND reg8,mem8 23 AND reg,mem 24 AND AL,imm8 25 AND AX,imm 26 ES: segment prefix 27 DAA 28 SUB mem8,reg8 29 SUB mem,reg 2A SUB reg8,mem8 2B SUB reg,mem 2C SUB AL,imm8 2D SUB AX,imm 2E CS: segment prefix 2F DAS 30 XOR mem8,reg8 31 XOR mem,reg 32 XOR reg8,mem8 33 XOR reg,mem 34 XOR AL,imm8 35 XOR AX,imm 36 SS: segment prefix 37 AAA 38 CMP mem8,reg8 39 CMP mem,reg 3A CMP reg8,mem8 3B CMP reg,mem 3C CMP AL,imm8 3D CMP AX,imm 3E DS: segment prefix 3F AAS 40 INC AX 41 INC CX 42 INC DX 43 INC BX 44 INC SP 45 INC BP 46 INC SI 47 INC DI 48 DEC AX 49 DEC CX 4A DEC DX 4B DEC BX 4C DEC SP 4D DEC BP 4E DEC SI 4F DEC DI 50 PUSH AX 51 PUSH CX 52 PUSH DX 53 PUSH BX 54 PUSH SP 55 PUSH BP 56 PUSH SI 57 PUSH DI 58 POP AX 59 POP CX 5A POP DX 5B POP BX 5C POP SP 5D POP BP 5E POP SI 5F POP DI 60 PUSHA ; NECs & 186+ 61 POPA ; NECs & 186+ 62 BOUND reg,mem ; NECs & 186+ 63 ARPL reg,mem ; 286+ PM 64 FS: segment prefix ; 386+ 65 GS: segment prefix ; 386+ 66 Memory access size prefix ; 386+ 67 Operands size prefix ; 386+ 68 PUSH imm ; NECs & 186+ 69 IMUL reg,imm,mem ; NECs & 186+ 6A PUSH imm8 ; NECs & 186+ 6B IMUL reg,imm8,mem ; NECs & 186+ 6C INSB ; 186+ 6D INS ; 186+ 6E OUTSB ; 186+ 6F OUTS ; 186+ 70 JO rel8 71 JNO rel8 72 JC rel8 73 JNC rel8 74 JZ rel8 75 JNZ rel8 76 JNA rel8 77 JA rel8 78 JS rel8 79 JNS rel8 7A JP rel8 7B JNP rel8 7C JL rel8 7D JNL rel8 7E JNG rel8 7F JG rel8 80 code extention [1] 81 code extention [2] 82 code extention [3] 83 code extention [4] 84 TEST mem8,reg8 85 TEST mem,reg 86 XCHG mem8,reg8 87 XCHG mem,reg 88 MOV mem8,reg8 89 MOV mem,reg 8A MOV reg8,mem8 8B MOV reg,mem 8C code extention [5] 8D LEA reg,mem 8E code extention [6] 8F code extention [7] 90 NOP 91 XCHG AX,CX 92 XCHG AX,DX 93 XCHG AX,BX 94 XCHG AX,SP 95 XCHG AX,BP 96 XCHG AX,SI 97 XCHG AX,DI 98 CBW 66 98 CWDE ; 386+ 99 CWD 66 99 CDQ ; 386+ 9A CALL FAR seg:offs 9B WAIT/FWAIT 9C PUSHF 66 9C PUSHFD ; 386+ 9D POPF 66 9D POPFD ; 386+ 9E SAHF 9F LAHF A0 MOV AL,[imm] A1 MOV AX,[imm] A2 MOV [imm],AL A3 MOV [imm],ax A4 MOVSB A5 MOVS A6 CMPSB A7 CMPS A8 TEST AL,imm8 A9 TEST AX,imm AA STOSB AB STOS AC LODSB AD LODS AE SCASB AF SCAS B0 MOV AL,imm8 B1 MOV CL,imm8 B2 MOV DL,imm8 B3 MOV BL,imm8 B4 MOV AH,imm8 B5 MOV CH,imm8 B6 MOV DH,imm8 B7 MOV BH,imm8 B8 MOV AX,imm B9 MOV CX,imm BA MOV DX,imm BB MOV BX,imm BC MOV SP,imm BD MOV BP,imm BE MOV SI,imm BF MOV DI,imm C0 code extention [8] C1 code extention [9] C2 RET NEAR imm C3 RET NEAR C4 LES reg,mem C5 LDS reg,mem C6 code extention [10] C7 code extention [11] C8 ENTER imm,imm8 ; NECs & 186+ C9 LEAVE ; NECs & 186+ CA RET FAR imm CB RET FAR CC INT 3 CD INT imm8 CE INTO CF IRET D0 code extention [12] D1 code extention [13] D2 code extention [14] D3 code extention [15] D4 AAM imm8 ; NECs w/o imm8 but D4 0A only D5 AAD imm8 ; NECs w/o imm8 but D4 0A only D6 SETALC ; 286+ D7 XLAT D8-DF ESC imm6,mem ; Note: Refer to Appendix F1 ; (Cooprocessor commands). E0 LOOPNZ rel8 E1 LOOPZ rel8 E2 LOOP rel8 E3 JCXZ rel8 66 E3 JECXZ rel8 ; 386+ E4 IN AL,imm8 E5 IN AX,imm8 E6 OUT imm8,AL E7 OUT imm8,AX E8 CALL NEAR rel16 E9 JMP NEAR rel16 EA JMP FAR seg:offs EB JMP SHORT rel8 EC IN AL,DX ED IN AX,DX EE OUT DX,AL EF OUT DX,AX F0 LOCK prefix F1 SMI ; AMD Am386/486DXLV F2 REPNZ F3 REP/REPZ ; Used in KNI/MMX2 as ; Modificator !!!!!! F4 HLT F5 CMC F6 code extention [16] F7 code extention [17] F8 CLC F9 STC FA CLI FB STI FC CLD FD STD FE code extention [18] FF code extention [19] ----------------------- [TABLE 01]: --------------------------- Note: First Byte of Operation is 0Fh 00 Extended Opcode 20 ; 286+ 01 Extended Opcode 21 ; 286+ 02 LAR reg,mem ; 286+ 03 LSL reg,mem ; 286+ 04 LOADALL ; 286 only 05 LOADALL ; 286 only 05 SYSCALL ; AMD K6 06 CLTS ; 286+ 07 LOADALL ; 386,486, None Pentium+ RES3 ; AMD Am386zXLV RES4 ; AMD Am486DXLV ICERET ; IBM 386SLC,486SLC,486SLC2 SYSRET ; AMD K6 08 INVD ; 486+ 09 WBINVD ; 486+ 0A Reserved, INT 6 0B UD2 ; all, but documented on ; Pentium Pro only 0C 0D code extention [25] ; AMD 3DNow! 0E FEMMS ; AMD 3DNow! 0F >>> TABLE 02 ; AMD 3DNow! 10 UMOV mem8,reg8 ; Really different op. space ; 386-486, Never Pentium+ ; on AMD Amz86zXLV,never Cx5x86+ TEST1 mem8,CL ; NEC V20+ MOVSS xmm,xmm/m32 ; KNI/MMX2 (F3 0F 10) MOVUPS xmm,xmm/m128 ; KNI/MMX2 11 UMOV mem,reg ; see 0Fh,10h TEST1 mem,CL ; NEC V20+ MOVSS xmm/m32,xmm ; KNI/MMX2 (F3 0F 11) MOVUPS xmm/m128,xmm ; KNI/MMX2 12 UMOV reg8,mem8 ; see 0Fh,10h CLEAR1 mem8,CL ; NEC V20+ MOVHLPS xmm,xmm ; KNI/MMX2 MOVLPS xmm,m64 ; KNI/MMX2 13 UMOV reg,mem ; see 0Fh,10h CLEAR1 mem,CL ; NEC V20+ MOVLPS m64,xmm ; KNI/MMX2 14 SET1 mem8,CL ; NEC V20+ UNPCKLPS xmm,xmm/m128 ; KNI/MMX2 15 SET1 mem,CL ; NEC V20+ UNPCKHPS xmm,xmm/m128 ; KNI/MMX2 16 NOT1 mem8,CL ; NEC V20+ MOVHPS xmm,m64 ; KNI/MMX2 MOVLHPS xmm,xmm ; KNI/MMX2 17 NOT1 mem,CL ; NEC V20+ MOVHPS m64,xmm ; KNI/MMX2 18 TEST1 mem8,imm8 ; NEC V20+ code extension [26] ; KNI/MMX2 19 TEST1 mem,imm8 ; NEC V20+ 1A CLEAR1 mem8,imm8 ; NEC V20+ 1B CLEAR1 mem,imm8 ; NEC V20+ 1C SET1 mem8,imm8 ; NEC V20+ 1D SET1 mem,imm8 ; NEC V20+ 1E NOT1 mem8,imm8 ; NEC V20+ 1F NOT1 mem,imm8 ; NEC V20+ 20 MOV reg32,CRn ; 386+ ADD4S ; NEC V20+ 21 MOV reg32,DRn ; 386+ 22 MOV CRn,reg32 ; 386+ SUB4S ; NEC V20+ 23 MOV DRn,reg32 ; 386+ 24 MOV reg32,TRn ; 386-486 only, and Cyrix 25 26 MOV TRn,reg32 ; 386-486 only, and Cyrix CMPS4S ; NEC V20+ 27 28 ROL4 mem8 ; NEC V20+ MOVAPS xmm,xmm/m128 ; KNI/MMX2 29 MOVAPS xmm/m128,xmm ; KNI/MMX2 2A ROL4 mem8 ; NEC V20+ CVTPI2PS xmm,mm/m64 ; KNI/MMX2 CVTSI2SS xmm,r32/m32 ; KNI/MMX2 (F3 0F 2A) 2B MOVNTPS m128,xmm ; KNI/MMX2 2C CVTTPS2PI mm,xmm/m64 ; KNI/MMX2 CVTTSS2SI r32,xmm/m32 ; KNI/MMX2 (F3 0F 2C) 2D CVTPS2PI mm,xmm/m64 ; KNI/MMX2 CVTSS2SI r32,xmm/m32 ; KNI/MMX2 (F3 0F 2D) 2E UCOMISS xmm,xmm/m32 ; KNI/MMX2 2F COMISS xmm,xmm/m32 ; KNI/MMX2 30 WRMSR ; Pentium+, IBM 386SLC,486SLC/SLC2 31 RDTSC ; Pentium+ INS reg8,reg8 ; NEC V20+ ; Note: NECINS 32 RDMSR ; Pentium, IBM 386SLC,486SLC/SLC2 33 EXT reg8,reg8 ; NEC V20+ RDPMC ; Pentium Pro+ 34 SYSENTER ; Pentium II+ 35 SYSEXIT ; Pentium II+ 36 RDSHR reg/mem32 ; Cx6x86MX (SMM only) 37 WRSHR reg/mem32 ; Cx6x86MX (SMM only) 38 39 3A 3B 3C 3D 3E 3F 40 CMOVO reg,mem ; Pentium Pro+ 41 CMOVNO reg,mem ; Pentium Pro+ 42 CMOVC reg,mem ; Pentium Pro+ 43 CMOVNC reg,mem ; Pentium Pro+ 44 CMOVZ reg,mem ; Pentium Pro+ 45 CMOVNZ reg,mem ; Pentium Pro+ 46 CMOVA reg,mem ; Pentium Pro+ 47 CMOVNA reg,mem ; Pentium Pro+ 48 CMOVS reg,mem ; Pentium Pro+ 49 CMOVNS reg,mem ; Pentium Pro+ 4A CMOVP reg,mem ; Pentium Pro+ 4B CMOVNP reg,mem ; Pentium Pro+ 4C CMOVL reg,mem ; Pentium Pro+ 4D CMOVNL reg,mem ; Pentium Pro+ 4E CMOVNG reg,mem ; Pentium Pro+ 4F CMOVG reg,mem ; Pentium Pro+ 50 PAVEB mm,mm/m64 ; Cyrix EMMX MOVMSKPS r32,xmm ; KNI/MMX2 51 PADDSIW mm,mm/m64 ; Cyrix EMMX SQRTPS xmm,xmm/m128 ; KNI/MMX2 SQRTSS xmm,xmm/m32 ; KNI/MMX2 (F3 0F 51) 52 PMAGW mm,mm/m64 ; Cyrix EMMX PSQRTPS xmm,xmm/m128 ; KNI/MMX2 PSQRTSS xmm,xmm/m32 ; KNI/MMX2 (F3 0F 52) 53 RCPPS xmm,xmm/m128 ; KNI/MMX2 RCPSS xmm,xmm/m32 ; KNI/MMX2 (F3 0F 53) 54 PDISTIB mm,m64 ; Cyrix EMMX ANDPS xmm,xmm/m128 ; KNI/MMX2 55 PSUBSIW mm,mm/m64 ; Cyrix EMMX ANDNPS xmm,xmm/m128 ; KNI/MMX2 56 ORPS xmm,xmm/m128 ; KNI/MMX2 57 XORPS xmm,xmm/m128 ; KNI/MMX2 58 PMVZB mm,m64 ; Cyrix EMMX ADDPS xmm,xmm/m128 ; KNI/MMX2 ADDSS xmm,xmm/m32 ; KNI/MMX2 (F3 0F 58) 59 PMULHRW mm,mm/m64 ; Cyrix EMMX MULPS xmm,xmm/m128 ; KNI/MMX2 MULSS xmm,xmm/m32 ; KNI/MMX2 (F3 0F 59) 5A PMVNZB mm,m64 ; Cyrix EMMX 5B PMVLZB mm,m64 ; Cyrix EMMX 5C PMVGEZB mm,m64 ; Cyrix EMMX SUBPS xmm,xmm/m128 ; KNI/MMX2 SUBSS xmm,xmm/m32 ; KNI/MMX2 (F3 0F 5C) 5D PMULHRIW mm,mm/m64 ; Cyrix EMMX MINPS xmm,xmm/m128 ; KNI/MMX2 MINSS xmm,xmm/m32 ; KNI/MMX2 (F3 0F 5D) 5E PMACHRIW mm,m64 ; Cyrix EMMX DIVPS xmm,xmm/m128 ; KNI/MMX2 DIVSS xmm,xmm/m32 ; KNI/MMX2 (F3 0F 5E) 5F MAXPS xmm,xmm/m128 ; KNI/MMX2 MAXSS xmm,xmm/m32 ; KNI/MMX2 (F3 0F 5F) 60 PUNPCKLBW mm,mm/m32 ; MMX 61 PUNPCKLWD mm,mm/m32 ; MMX 62 PUNPCKLDQ mm,mm/m32 ; MMX 63 PACKSSWB mm,mm/m64 ; MMX 64 PCMPGTB mm,mm/m64 ; MMX 65 PCMPGTW mm,mm/m64 ; MMX 66 PCMPGTD mm,mm/m64 ; MMX 67 PACKUSWB mm,mm/m64 ; MMX 68 PUNPCKHBW mm,mm/m64 ; MMX 69 PUNPCKHWD mm,mm/m64 ; MMX 6A PUNPCKHDQ mm,mm/m64 ; MMX 6B PACKSSDW mm,mm/m64 ; MMX 6C 6D 6E MOVD mm,r/m32 ; MMX 6F MOVQ mm,mm/m64 ; MMX 70 PSHUFW mm,mm/m64,i8 ; KNI/MMX2,AMD EMMX 71 code extention [28] ; MMX 72 code extention [29] ; MMX 73 code extention [30] ; MMX 74 PCMPEQB mm,mm/m64 ; MMX 75 PCMPEQW mm,mm/m64 ; MMX 76 PCMPEQD mm,mm/m64 ; MMX 77 EMMS ; MMX 78 SVDC mem,sreg ; Cyrix M5+ (SMM only) 79 RSDC sreg,mem ; Cyrix M5+ (SMM only) 7A SVLDT mem ; Cyrix M5+ (SMM only) 7B RSLDT mem ; Cyrix M5+ (SMM only) 7C SVTS mem ; Cyrix M5+ (SMM only) 7D RSTS mem ; Cyrix M5+ (SMM only) 7E SMINT ; Cyrix M6+ 7E MOVD r/m32,mm ; MMX 7F MOVD mm/m64,mm ; MMX 80 JO rel16 ; 386+ 81 JNO rel16 ; 386+ 82 JC rel16 ; 386+ 83 JNC rel16 ; 386+ 84 JZ rel16 ; 386+ 85 JNZ rel16 ; 386+ 86 JNA rel16 ; 386+ 87 JA rel16 ; 386+ 88 JS rel16 ; 386+ 89 JNS rel16 ; 386+ 8A JP rel16 ; 386+ 8B JNP rel16 ; 386+ 8C JL rel16 ; 386+ 8D JNL rel16 ; 386+ 8E JNG rel16 ; 386+ 8F JG rel16 ; 386+ 90 SETO mem8 ; 386+ 91 SETNO mem8 ; 386+ 92 SETC mem8 ; 386+ 93 SETNC mem8 ; 386+ 94 SETZ mem8 ; 386+ 95 SETNZ mem8 ; 386+ 96 SETNA mem8 ; 386+ 97 SETA mem8 ; 386+ 98 SETS mem8 ; 386+ 99 SETNS mem8 ; 386+ 9A SETP mem8 ; 386+ 9B SETNP mem8 ; 386+ 9C SETL mem8 ; 386+ 9D SETNL mem8 ; 386+ 9E SETNG mem8 ; 386+ 9F SETG mem8 ; 386+ A0 PUSH FS ; 386+ A1 POP FS ; 386+ A2 CPUID ; 486 SL enhanced, Pentium+ ; UMC,i386CX,Cyrix M1+,AMD K5+, ; Some NexGen, IDT A3 BT mem,reg ; 386+ A4 SHLD mem,reg,imm ; 386+ A5 SHLD mem,reg,CL ; 386+ A6 XBTS reg,mem,AX,CL ; Intel (!!!) 80386 steps A0-B0 CMPXCHG mem8,reg8 ; Intel (!!!) 80486 steps A0-B0 A7 IBTS mem,AX,CL,reg ; Intel (!!!) 80386 steps A0-B0 CMPXCHG mem,reg ; Intel (!!!) 80486 steps A0-B0 A8 PUSH GS ; 386+ A9 POP GS ; 386+ AA RSM ; i486 SL Enhanced, i386CX ; Intel Pentium+, etc AB BTS mem,reg ; 386+ AC SHRD mem,reg,imm ; 386+ AD SHRD mem,reg,CL ; 386+ AE code extention [24] AF IMUL reg,mem ; 386+ B0 CMPXCHG mem8,reg8 ; 486+ (Intel B1+ step only) B1 CMPXCHG mem,reg ; 486+ (Intel B1+ step only) B2 LSS reg,mem ; 386+ B3 BTR mem,reg ; 386+ B4 LFS reg,mem ; 386+ B5 LGS reg,mem ; 386+ B6 MOVZX reg,mem8 ; 386+ B7 MOVZX reg32,mem ; 386+ B8 B9 UD2 ; one more Undefined Opcode-2 BA code extention [22] BB BTC mem,reg ; 386+ BC BSF reg,mem ; 386+ BD BSR reg,mem ; 386+ BE MOVSX reg,mem8 ; 386+ BF MOVSX reg32,mem ; 386+ C0 XADD mem8,reg8 ; 486+ C1 XADD mem,reg ; 486+ C2 code extension [27] ; KNI/MMX2 C3 C4 PINSRW mm,r32/m16,i8 ; KNI/MMX2,AMD EMMX C5 PEXTRW r32,mm,i8 ; KNI/MMX2,AMD EMMX C6 SHUFPS xmm,xmm/m128,i8 ; KNI/MMX2 C7 code extention [23] C8 BSWAP EAX ; 486+ C9 BSWAP ECX ; 486+ CA BSWAP EDX ; 486+ CB BSWAP EBX ; 486+ CC BSWAP ESP ; 486+ CD BSWAP EBP ; 486+ CE BSWAP ESI ; 486+ CF BSWAP EDI ; 486+ D0 D1 PSRLW mm,mm/m64 ; MMX D2 PSRLD mm,mm/m64 ; MMX D3 PSRLQ mm,mm/m64 ; MMX D4 D5 PMULLW mm,mm/m64 ; MMX D6 D7 PMOVMSKB r32,mm ; KNI/MMX2,AMD EMMX D8 PSUBUSB mm,mm/m64 ; MMX D9 PSUBUSW mm,mm/m64 ; MMX DA PMINUB mm,mm/m64 ; KNI/MMX2,AMD EMMX DB PAND mm,mm/m64 ; MMX DC PADDUSB mm,mm/m64 ; MMX DD PADDUSW mm,mm/m64 ; MMX DE PMAXUB mm,mm/m64 ; KNI/MMX2,AMD EMMX DF PANDN mm,mm/m64 ; MMX E0 PAVGB mm,mm/m64 ; KNI/MMX2,AMD EMMX E1 PSRAW mm,mm/m64 ; MMX E2 PSRAD mm,mm/m64 ; MMX E3 PAVGW mm,mm/m64 ; KNI/MMX2, AMD EMMX E4 PMULHUW mm,mm/m64 ; KNI/MMX2, AMD EMMX E5 PMULHW mm,mm/m64 ; MMX E6 E7 MOVNTQ m64,mm ; KNI/MMX2, AMD EMMX E8 PSUBSB mm,mm/m64 ; MMX E9 PSUBSW mm,mm/m64 ; MMX EA PMINSW mm,mm/m64 ; KNI/MMX2, AMD EMMX EB POR mm,mm/m64 ; MMX EC PADDSB mm,mm/m64 ; MMX ED PADDSW mm,mm/m64 ; MMX EE PMAXSW mm,mm/m64 ; KNI/MMX2, AMD EMMX EF PXOR mm,mm/m64 ; MMX F0 F1 PSLLW mm,mm/m64 ; MMX F2 PSLLD mm,mm/m64 ; MMX F3 PSLLQ mm,mm/m64 ; MMX F4 F5 PMULADDWD mm,mm/m64 ; MMX F6 PSADBW mm,mm/m64 ; KNI/MMX2, AMD EMMX F7 MASKMOVQ mm,mm ; KNI/MMX2, AMD EMMX F8 PSUBB mm,mm/m64 ; MMX F9 PSUBW mm,mm/m64 ; MMX FA PSUBD mm,mm/m64 ; MMX FB FC PADDB mm,mm/m64 ; MMX FD PADDW mm,mm/m64 ; MMX FE PADDD mm,mm/m64 ; MMX FF UD ; AMD Am5k86+ and all other CPUs FF OIO ; Cyrix Cx6x86+ and all other CPUs FF BRKEM imm8 ; NEC V20+ ---------------------- [TABLE 02] -------------------------- First bytes is 0Fh,0Fh (In Table 02 marked only valid opcodes) 0C PI2FW mm,mm/m64 ; AMD 3FNow! extensions 0D PI2FD mm,mm/m64 ; AMD 3DNow! 1C PF2IW mm,mm/m64 ; AMD 3DNow! extensions 1D PF2ID mm,mm/m64 ; AMD 3DNow! 8A PFNACC mm,mm/m64 ; AMD 3DNow! extensions 8E PFPNACC mm,mm/m64 ; AMD 3DNow! extensions 90 PFCMPGE mm,mm/m64 ; AMD 3DNow! 94 PFMIN mm,mm/m64 ; AMD 3DNow! 96 PFRCP mm,mm/m64 ; AMD 3DNow! 97 PFRSQRT mm,mm/m64 ; AMD 3DNow! 9A PFSUB mm,mm/m64 ; AMD 3DNow! 9E PFADD mm,mm/m64 ; AMD 3DNow! A0 PFCMPGT mm,mm/m64 ; AMD 3DNow! A4 PFMAX mm,mm/m64 ; AMD 3DNow! A6 PFRCPIT1 mm,mm/m64 ; AMD 3DNow! A7 PFRSQIT1 mm,mm/m64 ; AMD 3DNow! AA PFSUBR mm,mm/m64 ; AMD 3DNow! AE PFACC mm,mm/m64 ; AMD 3DNow! B0 PFCMPEQ mm,mm/m64 ; AMD 3DNow! B4 PFMUL mm,mm/m64 ; AMD 3DNow! B6 PFRCPIT2 mm,mm/m64 ; AMD 3DNow! B7 PMULHRW mm,mm/m64 ; AMD 3DNow! BB PSWAPD mm,mm/m64 ; AMD 3DNow! extension BF PAVGUSB mm,mm/m64 ; AMD 3DNow! ************************************************** CODE EXTENTIONS: First byte(s) look at TABLES#00,01 Next byte have format MMOOOMMM : MM is memory mode (see postbyte) OOO select operation in this extention code field MMM is memory field (see Postbyte) Code Extention # 1 (First byte(s) = 80h) Field OOO Operation 000 ADD mem8,imm8 001 OR mem8,imm8 010 ADC mem8,imm8 011 SBB mem8,imm8 100 AND mem8,imm8 101 SUB mem8,imm8 110 XOR mem8,imm8 111 CMP mem8,imm8 Code Extention # 2 (First byte(s) = 81h) Field OOO Operation 000 ADD mem,imm 001 OR mem,imm 010 ADC mem,imm 011 SBB mem,imm 100 AND mem,imm 101 SUB mem,imm 110 XOR mem,imm 111 CMP mem,imm Code Extention # 3 (First byte(s) = 82h) Note: On some models, undefined code do nothing, on any work as 83h None INT 6 at all. Field OOO Operation 000 ADD mem8,simm8 001 010 ADC mem8,simm8 011 SBB mem8,simm8 100 101 SUB mem8,simm8 110 111 CMP mem8,simm8 Code Extention # 4 (First byte(s) = 83h) Field OOO Operation 000 ADD mem,simm8 001 OR mem,simm8 ; 386+ 010 ADC mem,simm8 011 SBB mem,simm8 100 AND mem,simm8 ; 386+ 101 SUB mem,simm8 110 XOR mem,simm8 ; 388+ 111 CMP mem,simm8 Code Extention # 5 (First byte(s) = 8Ch) Field OOO Operation 000 MOV mem,ES 001 MOV mem,CS 010 MOV mem,SS 011 MOV mem,DS 100 MOV mem,FS ; 386+ 101 MOV mem,GS ; 386+ 110 111 Code Extention # 6 (First byte(s) = 8Eh) Field OOO Operation 000 MOV ES,mem 001 MOV CS,mem ; Non CMOS version of 8086/8088 only 010 MOV SS,mem 011 MOV DS,mem 100 MOV FS,mem ; 386+ 101 MOV GS,mem ; 386+ 110 111 Code Extention # 7 (First byte(s) = 8Fh) Note: i486 can eat any OOO. Field OOO Operation 000 POP mem 001 010 011 100 101 110 111 Code Extention # 8 (First byte(s) = C0h) Field OOO Operation 000 ROL mem8,imm8 ; 186+ 001 ROR mem8,imm8 ; 186+ 010 RCL mem8,imm8 ; 186+ 011 RCR mem8,imm8 ; 186+ 100 SHL mem8,imm8 ; 186+ 101 SHR mem8,imm8 ; 186+ 110 SAL mem8,imm8 ; 186+ 111 SAR mem8,imm8 ; 186+ Code Extention # 9 (First byte(s) = C1h) Field OOO Operation 000 ROL mem,imm8 ; 186+ 001 ROR mem,imm8 ; 186+ 010 RCL mem,imm8 ; 186+ 011 RCR mem,imm8 ; 186+ 100 SHL mem,imm8 ; 186+ 101 SHR mem,imm8 ; 186+ 110 SAL mem,imm8 ; 186+ 111 SAR mem,imm8 ; 186+ Code Extention # 10 (First byte(s) = C6h) Note: i486 can eat any OOO field. Field OOO Operation 000 MOV mem8,imm8 001 010 011 100 101 110 111 Code Extention # 11 (First byte(s) = C7h) Note: i486 can eat any OOO field Field OOO Operation 000 MOV mem,imm16 001 010 011 100 101 110 111 Code Extention # 12 (First byte(s) = D0h) Field OOO Operation 000 ROL mem8,1 001 ROR mem8,1 010 RCL mem8,1 011 RCR mem8,1 100 SHL mem8,1 101 SHR mem8,1 110 SAL mem8,1 111 SAR mem8,1 Code Extention # 13 (First byte(s) = D1h) Field OOO Operation 000 ROL mem,1 001 ROR mem,1 010 RCL mem,1 011 RCR mem,1 100 SHL mem,1 101 SHR mem,1 110 SAL mem,1 111 SAR mem,1 Code Extention # 14 (First byte(s) = D2h) Field OOO Operation 000 ROL mem8,CL 001 ROR mem8,CL 010 RCL mem8,CL 011 RCR mem8,CL 100 SHL mem8,CL 101 SHR mem8,CL 110 SAL mem8,CL 111 SAR mem8,CL Code Extention # 15 (First byte(s) = D3h) Field OOO Operation 000 ROL mem,CL 001 ROR mem,CL 010 RCL mem,CL 011 RCR mem,CL 100 SHL mem,CL 101 SHR mem,CL 110 SAL mem,CL 111 SAR mem,CL Code Extention # 16 (First byte(s) = F6h) Note: Usually 001 do same thing as 000, TEST mem8,imm8 Field OOO Operation 000 TEST mem8,imm8 001 010 NOT mem8 011 NEG mem8 100 MUL mem8 101 IMUL mem8 110 DIV mem8 111 IDIV mem8 Code Extention # 17 (First byte(s) = F7h) Note: Usually 001 do same thing as 000, TEST mem,imm16 Field OOO Operation 000 TEST mem,imm16 001 010 NOT mem 011 NEG mem 100 MUL mem 101 IMUL mem 110 DIV mem 111 IDIV mem Code Extention # 18 (First byte(s) = FEh) Field OOO Operation 000 INC mem8 001 DEC mem8 010 011 100 101 110 111 Code Extention # 19 (First byte(s) = FFh) Field OOO Operation 000 INC mem 001 DEC mem 010 CALL NEAR mem 011 CALL FAR mem 100 JMP NEAR mem 101 JMP FAR mem 110 PUSH mem 111 Code Extention # 20 (First byte(s) = 0FH,00H) Field OOO Operation 000 SLDT mem ; 286+ 001 STR mem ; 286+ 010 LLDT mem ; 286+ 011 LTR mem ; 286+ 100 VERR mem ; 286+ 101 VERW mem ; 286+ 110 111 Code Extention # 21 (First byte(s) = 0Fh,01h) Field OOO Operation 000 SGDT mem ; 286+ 001 SIDT mem ; 286+ 010 LGDT mem ; 286+ 011 LIDT mem ; 286+ 100 SMSW mem ; 286+ 101 110 LMSW mem ; 286+ 111 INVLPG mem ; 486+ Code Extention # 22 (First byte(s) = 0Fh,BAh) Field OOO Operation 000 001 010 011 100 BT mem,imm8 ; 386+ 101 BTS mem,imm8 ; 386+ 110 BTR mem,imm8 ; 386+ 111 BTC mem,imm8 ; 386+ Code Extention # 23 (First byte(s) = 0Fh,C7h) Field OOO Operation 000 001 CMPXCHG8B mem ; Pentium 010 011 100 101 110 111 Code Extention # 24 (First byte(s) = 0Fh,AEh) Field OOO Operation 000 FXSAVE mem512byte ; KNI/MMX2 001 FXRSTOR mem512byte ; KNI/MMX2 010 LDMXCSR m32 ; KNI/MMX2 011 STMXCSR m32 ; KNI/MMX2 100 101 110 111 SFENCE ; KNI/MMX2, AMD EMMX (0F AE F8) Code Extention # 25 (First byte(s) = 0Fh,0Dh) Field OOO Operation 000 PREFETCH mem ; AMD 3DNow! 001 PREFETCHW mem ; AMD 3DNow! 010 011 100 101 110 111 Code Extention # 26 (First byte(s) = 0Fh,18h) Field OOO Operation 000 PREFETCHNTA mem ; KNI/MMX2, AMD EMMX 001 PREFETCHT0 mem ; KNI/MMX2, AMD EMMX 010 PREFETCHT1 mem ; KNI/MMX2, AMD EMMX 011 PREFETCHT2 mem ; KNI/MMX2, AMD EMMX 100 101 110 111 Code Extension # 27 (First byte(s) = (F3h) 0Fh,C2h) ; KNI/MMX2 All extension . Instruction have unusuall x86 format: <0Fh> [] <0Fh> [] . Next byte (w/o F3h Prefix) (with F3 prefix) 00 CMPEQPS xmm,xmm/m128 CMPEQSS xmm,xmm/m32 ; KNI/MMX2 01 CMPLTPS xmm,xmm/m128 CMPLTSS xmm,xmm/m32 ; KNI/MMX2 02 CMPLEPS xmm,xmm/m128 CMPLESS xmm,xmm/m32 ; KNI/MMX2 03 CMPUNORDPS xmm,xmm/m128 CMPUNORDSS xmm,xmm/m32 ; KNI/MMX2 04 CMPNEPS xmm,xmm/m128 CMPNESS xmm,xmm/m32 ; KNI/MMX2 05 CMPNLTPS xmm,xmm/m128 CMPNLTSS xmm,xmm/m32 ; KNI/MMX2 06 CMPNLEPS xmm,xmm/m128 CMPNLESS xmm,xmm/m32 ; KNI/MMX2 07 CMPORDPS xmm,xmm/m128 CMPORDSS xmm,xmm/m32 ; KNI/MMX2 . Note: This is other forms of CMPPS xmm,xmm/m128,imm8 CMPSS xmm,xmm/m32,imm8 Code Extention # 28 (First byte(s) = 0Fh,71h) Field OOO Operation 000 001 010 PSRLW mm,imm8 ; MMX 011 100 PSRAW mm,imm8 ; MMX 101 110 PSSLW mm,imm8 ; MMX 111 Code Extention # 29 (First byte(s) = 0Fh,72h) Field OOO Operation 000 001 010 PSRLD mm,imm8 ; MMX 011 100 PSRAD mm,imm8 ; MMX 101 110 PSLLD mm,imm8 ; MMX 111 Code Extention # 30 (First byte(s) = 0Fh,73h) Field OOO Operation 000 001 010 PSRLQ mm,imm8 ; MMX 011 100 101 110 PSLLQ mm,imm8 ; MMX 111 Note: Here Provided small note about Additional Instruction Sets (SIMD subset) Cyrix AMD 3DNow! P5 P6 MMX EMMX 3DNow! SIMD EMMX ext Pentium + - - - - - - - Pentium/wMMX + - + - - - - - Pentium Pro + + - - - - - - Pentium II + + + - - - - - Pentium III + + + - - + (+) - AMD K5 + - - - - - - - AMD K6 + + + - - - - - AMD K6-2 + + + - + - - - AMD K6-III + + + - + - - - AMD Athlon + + + - + - + + ------------------------------------------------ APPENDIX F1 FLOATING POINT OPCODES ESC 0 (First byte = D8h) ========================== ESCAPE 000 MMRRRMMM ========================== Operation RRR If MM<>11 If MM=11 000 FADD mem32r FADD ST,ST(i) 001 FMUL mem32r FMUL ST,ST(i) 010 FCOM mem32r FCOM ST(i) 011 FCOMP mem32r FCOMP ST(i) 100 FSUB mem32r FSUB ST,ST(i) 101 FSUBR mem32r FSUBR ST,ST(i) 110 FDIV mem32r FDIV ST,ST(i) 111 FDIVR mem32r FDIVR ST,ST(i) ESC 1 (First byte = D9h) ========================== ESCAPE 001 MMRRRMMM ========================== Operation RRR If MM<>11 If MM=11 000 FLD mem32r FLD ST(i) 001 empty FXCH ST(i) 010 FST mem32r See Table marked ESC1-Extended codes 011 FSTP mem32r FSTP ST(i) 100 FLDENV mem See Table marked ESC1-Extended codes 101 FLDCW mem See Table marked ESC1-Extended codes 110 FSTENV mem See Table marked ESC1-Extended codes 111 FSTCW mem See Table marked ESC1-Extended codes ESC1-Extended codes: \ RRR MMM \ 010 100 101 110 111 000 FNOP FCHS FLD1 F2XM1 FPREM 001 FABS FLDL2T FYL2X FYL2XP1 010 FLDL2E FPTAN FSQRT 011 FLDPI FPATAN FSINCOS' 100 FTST FLDLG2 FXTRACT FRNDINT 101 FXAM FLDLN2 FPREM1 FSCALE 110 FLDZ FDECSTP FSIN' 111 FINCSTP FCOS' ' means 387+ (include 287XL/XLT, 187!!!) ESC 2 (First byte = DAh) ========================== ESCAPE 010 MMRRRMMM ========================== Operation RRR If MM<>11 000 FIADD mem32i 001 FIMUL mem32i 010 FICOM mem32i 011 FICOMP mem32i 100 FISUB mem32i 101 FISUBR mem32i 110 FIDIV mem32i 111 FIDIVR mem32i Note: P6 DA C0+i FCMOVB ST0,STi DA C8+i FCMOVE ST0,STi DA D0+i FCMOVBE ST0,STi DA D8+i FCMOVU ST0,STi ESC 3 (First byte = DBh) ========================== ESCAPE 011 MMRRRMMM ========================== Operation RRR If MM<>11 000 FILD mem32i 001 010 FIST mem32i 011 FISTP mem32i 100 101 FLD mem80r 110 111 FSTP mem80r So,If MM=11 we have next command (first byte = DBh) Mnemonic Second byte of code FNENI E0H (8087 only, others do nothing) FNDISI E1H (8087 only, others do nothing) FNCLEX E2H FNINIT E3H FSETPM E4H (287s only) FRSTPM E5H (287XL/XLT only) FSTB0 E8H (IIT) FSTB2 EAH (IIT) FSTB1 EBH (IIT) F4X4 F1H (IIT) FRINT2 FCH (Cyrix) FUCOMI ST0,STi E8H+i (P6) FCMOVNB ST0,STi C0H+i (P6) FCMOVNE ST0,STi C8H+i (P6) FCMOVNBE ST0,STi D0H+i (P6) FCMOVNU ST0,STi D8H+i (P6) FCOMPI ST0,STi F0H+i (P6) ESC 4 (First byte = DCh) ========================== ESCAPE 100 MMRRRMMM ========================== Operation RRR If MM<>11 If MM=11 000 FADD mem64r FADD ST(i),ST 001 FMUL mem64r FMUL ST(i),ST 010 FCOM mem64r FCOM ST(i) 011 FCOMP mem64r FCOMP ST(i) 100 FSUB mem64r FSUB ST(i),ST 101 FSUBR mem64r FSUBR ST(i),ST 110 FDIV mem64r FDIV ST(i),ST 111 FDIVR mem64r FDIVR ST(i),ST ESC 5 (First byte = DDh) ========================== ESCAPE 101 MMRRRMMM ========================== Operation RRR If MM<>11 If MM=11 000 FLD mem64r FFREE ST(i) 001 FXCH ST(i) 010 FST mem64r FST ST(i) 011 FSTP mem64r FSTP ST(i) 100 FNRSTOR mem 101 110 FNSAVE mem FUCOM ST(i) 111 FSTSW mem FUCOMP ST(i) Note: FRICHOP have opcode (DDh FCh) (Cyrix) ESC 6 (First byte = DEh) ========================== ESCAPE 110 MMRRRMMM ========================== Operation RRR If MM<>11 If MM=11 000 FIADD mem16i FADDP ST(i),ST 001 FIMUL mem16i FMULP ST(i),ST 010 FICOM mem16i FCOMP ST(i),ST 011 FICOMP mem16i 100 FISUB mem16i FSUBP ST(i),ST 101 FISUBR mem16i FSUBRP ST(i),ST 110 FIDIV mem16i FDIVP ST(i),ST 111 FIDIVR mem16i FDIVRP ST(i),ST Note: FCOMPP have opcode (DEh D9h) (Intel and all) ESC 7 (First byte = DFh) ========================== ESCAPE 111 MMRRRMMM ========================== Operation RRR If MM<>11 If MM=11 000 FILD mem16i FFREE ST(i) 001 FXCH ST(i) 010 FIST mem16i FST ST(i) 011 FISTP mem16i FSTP ST(i) 100 FBLD mem80b 101 FILD mem64i 110 FBSTP mem80b 111 FISTP mem64i Note: Next Instruction have opcodes: Mnemonic Opcode FNSTSW AX DFh E0h (287+) FNSTDW AX DFh E1h (387SL Mobile) FSTSG AX DFh E2h (387SL Mobile) FRINEAR DFh FCh (Cyrix) FUCOMIP ST0,STi DFH E8H+i (P6) FCOMIP ST0,STi DFH F0H+i (P6) ------------------------------------------------------------ APPENDIX F2 CPUs AND INSTRUCTION SET Note: Here Provided small note about Additional Instruction Sets: P5 P6 MMX EMMX 3DNow! SIMD Pentium + Pentium/wMMX + + Pentium Pro + + Pentium II + + + Celeron + + + Pentium III + + + + AMD K5 + AMD K6 + + AMD K6-2 + + + AMD K6-3 + + + Cyrix Cx6x86 (1) Cyxix Cx6x86MX + + + + Cyrix MII + + + + IDT C6 + + IDT WinChip 2 + + + (1) - Not support CPUID ------------------------------------------ APPENDIX G BUGS & CPU IDENTIFICATION INFO 1) How to separate i386SX and i386DX (Cx486SLC and Cx486DLC) Note: With 386DX type CPU possible to used 287 class NPX, and bit 4 in CR0 ET - Extention Type on DX we may to clear to 0, but for SX and REAL 486 this bit always 1. Routine: mov eax,cr0 push eax and al,0efh mov cr0,eax mov eax,cr0 test al,10h pop eax mov cr0,eax jne SX/SLC jmp DX/DLC 2) How to separate i486SX and i487SX/i486DX/DX2 etc Routine: memory_location DW ? mov memory_location,0 fninit fstcw memory_location cmp memory_location,037Fh jz i486SX jmp i486DX/DX2etc/i487SX 3) How to separate Cyrix's CPUs and other Be sure that Your CPU no Pentium before UMOV executed on Intel and other in Non SM modes as MOV. But Cyrix executed this instruction as Double NOP, and never generate INT 6. So. Mem_Loc DW 1 xor ax,ax umov ax,Mem_Loc or ax,ax jz Cyrix jmp No_Cyrix 4) Standart Way: Part 1 (Intel recomended this way) pushf pop ax and ax,0fffh ; Clear bits 15..12 push ax popf pushf pop ax and ax,0f000h ; Is bits 15..12=0 ? jz 286_CPU and ax,8000h ; Is bit 15=0 jz 386_and_Higher jmp 86_88and186_186etc 5) How separate 86/88, 186/188 and NECs mov ax,1 mov cl,33 shl ax,cl jnz 186_188 pusha ; Executed on 8086/8088 as JMP $+2 stc jc NECs jmp 86_88 6) Non CMOS 8086/88 execute command MOV CS,xxxx (Opcode 8Eh ...) CMOS 80C86/88 ignore it. 7) Then Invalid Opcode NEC/Sony V40/V50 do INT 6 NEC/Sony V20/V30 don't. 8) Remember POP CS instruction on non-CMOS 8086/8088. 9) PUSH SP 286 placed in stack new value of SP 86/88 old. 10) Best way to Reset 286+ in Real Mode: mov sp,1 (LOW BOUND) push smth note: mov sp,ffffh (HIGH BOUND) pop smth caused non Stack Fault, but GPF. 11) Maximal Length of Instructian 86: N/R 286: 10 byte 386+: 15 byte 12) UMC Chips Detection (UMC U486SX, for other use CPUID) db 64h,0dbh ; look like "SETALC FS:", but it none cmp eax,0ab6b1b07h je u486SX jne Other 13) MSW on 386/486 On 386 MSR reserved bits = 1, so Real Mode 386 usually MSW = FFF0 Real Mode 486+ usually MSW = 0010 smsw ax and ah,ah jnz cpu_386 jz cpu_486_and_more 14) Selectors PUSH 486 write 2 bytes to stack and ADD ESP,4 Pentium Write all 4 bytes (and two of it are zero) (The same situation, then pushing 16-bit error code on exception) 15) TSS I/O Map Addressing Then I/O Map Base Address in TSS contain for example FFFFh, (don't forget TSS Limit) i486 wrap around segment and access invalid address near start of TSS. Pentium caused GPF. 16) Prefetcher up to 486 and 486 then instruction fetched to prefetcher and we write into memory area, where this instruction placed, will be execute already-prefetched command, but non-new. Pentium flush prefetcher, when detect modify of fetched cache line, so, for avoid this flush use different linear addresses for modify. CPU Size_of_prefetch_queue Number_of_empty_bytes_in (bytes) queue_needed_for_initiate prefetch_cycle 8086/186/V20 6 2 8088/188/V30 4 1 286 6 2 386SX 16 2 386DX 16 4 17) DR4/DR5 :)) on 486 then accessing DR4/DR5 CPU accessed DR6/DR7. on Pentium if CR4.DE=0 the same situation as on 486, but if CR4.DE=1 then MOV from/to DR4/DR5 caused GPF. 18) NexGen Nx586 On Pentium and 486 we cannot set ET flag in CR0. We may set ET flag in CR0. (On 386 we may set this flag too). 19) IDIV if result of IDIV will be 80h (byte IDIV) or 8000h (word IDIV) 86/88 caused INT 0 - Division by zero, on 286+ 80h/8000h keeps as result and no exception 20) Division by zero On 86/88 pointer in stack then caused Division by zero pointed to DIV/IDIV instruction, on 286+ pointed to next instruction. 21) FPU Exception So, then FPU command with prefixes caused exception on 86/88 pointer to failed instruction on stack pointed to ESC command, on 386+ pointed to one of prefixes before ESC. 22) String commands if while 86/88 execute string instruction interrupt caused, CPU end execute instruction and goto next instruction, CX,SI and DI have values after last complete iteration To avoid it, use: pushf cli rep STRING popf 23) How to separate C&T 386 CPU form other (AMD,Intel) (C&T none have POPAD bug, but Intel and AMD have) mov esi,32 mov eax,12345678h loop: mov ebx,eax mov edx,0 mov esi,0 pushad popad mov ecx,[edx+edi] cmp eax,ebx jnz AMD_Intel rol eax,1 dec esi jnz loop jmp C_T_CPUs ------------------------------------------------ APPENDIX H Internal Names Of Processors (Intel) P9 i386SX P4 i486DX P4S i486SX P23S i487SX P23T OverDrive for PGA(169) P4T OverDrive for PGA(168) P24S i486DX2 P24T Pentium OverDrive for i486DX2 socket 3 (Vcc=5V,core=3V). P24CT Pentium OverDrive for Socket 3 (Vcc=3V) P5 Pentium-60,66 P5T Overdrive for P5 socket (120/133 MHz). P54C Pentium-90,100,75 x1.5 usually with APIC and Multiprocessing features P54CS Pentium-120,133 x2 with reduced APIC and multipr. features P55C Pentium w/MMX P54LM Pentium P54C with 2.9V (for Notebooks) P24C IntelDX4 P24D i486DX2 with WB cache (IntelDX2 (tm) WriteBack Enhanced) P54M Overdrive ( include to P54C but P54C work too) P6 Pentium Pro (no comments) P6T Pentium Pro OverDrive (for extended Pentium Sockets) P7 "Merced" (IA-64, VLIW command set "Tahoe") P54CSQ 3xCLK Pentiums P120 etc. P54CSLM P54CS with Low Power. P6L Pentium II "Klamath" (P6+MMX, Slot 1, 66 MHz bus, L2 speed CLK/2) Pentium II "Deschutes" (modernized Klamath, Slot 1, 66 or 100 MHz bus, L2 speed CLK/2) Celeron "Covington" (Slot1, Deschutes w/o L2 cache) Celron "Mendocino" (Slot1, L2 speed at CLK) Pentium II Xeon "Xeon" (Slot2, L2 speed at CLK) Pentium III "Katmai" (Slot1, 100MHz system bus, SIMD (MMX2/KNI)) Pentium III Xeon "Tanner" (Slot2, 100MHz system bus, L2 speed at CLK) P68 "Willamette" (Next gen P6: Pentium IV?) "Dixon" (Mendocino, with L2 256KB) "Coppermine" (future high-tech Pentium III 0.18m) "Cascades" (future high-tech Pentium III Xeon) "Foster" (THE LAST IA-32 INTEL CPU) :( "McKinley" (Second Generation Merced) (Cyrix) M5 Cx486S/S2 M6 Cx486D/D2 C6 Cx487D M7 Cx486DX/Cx486DX2 M8 Cx486DX4 M1 Cx6x86 M1SC Cx5x86 M1R Cx6x86L (0.35 mkm, reduced due size) M2 Cx6x86MX MII MIII "Jalapeno" (may be will support 3DNow! :) MediaGX (Integerated PCI and some perepheria) GXm (MMX-version of MediaGX) (AMD) SSA/5 Am5k86 early series (K5 with big due size and with reduced some features, 'cos don't work). K5 Am5k86 K6 (IA MMX support) K6-2 (3DNow!+ some extensions) K6-III "Sharptooth" (K6-2 + L2 cache) K7 (Slot A,512KB..8M L2 at Clk,Clk/2,Clk/3, 500MHz or higher) (IDT) C6 Winchip (MMX) C2 "Winchip 2" (+3DNow! and higher cache) "Winchip 4" (Rise) ------------------------------------------------- APPENDIX I FORMAT OF DEBUG CONTROL REGISTERS (DR6/DR7) +---------+ | DR6 | +---------+ [Am386xx/i386xx/i486xx/Am486xx] 3322222222221111 1 1 1 111 1098765432109876 5 4 3 210987654 3 2 1 0 ---------------------------------------- 0000000000000000 B B B 000000000 B B B B T S D 3 2 1 0 ---------------------------------------- [Intel Pentium] 3322222222221111 1 1 1 111 1098765432109876 5 4 3 210987654 3 2 1 0 ---------------------------------------- 1111111111111111 B B B 111111111 B B B B T S D 3 2 1 0 ---------------------------------------- [Cyrix Cx486DX,TI 486SXLC, TI 486SLC/e] 3322222222221111 1 1 1 111 1098765432109876 5 4 3 210987654 3 2 1 0 ---------------------------------------- 1111111111111111 B B 0 011111111 B B B B T S 3 2 1 0 ---------------------------------------- [TI 486SXL/Cx486SLC] 3322222222221111 1 1 1 111 1098765432109876 5 4 3 210987654 3 2 1 0 ---------------------------------------- 1111111111111111 B B 1 011111111 B B B B T S 3 2 1 0 ---------------------------------------- [IBM 486SLC2] 3322222222221111 1 1 1 1 11 1098765432109876 5 4 3 2 10987654 3 2 1 0 ----------------------------------------- 0000000000000000 B B B B 00000000 B B B B T S D K 3 2 1 0 ---------------------------------------- [AMD Am486SXLV/Am386DXLV/Am386SXLV] 3322222222221111 1 1 1 1 11 1098765432109876 5 4 3 2 10987654 3 2 1 0 ----------------------------------------- 0000000000000000 B B B S 00000000 B B B B T S D M 3 2 1 0 M S ---------------------------------------- [Cyrix Cx6x86] [Cx6x86MX] 3322222222221111 1 1 1 1 11 1098765432109876 5 4 3 2 10987654 3 2 1 0 ----------------------------------------- 0000000000000000 B B 0 0 11111111 B B B B T S 3 2 1 0 ---------------------------------------- BT - Debug Trap due to Task Switch BS - Debug Trap due to Single-Step BD - Debug Fault due to attemped registeracess when GD bit set BK - Debug Trap due to ICE This bit set if exception 1 will invoked due to occurence of ICEMD interrupt or ICEBP software breakpoint. SMMS - SMM Status if = 1 SMM is entered B3 - Debug fault/trap due to Breakpoint # 3 B2 - Debug fault/trap due to Breakpoint # 2 B1 - Debug fault/trap due to Breakpoint # 1 B0 - Debug fault/trap due to Breakpoint # 0 +--------+ | DR7 | +--------+ [Am386xx/i386xx/i486xx/Am486xx] [TI486SXL/Cx486SLC] 33 22 22 22 22 22 11 11 11 1 111 10 98 76 54 32 10 98 76 54 3 210 9 8 7 6 5 4 3 2 1 0 ---------------------------------------------------- LL RR LL RR LL RR LL RR 00 G 000 G L G L G L G L G L EE // EE // EE // EE // D E E 3 3 2 2 1 1 0 0 NN WW NN WW NN WW NN WW 33 33 22 22 11 11 00 00 ---------------------------------------------------- [Pentium/Cx486DX/Cx486DX2/Cx486DX4] [TI486SLC/e / TI486SXLC/Cx6x86] [Cx6x86MX] 33 22 22 22 22 22 11 11 11 1 111 10 98 76 54 32 10 98 76 54 3 210 9 8 7 6 5 4 3 2 1 0 ---------------------------------------------------- LL RR LL RR LL RR LL RR 00 G 001 G L G L G L G L G L EE // EE // EE // EE // D E E 3 3 2 2 1 1 0 0 NN WW NN WW NN WW NN WW 33 33 22 22 11 11 00 00 ---------------------------------------------------- [IBM486SLC2] 33 22 22 22 22 22 11 11 1 1 1 1 1 1 10 98 76 54 32 10 98 76 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 ------------------------------------------------------- LL RR LL RR LL RR LL RR T T G T G 0 G L G L G L G L G L EE // EE // EE // EE // T B D P M E E 3 3 2 2 1 1 0 0 NN WW NN WW NN WW NN WW 33 33 22 22 11 11 00 00 ------------------------------------------------------- [Am486SXLV/Am386DXLV/Am386SXLV] 33 22 22 22 22 22 11 11 111 1 11 10 98 76 54 32 10 98 76 543 2 10 9 8 7 6 5 4 3 2 1 0 ----------------------------------------------------- LL RR LL RR LL RR LL RR 000 S 00 G L G L G L G L G L EE // EE // EE // EE // M E E 3 3 2 2 1 1 0 0 NN WW NN WW NN WW NN WW I 33 33 22 22 11 11 00 00 E ---------------------------------------------------- [Am486xx] 33 22 22 22 22 22 11 11 111111 10 98 76 54 32 10 98 76 543210 9 8 7 6 5 4 3 2 1 0 ---------------------------------------------------- LL RR LL RR LL RR LL RR 000000 G L G L G L G L G L EE // EE // EE // EE // E E 3 3 2 2 1 1 0 0 NN WW NN WW NN WW NN WW 33 33 22 22 11 11 00 00 ---------------------------------------------------- LENi - Length of Breakpoint 00 - byte 01 - word 10 - undefined 11 - dword R/Wi - Reaw/Write Instructions Enable 00 - Instruction Execute cause Debug Interrupt 01 - Data Writes only 10 - I/O Reads or Writes 11 - Data Reads or Writes GD - Global Debug Register Access Protect INT 1 will be caused if any instructions will be read/write DRs. This bit cleared when invoking Debug Exception. GE - Global Exact Any data breakpoint traps will be reported exactly after competition of the instruction that caused the operand transfer. LE - Local Exact (Cleared on Task Switches) Note: 486+ always does exact data breakpoint matches, regardless of GE/LE bits. But 386 not. G3 - Global Enable Breakpoint # 3 L3 - Local Enable Breakpoint # 3 (Cleared on Task Switches) G2 - Global Enable Breakpoint # 2 L2 - Local Enable Breakpoint # 2 (Cleared on Task Switches) G1 - Global Enable Breakpoint # 1 L1 - Local Enable Breakpoint # 1 (Cleared on Task Switches) G0 - Global Enable Breakpoint # 0 L0 - Local Enable Breakpoint # 0 (Cleared on Task Switches) TT - Enable Task Trace Messages (to External ICE hardware) TB - Enable Branch Trace Messages (to External ICE hardware) TP - Exception 1 Handler Entry Convention if TP=0 exception 1 will interrupt 1 in user address space if TP=1 exception 1 will enter ICE mode GM - Enable Global Mapping if =1 Enable Mapping user memory addresses into ICE space. (Paging Must be disabled) SMIE - Software SMI Enable if = 1 enable Note: DR7: Undocument features on Intel's CPUs. see IBM 486SLC2. All this bits in DR7 exist on Intel CPUs, but where thay are undocument. (bits 15,14,12). ------------------------------------------------- APPENDIX I FORMAT OF DEBUG DATA REGISTERS (except DR0-DR5) +---------+ +---------+ | DR4 | | DR5 | +---------+ +---------+ DR4 and DR5 physically not exist, but then You accessing it using MOV from/to DR, thay are aliasing to DR6,DR7. +---------+ | DR3 | +---------+ [386+] 3322222222221111111111 10987654321098765432109876543210 -------------------------------- BREAKPOINT_3_LINEAR_ADDRESS -------------------------------- +---------+ | DR2 | +---------+ [386+] 3322222222221111111111 10987654321098765432109876543210 -------------------------------- BREAKPOINT_2_LINEAR_ADDRESS -------------------------------- +---------+ | DR1 | +---------+ [386+] 3322222222221111111111 10987654321098765432109876543210 -------------------------------- BREAKPOINT_1_LINEAR_ADDRESS -------------------------------- +---------+ | DR0 | +---------+ [386+] 3322222222221111111111 10987654321098765432109876543210 -------------------------------- BREAKPOINT_0_LINEAR_ADDRESS -------------------------------- ------------------------------------------------- APPENDIX K FORMAT OF CACHE TEST REGISTER (TR4/TR5/TR3) +-------+ | TR4 | +-------+ [i486xx/Cx486xx] 332222222222111111111 1 109876543210987654321 0 987 6543 210 ------------------------------------- TTTTTTTTTTTTTTTTTTTTT V LLL VVVV %%% AAAAAAAAAAAAAAAAAAAAA RRR AAAA GGGGGGGGGGGGGGGGGGGGG UUU LLLL IIII DDDD -------------------------------------- [Cx486SXL/e] 3322222222221111111111 10987654321098765432109 8 7 6543 210 ------------------------------------- TTTTTTTTTTTTTTTTTTTTTTT % L VVVV 000 AAAAAAAAAAAAAAAAAAAAAAA R AAAA GGGGGGGGGGGGGGGGGGGGGGG U LLLL IIII DDDD ------------------------------------- [WB-Enhanced IntelDX2 WB-mode] 332222222222111111111 1 109876543210987654321 0 987 65432 1 0 -------------------------------------- TTTTTTTTTTTTTTTTTTTTT % LLL %%%%% V V AAAAAAAAAAAAAAAAAAAAA RRR H L GGGGGGGGGGGGGGGGGGGGG UUU -------------------------------------- [IntelDX4] 33222222222211111111 1 1 10987654321098765432 1 0 987 6543 210 -------------------------------------- TTTTTTTTTTTTTTTTTTTT % V LLL VVVV %%% AAAAAAAAAAAAAAAAAAAA RRR AAAA GGGGGGGGGGGGGGGGGGGG UUU LLLL IIII DDDD -------------------------------------- [WB-Enhanced IntelDX4 WB-mode] 33222222222211111111 11 10987654321098765432 10 987 65432 10 -------------------------------------- TTTTTTTTTTTTTTTTTTTT %% LLL %%%%% V V AAAAAAAAAAAAAAAAAAAA RRR H L GGGGGGGGGGGGGGGGGGGG UUU -------------------------------------- [TI486SXL] 3322222222221111111 111 1098765432109876543 21098 7 6543 2 10 -------------------------------------- TTTTTTTTTTTTTTTTTTT %%%%% L VVVV V 00 AAAAAAAAAAAAAAAAAAA R AAAA A GGGGGGGGGGGGGGGGGGG U LLLL L IIII I DDDD D B -------------------------------------- [AMD Enhanced 486 CPU with EXT=0] 33222222222211111111 1 1 10987654321098765432 1 0 987 6543 210 -------------------------------------- TTTTTTTTTTTTTTTTTTTT 0 V LLL VVVV %%% AAAAAAAAAAAAAAAAAAAA RRR AAAA GGGGGGGGGGGGGGGGGGGG UUU LLLL IIII DDDD -------------------------------------- [AMD Enhanced 486 CPU with EXT=1] 3 32 2 22 22 22 22 111111111 1 1 09 8 76 54 32 10 987654321 0 987 6543 210 -------------------------------------------- % SS % SS SS SS SS %%%%%%%%% V LLL VVVV %%% TT TT TT TT TT RRR AAAA nn 33 22 11 00 UUU LLLL IIII DDDD -------------------------------------------- [Cyrix Cx6x86] 33222222222211111111 11 10987654321098765432 1098 76 54 3210 -------------------------------------- TTTTTTTTTTTTTTTTTTTT %%%% MM MM MMMM AAAAAAAAAAAAAAAAAAAA EE EE RRRR GGGGGGGGGGGGGGGGGGGG SS SS UUUU II II UU LL -------------------------------------- [Cyrix Cx6x86MX] 3322222222221111111111 109876543210987654321098765432 10 --------------------------------- AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA DDDDDDDDDDDDDDDDDDDDDDDDDDDDDD DDDDDDDDDDDDDDDDDDDDDDDDDDDDDD RRRRRRRRRRRRRRRRRRRRRRRRRRRRRR --------------------------------- VALUD - dwords (or other size units) of Cache Line which Valid LRU - LRU V - is cache line entry valid TAG - Tag of cache line VL,VH - Define MESI state of line VH VL State 1 1 M 0 1 E 1 0 S 0 0 I VALIDB - Valid of Cache Line STn - State of Cache Line (MESI) ST3 - State of 3rd dword of cache line (MESI) ST2 - State of 2nd dword of cache line (MESI) ST1 - State of 1st dword of cache line (MESI) ST0 - State of 0 dword of cache line (MESI) 00 - Invalid 01 - Exclusive 10 - Modified 11 - Shared MESIU - Upper Sector of Cache Line MESI state 00 - Modified 01 - Shared 10 - Exclusive 11 - Invalid MESIL - Lower Sector of Cache Line MESI state 00 - Modified 01 - Shared 10 - Exclusive 11 - Invalid MRU - Used for Determinate LRU line ADDR - Physical Address of Cache Line +--------+ | TR5 | +--------+ [i486xx/Am486xx/Cx486xx] 332222222222111111111 1 109876543210987654321 0987654 32 10 ------------------------------------- %%%%%%%%%%%%%%%%%%%%% SSSSSSS EE CC EEEEEEE NN TT TTTTTTT TT LL -------------------------------------- [TI486SXL/e] 33222222222211111111 11 10987654321098765432 10987654 3 2 10 -------------------------------------- %%%%%%%%%%%%%%%%%%%% SSSSSSSS % E CC EEEEEEEE N TT TTTTTTTT T LL -------------------------------------- [WB-Enhanced IndelDX2 WB-mode] 332222222222111111 1 11 1 109876543210987654 3 21 0987654 32 10 --------------------------------------- %%%%%%%%%%%%%%%%%% S %% SSSSSSS EE CC L EEEEEEE NN TT F TTTTTTT TT LL -------------------------------------- [IntelDX4] 33222222222211111111 11 10987654321098765432 10987654 32 10 ------------------------------------- %%%%%%%%%%%%%%%%%%%% SSSSSSSS EE CC EEEEEEEE NN TT TTTTTTTT TT LL -------------------------------------- [WB-Enhanced IntelDX4 WB-mode] 332222222222111111 1 1 11 109876543210987654 3 2 10987654 32 10 ------------------------------------- %%%%%%%%%%%%%%%%%% S % SSSSSSSS EE CC L EEEEEEEE NN TT F TTTTTTTT TT LL ------------------------------------- [TI486SXL] 3322222222221111111 1 11 1098765432109876543 2 10987654 32 10 ------------------------------------- %%%%%%%%%%%%%%%%%%% W SSSSSSSS EE CC A EEEEEEEE NN TT Y TTTTTTTT TT LL ------------------------------------- [AMD Enhanced 486 in WT-mode] 3322222222221111111 1 11 1098765432109876543 2 10987654 32 10 ------------------------------------- %%%%%%%%%%%%%%%%%%% ( SSSSSSSS EE CC S EEEEEEEE NN TT E TTTTTTTT TT LL T ) ------------------------------------- [AMD Enhanced 486 in WB-mode] 332222222222 1 11 1111 1 11 109876543210 9 87 6543 2 10987654 32 10 ------------------------------------- %%%%%%%%%%%% E SS %%%% ( SSSSSSSS EE CC X TT S EEEEEEEE NN TT T E TTTTTTTT TT LL T ) ------------------------------------- [Cx6x86] 332222222222111111 11 11 109876543210987654 32 1098765 432 10 ------------------------------------- %%%%%%%%%%%%%%%%%% WW SSSSSSS EEE CC AA EEEEEEE NNN TT YY TTTTTTT TTT LL ------------------------------------- [Cx6x86MX] 33222222 2 222 1 111 1111 11 10987654 3 210 9 876 5432 1098 76 54 32 10 ------------------------------------------ %%%%%%%% S %%% V MMM %%%% MMMM %% SS %% CC M EEE RRRR EE TT I SSS UUUU TT LL III ------------------------------------------ CTL - Control (Select operation) 00 - Enable (Fill Buffer Write/Read Buffer Read) 01 - Perform Cache Line Write 10 - Perform Cache Line Read 11 - Perform Cache Line Flush ENT - Select Entry for Operation SET - Select Set for Operation SLF - WAY - Select Way for Operation ST - State of set will be writing during write operation 00 - Invalid 01 - Exclusive 10 - Modified 11 - Shared EXT - Extension if EXT=0 bits 31..11 of TR4 contain TAG if EXT=1 bits 31..11 of TR4 contain STi SMI - SMI Address bit. Select separate/cachable SMI code/data space. V,MESI - Select Valid & MESI V MESI Description 1 000 Modified 1 001 Shared 1 010 Exclusive 0 011 Invalid 1 100 Locked Valid 0 111 Locked Invalid else Undefined MRU - Used for determinate LRU. +-------+ | TR3 | +-------+ [any,which support Cache Testing (all 486+)] 3322222222221111111111 10987654321098765432109876543210 -------------------------------- ___________CACHE_DATA___________ -------------------------------- CACHE_DATA - Data which will be reading/writing to/from cache line part. ------------------------------------------------- APPENDIX L FORMAT OF BTB TEST REGISTER (TR1/TR2) Note: This kind of registers present only on Cx6x86 and may be on Cx6x86MX. +-------+ | TR1 | +-------+ [Cx6x86] 3322222222221111111111 10987654321098765432109876 543 210 ---------------------------------- ?????????????????????????? III ??? DDD XXX ---------------------------------- IDX - Index of Register in BTB control space, which may be accessed via TR2. +-------+ | TR2 | +-------+ [Cx6x86] 3322222222221111111111 10987654321098765432109876543210 -------------------------------- _____________DATA_______________ -------------------------------- DATA - data which will be reading/writing from/to BTB control space registers. Note: Refer to Appendix A5 for more details. ------------------------------------------------- APPENDIX K FORMAT OF TLB TEST REGISTER (TR6/TR7) Note: Pentium and Higher Intel CPUs not support Test registers (TRs) at all. +-------+ | TR6 | +-------+ [i386xx] [i486xx] [TI486SXL] 33222222222211111111 1 1 10987654321098765432 1 0 9 8 7 6 5 4321 0 ----------------------------------------- LLLLLLLLLLLLLLLLLLLL V D D U U W W %%%% O AAAAAAAAAAAAAAAAAAAA # # # P DDDDDDDDDDDDDDDDDDDD DDDDDDDDDDDDDDDDDDDD RRRRRRRRRRRRRRRRRRRR ----------------------------------------- [Cx6x86] 33222222222211111111 1 1 10987654321098765432 1 0 9 8 7 6 5 4 3 210 ------------------------------------------ LLLLLLLLLLLLLLLLLLLL V D D U U W W A A CCC AAAAAAAAAAAAAAAAAAAA # # # # MMM DDDDDDDDDDDDDDDDDDDD DDD DDDDDDDDDDDDDDDDDDDD RRRRRRRRRRRRRRRRRRRR ------------------------------------------ [Cx6x86MX] 33222222222211111111 1 1 10987654321098765432 1 0 9 8 7 6 5 4 3 210 ------------------------------------------ LLLLLLLLLLLLLLLLLLLL V D P U 0 W 0 A 0 CCC AAAAAAAAAAAAAAAAAAAA G MMM DDDDDDDDDDDDDDDDDDDD DDD DDDDDDDDDDDDDDDDDDDD 222 RRRRRRRRRRRRRRRRRRRR ------------------------------------------ LADDR - Linear Address V - Valid bit for TLB entry D,D# - The Dirty Bit for/from TLB entry (Normal and Reverse) U,U# - The User/Supervisor bit for/from TLB Entry (Normal and Reverse) W,W# - The Read/Write bit for/from TLB entry (Normal and Reverse) OP - Operation 0 - TLB Write 1 - TLB LookUp A,A# - The Accessed Bit (Normal and Reverse) CMD - Array Command Select 000 - Direct Write to main TLB 001 - TLB lookup for an linear address in all arrays 100 - Write to variable page size mask only 110 - Write to variable page size, linear and physical addreses 101 - Read variable page size and linear address. 111 - Read variable page size cache physical and linear address PG - Page Global bit CMD2 - Array Command Select Value Description x00 - Write to L1 TLB x01 - Write to L2 TLB 010 - Read from L1 TLB X-port 011 - Read from L2 TLB X-port 110 - Read from L1 TLB Y-port 111 - Read from L2 TLB Y-port +-------+ | TR7 | +-------+ [i386xx] 33222222222211111111 11 10987654321098765432 1098765 4 32 10 ------------------------------------- PPPPPPPPPPPPPPPPPPPP %%%%%%% H RR %% HHHHHHHHHHHHHHHHHHHH T EE YYYYYYYYYYYYYYYYYYYY PP SSSSSSSSSSSSSSSSSSSS ------------------------------------- [i486xx] [TI486SXL] 33222222222211111111 1 1 10987654321098765432 1 0 987 65 4 32 10 --------------------------------------- PPPPPPPPPPPPPPPPPPPP P P LLL %% R RR %% HHHHHHHHHHHHHHHHHHHH C W RRR P PP YYYYYYYYYYYYYYYYYYYY D T UUU S // SSSSSSSSSSSSSSSSSSSS / HH H LL I --------------------------------------- [Cx6x86] 33222222222211111111 1 1 10987654321098765432 1 0 987 6 5 4 3 210 ---------------------------------------- PPPPPPPPPPPPPPPPPPPP P P BBB % H H H %%% HHHHHHHHHHHHHHHHHHHH C W III V D B YYYYYYYYYYYYYYYYYYYY D T SSSSSSSSSSSSSSSSSSSS ---------------------------------------- [Cx6x86MX] 33222222222211111111 1 1 10987654321098765432 1 0 987 6 5 4 3 210 ---------------------------------------- PPPPPPPPPPPPPPPPPPPP P P SSS % H H % HHH HHHHHHHHHHHHHHHHHHHH C W EEE 1 2 SSS YYYYYYYYYYYYYYYYYYYY D T TTT EEE SSSSSSSSSSSSSSSSSSSS TTT ---------------------------------------- PHYS - Physiacl Address HT - TLB Lookup Hit REP - Replacement Pointer PCD - Page Cache Disable PWT - Page Write Throught LRU - LRU RPS/HI - Replacement Pointer Select (writes)/Hit Indication (LookUp) RP/HL - Replacement Pointer (writes)/Hit Location (LookUp) BI - Cell Index for victim TLB and block cache operation. HV - Victim TLB Hit HD - Main TLB Hit HB - Variable-size Paging Mechanism Hit SET - L2 TLB Set Selection (0..5h) H1 - Hit in L1 TLB H2 - Hit in L2 TLB HSET - L2 set selection when L2 TLB hit occures (0h..5h) ---------------------------------------------------- APPENDIX N EFLAGS register format +---------+ | EFLAGS | +---------+ [Pentium P5] [Pentium P54C] [IntelDX4] [Am5k86] [Pentium Pro] [Pentium II] [Am6k86] [Pentium w/MMX (P55C)] 3322222222 2 2 1 1 1 1 1 1 11 1 1 1098765432 1 0 9 8 7 6 5 4 32 1 0 9 8 7 6 5 4 3 2 1 0 ----------------------------------------------------- I V V A V R N IO O D I T S Z A P C 0000000000 D I I C M F 0 T PL F F F F F F 0 F 0 F 1 F P F ----------------------------------------------------- [i486 SL Enhanced SX,DX,DX2] [IntelSX2] [Cx5x86] [UMC] [Cx6x86] [Cx6x86MX] 3322222222 2 2 1 1 1 1 1 1 11 1 1 1098765432 1 0 9 8 7 6 5 4 32 1 0 9 8 7 6 5 4 3 2 1 0 ----------------------------------------------------- I A V R N IO O D I T S Z A P C 0000000000 D 0 0 C M F 0 T PL F F F F F F 0 F 0 F 1 F ----------------------------------------------------- [i486 SX,DX,DX2] [OverDrive] [M5,M6,M7] [AMD Am486DX/DXL/DX2/DXL2 ] etc [IBM BL486DX/DX2] [Cx486SLC/DLC/SLC2/DLC2] [NexGen Nx586] 3322222222 2 2 1 1 1 1 1 1 11 1 1 1098765432 1 0 9 8 7 6 5 4 32 1 0 9 8 7 6 5 4 3 2 1 0 ----------------------------------------------------- A V R N IO O D I T S Z A P C 0000000000 0 0 0 C M F 0 T PL F F F F F F 0 F 0 F 1 F ----------------------------------------------------- [i386 SX,DX,CX,EX] [AMD Am386 ] [C&T 38600 ] etc [IBM 486SLC2] 3322222222 2 2 1 1 1 1 1 1 11 1 1 1098765432 1 0 9 8 7 6 5 4 32 1 0 9 8 7 6 5 4 3 2 1 0 ----------------------------------------------------- V R N IO O D I T S Z A P C 0000000000 0 0 0 0 M F 0 T PL F F F F F F 0 F 0 F 1 F ----------------------------------------------------- [i376] 3322222222 2 2 1 1 1 1 1 1 11 1 1 1098765432 1 0 9 8 7 6 5 4 32 1 0 9 8 7 6 5 4 3 2 1 0 ----------------------------------------------------- R N IO O D I T S Z A P C 0000000000 0 0 0 0 0 F 0 T PL F F F F F F 0 F 0 F 1 F ----------------------------------------------------- [i286 and all clones] 1 1 11 1 1 5 4 32 1 0 9 8 7 6 5 4 3 2 1 0 ------------------------------ N IO O D I T S Z A P C 0 T PL F F F F F F 0 F 0 F 1 F ------------------------------ [NEC/Sony V20/V30] 1 1 1 1 1 1 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 ------------------------------- M O D I T S Z A P C D 1 1 1 F F F F F F 0 F 0 F 1 F ------------------------------- [80x186 ,EA,EB,EC,XL] [8086/88 and all clones] 1 1 1 1 1 1 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 ------------------------------- O D I T S Z A P C 1 1 1 1 F F F F F F 0 F 0 F 1 F ------------------------------- Flags Summary: ID - Identification Flag VIP - Virtual Interrupt Pending VIF - Virtual Interrupt Flag AC - Align Check VM - Virtual 8086 Mode RF - Resume Flag MD - Mode Flag NT - Nested Task flag IOPL - Input/Output Privelege Level OF - Overflow Flag DF - Direction Flag IF - Interrupt Flag TF - Trap Flag SF - Sign Flag ZF - Zero Flag AF - Auxiliary Carry Flag PF - Parity Flag CF - Carry Flag --------------------------------------------------- APPENDIX O OLD CONTROL REGISTERS FORMAT (CR0-CR3) +---------+ | CR0 | +---------+ [Pentium P5] [Pentium P54C] [Pentium Pro] [Pentium II] [Pentium w/MMX] [Cx6x86MX] [Am6k86] [Am5k86] 3 3 2 2222222221 1 1 1 111111 1 0 9 8765432109 8 7 6 5432109876 5 4 3 2 1 0 --------------------------------------------- P C N A W N T E M P G D W 0000000000 M 0 P 0000000000 E 1 S M P E --------------------------------------------- [IntelDX4] [486DX/DX2, IntelDX4 ] 3 3 2 2222222221 1 1 1 111111 1 0 9 8765432109 8 7 6 5432109876 5 4 3 2 1 0 --------------------------------------------- P C N A W T M P G D W 0000000000 M 0 P 0000000000 * 1 S 1 P E --------------------------------------------- [Cx486SLC] 3 3 2 2222222221 1 1 1 111111 1 0 9 8765432109 8 7 6 5432109876 5 4 3 2 1 0 --------------------------------------------- P C A W T E M P G D 0 0000000000 M 0 P 0000000000 0 1 S M P E --------------------------------------------- [Cx486DLC] 3 3 2 2222222221 1 1 1 111111 1 0 9 8765432109 8 7 6 5432109876 5 4 3 2 1 0 --------------------------------------------- P C N A W E T E M P G D W 0000000000 M 0 P 0000000000 0 T S M P E --------------------------------------------- [Intel i486SX,SX2] 3 3 2 2222222221 1 1 1 111111 1 0 9 8765432109 8 7 6 5432109876 5 4 3 2 1 0 --------------------------------------------- P C N A W T E M P G D W 0000000000 M 0 P 0000000000 * 1 S M P E --------------------------------------------- [IBM 486SLC2] 3 32222222222111 1 111111 1 09876543210987 6 54321098765 4 3 2 1 0 --------------------------------------------- P W T E M P G 00000000000000 P 0000000000 1 S M P E --------------------------------------------- [Intel i386SX] 3 322222222221111111111 1 09876543210987654321098765 4 3 2 1 0 --------------------------------------------- P T E M P G 0000000000000000000000000 1 S M P E --------------------------------------------- [Intel i386DX] 3 322222222221111111111 1 09876543210987654321098765 4 3 2 1 0 --------------------------------------------- P E T E M P G 0000000000000000000000000 T S M P E --------------------------------------------- [80286] Note: None CR0, but MSW 111111 543210987654 3 2 1 0 --------------------- T E M P 000000000000 S M P E --------------------- PE - Protection Enable MP - Monitor Processor EM - Emulation TS - Task Switch ET - Extention Type NE - Numeric Exception WP - Write protect AM - Align Mode NW - No Write Throught CD - Cache Disable PG - Paging +--------+ | CR1 | +--------+ CR1 register not exist on x86 architecture. Usually aliased CR0. +--------+ | CR2 | +--------+ [386+] 3 322222222221111111111 1 0987654321098765432109876543210 --------------------------------- LAST_PAGE_FAULT_LINEAR_ADDRESS --------------------------------- +--------+ | CR3 | +--------+ [Intel i386xx] [Cyrix Cx486SLC] 33222222222211111111 11 10987654321098765432 109876543210 --------------------------------- PPPPPPPPPPPPPPPPPPPP %%%%%%%%%%%% DDDDDDDDDDDDDDDDDDDD BBBBBBBBBBBBBBBBBBBB RRRRRRRRRRRRRRRRRRRR --------------------------------- [Intel i486xx] [Cx6x86] [Cx6x86MX] [Pentium] [Pentium Pro] [Pentium II] [Pentium w/MMX] 33222222222211111111 11 10987654321098765432 1098765 4 3 210 ------------------------------------ PPPPPPPPPPPPPPPPPPPP %%%%%%% P P %%% DDDDDDDDDDDDDDDDDDDD C W BBBBBBBBBBBBBBBBBBBB D T RRRRRRRRRRRRRRRRRRRR ------------------------------------ see APPENDIX PDBR - Page Directory Base Register PCD - Page Cache Disable PWT - Page Write Whrought --------------------------------------------------- APPENDIX P CR4 register format +-------+ | CR4 | +-------+ [Katmai] [Deschutes] 3322222222221111111111 1098765432109876543210 9 8 7 6 5 4 3 2 1 0 ------------------------------------------ F P P M P P D T P V 0000000000000000000000 S C G C A S E S V M R E E E E E D I E ------------------------------------------ [Pentium Pro] [Pentium II] 3322222222221111111111 10987654321098765432109 8 7 6 5 4 3 2 1 0 ----------------------------------------- P P M P P D T P V 00000000000000000000000 C G C A S E S V M E E E E E D I E ----------------------------------------- [IDT C6] [IDT WinChip 2] 3322222222221111111111 10987654321098765432109 8 7 6 54 3 2 10 --------------------------------------- P M D T 00000000000000000000000 C 0 C 00 E S 00 E E D --------------------------------------- [Cx6x86MX/MII] 3322222222221111111111 10987654321098765432109 8 7 654 3 2 10 --------------------------------------- P P D T 00000000000000000000000 C G 000 E S 00 E E D --------------------------------------- [Pentium w/MMX] 3322222222221111111111 10987654321098765432109 8 7 6 5 4 3 2 1 0 ----------------------------------------- P M P D T P V 00000000000000000000000 C 0 C 0 S E S V M E E E D I E ----------------------------------------- [AMD Am5k86] [AMD Am6k86] [AMD K6-III] 3322222222221111111111 109876543210987654321098 7 6 5 4 3 2 1 0 ---------------------------------------- P M P D T P V 000000000000000000000000 G C 0 S E S V M E E E D I E ---------------------------------------- [Pentium P5] [Pentium P54C] 3322222222221111111111 1098765432109876543210987 6 5 4 3 2 1 0 --------------------------------------- M P D T P V 0000000000000000000000000 C 0 S E S V M E E D I E ---------------------------------------- [IntelDX4] [486s SL Enhanced] 3322222222221111111111 109876543210987654321098765432 1 0 ---------------------------------- P V 000000000000000000000000000000 V M I E ---------------------------------- FSR - Fast F.P. Context save/restore Enabled PCE - Perfomance Monitoring Counters Enabled PGE - Page Global Extension MCE - Machine Check Enable PAE - Physical Address Extention PSE - Page Size Extention DE - Debbuging Expection TSD - Time Stamp Disable PVI - Protected mode Virtual Interrupt VME - Virtual Mode Exception ------------------------------------------------------ APPENDIX Q TYPE OF INTEL'S SOCKETS Socket # Pins Vcc CPU OverDrive Bus Clk ---------------------------------------------- 1 169 5 i486SX IntelSX2 ODP ..50MHz i486DX IntelDX2 ODP ---------------------------------------------- 2 238 5 i486SX IntelSX2 ODP ..50MHz i486DX IntelDX2 ODP i486DX2 IntelDX4 ODP Pentium ODP (P24T) ---------------------------------------------- 3 237 3/5 i486SX IntelSX2 ODP ..50Mhz i486DX IntelDX2 ODP i486DX2 IntelDX4 ODP i486SX2 Pentium ODP (P24T) IntelDX4 ---------------------------------------------- 4 273 5 Pentium (P5) Pentium ODP (P5T) ..66MHz ---------------------------------------------- 5 320 3.3 Pentium (P54C) Pentium ODP (P54T) ..66Mhz ---------------------------------------------- 6 235 3.3 IntelDX4 Pentium ODP (P24T) ---------------------------------------------- 7 321 2.9-3.3 Pentium (P54C) Pentium ODP (P54T) ..100MHz Pentium (P55C) ---------------------------------------------- 8 387 2.9-3.3 Pentium Pro(P6) Pentium Pro ODP (P6T) ..66MHz ---------------------------------------------- Socket370 370 2.9? Celeron ...100MHz ---------------------------------------------- Slot # Pins Vcc CPU Overdrive ---------------------------------------------- 1 242 2.9-3.3 Pentium II 66MHz Celeron Pentium III ---------------------------------------------- 2 330 2.0? Pentium II Xeon 100MHz Pentium III Xeon ----------------------------------------------- Note: The main Pentium II chip have 528 pins. ------------------------------------------------------ APPENDIX R UNDEFINED FLAGS See CPUUTIL.ZIP for UFLAGS.COM !! Hey, Guys! Do You really think about set of 80x86 CPU cores and "That's mean UNDEFINED FLAGS?". 1) Do You Ask Yourself: "How many 80x86 base cores are?" Let's discuss about definitions: What's mean "base core"? "Base core" mean: same core clock for instructions, same undefined features e.t.c., and was produced many CPUs this type. (so, i486DX2 and i486DX have same core), (but i486DX2 and IntelDX4 have differ (cos MUL time +etc.). (i486SX integer core is look like i486DX core without NPX and all things joined with it). So we have next list of Main Base Cores: 8086/8088 (186s skipped) 286 386 (have some differents on vendors) Cx486SLC/Cx486DX (and all clones like TI486SXL) i486 UMC U5S Cyrix Cx5x86 (M1sc) Pentium NexGen Nx5x86 Cyrix Cx6x86 (M1) AMD Am5k86 Pentium Pro Of course one Main Base Core have many CPUs which have differents between self, for example: TI486SXL have Cx486DLC Base Core. This Base Cores is relative, of course. (We may discuss Where to push C&T 38600DX etc., but it doesn't matter) 2) How many situation with Undefined Flags exists? Not too many, as You think: MUL DIV IMUL IDIV NEG (ZF) AND/OR/XOR/etc (AF) Shift/Rotates (OF) and some more. 3) What's To Do? Let's make next experiment: AH = 0 AH -> FLG PERFORM TEST SEQUENCE FLG -> AH GET RESULT # 1 AH = FF AH -> FLG PERFORM TEST SEQUENCE FLG -> AH GET RESULT # 2 ANALYSING RESULTS. (WHICH BIT PASSED, WHICH DRIVEN BY INSTRUCTION Main Test Sequences are: MUL: mov ax,0000h mov bx,1234h mul bx DIV: mov ax,1234h mov bl,22h div bl IMUL: mov ax,0092h mov bl,22h imul bl IDIV: mov ax,0ffeeh mov bl,22h idiv bl LOG: mov ax,0ff00h mov bx,0f0fh and ax,bx 4) Result: Here placed summary of Undefined flag analysis on CPUs. ------------------------------------------------------------------------ CPU ------------- Sequence ------------- CORE MUL DIV IMUL IDIV LOG Note ------------------------------------------------------------------------ 286 ALL ALL ALL ALL ALL as 386,i486 DRIVEN DRIVEN DRIVEN DRIVEN DRIVEN ------------------------------------------------------------------------ 386 ALL ALL ALL ALL ALL as 286,i486 DRIVEN DRIVEN DRIVEN DRIVEN DRIVEN ------------------------------------------------------------------------ i486 ALL ALL ALL ALL ALL as 286,386 DRIVEN DRIVEN DRIVEN DRIVEN DRIVEN ------------------------------------------------------------------------ Cx486SLC Z,S,P,A ALL Z,S,P,A ALL AF PASSED PASSED PASSED PASSSED PASSED ------------------------------------------------------------------------ UMC U5S Z,S,P,A ALL Z,S,P,A ALL ALL PASSED PASSED PASSED PASSED DRIVEN ------------------------------------------------------------------------ Cx5x86 P,A C,O,P,A P,A C,O,P,A ALL PASSED PASSED PASSED PASSED DRIVEN ------------------------------------------------------------------------ Pentium Z,S,P,A ALL Z,S,P,A ALL ALL as Pentium Pro Pentium w/MMX PASSED DRIVEN PASSED DRIVEN DRIVEN ------------------------------------------------------------------------ Nx5x86 ???? ???? ???? ???? ???? Somebody who have ???? ???? ???? ???? ???? NexGen please contact Me. ------------------------------------------------------------------------- Cx6x86 ALL C,O ALL C,O ALL DRIVEN PASSED DRIVEN PASSED DRIVEN ------------------------------------------------------------------------ Am5k86 Z,S,P,A C,O Z,S,P,A C,O ALL K6 PASSED PASSED PASSED PASSED DRIVEN ------------------------------------------------------------------------ Pentium Pro Z,S,P,A ALL Z,S,P,A ALL ALL as Pentium Pentium II PASSED DRIVEN PASSED DRIVEN DRIVEN Celeron ------------------------------------------------------------------------ Note: See utilites, included to this OPCODE.LST for getting UNDEFINED FLAGS on Your processor. All looks like Intel and AMD frozen theys Undefined Flags conception :) --------------------------------------------------- APPENDIX S FLOATING POINT REGISTERS FORMATS +-------+ | CW | +-------+ [8087] 1111 1 11 6543 2 10 98 7 6 5 4 3 2 1 0 ---------------------------- %%%% I RR PP I % P U O Z D I C CC CC E M M M M M M M ---------------------------- [80287] 1111 1 11 6543 2 10 98 76 5 4 3 2 1 0 --------------------------- %%%% I RR PP %% P U O Z D I C CC CC M M M M M M --------------------------- [287XL/XLT,387SX/DX and all build-in FPUs] 11111 11 65432 10 98 76 5 4 3 2 1 0 ---------------------------- %%%%% RR PP %% P U O Z D I CC CC M M M M M M ---------------------------- IC - Infinity Control if =0 Infinity is Projective if =1 Infinity is Affine RC - Round Control 00 - Round to nearest or soon 01 - Round down (toward -infinity) 10 - Round up (toward +infinity) 11 - Chop (Truncate toward 0) PC - Precension Control 00 - 24 bit 01 - Reserved 10 - 53 bit 11 - 64 bit IEM - Interrupt Mask Enable 0 - Interrupts Enable 1 - Interrupts Disable PM - Precension mask UM - Underflow mask OM - Overflow Mask ZM - Zero Maks DM - Denormalized operand mask IM - Invalid Operation Mask All other F.P registers: ST(i), TAGS, SW have same format on all FPUs. Present some different in FPU environment, but now is no time for describe it here. ------------------------------------------------- APPENDIX T FORMAT OF PAGE TABLES ENTRYES In X86 Architecture there are 3 modes of Paging: Mode A - i386..Pentium Compatible The selection of paging mode: CR0.PG CR4.PAE CR4.PSE page_desc.PS Page Size Address Space Paging Mode 0 x x x ----- Paging Disable ----- 1 0 0 x 4K 32bit A 1 0 1 0 4K 32bit A 1 0 1 1 4M 32bit A 1 1 x 0 4K 36bit B 1 1 x 1 2M 36bit C +----------------------------------------------------------------------------+ | ---------------- Paging Mode A ----------- | +----------------------------------------------------------------------------+ Format of Linear Address: [32 bit address, 4K pages] bit description 31..22 index in PDT (Page Directory Table) 21..12 index in PT (Page Table) 11..0 offset within Page [32 bit address, 4M pages] bit description 31..22 index in PDT (Page Directory Table) 21..0 offset within Page Format of CR3 register: ----------------- bit description 31..12 PDT base address (31..12) (PDBR) 11..5 Reserved 4 PCD 3 PWT 2..0 Reserved (0) +----------+ | CR3.PDBR | +----------+ | PDT (Pages | Directory Table) \---->+----------------+ | .... | +----------------+ PT (Pages Table) | PT desc. |------>+-------------------+ +----------------+ | ...... | | .... | +-------------------+ +----------------+ | Page desc. | ---> +-----------+ | | +-------------------+ | Page in | | | | ..... | | memory 4K | | | +-------------------+ +-----------+ +----------------+ | 4M page desc. |-----> +----------+ +----------------+ | Page in | | | | memory | +----------------+ | 4Mb | +----------+ +------------------------------+ | Format of Pages Descriptors | +------------------------------+ [Pentium Pro,Pentium II,AMD K5,K6] (only page directory entrys support 4MB pages) 33222222222211111111 11 10987654321098765432 109 8 7 6 5 4 3 2 1 0 ------------------------------------------ PPPPPPPPPPPPPPPPPPPP AAA G P D A P P U R P FFFFFFFFFFFFFFFFFFFF VVV S C W / / AAAAAAAAAAAAAAAAAAAA LLL D T S W ------------------------------------------ [Pentium,Cyrix Cx6x86MX] (only page directory entrys support 4MB pages) 33222222222211111111 11 10987654321098765432 109 8 7 6 5 4 3 2 1 0 ------------------------------------------ PPPPPPPPPPPPPPPPPPPP AAA 0 P D A P P U R P FFFFFFFFFFFFFFFFFFFF VVV S C W / / AAAAAAAAAAAAAAAAAAAA LLL D T S W ------------------------------------------ [i486 and clones] 33222222222211111111 11 10987654321098765432 109 8 7 6 5 4 3 2 1 0 ------------------------------------------ PPPPPPPPPPPPPPPPPPPP AAA 0 0 D A P P U R P FFFFFFFFFFFFFFFFFFFF VVV C W / / AAAAAAAAAAAAAAAAAAAA LLL D T S W ------------------------------------------ [Cx486SLC/DLC,TI486SLC/DLC/e,TI486SXL and clones] 33222222222211111111 11 10987654321098765432 109 8 7 6 5 4 3 2 1 0 ------------------------------------------ PPPPPPPPPPPPPPPPPPPP AAA 0 0 D A P 0 U R P FFFFFFFFFFFFFFFFFFFF VVV C / / AAAAAAAAAAAAAAAAAAAA LLL D S W ------------------------------------------ [i386 and all clones] 33222222222211111111 11 10987654321098765432 109 8 7 6 5 43 2 1 0 ------------------------------------------ PPPPPPPPPPPPPPPPPPPP AAA 0 0 D A 00 U R P FFFFFFFFFFFFFFFFFFFF VVV / / AAAAAAAAAAAAAAAAAAAA LLL S W ------------------------------------------ PFA - Physical Frame address AVL - Available for Operating System G - Global Page (valid if PGE bit in CR4 set PS - Page Size =0 Directory entry (if in PDT) 4K page (if in page table) =1 4M boundary (descriptor must be in PDT only)) D - Dirty (ignored in PDT) A - Accessed PCD - Page Cache disable PWT - Page Write throught U/S - User/Supervisor R/W - Read/Write P - Present +----------------------------------------------------------------------------+ | ---------------- Paging Modes B & C ----------- | +----------------------------------------------------------------------------+ Schemes, which used in paging modes B and C support address extension up to 64bit, but now can be used only 36 bits of it. Format of Linear Address: [36 bit address, 4K pages] (mode B) bit description 31..30 index in PDPT (Page Directory Pointers Table) 29..21 index in PDT (Page Directory Table) 20..12 index in PT (Page Table) 11..0 offset within Page [36 bit address, 2M pages] (mode C) bit description 31..30 index in PDPT (Page Directory Pointers Table) 29..21 index in PDT (Page Directory Table) 20..0 offset within Page Format of CR3 register: -------------------- bit description 31..5 PDPT base address (38..12) (PDBR) 4 PCD 3 PWT 2..0 Reserved (0) PDPT (Page Directory Pointer Table) +----------+ +----------+ <--------------------| CR3.PDBR | | ... | +----------+ +----------+ | PDT desc | +----------+ | PDT (Pages | Directory Table) \---->+----------------+ | .... | +----------------+ PT (Pages Table) | PT desc. |------>+-------------------+ +----------------+ | ...... | | .... | +-------------------+ +----------------+ | Page desc. | ---> +-----------+ | | +-------------------+ | Page in | | | | ..... | | memory 4K | | | +-------------------+ +-----------+ +----------------+ | 2M page desc. |-----> +----------+ +----------------+ | Page in | | | | memory | +----------------+ | 2M | +----------+ Format of Page Directory Pointer Table Entry (4 entry/PDPT): ---------------------------------- 6 3 3 1 1 3 ... 6 5 ..... 2 1 ... 9 8..5 4 3 2..0 -------+---------+-------+----+-+-+---- %%%%%%%| PDT Base| | %% |P|P| %%% %%%%%%%| Address | AVAIL | %% |C|W| %%% %%%%%%%|(35..12) | | %% |D|T| %%% -------+---------+-------+----+-+-+---- Format of Page Directory Table Entry (512 entry/PDT) ---------------------------- [4K pages DT]: (Mode B) 6 3 3 1 1 3 ... 6 5 ..... 2 1 ... 9 8..6 5 4 3 2 1 0 -------+---------+-------+----+-+-+-+-+-+- %%%%%%%| PT Base | | %% | |P|P|U|R| %%%%%%%| Address | AVAIL | %% |A|C|W|/|/|P %%%%%%%|(35..12) | | %% | |D|T|S|W| -------+---------+-------+----+-+-+-+-+-+- [2M page]: (Mode C) 6 3 3 2 2 1 1 3 ... 6 5 ..... 1 0..2 1 ... 9 8 7 6 5 4 3 2 1 0 -------+---------+----+-------+-+-+-+-+-+-+-+-+- %%%%%%%|Page Base| %% | | | | | |P|P|U|R| %%%%%%%| Address | %% | AVAIL |G|1|D|A|C|W|/|/|P %%%%%%%|(35..21) | %% | | | | | |D|T|S|W| -------+---------+----+-------+-+-+-+-+-+-+-+-+- Format of Page Table Entry (512 entry/PT): ------------------------- [2K page]: (Mode B) 6 3 3 1 1 3 ... 6 5 ..... 2 1 ... 9 8 7 6 5 4 3 2 1 0 -------+---------+-------+-+-+-+-+-+-+-+-+- %%%%%%%|Page Base| | | | | |P|P|U|R| %%%%%%%| Address | AVAIL |G|0|D|A|C|W|/|/|P %%%%%%%|(35..21) | | | | | |D|T|S|W| -------+---------+-------+-+-+-+-+-+-+-+-+- The means of bits same as in Paging Mode A. ------------------------------------------------- APPENDIX U FORMAT OF DESCRIPTORS +-------------------------------+ | Format of Generic Descriptor: | +-------------------------------+ +00 WORD Segment Limit (Low) (15..0) +02 WORD Segment Base (Low) (15..0) +04 BYTE Segment Base (Mid) (23..16) +05 BYTE Access Rights Byte (AR) +06 BYTE Segment Limit (High) (19..16)/AR2 +07 BYTE Segment Base (High) (31..24) This format have data and code segment descriptors. +----------+ | AR | Access Rights Byte +----------+ +----+----+----+----+----+----+----+----+ | P | DPL | S | | | | | [General AR] +----+----+----+----+----+----+----+----+ P - (Present segment) =0 segment not present =1 segment present in memory DPL - (Descriptor Privelege Level) 00 - Highest 11 - Lowest S - (System) =0 descriptor is system =1 descriptor is segment +----+----+----+----+----+----+----+----+ | P | DPL | 1 | E | | | | [segment AR] +----+----+----+----+----+----+----+----+ E - (Extended Type of Segment Descriptor) =0 data segment =1 code segment +----+----+----+----+----+----+----+----+ | P | DPL | 1 | 1 | C | R | A | [Code segment AR] +----+----+----+----+----+----+----+----+ C - (Control Bit) =0 Working rules of calling segment wia gates, using PL. =1 Segment may be immediate called using CALL FAR from same or more privelege segment R - (Readable segment) =0 Reading disable (only execution enable) =1 Enable reading A - (Accessable) =0 None accesses into segment was =1 Some accesses was +----+----+----+----+----+----+----+----+ | P | DPL | 1 | 0 | ED | W | A | [Data segment AR] +----+----+----+----+----+----+----+----+ ED - (Expand Down) =0 Expand Up =1 Expand down W - (Writable) =0 Write disable =1 Write enable +----+----+----+----+----+----+----+----+ | P | DPL | 0 | T Y P E | [System descriptor AR] +----+----+----+----+----+----+----+----+ TYPE - (Type of System descriptor) 0000 - Not Used 0001 - Available TSS (286 style) 0010 - LDT 0011 - Busy TSS (286 style) 0100 - Call Gate (286 style) 0101 - Task Gate (286 style) 0110 - Interrupt Gate (286 style) 0111 - Trap Gate (286 style) 1000 - Not Used 1001 - Available TSS (386 style) 1010 - Reserved 1011 - Busy TSS (386 style) 1100 - Call Gate (386 style) 1101 - Reserved 1110 - Interrupt Gate (386 style) 1111 - Trap Gate (386 style) +--------+ | AR2 | +--------+ +----+----+----+----+ | G | D | 0 | X | +----+----+----+----+ G - (Granularity) =0 Segment limit calculated in Bytes (up to 2^20 bytes) =1 Segment limit calculated in Pages of 4K (up to 2^32 bytes) D - (Dimensions) =0 16 bit segment =1 32 bit segment Note: need for code segments, 'cos opcodes in 16-bit and 32-bit segments are different. X - Available for Operating System +---------------------------------------------------------------------------+ | ------------------------ System Descriptors -----------------------------| +---------------------------------------------------------------------------+ +-----+ | LDT | +-----+ +00 WORD LDT Limit (Low) 15..0 +02 WORD LDT Base (15..0) (Low) +04 BYTE LDT Base (23..16) (Mid) +05 BYTE AR +06 BYTE AR2 +07 BYTE LDT Base (31..24) (High) +----+----+----+----+----+----+----+----+ | P | DPL | 0 | 0 | 0 | 1 | 0 | [AR] +----+----+----+----+----+----+----+----+ +---------------+ | 286 Call Gate | +---------------+ +00 WORD Offset 15..0 +02 WORD Selector +04 BYTE Word Count (5 bit) +05 BYTE AR +06 WORD 0 +----+----+----+----+----+----+----+----+ | P | DPL | 0 | 0 | 1 | 0 | 0 | [AR] +----+----+----+----+----+----+----+----+ +---------------+ | 386 Call Gate | +---------------+ +00 WORD Offset 15..0 (Low) +02 WORD Selector +04 BYTE Dword Count (5 bit) +05 BYTE AR +06 WORD Offset 31..16 +----+----+----+----+----+----+----+----+ | P | DPL | 0 | 1 | 1 | 0 | 0 | [AR] +----+----+----+----+----+----+----+----+ +---------+ | 286 TSS | +---------+ +00 WORD TSS Limit (15..0) +02 WORD TSS Base (15..0) (Low) +04 BYTE TSS Base (23..16) (Mid) +05 BYTE AR +06 WORD 0 +----+----+----+----+----+----+----+----+ | P | DPL | 0 | 0 | 0 | B | 1 | [AR] +----+----+----+----+----+----+----+----+ B - (Busy) =0 TSS is available =1 TSS is busy (active,current) +---------+ | 386 TSS | +---------+ +00 WORD TSS Limit (15..0) (Low) +02 WORD TSS Base (15..0) (Low) +04 BYTE TSS Base (23..16)(Mid) +05 BYTE AR +06 BYTE AR2/TSS Limit High (19..16) +07 BYTE TSS Base (31..24) (High) +----+----+----+----+----+----+----+----+ | P | DPL | 0 | 1 | 0 | B | 1 | [AR] +----+----+----+----+----+----+----+----+ +-------------------------+ | Interrupt/Trap Gate 286 | +-------------------------+ +00 WORD Offset 15..0 +02 WORD Selector +04 BYTE 0 +05 BYTE AR +06 WORD 0 +----+----+----+----+----+----+----+----+ | P | DPL | 0 | 0 | 1 | 1 | T | [AR] +----+----+----+----+----+----+----+----+ T - (Trap Flag) =0 Interrupt Gate =1 Trap Gate +-------------------------+ | Interrupt/Trap Gate 386 | +-------------------------+ +00 WORD Offset 15..0 (Low) +02 WORD Selector +04 BYTE 0 +05 BYTE AR +06 WORD Offset 31..16 (High) +----+----+----+----+----+----+----+----+ | P | DPL | 0 | 1 | 1 | 1 | T | [AR] +----+----+----+----+----+----+----+----+ +-----------+ | Task Gate | +-----------+ +00 WORD 0 +02 WORD TSS Selector +04 BYTE 0 +05 BYTE AR +06 WORD 0 +----+----+----+----+----+----+----+----+ | P | DPL | 0 | 0 | 1 | 0 | 1 | [AR] +----+----+----+----+----+----+----+----+ +----------------------------------+ | Possible Tables for Descriptors | +----------------------------------+ ---------------+-----------------------+--------------------------- Lowest 5 bits | | Valid in of AR | Type | GDT LDT IDT ---------------+-----------------------+--------------------------- 00010 LDT + - - 0*0*1 286 TSS + - - 0*100 Call Gate + + - 0*101 Task Gate + + + 0*110 Interrupt Gate - - + 0*111 Trap Gate - - + 10*** Data segment + + - 11*** Code segment + + - ------------------------------------------------- APPENDIX V FORMAT OF TSS +--------------------+ | Format of 286 TSS | +--------------------+ +00 WORD Previous TSS Selector (Back Link) +02 WORD Offset of stack ring 0 +04 WORD Selector of stack ring 0 +06 WORD Offset of stack ring 1 +08 WORD Selector of stack ring 1 +0A WORD Offset of stack ring 2 +0C WORD Selector of stack ring 2 +0E WORD IP +10 WORD FLG +12 WORD AX +14 WORD CX +16 WORD DX +18 WORD BX +1A WORD SP +1C WORD BP +1E WORD SI +20 WORD DI +22 WORD ES +24 WORD CS +26 WORD SS +28 WORD DS +2A WORD LDT Note: Len of 286 TSS is 2Ch bytes (44d) +--------------------+ | Format of 386 TSS | +--------------------+ High word/Low word +00 DWORD 0/Previous TSS selector (Back Link) +04 DWORD Stack pointer for ring 0 +08 DWORD 0/Stack Selector for ring 0 +0C DWORD Stack pointer for ring 1 +10 DWORD 0/Stack Selector for ring 1 +14 DWORD Stack pointer for ring 2 +18 DWORD 0/Stack Selector for ring 2 +1C DWORD CR3 +20 DWORD EIP +24 DWORD EFLAGS +28 DWORD EAX +2C DWORD ECX +30 DWORD EDX +34 DWORD EBX +38 DWORD ESP +3C DWORD EBP +40 DWORD ESI +44 DWORD EDI +48 DWORD 0/ES +4C DWORD 0/CS +50 DWORD 0/SS +54 DWORD 0/DS +58 DWORD 0/FS +5C DWORD 0/GS +60 DWORD 0/LDT +64 WORD Trap Bits +66 WORD Offset within TSS to I/O Permission Map Minimal Length of TSS is 68 bytes. IPM is IO Permition Map Base address TSS_LAST is last byte of TSS. +IPM-20h 20h BYTEs Software Interrupt Redirection Bitmap (VME) 1 bit/int +IPM xxh BYTEs I/O Permition Bitmap 1 bit/port +TSS_LAST BYTE I/O PAD Byte PAD byte show which bits in last byte of I/O permission bitmap valid. (recommended to set up this byte to FF) TSS +----------------+ | | | ..... | | | +----------------+ | offset to IPM |----------------+ +----------------+ | | .... | | | .... | | +----------------+ | |Int Redir Bitmap| | +----------------+ <--------------+ | IPM | +----------------+ | PAD BYTE | +----------------+ <------ TSS Limit --------------------------------------------------- APPENDIX W - Model Specific Registers List ------------------------------------------------- MSR 0 is Machine check Exception Address register (Read only) (Pentium,AMD Am5k86) bits Description 63..32 Reserved 31..0 Machine Check Phisical Address (AMD K6) K6 not support machine check, it support only read/write in this register as in GPRs, and set this MSR after RESET to 0. (Pentium II,Pentium Pro) Not support MCE, but accessed without generating exceptions. ------------------------------------------------- MSR 1 is Machine Check Type register (Read Only) (Pentium,Am5k86) bits Description 63..5 Reserved 5 FERI (Fun Error Indicator) (Pentium OverDrive Only) initialazed after RESET as 0. If temperature of CHIP > ~75'C then set this bit to 1 and this bit still will 1 before Next RESET. This bit used FANMONIT.EXE utility shipped with PODP5V. 4 LOCK =1 if bus cycle called Machine Check was Locked =0 if --//-- not locked (normal) 3 M/IO# \ 2 D/C# State of output pins in bus cycle called 1 W/R# / Machine check 0 CHK (Check) =1 after last read MSR 1 was Machine Check Note: This bit Clearing on reading (AMD K6) K6 not support machine check, it support only read/write in this register as in GPRs, and set this MSR after RESET to 0. (Pentium II,Pentium Pro) Not support MCE, but accessed without generating exceptions. ------------------------------------------------- MSR 2h is Test Register 1 (TR1) (Read/Write) (Pentium,Pentium w/MMX) Parity Reversal Register (PRR) bits Description 63..14 Reserved (should be zero) 13 MC (Microcode Parity Error) 12 DTD (data TLB data error) 11 DTT (data TLB tag error) 10 DD (data cache data) 9 DT (data cache tag) 8 ITD (instruction TLB data error) 7 ITT (instruction TLB tag error) 6 ID3 (data cache odd bits (255, ..., 129) error) 5 ID2 (data cache even bits (254,..., 128) error) 4 ID1 (data cache odd bits (127, ..., 1) error) 3 ID0 (data cache even bits (126, ..., 0) error) 2 IT (instruction cache TAG) 1 NS (No shutdown) If = 0 On parity errors set PRR.PES, assert IERR# and shutdown. If =1 On parity error set PRR.PES and assert IERR# 0 PES (Parity Error Summary) If =1 Parity Error If =0 Never Parity error Note: bits 13..2, if bit=1 it means that error joined with this bit present. (IDT C6/Winchip2) bits description 63..2 reserved 1 NS if = 0 Assert #IERR and cause shutdown on Internal parity error if = 1 Assert #IERR and do not cause shutdown --//-- 0 reserved ------------------------------------------------- MSR 3h is Reserved (Do not Accessed it) (Intel) ------------------------------------------------- MSR 3h is Test Data (since Cyrix 6x86MX) Bits Description 63..32 Reserved 31..0 TR3 like data ------------------------------------------------- MSR 4h is Test Register 2 (TR 2) (Read/Write) (Pentium) (Instruction Cache End bits TR) bits Description 63..4 Reserved (should be zero) 3..0 End Bits Note: each bit of End bit correspond to one byte of instruction in TR3 during code testability access. I.c. line size = 32 bytes, 8 accesses are needed for read/write the end bits of cache line. Each of this bits indicated an instruction boundarues If given byte is last byte of instruction then bit joined with this byte =1. Then new line writting into cache all ends bits =1, when line decoding setting bits to 0, except last byte of instruction. (Pentium w/MMX) This register is reserved. ------------------------------------------------- MSR 4h is Test Address (since Cyrix 6x86MX) Bits Description 63..32 Reserved 31..0 TR4 like address ------------------------------------------------- MSR 5h is Test Register 3 (TR 3) (Read/Write) (Pentium,Pentium w/MMX) (Cache test Data) bits Description 63..32 Reserved (should be zero) 31..0 Data Reading/Writing from/to {code/data} cache ------------------------------------------------- MSR 5h is Test Command/Status (since 6x86MX and later) Bits Description 63..32 Reserved 31..0 TR5 like command: 31..24 Reserved 23 SMI (SMI Address Bit) Select Separate/Cachable SMI memory space. 22..20 Reserved 19 V (Valid Bit) 18..16 MESI 19..16 1000 - Modified 1001 - Shared 1010 - Exclusive 0011 - Invalid 1100 - Locked Valid 0111 - Locked Invalid 15..12 Reserved 11..8 MRU (Used to determinate LRU Line) 7..6 Reserved 5..4 SET 3..2 Reserved 1..0 Control Field 00 = Flush cache without invalidate 01 = write cache 10 = read cache 11 = no cache or test register modification ------------------------------------------------- MSR 6h is Test Register 4 (TR 4) (Read/Write) (Pentium) (Cache Test Tag) bits Description 63..32 Reserved (should be zero) 31..8 Cache Tag [35:12] 7..3 Reserved (should be zero) 2 LRU (Last Resently Used) Contain way joined with readed/writed cache line 1..0 VALID Contain Valid Status Information [Code Cache (TR5.CD=0)]: VALID[1] VALID[0] Description x 0 Code cache line is invalid x 1 Code cache line is valid [Data Cache (TR5.CD=1)]: VALID[1] VALID[0] Description 0 0 Data cache line is invalid 0 1 Data cache line is shared 1 0 Data cache line is exclusive 1 1 Data cache line is modified (Pentium w/MMX) bits Description 63..32 Reserved (should be zero) 31..8 Cache Tag [35:12] 7..3 Reserved (should be zero) 4..2 LRU (Last Resently Used) Contain way joined with readed/writed cache line 1..0 VALID Contain Valid Status Information [Code Cache (TR5.CD=0)]: VALID[1] VALID[0] Description x 0 Code cache line is invalid x 1 Code cache line is valid [Data Cache (TR5.CD=1)]: VALID[1] VALID[0] Description 0 0 Data cache line is invalid 0 1 Data cache line is shared 1 0 Data cache line is exclusive 1 1 Data cache line is modified ------------------------------------------------- MSR 7h is Test Register 5 (TR 5) (Read/Write) (Pentium) (Cache Test Control) bits Description 63..15 Reserved (should be zero) 14 WB (Write-back) If = 0 Write-throught If = 1 Write-back see also TR5.CNTRL 13 CD (Code/Data) Select Code/Data cache for test operation If = 0 Code cache select If = 1 Data cache select 12 ENTRY Specify cache Way 11..5 SET Cache Set Number (for Write/then read) 4..2 BUFFER SELECT Select one of 8 (4byte) part of cache line 1..0 CNTRL (Control) CNTRL[1] CNTRL[0] Description 0 0 Normal Operation Mode 0 1 Testability Write 1 0 Testability Read 1 1 Flush Note: Flush actions depends on TR7.WB: TR7.CD TR7.WB Description 0 x Invalidate code cache line 1 0 Invalidate data cache line, no WB, if modified 1 1 Invalidate data cache line, WB, if modified (Pentium w/MMX) (Cache Test Control) bits Description 63..20 Reserved (should be zero) 19 ENTRY[1] - specify high part of cache way 18..15 Reserved (shiuld be zero) 14 WB (Write-back) If = 0 Write-throught If = 1 Write-back see also TR5.CNTRL 13 CD (Code/Data) Select Code/Data cache for test operation If = 0 Code cache select If = 1 Data cache select 12 ENTRY[0] - specify low part of cache Way 11..5 SET Cache Set Number (for Write/then read) 4..2 BUFFER SELECT Select one of 8 (4byte) part of cache line 1..0 CNTRL (Control) CNTRL[1] CNTRL[0] Description 0 0 Normal Operation Mode 0 1 Testability Write 1 0 Testability Read 1 1 Flush Note: Flush actions depends on TR7.WB: TR7.CD TR7.WB Description 0 x Invalidate code cache line 1 0 Invalidate data cache line, no WB, if modified 1 1 Invalidate data cache line, WB, if modified ------------------------------------------------- MSR 8h is Test Register 6 (TR 6) (Read/Write) (Pentium,Pentium w/MMX) (TLB Command Test Register) bits Description 63..32 Reserved (should be zero) 31..12 LINEAR ADDRESS 11 V (Valid) If = 1 valid TLB entry If = 0 invalid TLB entry 10 D (Dirty) If = 1 page was write-accessed If = 0 page never was write-accessed 9 U (User Mode) If = 0 page may accessed at PL=0,1,2,3 If = 1 PL=0 access allowed 8 W (Writable) If = 0 Read only page If = 1 Read/Write page 7..3 Reserved (should be zero) 2 PS (Page Size) If = 0 4KB page If = 1 4MB page 1 CD (Code/Data TLB) If = 0 Code TLB If = 1 Data TLB 0 OP (Operation) If = 0 TLB Write If = 1 TLB Read ------------------------------------------------- MSR 9h is Test Register 7 (TR 7) (Read/Write) (Pentium) (TLB Test Physical Address) bits Description 63..32 Reserved (should be zero) 31..12 PHYSICAL ADDRESS 11 PCD (Page Cache Disable) 10 PWT (Page Write-Throught) 9..7 LRU (TLB LRU) 6..5 Reserved (should be zero) 4 H (Hit Indicator) If we want write into TLB, set this bit to 1. If read, then if linear address found in TLB this bit set to 1, otherwize to 0. 3..2 ENTRY One of 4 TLB ways where to write, or where found linear address if read. 1..0 Reserved (should be zero) (Pentium w/MMX) (TLB Test Physical Address) bits Description 63..32 Reserved (should be zero) 31..12 PHYSICAL ADDRESS 11 PCD (Page Cache Disable) 10 PWT (Page Write-Throught) 9..7 Reserved 6..5 ENTRY[5:4] 4 H (Hit Indicator) If we want write into TLB, set this bit to 1. If read, then if linear address found in TLB this bit set to 1, otherwize to 0. 3..0 ENTRY[3:0] ------------------------------------------------- MSR Ah is Reserved (TR8) (Do not Accessed it) ------------------------------------------------- MSR Bh is Test Register 9 (TR 9) (Read/Write) (Pentium) (BTB Test Tag Register) bits Description 63..32 Reserved (should be zero) 31..8 TAG ADDRESS 7..2 Reserved (should be zero) 1..0 HISTORY History is state of current branch (Pentium w/MMX) (BTB Test Tag Register) bits Description 63..32 Reserved (should be zero) 31..8 TAG ADDRESS (bit[31..8] of last byte of branch). 7..6 Offset (bit[1..0] of branch) 5 Valid bit (show if entry in BTB valid). 4 Prediction bit (show if branch taken/not taken). 3..0 HISTORY (contain previous history for branch). ------------------------------------------------- MSR Ch is Test Register 10 (TR 10) (Read/Write) (Pentium,Pentium w/MMX) (BTB Test Target Register) bits Description 63..32 Reserved (should be zero) 31..0 TARGET ADDRESS ------------------------------------------------- MSR Dh is Test Register 11 (TR 11) (Read/Write) (Pentium) bits Description 63..12 Reserved (should be zero) 11..8 BTB SET Select one of 64 set to access 7..4 Reserved (should be zero) 3..2 ENTRY select BTB way 1..0 CNTL Command to Test BTB CNTL[1] CNTL[0] Description 0 0 Normal Operating Mode 0 1 Testability Write 1 0 Testability Read 1 1 Flush (Pentium w/MMX) bits Description 63..26 Reserved (should be zero) 25..24 Branch Type 00 - conditional JUMP 01 - unconditional JUMP 10 - CALL 11 - RET 23..13 Reserved (should be zero) 12 CNTL[2] 11..8 BTB SET Select one of 64 set to access 7..6 Bank (4 bank/BTB lines) (bits[3..2] of Branch)) 5..4 Reserved (should be zero) 3..2 WAY 1..0 CNTL Command to Test BTB CNTL[2] CNTL[1] CNTL[0] Description 0 0 0 Normal Operating Mode 0 0 1 Testability Write 0 1 0 Testability Read 0 1 1 Flush 1 0 1 Read BTB Tag ------------------------------------------------- MSR Eh is Test Register 12 (TR 12) (Read/Write) (Pentium) (New Feature Control) bits Description 63..10 Reserved (should be zero) 9 ITR (I/O Trap Restart) (Re: SMM) 8 FTR (Fast Execution Tracing) 7 Reserved (should be zero) 6 Disable Auto-Halt feature (P54C oly) 5 Reserved 4 APICD (Disable internal APIC) 3 CI (Cache Inhibit) if =0 chip operated normally =1 then all cache line fill are inhibited, and bus cycles due to cache misses are run as single-transfer cycles 2 SE (Single-Pipe Execution) If =0 instruction executed in U and V pipes. =1 instruction executed only in U pipe 1 TR (Tracing Control) After reset clear to zero. This bit enable/disable special branch trace message cycle which generating when BTB hit. =0 disable =1 enable 0 NBP (No Branch prediction) If = 1 Disable Allocated entryes in BTB If = 0 Enable (AMD K6) bits Description 63..3 Reserved (should be zero) 3 CI (Cache Inhibit) 2..0 Reserved (should be zero) (Pentium w/MMX) (New Feature Control) bits Description 63..21 Reserved (should be zero) 20 DCI (Data Cache Inhibit) 19 CCI (Code Cache Inhibit) 9 ITR (I/O Trap Restart) (Re: SMM) 8 FTR (Fast Execution Tracing) 7..4 Reserved (should be zero) 3 CI (Cache Inhibit) 2 SE (Single-Pipe Execution) 1 TR (Tracing Control) 0 NBP (No Branch prediction) (IDT C6/Winchip 2) (Feature Control) bits Description 63..10 Reserved 9 ITR (I/O Trap Restart) 8..7 reserved 6 AHD (Auto-Halt Powerdown Function disable) 5..4 reserved 3 CI (Cache Inhibit) 2..0 Reserved ------------------------------------------------- MSR Fh is Reserved (Not use it) ------------------------------------------------- MSR 10h is Time Stamp Counter (TSC) (Read/Write) (Pentium,Am5k86,Pentium Pro,Pentium II,Cx6x86MX,AMD K6, IDT C6/Winchip 2) Time Stamp Counter (as all other MSRs) is clearing to 0 when RESET pin shutdown and unchanged when INIT pin shutdown. TSC is incremented every CPU core clock cycle. Note: On Pentium Pro only Low 32-bit may be written, the high bits forced to 00000000 during write. ------------------------------------------------- MSR 11h is Control/Event Select Register (CESR) (Read/Write) (Pentium,Pentium w/MMX,Cyrix Cx686MX,IDT C6/Winchip 2) Init value after reset = 00000000000000000h bits Description 63..26 Reserved 25 PC1 (Pin Control, counter #1) If =0 counter # 1 has incremented If =1 counter # 1 has overflowed 24..22 CC1 (Counter #1 Control) CC[2] CC[1] CC[0] Description 0 0 0 Counting nothing 0 0 1 Counting events while in PL=0,1,2 0 1 0 Counting events while in PL =3 0 1 1 Counting events in any PL 1 0 0 Counting nothing 1 0 1 Counting clocks (like TSC) in PL=0..2 1 1 0 Counting clocks in PL=3 1 1 1 Counting clocks at any PL 21..16 ES1 (Event Select, counter # 1) (see below) 15..10 Reserved 9 PC0 (see PC1 for description) 8..6 CC0 (see CC1 for description 5..0 ES0 (Event select, counter # 0) Event Type for ES: Value Event Type (Pentium + 00h Data Read Pentium w/MMX) 01h Data Write 02h Data TLB miss 03h Data Read Miss 04h Data Write miss 05h Write hit to Modified or Exclusive Cacheline 06h Data cache lines written back 07h Data cache snoops 08h Data cache snoops hit 09h Memory access in both pipes 0Ah Data bank access conflict 0Bh Misaligned data memory references 0Ch Code read 0Dh Code TLB miss 0Eh Code cache miss 0Fh Any segment register load 10h Segment descriptor cache accessed 11h Segment descriptor cache hit 12h Branches 13h BTB hit 14h Taken branch or BTB hit 15h Pipeline flushes 16h Instructions executed 17h Instruction executed in V pipes 18h Bus utilization 19h Pipeline stalled by write backups 1Ah Pipeline stalled by data memory read 1Bh Pipeline stalled by write to M or E line 1Ch Locked bus cycle 1Dh I/O cycle 1Eh Noncachable memory references 1Fh Pipeline stalled by AGI 20h-21h Reserved 22h FP operations 23h Breakpoint 0 match 24h Breakpoint 1 match 25h Breakpoint 2 match 26h Breakpoint 3 match 27h Hardware interrupt 28h Data read or data write 29h Data read/write miss (Pentium) 2Ah-3Fh Reserved (Pentium w/MMX)2Ah Bus Ownership Latency(c#0) Bus Ownership Transfers(c#1) 2Bh MMX instruction executed in U pipe (c#0) MMX instruction executed in V pipe (c#1) 2Ch Cache M-state line Sharing 2Dh EMMS instruction executed (c#0) transition between EMMS and FP instruction (c#1) 2Eh Bus Utilization due processor activity (c#0) Writes-to-non-cacheable Memory (c#1) 2Fh saturating MMX instruction Executed (c#0) saturation performed (c#1) 30h Number of Cycles not in HLT state 31h MMX instruction data reads (c#0) MMX instruction data misses (c#1) 32h F.P. stalls (c#0) Taken Branchs (c#1) 33h D1 starvation and FIFO is empty (c#0) D1 starvation and only one instruction in FIFO (c#1) 34h MMX instruction data write (c#0) MMX instruction data write misses (c#1) 35h Pipeline flushing due to wrong branch prediction (c#0) Pipeline flushing due to wrong branch prediction resolved in WB-stage (c#1) 36h Misaligned reference on MMX instruction. (c#0) Pipeline stalled waiting for MMX instruction data memory read (c#1) 37h Returns predict incorrectly or not predicted at all (c#0) Returns predicted correctly or incorrectly (c#1) 38h MMX instruction Multiply Unit Interlock (c#0) MOVD/MOVQ stall due to previous operation (c#1) 39h Returns (c#0) 3Ah BTB false entries (c#0) BTB miss prediction on a not-taken block (c#1) 3Bh Clks stalled due to Full Write Buffers While executing MMX instuction (c#0) Stall on MMX instructions Write to E or M line (c#1) (Cyrix Cx6x86MX) bits Description 63..27 Reserved 26 TC1 (Event Type 1, high bit) 25 PC1 (Pin Control, counter #1) If =0 counter # 1 has incremented If =1 counter # 1 has overflowed 24..22 CC1 (Counter #1 Control) CC[2] CC[1] CC[0] Description 0 0 0 Counting nothing 0 0 1 Counting events while in PL=0,1,2 0 1 0 Counting events while in PL =3 0 1 1 Counting events in any PL 1 0 0 Counting nothing 1 0 1 Counting clocks (like TSC) in PL=0..2 1 1 0 Counting clocks in PL=3 1 1 1 Counting clocks at any PL 21..16 TC1 (Event Select, counter # 1) (see below) 15..11 Reserved 10 TC0 (Type of Event, high bit) 9 PC0 (see PC1 for description) 8..6 CC0 (see CC1 for description 5..0 TC0 (Event select, counter # 0) Event Type for ES Value Event Type 00h Data Read 01h Data Write 02h Data TLB miss 03h Data Read : Cache Miss 04h Data Write: Cache miss 05h Write hit to Modified or Exclusive Cacheline 06h Data cache lines written back 07h External Inquires 08h External Inquires what hit 09h Memory access in both pipes 0Ah Cache bank access conflict 0Bh Misaligned data memory references 0Ch Instruction Fetch Requests 0Dh L2 Code TLB miss 0Eh Cache miss: instruction fetch 0Fh Any segment register load 10h reserved 11h reserved 12h Any Branch 13h BTB hit 14h Taken branch or BTB hit 15h Pipeline flushes 16h Instructions executed in both pipes 17h Instruction executed in Y pipes 18h Clocks while bus cycles are in progress 19h Pipeline stalled by full write buffers 1Ah Pipeline stalled by data memory read 1Bh Pipeline stalled by write to !M or !E line 1Ch Locked bus cycle 1Dh I/O cycle 1Eh Noncachable memory references 1Fh Pipeline stalled by AGI 20h-21h Reserved 22h FP operations 23h Breakpoint 0 match 24h Breakpoint 1 match 25h Breakpoint 2 match 26h Breakpoint 3 match 27h Hardware interrupt 28h Data read or data write 29h Data read/write miss 2Bh MMX instruction executed in X pipe (counter 0) 2Bh MMX instruction executed in Y pipe (counter 1) 2Dh EMMS instruction executed (counter 0) 2Dh transition between EMMS and FP instruction (counter 1) 2Fh saturating MMX instruction Executed (counter 0) 2Fh saturation performed (counter 1) 31h MMX instruction data reads (counter 0) 32h Taken Branchs (counter 1) 37h Returns predict incorrectly (counter 0) 37h Returns predicted (corr+incorr) (counter 1) 38h MMX instruction Multiply Unit Interlock (cnt 0) 38h MOVD/MOVQ stall due to previous operation (cnt 1) 39h Returns (cnt 0) 39h RSB Overflows (cnt 1) 3Ah BTB false entries (cnt 0) 3Ah BTB miss prediction on a not-taken block (cnt 1) 3Bh Clks stalled due to Full Write Buffers While executing (cnt 0) 3Bh Stall on MMX instructions Write to E or M line (cnt 1) 40h L2 TLB Misses (Code or Data) 41h L1 TLB Data Misses 42h L1 TLB Code Misses 43h L1 TLB Miss (Code or Data) 44h TLB Flushes 45h TLB Page Invalidates 46h TLB page invalidates that hit 48h Instruction Decoded (IDT C6) Bits Description 63..24 reserved 23..16 Counter 1 Control 15..8 reserved 7..0 Counter 0 Control Events which calculates: (IDT C6) 00h Internal clocks 01h Valid Cycles Reaching writebacks 02h x86 Instructions 47h Data Read Cache Misses 4Ah Data Write Cache Misses 63h Instruction fetch cache miss (IDT WinChip 2) 00 Data Read 01 Data Write 02 Data TLB Miss 03 Data Read Cache Miss 04 Data write Cache Miss 06 Data Cache writebacks 08 Data Cache Snoop Hits 09 Push/push pop/pop pairing 0B Misaligned Data Memory 0C Code read 0D Code TLB Miss 0E Instruction Fetch cache miss 13 BHT hits 14 BHT candidate 16 Instruction executed 17 Instruction in pipe 2 (V-pipe) 18 Bus Utilization 1D I/O Read or Write cycle 28 Data Read or Data Write 2B MMX_instruction U-pipe (EC0) 2B MMX_instruction V-pipe (EC1) 37 Returns predicted incorrectly (EC0) 37 Returns predicted incorrectly (EC1) 3F Internal Clocks (Default event for CTR0) 00h Internal clocks 01h Valid Cycles Reaching writebacks 02h x86 Instructions 47h Data Read Cache Misses 4Ah Data Write Cache Misses 63h Instruction fetch cache miss ------------------------------------------------- MSR 12h is Counter #0 (Read/Write) (Pentium,Pentium w/MMX,Cx6x86MX,IDT C6/Winchip 2) bits Description 63..40 Reserved 39..0 Current counter value ------------------------------------------------- MSR 13h is Counter #1 (Read/Write) (Pentium,Pentium w/MMX,Cx6x86MX,IDT C6/Winchip 2) bits Description 63..40 Reserved 39..0 Current counter value ------------------------------------------------- MSR 17h is ????? (Pentium II 0.25m) ------------------------------------------------- MSR 18h is ????? (Pentium II) -------------------------------------------------- MSR 1Bh is APIC Base (Pentium Pro/Pentium II) bits Description 64..32 Reserved 31..12 APIC Base Address 11 APIC (APIC Global Enable Bit - permanent till reset Enabled = 1, Disabled = 0. 10..9 Reserved 8 BSP (Boot Strap Processor Indicator Bit) 7..0 Reserved ------------------------------------------------- MSR 21h is ????? (Pentium II) -------------------------------------------------- MSR 2Ah is EBL_CR_POWERON (Pentium Pro/Pentium II) bits Description 0 Data Bus error code policy 1 = ECC 0 = Parity 1 Data Error Checking Enable 0 = Disabled 1 = Enabled 2 Response Error Checking Enable 1 = Disabled 0 = Enabled 3 AERR# Drive Enable 1 = Disabled 0 = Enabled 4 BEER# Enable for Initiator bus requests 1 = Disable 0 = Enabled 5 Reserved 6 BEER# Enable for initiator internal errors 1 = Disabled 0 = Enable 7 BINIT# Driver Enable 1 = Disabled 0 = Enabled 8 Output Tri-state enabled R 9 Execute BIST R 10 AEER# Observation enable R 12 BINIT# Observation enable R 13 IN Order Queue Depth R 14 1M Power on Reset Vector R 15 FRC Mode Enabled R 17..16 APIC Cluster ID R 21..20 Symmetric Arbitration ID R 24..22 Clock Frequency Ratio R 25 Reserved 26 Low Power Enable R 64..27 Reserved ------------------------------------------------- MSR 32h is ????? (Pentium II) -------------------------------------------------- MSR 33h is TEST_CTL (Pentium Pro/Pentium II) Test Control Register Bits Description 64..32 reserved 31 Disable LOCK# assertion for split locked access 30 Streaming buffer disable 29..0 Reserved -------------------------------------------------- MSR 34h,3Ah,3Bh,50h,52h,53h,54h is ????? (Pentium II) -------------------------------------------------- MSR 79h is BIOS_UPDT_TRIG (Pentium Pro/Pentium II) BIOS Update Trigger Register. Contain Linear Address of microcode update block. ------------------------------------------------- MSR 82h is Array Access Register (AAR) (Am5k86) 63..32 Array pointer: 31..8 Pointer within array 7..0 Array will be accessed Array Description E0h Data cache: data E1h Data cache: Linear Tag E4h Code cache: Instruction E5h Code Cache: Linear Tag E6h Code Cache: Valid Bits E7h Code cache: Branch-prediction bits E8h 4K TLB: Page E9h 4K TLB: Linear Tag EAh 4M TLB: Page EBh 4M TLB: Linear Tag ECh Data cache: Physical tag EDh Code cache: Physical Tag 31..0 Array Data If array = E0h (Data cache: data) 31..0 Data If array = E1h (Data cache: Linear Tag) 31..26 Reserved (0s) 25 Dirty Bit 24 User/Supervisor 23 R/W 22 0 21 Linear Valid bit 20..0 Tag If array = E4h (Code cache: Instruction) 31..26 Reserved (0s) 25 Pfix1: Start bit 24 Pfix1: End bit 23 Pfix1: Opcode bit 22..21 Pfix1: Map (ROPs/MROM) 20..13 Byte1 12 Pfix0: Start bit 11 Pfix0: End bit 10 Pfix0: Opcode bit 9..8 Pfix0: Map (ROPs/MROM) 7..0 Byte0 If array = E5h (Code Cache: Linear Tag) 31..20 Reserved(0s) 19..0 linear address 31..12 If array = E6h (Code Cache: Valid Bits) 31..18 Reserved (0s) 17 Linear Tag Valid bit 16 User/Supervisor 15..0 Byte-Valid bits If array = E7h (Code cache: Branch-prediction bits) 31..19 Reserved (0s) 18 Predicted taken 17..14 Byte offset within block of last byte of predicted branch instruction 13..12 Column of predicted target 11..4 Index of Predicted Target 3..0 Target Byte If array = E8h (4K TLB: Page) 31..22 Reserved (0s) 21 PCD bit 20 PWT bit 19..0 Page frame address If array = E9h (4K TLB: Linear Tag) 31..20 Reserved (0s) 19 Global Valid Bit 18 Dirty 17 U/S 16 R/W 15 Valid 14..0 Tag (virtual address 31..17) If array = EAh (4M TLB: Page) 31..12 Reserved (0s) 11 PCD bit 10 PWT bit 9..0 Page frame Address If array = EBh (4M TLB: Linear Tag) 31..15 reserved (0s) 14 Global Valid Bit 13 Dirty Bit 12 U/S 11 R/W 10 Valid bit 9..0 Tag If array = ECh (Data cache: Physical tag) 31..23 Reserved (0s) 22..21 MESI status 00 = invalid 01 = shared 10 = modified 11 = exclusive 20..0 Tag (Physical Address 31..11) If array = EDh (Code cache: Physical Tag) 31..21 Reserved(0s) 20 Valid Bit 19..0 Tag (Physical Address 31..12) Note: READ DATA: mov ecx,82h mov edx,Array Pointer rdmsr ; in EAX - 32bit data WRITE DATA: mov ecx,82h mov edx,Array Pointer mov eax,data wrmsr ------------------------------------------------- MSR 83h is Hardware Configuration register (HWCR) (Am5k86) bits Description 63..8 Reserved 7 DDC (Disable Data Cache) 6 DIC (Disable Instruction Cache) 5 DBP (Disable Branch Prediction) 4 Reserved 3..1 Debug Control 000 Off 001 Enable branch trace 100 Enable Probe mode on debug trap 0 DSPC (Disable Stopping Processor Clock) ------------------------------------------------- MSR 85h is Write Allocate Top-of-Memory and Control Register (WATMCR) (Am5k86 model 1,2,3 with stepping >= 4) ------------------------------------------------- MSR 86h is Write Allocate Programmable Memory Range Register (WAPMRR) (Am5k86 model 1,2,3 with stepping >= 4) Note: For more information about MSRs 85h and 86h refer to "Implementation of Write Allocate in the K86(tm) Processors", application note, order# 21326, http://www.amd.com ------------------------------------------------- MSR 88h is BBL_CR_D0[63..0] (Pentium II) Chunk 0 data register. Used to write and to read from L2 ------------------------------------------------- MSR 89h is BBL_CR_D1[63..0] (Pentium II) ------------------------------------------------- MSR 8Ah is BBL_CR_D2[63..0] (Pentium II) ------------------------------------------------- MSR 8Bh is BIOS_SIGN (Pentium Pro/Pentium II) BIOS Update Signature Register. When load microcode, this register contain Standart Version/Model of CPU, else it contain usually 0. (Pentium II) BBL_CR_D3[63..0]. Which of this two usage (BIOS Sign/BBL_CR) depends on the usage model ------------------------------------------------- MSR AEh is ????? (Pentium II) ------------------------------------------------- MSR C1h is PERFCTR0 (Pentium Pro/Pentium II) Pefromance Monitoring counter # 0 ------------------------------------------------- MSR C2h is PERFCTR1 (Pentium Pro/Pentium II) Perfomance Monitoring counter # 1 ------------------------------------------------- MSR FEh is MTRRcap (Memory Type Range Registers Capabilities) (Pentium Pro/Pentium II) ------------------------------------------------- MSR 107h is FCR (Feature Control Register) (IDT C6/Winchip 2) bits Description 63..31 Reserved 30 EMOVTR (Enable move-to-test register instruction) 29 DCPUID (Disable CPUID Instruction) 28 ADIVFLG (Select Alternative EFLAGS results for divide) (IDT C6/Winchip only) 27..26 Reserved 25..22 Stepping ID 21 Reserved 20 EAMD3D (Enable AMD 3D Instructions) (Winchip 2) 19 E2MMX (Enable pairing of MMX instructions) (Winchip 2) 18..17 Reserved 16 ERETSTK (Enable CALL-RET stack operation) 15 DNA (Disables bus pipelining) 14 DDC (Disables D-cache) 13 DIC (Disables I-cache) 12 EBPRED (Enable Branch Prediction) (Winchip2 and higher) 11 DPDC (Disables Page Directory Cache) 10 reserved 9 EMMX (Enable MMX-compatible instructions) 8 EDCTLB (C6) (Enables D-cache for updates to PDE/PTE) 8 DTLOCK (C2) (Disable PDE/PTE update locking) 7 DSMC (Disables Strict Cache coherency (self-modifying code) 6 ELINEAR (Enable Linear Burst Mode) 5 DSTPCLK (Disables supporting STPCLK) 4 DMCE (Disable Machine check Extension) 3 DPM (Disable Dynamic Power Managment) 2 EIERRINT (Enables INT 12h (Machine Check) for internal errors) 1 EXC8 (Enables CPUID reporting CMPXCHG8B present) 0 Reserved ------------------------------------------------- MSR 108h is FCR2 (Feature Control Register 2) (IDT C6/Winchip 2) Bits Description 63..32 Last 4 characters of alternative Vendor ID string 31..15 reserved 14 AVS (Alternative Vendor String) if = 0 (then "CentaurHauls") if = 1 defines in FCR2 and FCR 3 13..12 reserved 11..8 Family ID 7..4 Model ID 3..0 Reserved ------------------------------------------------- MSR 109h is FCR3 (Feature Control Register 3) (Write-only) (IDT C6/Winchip 2) Bits Description 63..32 First 4 characters of alternative Vendor ID string 31..0 Middle 4 characters of alternative Vendor ID string ------------------------------------------------- MSR 10Ah is FCR4 (Feature Control Register 4) (Read-only) (Winchip 2) Bits Description 63..6 Reserved 5..2 DIVIDENT Divident (use it if bus speed > 100MHz) DIVIDENT DIVISOR MULTIPLY_coeff_for_100Mhz_bus 0101 01 x2.33 0011 00 x2.5 0110 01 x2.66 0100 00 x3.0 1000 01 x3.33 0101 00 x3.5 0110 00 x4.0 0111 00 x4.5 1..0 DIVISOR Fractional bus frequency multiplier 00 = x2 (on bus < 100 MHz multiplier based on 01 = x3 FCR4[1..0] only 10 = x4 11 = x5 ------------------------------------------------- MSR 110h is MCR0 (Memory Configuration Register 0) (Write-only) (IDT C6/Winchip 2) Bits Descriptions 63..44 Base Address of Region (in 4K blocks) 43..32 reserved 31..12 Mask Defined Region (Size Mask: End of Region = Base AND Mask) 11..5 Reserved 4..0 Attributes bits description 4..3 Defines write-ordering strategy for memory region 00 - All writes strongly ordering 01 - string writes weakly ordered 10 - stack writes weakly ordered 11 - All writes weakly ordered 2 Enables byte combining on stack instruction writes 1 Enables byte combining on string instruction writes 0 Enable byte combining on non-stack and non-string writes. ------------------------------------------------- MSR 111h is MCR1 (Memory Configuration Register 1) (Write-only) (IDT C6/Winchip 2) See format in MSR 110h ------------------------------------------------- MSR 112h is MCR2 (Memory Configuration Register 2) (Write-only) (IDT C6/Winchip 2) See format in MSR 110h ------------------------------------------------- MSR 113h is MCR3 (Memory Configuration Register 3) (Write-only) (IDT C6/Winchip 2) See format in MSR 110h ------------------------------------------------- MSR 114h is MCR4 (Memory Configuration Register 4) (Write-only) (IDT C6/Winchip 2) See format in MSR 110h ------------------------------------------------- MSR 115h is MCR5 (Memory Configuration Register 5) (Write-only) (IDT C6/Winchip 2) See format in MSR 110h ------------------------------------------------- MSR 116h is MCR6 (Memory Configuration Register 6) (Write-only) (IDT C6/Winchip 2) See format in MSR 110h ------------------------------------------------- MSR 116h is BBL_CR_ADDR Used to send specified address to L2 during cache initialization access. (Pentium II) Bits Description 63..32 Reserved 31..3 Address Bits [35..3] 2..0 Reserved =0 ------------------------------------------------- MSR 117h is MCR7 (Memory Configuration Register 7) (Write-only) (IDT C6/Winchip 2) See format in MSR 110h ------------------------------------------------- MSR 118h is BBL_CR_DECC (Pentium II) Used to read/write ECC from/to L2 cache. 63..8 Reserved 7..0 ECC Data ------------------------------------------------- MSR 119h is BBL_CR_CTL (Pentium II) Bits Description 63..22 Reserved 21 Disable Processor Serial Number (Pentium III) 20..19 Reserved 18 Used supplied ECC 17 Reserved 16 L2 Hit 15..14 Reserved 13..12 State from L2 11 - M 10 - E 01 - S 00 - I 11..10 Way from L2 (0..3) 9..8 Way to L2 (0..3) 7 Reserved 6..5 State to L2 4..0 L2 Command 01100 - Data Read w/LRU update (RLU) 01110 - Tag Read w/ Data Read (TRR) 01111 - Tag Inquire (TI) 00010 - L2 Control Register Read (CR) 00011 - L2 Control Register Write (CW) 010mm - Tag write w/Data Read (TWR) 111mm - Tag write w/Data Write (TWW) 100mm - Tag write (TW) (mm - is MESI State) ------------------------------------------------ MSR 11Ah is BBL_CR_TRIG (Pentium II) Trigger Register. Used to initiate cache configuration access cycle. Write only with data = 0. ------------------------------------------------ MSR 11Bh is BBL_CR_BUSY (Pentium II) Indicates when cache configuration accesses L2 command in progress If Bit 0 = 1 then BUSY. ------------------------------------------------ MSR 11Eh is BBL_CR_CTL3 (Pentium II) Control Register 3. Used for configure the L2 cache. Bits Description 63..26 Reserved 25 Cache Bus Fraction (Read-only) 24 Reserved 23 L2 Hardware Disable (Read-only) 22..20 L2 Physical Address Range Support 111 - 64G 110 - 32G 101 - 16G 100 - 8G 011 - 4G 010 - 2G 001 - 1G 000 - 512M 19 Reserved 18 Cache state error checking enable 17..13 Cache size per Bank 00001 - 256K 00010 - 512K 00100 - 1M 01000 - 2M 10000 - 4M 12..11 Number of L2 banks (Read only) 10..9 L2 Associativity (Read only) 00 Direct Mapped 01 2 way 10 4 way 11 Reserved 8 L2 Enabled 7 CRTN Parity Check Enable 6 Address Parity Check Enable 5 ECC Check Enable 4..1 L2 cache latency 0 L2 Configured ------------------------------------------------ MSR 120h is MCR_CTRL (Memory Configuration Register Control) (Write-only) (IDT C6\Winchip 2) (Winchip 2 = Read/write) Bits Description (WinChip 2) 63..5 Reserved 19..17 Trait Mode Key, must write this value to MCR_CTL[8..6] to enable Memory Configuration Registers 16 MCR 7 is in use 15 MCR 6 is in use 14 MCR 5 is in use 13 MCR 4 is in use 12 MCR 3 is in use 11 MCR 2 is in use 10 MCR 1 is in use 9 MCR 0 is in use 8..6 Trait Mode control (if = MCR_CTL[19..17]) then MCR enable 5 Reserved (IDT C6\Winchip 2) 4 Weak Write-Ordering Enabled 3..2 Store Combining definition for string 00 - Forward combining 01 - Forward and overlapped combining 10 - Forward and reverse combining 11 - Forward,reverse and overlapped combining 1..0 Store combining for non-stack & non-string 00 - Forward combining 01 - Forward and overlapped combining 10 - Forward and reverse combining 11 - Forward,reverse and overlapped combining ------------------------------------------------- MSR 131h,142h,143h,144h,145h,147h,150h,151h is ???? (IDT C2) ------------------------------------------------- MSR 131h,14eh,14fh,150h,151h,154h,15bh,15fh is ???? (Pentium II) ------------------------------------------------- MSR 174h is SYSENTER_CS (Pentium II) SYSENTER instruction target CS ------------------------------------------------- MSR 175h is SYSENTER_ESP (Pentium II) SYSENTER instruction target ESP ------------------------------------------------- MSR 176h is SYSENTER_EIP (Pentium II) SYSENTER instruction target EIP ------------------------------------------------- MSR 179h is MCG_CAP (Pentium Pro/Pentium II) ------------------------------------------------- MSR 17Ah is MCG_STATUS (Pentium Pro/Pentium II) ------------------------------------------------- MSR 17Bh is MCG_CTL (Pentium Pro/Pentium II) ------------------------------------------------- MSR 186h is EVNTSEL0 (Event Select # 0) (Pentium Pro/Pentium II) bits Description 7..0 Event number Value Description -------------------- Memory Ordering ----------------- 02h SB_FORWARDS Number of store buffers forwards. 03h LD_BLOCKS Number of store buffers blocks. 04h SB_DRAINS Number of store buffer drain cycles. 05h MISALIGN_MEM_REF 06h SEGMENT_REG_LOADS Number of segment registers loads --------------------- FPU --------------------------- 10h FP_COMP_OPS_EXE FP. computation operations executed. (c#0) 11h FP_ASSIST Number of FP exceptions cases handled by microcode. (c#1) 12h MUL Number of Multiplies (Int+FP) (c#1). 13h DIV Number of Divides (Int+FP) (c#1). 14h CYCLES_DIV_BUSY Number of cycles, when divider is busy and cannot accept new divides (c#0). ---------------------- L2 cache -------------------- 21h L2_ADS Number of L2 address strobes. 22h L2_DBUS_BUSY Number of cycles L2 cache data bus is busy. 23h L2_DBUS_BUSY_RD ---//--- transferring read data from L2 to processor. 24h L2_LINES_IN Number of lines, allocated in L2. 25h L2_M_LINES_IN ---//--- (modified lines) 26h L2_LINES_OUT Number of lines, removed from L2. 27h L2_M_LINES_OUT ---//--- (modified lines) 28h [M] L2_IFETCH L2 cache instruction fetched. 29h [M] L2_LD L2 load requests. 2Ah [M] L2_ST L2 store request. 2Eh [M] L2_RQSTS Total Number of all L2 requests. ---------------------- DCU ------------------------- 40h DCU_LD (L1 Data Cache unit load req.) 41h DCU_ST (L1 DCU store request) 42h DCU_LOCKS (L1 DCU locked requests) 43h DCU_RQSTS (all L1 request) 43h DATA_MEM_REFERENCE (cached and non-cached) 45h DCU_LINES_IN (Total number of lines have been allocated) 46h DCU_M_LINES_IN (Number of Modified state lines that have been allocated in DCU) 47h DCU_M_LINES_OUT (Number of Modified Lines, thet have been evicted from DCU) 48h DCU_MISS_OUT_STANDING (Weighted number of cycles while a DCU miss is outstanding) 49h DTLB_MISS L1 data TLB misses. ---------------- EBL (External Bus Logic) ---------- 60h BUS_REQ_OUTSTANDING Number of bus request outstanding 61h BUS_BNR_DRV Number of bus clocks that this CPU is driving BNR pin. 62h [+] BUS_DRDY_CLOCKS Number of clocks during which DRDY# is asserted. 63h [+] BUS_LOCK_CLOCKS Number of clocks during which LOCK# is asserted. 64h BUS_DATA_RCV Number of CLKs during which CPU receiving data. 65h [+] BUS_TRAN_BRD Number of Bus Burst reads transaction. 66h [+] BUS_TRAN_RFO Number of completed bus read for ownership transaction. 67h [+] BUS_TRANS_WB Number of completed bus WB transactions. 68h [+] BUS_TRAN_IFETCH Number of completed bus instruction fetch transactions. 69h [+] BUS_TRAN_INVAL Number of completed bus invalidate Transactions. 6Ah [+] BUS_TRAN_PWR Number of completed bus partial write transactions. 6Bh [+] BUS_TRANS_P Number of completed bus partial transactions. 6Ch [+] BUS_TRANS_IO Number of completed bus I/O transactions. 6Dh [+] BUS_TRANS_DEF Number of completed bus deffered transactions. 6Eh [+] BUS_TRAN_BURST Number of completed burst transactions. 6Fh [+] BUS_TRAN_MEM Number of completed bus memory transactions. 70h [+] BUS_TRAN_ANY Number of all completed bus transactions. 79h CPU_CLK_UNHALTED Nnumber of cycles for which processor is not halted. 7Ah BUS_HIT_DRV Bus CLKs during which CPU driving the HIT pin (incl. cycles of snoop stall). 7Bh BUS_HITM_DRV Bus CLKs during which CPU driving the HITM pin (incl. cycles of snoop stall). 7Eh BUS_SNOOP_STALL Bus CLKs. for which bus is snoop stalled. ------------------- IFU ------------------------------ 80h IFU_IFETCH Number of Instructions fetched. 81h IFU_FETCH_MISS Fetch Misses. 85h ITLB_MISS Number of L1 Instruction TLB misses. 86h IFU_MEM_STALL Number of Cycles, then fetch is stalled. 87h ILD_STALL Number of cycles instruction length decoder stalled. A2h RESOURCE_STALL Count resource related stalls. (Resource is: ROB, Memory buffers). (Pentium II) B0h MMX_INSTR_EXEC Number of MMX instructions executed. (Pentium II) B1h MMX_SAT_INSTR_EXEC Number of MMX saturation instructions executed. (Pentium II) B2h MMX_UOPS_EXEC Number of MMX uops executed B3h MMX_INSTR_TYPE_EXEC Number of MMX instructions executed. Mask Unit contain instruction type: 01h - MMX packed multiply 02h - MMX packed shift 04h - MMX pack operations 08h - MMX unpack operations 10h - MMX packed logical 20h - MMX packed arithmetic --------- Instruction decore and retairement ---------- C0h INST_RETIRED Number of instruction retired C1h FLOPS (c#0) C2h UOPS_RETIRED Number of Uops retired. C4h BR_INST_RETIRED Number of branch instr. retired. C5h BR_MISS_PRED_RETIRED Number of Mispredicted branch instruction retired. C6h CYCLES_INT_MASKED Number of Cycles for which interrupts was disable. C7h CYCLES_INT_PENDING_AND_MASKED Number of cycles for which interrupts was disabled and interrupts are pending. C8h HW_INT_RX Hardware interrupts received. C9h BR_TAKEN_RETIRED Total Number of Taken Branches retired. CAh BR_MISS_PRED_TAKEN_RETIRED Total Number of Taken, but mispredicted branches retired. (Pentium II) CCh FP_MMX_TRANS Unit Mask: 00h - Trasnslation from MMX to FP instructions. 01h - Translation from FP to MMX instructions. (Pentium II) CDh MMX_ASSIST Number of EMMS instruction executed. (Pentium II) CEh MMX_INSTR_RET Number of MMX instruction retired. D0h INST_DECODER Total Number of Decoded Instructions. D2h PARTIAL_PAT_STALLS Partial stalls. (Pentium II) D4h SEG_RENAME_STALL Unit Mask: 01h - Segment register ES 02h - Segment register DS 04h - Segment register FS 08h - Segment register GS 0Fh - Segment register ES+DS+FS+GS (Pentium II) D5h SEG_REG_RENAMES Unit Mask: 01h - Segment register ES 02h - Segment register DS 04h - Segment register FS 08h - Segment register GS 0Fh - Segment register ES+DS+FS+GS (Pentium II) D6h RET_SEG_RENAMES Number of segment register rename events E0h BR_INST_DECODED Number of Branch instructions decoded. E2h BTB_MISSES Number of BTB Misses. E4h BTB_BOGUS Number of Branch predictions which is generated but are not actually branches. E6h BACLEARS Number of time BACLEAR asserted. (Number of times that a static branch prediction was made by decoder). Note: if none mark then Pentium Pro/Pentium II Only Pentium II marks (Pentium II) if Unit Mask not specify (in square brackets [xx]) in Event List above, then Unit Mask = 0 if [+] it means: if unit mask = 00h to count bus operations for current processor (self), if = 20h to count bus operations (any CPU). if [M] it means: unit mask = 0Fh - count for all cahce lines, 1,2,4,8 - flags for MESI. (c#0) - only count in counter 0. (c#1) - only count in counter 1. 15..8 UMASK (Unit Mask) Contain event specific qualificator. 16 USR (User) if = 1 Count events in ring 1,2,3. 17 OS (Operation system mode) if =1 Count events in ring 0. 18 E (Edge Detect) Select Occurrence/Duration mode if = 0 Duration mode if = 1 Duration mode 19 PC (Pin Control) Enables signaling counters overflows via PMi pins. 20 INT (APIC Interrupt Enable) if =1 processor generated exception via local APIC, when counter overflow. 21 Reserved 22 EN (Enable Counters Flag) if =1 enable counting perfomance events in both counters, if = 0 disable in both. 23 INV (Invert Flag) if =1 reverse result of comparasion with counter mask. 31..24 Counter mask fields if <> 0 then CPU compares this value with count of event, if this count >= mask, counter incremented. (Need for calculate, for ex: two or more instruction retired.) if =0, counter incremented each event 63..32 Reserved ------------------------------------------------- MSR 187h is EVNTSEL1 (Event Select # 1) (Pentium Pro/Pentium II) bits Description 7..0 Event number 15..8 UMASK (Unit Mask) 16 USR (User) 17 OS (Operation system mode) 18 E (Edge Detect) 19 PC (Pin Control) 20 INT (APIC Interrupt Enable) 21..22 Reserved (bit 22 reseved !!!!) 23 INV (Invert Flag) 31..24 Counter mask fields 63..32 Reserved ------------------------------------------------- MSR 1D3h is ????? (Pentium II) ------------------------------------------------- MSR 1D9h is DEBUGCTLMSR (Debbuging Control MSR) (Pentium Pro/Pentium II) Bits Description 0 Enable/Disable Last Branch Record 1 Branch Trap Flag 5..2 Perfomance Monitoring/Break Point Pins 6 Enable/Disable Execution Trace Messages 13..7 Reserved 15..14 Enable/Disable Execution Trace Messages 63..16 Reserved ------------------------------------------------- MSR 1DBh is LASTBRANCHFROMIP (Last Branch From IP) (Pentium Pro/Pentium II) ------------------------------------------------- MSR 1DCh is LASTBRANCHTOIP (Last Branch To IP) (Pentium Pro/Pentium II) ------------------------------------------------- MSR 1DDh is LASTINTFROMIP (Last INT From IP) (Pentium Pro/Pentium II) ------------------------------------------------- MSR 1DEh is LASTINTTOIP (Last INT To IP) (Pentium Pro/Pentium II) ------------------------------------------------- MSR 1E0h is ROB_CR_BKUPTMPDR6 (Pentium Pro/Pentium II) Bits Description 63..3 Reserved 2 Fast String Enable Bit If Enable REP MOVS move 64bit on 1 clk. 1..0 Reserved ------------------------------------------------- MSR 200h is MTRR Physical Base 0 (Pentium Pro/Pentium II) ------------------------------------------------- MSR 201h is MTRR Physical Mask 0 (Pentium Pro/Pentium II) ------------------------------------------------- MSR 202h is MTRR Physical Base 1 (Pentium Pro/Pentium II) ------------------------------------------------- MSR 203h is MTRR Physical Mask 1 (Pentium Pro/Pentium II) ------------------------------------------------- MSR 204h is MTRR Physical Base 2 (Pentium Pro/Pentium II) ------------------------------------------------- MSR 205h is MTRR Physical Mask 2 (Pentium Pro/Pentium II) ------------------------------------------------- MSR 206h is MTRR Physical Base 3 (Pentium Pro/Pentium II) ------------------------------------------------- MSR 207h is MTRR Physical Mask 3 (Pentium Pro/Pentium II) ------------------------------------------------- MSR 208h is MTRR Physical Base 4 (Pentium Pro/Pentium II) ------------------------------------------------- MSR 209h is MTRR Physical Mask 4 (Pentium Pro/Pentium II) ------------------------------------------------- MSR 20Ah is MTRR Physical Base 5 (Pentium Pro/Pentium II) ------------------------------------------------- MSR 20Bh is MTRR Physical Mask 5 (Pentium Pro/Pentium II) ------------------------------------------------- MSR 20Ch is MTRR Physical Base 6 (Pentium Pro/Pentium II) ------------------------------------------------- MSR 20Dh is MTRR Physical Mask 6 (Pentium Pro/Pentium II) ------------------------------------------------- MSR 20Eh is MTRR Physical Base 7 (Pentium Pro/Pentium II) ------------------------------------------------- MSR 20Fh is MTRR Physical Mask 7 (Pentium Pro/Pentium II) ------------------------------------------------- MSR 250h is MTRR Fixed 64K at 00000h (Pentium Pro/Pentium II) ------------------------------------------------- MSR 258h is MTRR Fixed 16K at 80000h (Pentium Pro/Pentium II) ------------------------------------------------- MSR 259h is MTRR Fixed 16K at A0000h (Pentium Pro/Pentium II) ------------------------------------------------- MSR 268h is MTRR Fixed 4K at C0000h (Pentium Pro/Pentium II) ------------------------------------------------- MSR 269h is MTRR Fixed 4K at C8000h (Pentium Pro/Pentium II) ------------------------------------------------- MSR 26Ah is MTRR Fixed 4K at D0000h (Pentium Pro/Pentium II) ------------------------------------------------- MSR 26Bh is MTRR Fixed 4K at D8000h (Pentium Pro/Pentium II) ------------------------------------------------- MSR 26Ch is MTRR Fixed 4K at E0000h (Pentium Pro/Pentium II) ------------------------------------------------- MSR 26Dh is MTRR Fixed 4K at E8000h (Pentium Pro/Pentium II) ------------------------------------------------- MSR 26Eh is MTRR Fixed 4K at F0000h (Pentium Pro/Pentium II) ------------------------------------------------- MSR 26Fh is MTRR Fixed 4K at F8000h (Pentium Pro/Pentium II) ------------------------------------------------- MSR 277h is PAT (Page Attribute Table) (Pentium II) ------------------------------------------------- MSR 280h is ???? (Pentium II) ------------------------------------------------- MSR 2FFh is MTTR Default Memory Type (Pentium Pro/Pentium II) Bits Description 63..12 Reserved 11 MTTR (Memory Type Region Registers) Enable 10 Fixed MTRR Enable 9..3 Reserved 2..0 Default Memory Type ------------------------------------------------- MSR 400h is MC0_CTL (Machine Check Control 0) (Pentium Pro/Pentium II) ------------------------------------------------- MSR 401h is MC0_STATUS (Machine Check Status 0) (Pentium Pro/Pentium II) Bits Description 63 MC_STATUS_V 62 MC_STATUS_O 61 MC_STATUS_UC 60 MC_STATUS_EN 59 MC_STATUS_MISCV 58 MC_STATUS_ADDRV 57 MC_STATUS_DAM 56..32 Reserved 31..16 MC_STAT_MSCOD 15..0 MC_STAT_MACCOD ------------------------------------------------- MSR 402h is MC0_ADDR (Machine Check Address 0) (Pentium Pro/Pentium II) ------------------------------------------------- MSR 404h is MC1_CTL (Pentium Pro/Pentium II) ------------------------------------------------- MSR 405h is MC1_STATUS (Pentium Pro/Pentium II) ------------------------------------------------- MSR 406h is MC1_ADDR (Pentium Pro/Pentium II) ------------------------------------------------- MSR 408h is MC2_CTL (Pentium Pro/Pentium II) ------------------------------------------------- MSR 409h is MC2_STATUS (Pentium Pro/Pentium II) ------------------------------------------------- MSR 40Ah is MC2_ADDR (Pentium Pro/Pentium II) ------------------------------------------------- MSR 40Ch is MC4_CTL (Pentium Pro/Pentium II) ------------------------------------------------- MSR 40Dh is MC4_STATUS (Pentium Pro/Pentium II) Note: MSR 40Eh (MC4_ADDR not implemented in Pentium Pro) ------------------------------------------------- MSR 410h is MC3_CTL (Pentium Pro/Pentium II) ------------------------------------------------- MSR 411h is MC3_STATUS (Pentium Pro/Pentium II) ------------------------------------------------- MSR 412h is MC3_ADDR (Pentium Pro/Pentium II) ------------------------------------------------- MSR 1000h..1007h is aliasing to DR0..DR7 (Pentium Pro/Pentium II) ------------------------------------------------- MSR 1000H is Processor Operation Register (IBM 486SLC/486SLC2/386SLC) bits Description 63..19 Reserved 18 LWPLA (Low Power PLA) (reserved on IBM 386SLC) 17 BUSRD (Bus Read) (reserved on IBM 386SLC) 16 CPGE (Cache Parity Generate Error) (reserved on IBM 386SLC) 15 ECNPX (Enable cachebility of NPX operands) 14 EPWIA (Enable PWI ADS) 13 ELPWH (Enable Low Power Halt Mode) 12 XTOUT (Extend Out Instruction) 11 CRLD (Cache reload bit) 10 EIKEN (Enable internal KEN#) 9 DSCL (Disable cache Lock Mode) 8 Reserved 7 CE (Cache enable) 6 EDBS (Enable DBCS) 5 EPWI (Enable Power Interrupt) 4 EFSP (Enable Flush Snooping) 3 ENSP (Enable Snoop Input) 2 A20M (Address line 20 Mask) 1 CPCE (Cache Parity Checking Enable) 0 CPE (Cache Parity Error) ------------------------------------------------- MSR 1001H is Cache Region Control Register (IBM 386SLC/486SLC/486SLC2) bits description 63..40 Reserved 39..32 Cache Memory Limit (CMLR) 31..16 1st MB Read Only (LMROR) 15..0 1st MB Cachable (LMCR) ------------------------------------------------- MSR 1002H is processor operation register (IBM 486SLC2 only) bits description 63..30 Reserved 29 EEDFS (Enable External Dynamic Frequency Shift) 28 DFSRY (Dynamic Frequency Shift Ready) 27 DFSMD (Dynamic Frequency Shift Mode) 26..24 CLKMD (Clock Mode) =000 x2 =011 x1 23..0 Reserved ------------------------------------------------- MSR 1004H us processor control register (IBM 486BL3 Blue Lightning only) bits description 63..24 reserved 23 if = 0 DD1 hardware if = 1 DD0 hardware (for OS/2 boot) 22 if = 0 MOV CR0 decode for DD0,DD1A,DD1B and DD1D hardware = 1 MOV CR0 decode for DD1C hardware 21 reserved 20 if = 0 cache enabled if = 1 cache disabled when not used (low-power mode) 19 reserved 18 NOP instruction cycles if = 0 (DD0 - 2clk, DD1 - 3clk) if = 1 (DD0 - 3clk, DD1 - 2clk) 17..0 reserved ------------------------------------------------- MSR 2000h..2004h is aliasing to CR0..CR4 (Pentium Pro/Pentium II) ------------------------------------------------- MSR 80000000h..80000013h (Pentium) Aliased to MSRs (0..13h) ------------------------------------------------- MSR 80000019h is Last Prefetched F.P. Opcode (Pentium) Bits Description 63..11 Reserved 10..8 Low 3-bit of F.P. opcode 7..0 Second Byte of F.P. opcode ------------------------------------------------- MSR 8000001Ah is Last Non-control F.P. Opcode (Pentium) Note: format as MSR 80000019h ------------------------------------------------- MSR 8000001Bh is Last Exception F.P. Opcode (Pentium) Note: format as MSR 80000019h ------------------------------------------------- MSR 8000001Dh is Probe Mode Control Register (Pentium) Bits Description 63..32 Reserved 31 SMM is active (Read only) 30..3 Reserved 2 PB1 monitors breakpoints matches instead of perfomance counter # 1 1 PB0 monitors breakpoints matches instead of perfomance counter # 0 0 Ice-Mode switch and ICEBP instruction enabled ------------------------------------------------- MSR C0000080h is EFER (Extended Feature Enable Register) (AMD K6) Bits Description 63..4 Reserved (Writing 1 to any reserved bit caused GPF# on K6-III) 4 L2D (L2 Cache Disable) (AMD K6-III) if =1 disabled if =0 enabled 3 GEWBED (global EWBE disable) if =1 disabled 2 SEWBED (speculative EWBE disable) if =1 disabled 1 DPE (Data Prefetch Enable) if =1 enabled (bits 3..1 valid since K6-2 Steps 8..F) 0 SCE (System Call Extension) if = 1 System call extension enable (see SYSCALL and SYSRET instructions for more informations about system call). ------------------------------------------------- MSR C0000081h is STAR (SYSCALL Target Address Register) (AMD K6) Bits Description 63..48 RET_BASE (CS and SS selector base for SYSRET) 47..32 CALL_BASE CS selector and SS selector base 31..0 TEIP Target IP address ------------------------------------------------- MSR C0000082h is WHCR (Write Handling Control Register) (AMD K6) Bits Description (AMD K6 with model <8, and model 8 with steps 0..7) 63..9 Reserved 8 WCDE (Write Cachebility Detection Enable) Note: Triton does not support this hardware mechanism, so clear this bit to 0. 7..1 WAELIM (Write Allocate Enable Limit) This field multiplied on 4MB defines upper memory limit. All memory upper this limit will be acessed w/o write allocate. 0 WAE15M (Write Allocate Enable 15-to-16 Mbyte) if = 1 enable write allocation on region 15MB-16MB. (AMD K6-2 with model >8, and model 8 with steps 8..f + AMD K6-III) 63..32 Reserved 32..22 WAELIM (Write Allocation enable limit) 0..4092MB by 4MB blocks 21..17 reserved 16 WAE15M (Write Allocation Enable 15..16MB) if = 1 enable 15..0 Reserved for more info refer to "AMD-K6(tm) MMX(tm) Enhanced Processor Data Sheet", order# 20695, http://www.amd.com ------------------------------------------------- MSR C0000085h is UWCCR (UC/WC Cacheability Control Register) (AMD K6-2 Step 8..F, AMD K6-III) (Read/Write) Bits Description 63..49 PHYS_BASE1 Physical Address Base # 1, 128 KB and range size-aligned 48..34 PHYS_MASK1 Physical Address Mask # 1, 128KB aligned 33 WC1 (Write Combinbing # 1) = 1 enabled/uncachable = 0 disabled 32 UC1 (Uncacheble) = 1 uncachable = 0 disabled 31..17 PHYS_BASE0 16..2 PHYS_MASK0 1 WC0 0 UC0 ------------------------------------------------- MSR C0000087h is PSOR (Processor State Observability Register) (AMD K6-2 Step 8..F, AMD K6-III) (Read-only) Bits Description 63..9 Reserved 8 NOL2 (No L2 functionallity) 7..4 STEP (Stepping of CPU) 3 Reserved 2..0 BF (Bus Frequency Deivisor) 000 = x4.5 100 = x2.5 001 = x5.0 101 = x3.0 010 = x4.0 110 = x6.0 011 = x5.5 111 = x5.5 ------------------------------------------------- MSR C0000088h is PFIR (Page Flush/Invalidate Register) (AMD K6-2 Step 8..F, AMD K6-III) Bits Description 63..32 Reserved 31..12 LINPAGE (linear 4KB page address) 11..9 Reserved 8 PF (Page Fault Occured) =1 occured, =0 no 7..1 Reserved 0 F/I (Flush/Invalidate command) = 1 invalidate, = 0 flush ------------------------------------------------- MSR C0000089h is L2AAR (Level 2 cache access register) (AMD K6-III) Operation T/D (Read) 0 Read L2 Data (Read) 1 Read Tag (Write) 0 Write L2 Data (Write) 1 Write Tag Bits Description (Write) 64..53 Reserved 52 T/D (Select Tag or Data Access) =1 Select Tag =0 Data Access 51..50 Reserved 49..48 Way 47..38 Set 37 Line (Select Line0 or Line1) 36..35 Octet (Select one of 4 bytes) 34 Dword (Select High or Low Dword) 33..32 Reserved 31..0 Data Bits Description (Read) (if read tag) Location of Tag placed in EDX before WRMSR EDX not changed !!!! 31..15 Tag 14..12 Reserved 11..10 Line 1 MESI State 11 = M 10 = E 01 = S 00 = I 9..8 Line 2 MESI State 7..0 LRU (2 bits of LRU for each way) 00 = most ... 11 = least (if read data) 31..0 Data ------------------------------------------------- MSR C0010000h is PerfEvtSel[0] (Perfomance Event selector # 0) (AMD Athlon) Bits Description 31..24 Counter Mask 23 INV (Invert Mask) 22 EN (Enable Counter) 21 Reserved 20 INT (APIC Interrupt Enable) if =1 CPU generate APIC interrupt if counter overflow 19 PC (Pin Control) if =1 CPU togle PMi pins when counters overflow 18 E (Edge Detect) 17 OS (OS Mode) if =1 counter if CPL=0 16 USR (User Mode) if =1 counter if CPL=1,2,3 15..8 Unit Mask unit specified info, for example for cache event unit mask use MESI protocol qualificators. 7..0 Event Mask Event Mask Description Unit Mask Note 20h Load Segment Register x1xx xxxx HS xx1x xxxx GS xxx1 xxxx FS xxxx 1xxx DS xxxx x1xx SS xxxx xx1x CS xxxx xxx1 ES 21h Stores to active instruction stream 40h Data cache accesses 41h Data cache misses 42h Data cache refills xxx1 xxxx M xxxx 1xxx O (Owner) xxxx x1xx E xxxx xx1x S xxxx xxx1 I 43h Data cache refills from stream (-------- see 42h ---------) 44h Data cache writebacks (-------- see 42h ---------) 45h L1 DTLB Misses and L2 DTLB misses 46h L1 and L2 DTLB misses 47h Misaligned data reference 64h DRAM system request 65h System Request with type: x1xx xxxx WB xx1x xxxx WP xxx1 xxxx WT xxxx xx1x Data Cache xxxx xxx1 Instr. cache. 73h Snoop Hits xxxx x1xx L2 xxxx xx1x Data cache xxxx xxx1 Instr cache 74h Single bit ECC error xxxx xx1x L2 error xxxx xxx1 system 75h Internal cache line invalidates xxxx 1xxx I inv D xxxx x1xx I inv I xxxx xx1x D inv D xxxx xxxx D inv I 76h Cycles Processor running (Not in HLT or STPCLK) 79h L2 requests 1xxx xxxx Blk Wrt from L2 x1xx xxxx Blk Wrt from DC xx1x xxxx Blk Wrt from Sys xxx1 xxxx Blk Rd Data Store xxxx 1xxx Blk Rd Data Load xxxx x1xx Read code (data blk) xxxx xx1x Tag read xxxx xxx1 Tag Write 7Ah Cycles that at least one fill request wanted to use L2 80h Instruction cache fetches 81h Instruction cache misses 82h Instruction cache refill from L2 83h Instruction cache refill from System 84h L1 ITLB Miss 85h (L1 and) L2 ITLB Miss 86h Snoop Resync 87h Instruction fetch stall cycle 88h Return Stack Hits 89h Return Stack Overflow C0h Retired Instruction C1h Retired Ops C2h Retired branches C3h Retired branches mispredict C4h Retired taken branches C5h Retured taken branches mispredict C6h Retired far control transfers C8h Retired near returns C9h Retired near returns mispredict CAh Retired indirect branches with target mispredict CDh Interrupt masked cycles CEh Interrupt Masked while pending cycles CFh Number of taken hardware interrupts D0h Instruction decoder empty D1h Dispatch Stall D2h Branch abort to retire D3h Serialize D4h Segment load stall D5h ICU fill D6h Reservation station fill D7h FPU full D8h LS full D9h All quiet stall DAh Far transfer or resync branch pending DCh Breakpoint matches for DR0 DDh Breakpoint matches for DR1 DEh Breakpoint matches for DR2 DFh Breakpoint matches for DR3 ------------------------------------------------- MSR C0010001h is PerfEvtSel[1] (Perfomance Event selector # 1) (AMD Athlon) ------------------------------------------------- MSR C0010002h is PerfEvtSel[2] (Perfomance Event selector # 2) (AMD Athlon) ------------------------------------------------- MSR C0010003h is PerfEvtSel[3] (Perfomance Event selector # 3) (AMD Athlon) ------------------------------------------------- MSR C0010004h is PerfCnt[0] (Perfomance Counter # 0) [Read only] (AMD Athlon) ------------------------------------------------- MSR C0010005h is PerfCnt[1] (Perfomance Counter # 1) [Read only] (AMD Athlon) ------------------------------------------------- MSR C0010006h is PerfCnt[2] (Perfomance Counter # 2) [Read only] (AMD Athlon) ------------------------------------------------- MSR C0010007h is PerfCnt[3] (Perfomance Counter # 3) [Read only] (AMD Athlon) ---------------------------------------------------------- APPENDIX X - SYSTEM MANAGMENT MODE (SMM) +----------------+ | Base SM Modes: | +----------------+ There are 4 base types of SMM in x86 CPUs (unfortunetly, I don't knew SMM in NexGen): Activation Bytes Hidden RAM Hidden RAM SMM Vendor Hard Soft Saved Save Area SMM code start Type AMD 386SXLV + SMI 228 6000:0000 FFFFFFF0 \ AMD 386DXLV + SMI 228 6000:0000 FFFFFFF0 | old AMD AMD 486DXLV + SMI 364 6000:0000 FFFFFFF0 / ----------------------------------------------------------- Cx486SLC/DLC + HLT - - - \ Cx486SLC/e + - 35 User Definded User Defined | Cyrix Cx486S..Cx486MX + (SMINT) 48 User Defined User Defined / ----------------------------------------------------------- IBM 386/486SLC + ICEBP 284 6000:0000 FFFFFFF0 ] IBM ----------------------------------------------------------- i386SL/i486SL + Timer 512 3000:FE00 3000:8000 \ i486SL-Enhanced + - 512 3000:FE00 3000:8000 | Intel Pentium + (APIC) 512 3000:FE00 3000:8000 | Pentium Pro/II + (APIC) 512 3000:FE00 3000:8000 / Intel Type SMM support all Intel CPUs (starting i386SL or i486 SL-Enhanced), and AMD K5, K6 and later, IDT C6. +---------------+ | Intel SMM | +---------------+ Format of SMRAM Ofset from Actual SMBASE Description Size Writeable FFFC 4 CR0 32 - FFF8 4 CR3 32 - FFF4 4 EFLAGS 32 + FFF0 4 EIP 32 + FFEC 4 EDI 32 + FFE8 4 ESI 32 + FFE4 4 EBP 32 + FFE0 4 ESP 32 + FFDC 4 EBX 32 + FFD8 4 EDX 32 + FFD4 4 ECX 32 + FFD0 4 EAX 32 + FFCC 4 DR6 32 - FFC8 4 DR7 32 - FFC4 4 TR 16 - FFC0 4 LDTR 16 - FFBC 4 GS 16 - FFB8 4 FS 16 - FFB4 4 DS 16 - FFB0 4 SS 16 - FFAC 4 CS 16 - FFA8 4 ES 16 - FFA4 4 I/O trap Dword 32 - FFA0 8 reserved - FF9C 4 I/O trap EIP 32 - FF94 8 reserved - FF90 4 IDT Base 32 - FF8C 4 IDT Limit 20 - FF88 4 GDT Base 32 - FF84 4 GDT Limit 20 - FF80 4 TSS Attribute 12 - FF7C 4 TSS Base 32 - FF78 4 TSS Limit 20 - FF74 4 LDT Attribute 12 - FF70 4 LDT Base 32 - FF6C 4 LDT Limit 20 - FF68 4 GS Attribute 12 - FF64 4 GS Base 32 - FF60 4 GS Limit 20 - FF5C 4 FS Attribute 12 - FF58 4 FS Base 32 - FF54 4 FS Limit 20 - FF50 4 DS Attribute 12 - FF4C 4 DS Base 32 - FF48 4 DS Limit 20 - FF44 4 SS Attribute 12 - FF40 4 SS Base 32 - FF3C 4 SS Limit 20 - FF38 4 CS Attribute 12 - FF34 4 CS Base 32 - FF30 4 CS Limit 20 - FF2C 4 ES Attribute 12 - FF28 4 ES Base 32 - FF24 4 ES Limit 20 - FF18 12 reserved - FF14 4 CR2 32 - FF10 4 CR4 32 - FF0C 4 I/O Restart ESI 32 - FF08 4 I/O Restart ECX 32 - FF04 4 I/O Restart EDI 32 - FF02 2 Auto HALT Restart Slot 16* + FF00 2 I/O Trap Restart Slot 16* + FEFC 4 SMM Revision ID 32 - FEF8 4 SMBASE Slot 32 + 7E00 248 reserved - Note: if Actual size < fiels size, then all upper that actual size bits are reserved. +---------------+ | Cyrix SMM | +---------------+ Full description of Cyrix SMM will be placed in future OPCODE.LST. Now see SMINT and some other Cyrix SMM commands for more details. See APPENDIX A1-A6 for more details. Format of SMRAM: +00 <-------- Here pointed SMHR register (M2) -04 4 DR7 -08 4 EFLAGS -0C 4 CR0 -10 4 Current EIP -14 4 Next EIP -18 4 CS selector -20 8 CS descriptor -24 4 Bitfields Bit Description 22..21 CPL 15 N (Nested SMI Indicator) 13 IS (Internal SMI Indicator) 4 H (SMI on HLT instruction) 3 S (Software SMI entrance) 2 P (REP INSx/OUTSx indicator) 1 I (IN/INSx/OUT/OUTSx indicator) 0 C (Code segment writable flag) -26 2 I/O Write Data Size -28 2 I/O Write Address -2C 4 I/O Write Data -30 4 ESI or EDI +-------------------+ | Old-style AMD SMM | +-------------------+ Format of SMRAM: Offset Bytes Description 60000 4 CR0 60004 4 EFLAGS 60008 4 EIP 6000C 4 EDI 60010 4 ESI 60014 4 EBP 60018 4 ESP 6001C 4 EBX 60020 4 EDX 60024 4 ECX 60028 4 EAX 6002C 4 DR6 60030 4 DR7 60034 4 TR selector 60038 4 LDT selector 6003C 4 GS selector 60040 4 FS selector 60044 4 DS selector 60048 4 SS selector 6004C 4 CS selector 60050 4 ES selector 60054 4 TSS descriptor (ATTR) 60058 4 TSS descriptor (BASE) 6005C 4 TSS descriptor (LIMIT) 60060 4 reserved 60064 4 IDTR (BASE) 60068 4 IDTR (LIMIT) 6006C 4 REP OUTS Overrun Flag 60070 4 GDTR (BASE) 60074 4 GDTR (LIMIT) 60078 4 LDT (ATTR) 6007C 4 LDT (BASE) 60080 4 LDT (LIMIT) 60084 4 GS (ATTR) 60088 4 GS (BASE) 6008C 4 GS (LIMIT) 60090 4 FS (ATTR) 60094 4 FS (BASE) 60098 4 FS (LIMIT) 6009C 4 DS (ATTR) 600A0 4 DS (BASE) 600A4 4 DS (LIMIT) 600A8 4 SS (ATTR) 600AC 4 SS (BASE) 600B0 4 SS (LIMIT) 600B4 4 CS (ATTR) 600B8 4 CS (BASE) 600BC 4 CS (LIMIT) 600C0 4 ES (ATTR) 600C4 4 ES (BASE) 600C8 4 ES (LIMIT) .... 60100 4 Temporary Register TST 60104 4 Temporary Register IDX 60108 4 Temporary Register TMPH 6010C 4 Temporary Register TMPG 60110 4 Temporary Register TMPF 60114 4 Temporary Register TMPE 60118 4 Temporary Register TMPD 6011C 4 Temporary Register TMPC 60120 4 Temporary Register TMPB 60124 4 LEIP (Last EIP) ------------- AMD Am486DXLV additional fields 60128 4 PEIP 6012C 36 Unused 60150 88 F.P. Internal Registers Note: See LOADALL for More Information +-------------------+ | IBM SMM | +-------------------+ Format of SMRAM: Offset Bytes Description 60000 4 CR0 60004 4 EFLAGS 60008 4 EIP 6000C 4 EDI 60010 4 ESI 60014 4 EBP 60018 4 ESP 6001C 4 EBX 60020 4 EDX 60024 4 ECX 60028 4 EAX 6002C 4 DR6 60030 4 DR7 60034 4 TR selector 60038 4 LDT selector 6003C 4 GS selector 60040 4 FS selector 60044 4 DS selector 60048 4 SS selector 6004C 4 CS selector 60050 4 ES selector 60054 4 TSS descriptor (ATTR) 60058 4 TSS descriptor (BASE) 6005C 4 TSS descriptor (LIMIT) 60060 4 reserved 60064 4 IDTR (BASE) 60068 4 IDTR (LIMIT) 6006C 4 REP OUTS Overrun Flag 60070 4 GDTR (BASE) 60074 4 GDTR (LIMIT) 60078 4 LDT (ATTR) 6007C 4 LDT (BASE) 60080 4 LDT (LIMIT) 60084 4 GS (ATTR) 60088 4 GS (BASE) 6008C 4 GS (LIMIT) 60090 4 FS (ATTR) 60094 4 FS (BASE) 60098 4 FS (LIMIT) 6009C 4 DS (ATTR) 600A0 4 DS (BASE) 600A4 4 DS (LIMIT) 600A8 4 SS (ATTR) 600AC 4 SS (BASE) 600B0 4 SS (LIMIT) 600B4 4 CS (ATTR) 600B8 4 CS (BASE) 600BC 4 CS (LIMIT) 600C0 4 ES (ATTR) 600C4 4 ES (BASE) 600C8 4 ES (LIMIT) ... 60100 4 Temporary Register TST 60104 4 Temporary Register IDX 60108 4 Temporary Register TMPH 6010C 4 Temporary Register TMPG 60110 4 Temporary Register TMPF 60114 4 Temporary Register TMPE 60118 4 Temporary Register TMPD 6011C 4 Temporary Register TMPC 60120 4 Temporary Register TMPB 60124 4 Temporary Register TMPA 60128 4 CR2 6012C 4 CR3 60130 4 MSR 1001h (0..31) 60134 4 MSR 1001h (63..32) 60138 4 MSR 1000h (0..31) 6013C 4 DR0 60140 4 DR1 60144 4 DR2 60148 4 DR3 6014C 4 PEIP (Previous Hidden Memory Space Instruction Pointer) Note: See ICEBP/ICERET for More Information ---------------------------------------------------------- APPENDIX Y0 - Vendor Instruction Time for Intel 8088 CPU AAA 4 AAD 60 AAM 83 AAS 4 ADC AL,imm8 4 ADC AX,imm16 4 ADC r/m8,imm8 4/17+EA ADC r/m16,imm8 4/25+EA ADC r/m16,imm16 4/25+EA ADC r/m8,r8 3/16+EA ADC r/m16,r16 3/24+EA ADC r8,r/m8 3/9+EA ADC r16,r/m16 3/13+EA ADD AL,imm8 4 ADD AX,imm16 4 ADD r/m8,imm8 4/17+EA ADD r/m16,imm8 4/25+EA ADD r/m16,imm16 4/25+EA ADD r/m8,r8 3/16+EA ADD r/m16,r16 3/24+EA ADD r8,r/m8 3/9+EA ADD r16,r/m16 3/13+EA AND AL,imm8 4 AND AX,imm16 4 AND r/m8,imm8 4/16+EA AND r/m16,imm16 4/25+EA AND r/m8,r8 3/16+EA AND r/m16,r16 3/24+EA AND r8,r/m8 3/9+EA AND r16,r/m16 3/13+EA CALL rel16 19(23) CALL r/m16 16(24)/21(29)+EA CALL ptr16:16 28(36) CALL m16:16 37(57)+EA CBW 2 CLC 2 CLD 2 CLI 2 CMC 2 CMP AL,imm8 4 CMP AX,imm16 4 CMP r/m8,imm8 4/10+EA CMP r/m16,imm8 4/- CMP r/m16,imm16 4/14+EA CMP r/m8,r8 3/9+EA CMP r/m16,r16 3/13+EA CMP r8,r/m8 3/9+EA CMP r16,r/m16 3/13+EA CMPSB 22 CMPSW 30 CWD 5 DAA 4 DAS 4 DEC r/m8 3/15+EA DEC r/m16 2/23+EA DEC r16 2 DIV r/m8 80-90/(86-96)+EA DIV r/m16 144-162/(154-172)+EA HLT 2 IDIV r/m8 101-112/(107-118)+EA IDIV r/m16 165-184/(175-194)+EA IMUL r/m8 80-98/(86-104)+EA IMUL r/m16 128-154/(138-164)+EA IN AL,imm8 10 IN AX,imm8 14 IN AL,DX 8 IN AX,DX 12 INC r/m8 3/15+EA INC r/m16 2/23+EA INC r16 2 INT 3 53(72) INT imm8 51(71) INTO 53(73) or 4 IRET 32(44) Jcc rel8 4 or 16 JCXZ rel8 6 or 18 JMP rel8 15 JMP rel16 15 JMP r/m16 11/18+EA JMP ptr16:16 15 JMP m16:16 24+EA LAHF 4 LDS r16,m16:16 24+EA LES r16,m16:16 24+EA LEA r16,m 2+EA LODSB 12 LODSW 16 LOOP rel8 5 or 17 LOOPE rel8 6 or 18 LOOPNE rel8 5 or 19 MOV r/m8,r8 2/9+EA MOV r/m16,r16 2/13+EA MOV r8,r/m8 2/8+EA MOV r16,r/m16 2/12+EA MOV r/m16,sreg 2/9(13)+EA MOV sreg,r/m16 2/8(12)+EA MOV AL,moffs8 10 MOV AX,moffs16 14 MOV moffs8,AL 10 MOV moffs16,AX 14 MOV r8,imm8 4 MOV r16,imm16 4 MOV r/m8,imm8 4/10+EA MOV r/m16,imm16 4/14+EA MOVSB 18 MOVSW 26 MUL r/m8 70-77/(76-83)+EA MUL r/m16 118-133/(128-143)+EA NEG r/m8 3/16+EA NEG r/m16 3/24+EA NOP 3 NOT r/m8 3/16+EA NOT r/m16 3/24+EA OR AL,imm8 4 OR AX,imm16 4 OR r/m8,imm8 4/17+EA OR r/m16,imm16 4/25+EA OR r/m8,r8 3/16+EA OR r/m16,r16 3/24+EA OR r8,r/m8 3/9+EA OR r16,r/m16 3/13+EA OUT imm8,AL 10 OUT imm8,AX 14 OUT DX,AL 8 OUT DX,AX 12 POP m16 25+EA POP r16 12 POP sreg 12 POPF 12 PUSH r/m16 15/24+EA PUSH r16 15 PUSH sreg 14 PUSHF 14 RCL r/m8,1 2/15+EA RCL r/m16,1 2/23+EA RCL r/m8,CL 8+4*bit/20+EA+4*bit RCL r/m16,CL 8+4*bit/28+EA+4*bit RCR r/m8,1 2/15+EA RCR r/m16,1 2/23+EA RCR r/m8,CL 8+4*bit/20+EA+4*bit RCR r/m16,CL 8+4*bit/28+EA+4*bit ROL r/m8,1 2/15+EA ROL r/m16,1 2/23+EA ROL r/m8,CL 8+4*bit/20+EA+4*bit ROL r/m16,CL 8+4*bit/28+EA+4*bit ROR r/m8,1 2/15+EA ROR r/m16,1 2/23+EA ROR r/m8,CL 8+4*bit/20+EA+4*bit ROR r/m16,CL 8+4*bit/28+EA+4*bit REP MOVSB 9+17*reps REP MOVSW 9+25*reps REP LODSB n/a REP LODSW n/a REP STOSB 9+10*reps REP STOSW 9+14*reps REPE CMPSB 9+17*reps REPE CMPSW 9+25*reps REPE SCASB 9+15*reps REPE SCASW 9+19*reps REPNE CMPSB 9+17*reps REPNE CMPSW 9+25*reps REPNE SCASB 9+15*reps REPNE SCASW 9+19*reps RET (near) 20 RET imm16 (near) 24 RET (far) 32 RET imm16 (far) 31 SAHF 4 SAL r/m8,1 2/15+EA SAL r/m16,1 2/23+EA SAL r/m8,CL 8+4*bit/20+EA+4*bit SAL r/m16,CL 8+4*bit/28+EA+4*bit SAR r/m8,1 2/15+EA SAR r/m16,1 2/23+EA SAR r/m8,CL 8+4*bit/20+EA+4*bit SAR r/m16,CL 8+4*bit/28+EA+4*bit SHL r/m8,1 2/15+EA SHL r/m16,1 2/23+EA SHL r/m8,CL 8+4*bit/20+EA+4*bit SHL r/m16,CL 8+4*bit/28+EA+4*bit SHR r/m8,1 2/15+EA SHR r/m16,1 2/23+EA SHR r/m8,CL 8+4*bit/20+EA+4*bit SHR r/m16,CL 8+4*bit/28+EA+4*bit SBB AL,imm8 4 SBB AX,imm16 4 SBB r/m8,imm8 4/17+EA SBB r/m16,imm8 4/25+EA SBB r/m16,imm16 4/25+EA SBB r/m8,r8 3/16+EA SBB r/m16,r16 3/24+EA SBB r8,r/m8 3/9+EA SBB r16,r/m16 3/16+EA SCASB 15 SCASW 19 SETALC n/a STC 2 STD 2 STI 2 STOSB 11 STOSW 15 SUB AL,imm8 4 SUB AX,imm16 4 SUB r/m8,imm8 4/17+EA SUB r/m16,imm8 4/25+EA SUB r/m16,imm16 4/25+EA SUB r/m8,r8 3/16+EA SUB r/m16,r16 3/24+EA SUB r8,r/m8 3/9+EA SUB r16,r/m16 3/13+EA TEST AL,imm8 4 TEST AX,imm16 4 TEST r/m8,imm8 5/11+EA TEST r/m16,imm16 5/11+EA TEST r/m8,r8 3/9+EA TEST r/m16,r16 3/13+EA WAIT 3+5*number_of_wait_cycles XCHG AX,r16 3 XCHG r/m8,r8 4/17+EA XCHG r/m16,r16 4/25+EA XLAT 11 XOR AL,imm8 4 XOR AX,imm16 4 XOR r/m8,imm8 4/17+EA XOR r/m16,imm16 4/25+EA XOR r/m8,r8 3/16+EA XOR r/m16,r16 3/24+EA XOR r8,r/m8 3/9+EA XOR r16,r/m16 3/13+EA (END) ---------------------------------------------------------- APPENDIX Y1 - Vendor Instruction Time for Intel i80186 CPU AAA 8 AAD 15 AAD imm8 15 ?? (n/a) AAM 19 AAM imm8 19 ?? (n/a) AAS 7 ADC AL,imm8 3 ADC AX,imm16 4 ADC r/m8,imm8 4/16 ADC r/m16,imm16 4/16 ADC r/m8,r8 3/15 ADC r/m16,r16 3/15 ADC r8,r/m8 3/10 ADC r16,r/m16 3/10 ADD AL,imm8 3 ADD AX,imm16 4 ADD r/m8,imm8 4/16 ADD r/m32,imm8 4/16 ADD r/m8,r8 3/15 ADD r/m16,r16 3/15 ADD r8,r/m8 3/10 ADD r16,r/m16 3/10 AND AL,imm8 3 AND AX,imm16 4 AND r/m8,imm8 4/16 AND r/m16,imm16 4/16 AND r/m8,r8 3/15 AND r/m16,r16 3/15 AND r8,r/m8 3/10 AND r16,r/m16 3/10 BOUND r16,m16&16 33-35 CALL rel16 15 CALL r/m16 13/19 CALL ptr16:16 23 CALL m16:16 38 CBW 2 CLC 2 CLD 2 CLI 2 CMC 2 CMP AL,imm8 3 CMP AX,imm16 4 CMP r/m8,imm8 3/10 CMP r/m16,imm16 3/10 CMP r/m8,r8 3/10 CMP r/m16,r16 3/10 CMP r8,r/m8 3/10 CMP r16,r/m16 3/10 CMPSB 22 CMPSW 22 CWD 4 DAA 4 DAS 4 DEC r/m8 3/15 DEC r/m16 3/15 DEC r16 3 DIV r/m8 29/35 DIV r/m16 38/44 ESC imm4,r/m n/a ENTER imm16,0 15 ENTER imm16,1 25 ENTER imm16,imm8 22+16*(level-1) HLT 2 IDIV r/m8 44-52/50-58 IDIV r/m16 53-61/59-67 IMUL r/m8 25-28/31-34 IMUL r/m16 34-47/40-43 IMUL r16,imm8 22-25/29-32 (~) IMUL r16,imm16 22-25/29-32 (~) IMUL r16,r/m16,imm8 22-25/29-32 (~) IMUL r16,r/m16,imm16 22-25/29-32 (~) IN AL,imm8 10 IN AX,imm8 10 IN AL,DX 8 IN AX,DX 8 INC r/m8 3/15 INC r/m16 3/15 INC r16 3 INSB 14 INSW 14 INT 3 45 INT imm8 47 INTO 4 or 48 IRET 28 Jcc rel8 4 or 13 JCXZ rel8 5 or 15 JMP rel8 14 JMP rel16 14 JMP r/m16 11/17 JMP ptr16:16 14 JMP m16:16 26 LAHF 2 LDS r16,m16:16 18 LES r16,m16:16 18 LEA r16,m 6 LEAVE 8 LODSB 12 LODSW 12 LOOP rel8 6 or 16 LOOPE rel8 6 or 16 LOOPNE rel8 6 or 16 MOV r/m8,r8 2/12 MOV r/m16,r16 2/12 MOV r8,r/m8 2/9 MOV r16,r/m16 2/9 MOV r/m16,sreg 2/11 MOV sreg,r/m16 2/9 MOV AL,moffs8 8 MOV AX,moffs16 8 MOV moffs8,AL 9 MOV moffs16,AX 9 MOV r8,imm8 3 MOV r16,imm16 4 MOV r/m8,imm8 3/12 MOV r/m16,imm16 4/13 MOVSB 14 MOVSW 14 MUL r/m8 26-28/32-34 MUL r/m16 35-37/41-43 NEG r/m8 3/10 NEG r/m16 3/10 NOP 3 NOT r/m8 3/10 NOT r/m16 3/10 OR AL,imm8 3 OR AX,imm16 4 OR r/m8,imm8 4/16 OR r/m16,imm16 4/16 OR r/m8,r8 3/15 OR r/m16,r16 3/15 OR r8,r/m8 3/10 OR r16,r/m16 3/10 OUT imm8,AL 9 OUT imm8,AX 9 OUT DX,AL 7 OUT DX,AX 7 OUTSB 14 OUTSW 14 POP m16 20 POP r16 10 POP sreg 8 POPA 51 POPF 8 PUSH r/m16 10/16 PUSH r16 10 PUSH imm8 10 PUSH imm16 10 PUSH sreg 9 PUSHA 36 PUSHF 9 RCL r/m8,1 2/15 RCL r/m16,1 2/15 RCL r/m8,CL 5+n/17+n RCL r/m16,CL 5+n/17+n RCL r/m8,imm8 5+n/17+n RCL r/m16,imm8 5+n/17+n RCR r/m8,1 2/15 RCR r/m16,1 2/15 RCR r/m8,CL 5+n/17+n RCR r/m16,CL 5+n/17+n RCR r/m8,imm8 5+n/17+n RCR r/m16,imm8 5+n/17+n ROL r/m8,1 2/15 ROL r/m16,1 2/15 ROL r/m8,CL 5+n/17+n ROL r/m16,CL 5+n/17+n ROL r/m8,imm8 5+n/17+n ROL r/m16,imm8 5+n/17+n ROR r/m8,1 2/15 ROR r/m16,1 2/15 ROR r/m8,CL 5+n/17+n ROR r/m16,CL 5+n/17+n ROR r/m8,imm8 5+n/17+n ROR r/m16,imm8 5+n/17+n RET (near) 16 RET (far) 22 RET imm16 (near) 18 RET imm16 (far) 25 SAHF 3 SAL r/m8,1 2/15 SAL r/m16,1 2/15 SAL r/m8,CL 5+n/17+n SAL r/m16,CL 5+n/17+n SAL r/m8,imm8 5+n/17+n SAL r/m16,imm8 5+n/17+n SAR r/m8,1 2/15 SAR r/m16,1 2/15 SAR r/m8,CL 5+n/17+n SAR r/m16,CL 5+n/17+n SAR r/m8,imm8 5+n/17+n SAR r/m16,imm8 5+n/17+n SHL r/m8,1 2/15 SHL r/m16,1 2/15 SHL r/m8,CL 5+n/17+n SHL r/m16,CL 5+n/17+n SHL r/m8,imm8 5+n/17+n SHL r/m16,imm8 5+n/17+n SHR r/m8,1 2/15 SHR r/m16,1 2/15 SHR r/m8,CL 5+n/17+n SHR r/m16,CL 5+n/17+n SHR r/m8,imm8 5+n/17+n SHR r/m16,imm8 5+n/17+n SBB AL,imm8 3 SBB AX,imm16 4 SBB r/m8,imm8 4/16 SBB r/m16,imm16 4/16 SBB r/m8,r8 3/15 SBB r/m16,r16 3/15 SBB r8,r/m8 3/10 SBB r16,r/m16 3/10 SCASB 15 SCASW 15 SETALC n/a STC 2 STD 2 STI 2 STOSB 10 STOSW 10 SUB AL,imm8 3 SUB AX,imm16 4 SUB r/m8,imm8 4/16 SUB r/m16,imm16 4/16 SUB r/m8,r8 3/15 SUB r/m16,r16 3/15 SUB r8,r/m8 3/10 SUB r16,r/m16 3/10 TEST AL,imm8 3 TEST AX,imm16 4 TEST r/m8,imm8 4/10 TEST r/m16,imm16 4/10 TEST r/m8,r8 3/10 TEST r/m16,r16 3/10 WAIT 6 (min) XCHG AX,r16 3 XCHG r/m8,r8 4/17 XCHG r/m16,r16 4/17 XLAT 11 XOR AL,imm8 3 XOR AX,imm16 4 XOR r/m8,imm8 4/16 XOR r/m16,imm16 4/16 XOR r/m8,r8 3/15 XOR r/m16,r16 3/15 XOR r8,r/m8 3/10 XOR r16,r/m16 3/10 (END) ---------------------------------------------------------- APPENDIX Y2 - Vendor Instruction Time for NEC V20 CPU AAA 3 AAD 7 AAD imm8 7 AAM 15 AAM imm8 15 AAS 3 ADC AL,imm8 4 ADC AX,imm16 4 ADC r/m8,imm8 4/18 ADC r/m16,imm16 4/26 ADC r/m8,r8 2/15 ADC r/m16,r16 2/24 ADC r8,r/m8 2/11 ADC r16,r/m16 2/15 ADD AL,imm8 4 ADD AX,imm16 4 ADD r/m8,imm8 4/18 ADD r/m16,imm16 4/26 ADD r/m8,r8 2/15 ADD r/m16,r16 2/24 ADD r8,r/m8 2/11 ADD r16,r/m16 2/15 AND AL,imm8 4 AND AX,imm16 4 AND r/m8,imm8 4/18 AND r/m16,imm16 4/26 AND r/m8,r8 2/15 AND r/m16,r16 2/24 AND r8,r/m8 2/11 AND r16,r/m16 2/15 BOUND r16,m16&16 18-23/73-76 CALL rel16 16-20 CALL r/m16 14-18/23-31 CALL ptr16:16 21-29 CALL m16:16 31-47 CBW 2 CLC 2 CLD 2 CLI 2 CMC 2 CMP AL,imm8 4 CMP AX,imm16 4 CMP r/m8,imm8 4/13 CMP r/m16,imm16 4/17 CMP r/m8,r8 2/11 CMP r/m16,r16 2/15 CMP r8,r/m8 2/11 CMP r16,r/m16 2/15 CMPSB 7+14n !! CMPSW 7+14n !! CWD 4-5 DAA 3 DAS 7 DEC r/m8 2/16 DEC r/m16 2/24 DEC r16 2 DIV r/m8 19/25 DIV r/m16 25/35 ESC imm4,r/m n/a ENTER imm16,0 16 ENTER imm16,1 23 ?? ENTER imm16,imm8 23+16*(level-1) HLT 2 IDIV r/m8 29/35 IDIV r/m16 43/53 IMUL r/m8 33/39 IMUL r/m16 47/57 IMUL r16,r/m16,imm8 28-34/34-44 IMUL r16,r/m16,imm16 36-42/46-52 IN AL,imm8 9 IN AX,imm8 13 IN AL,DX 8 IN AX,DX 12 INC r/m8 2/16 INC r/m16 2/24 INC r16 2 INSB 9+8n !! INSW 9+8n !! INT 3 38-50 INT imm8 38-50 INTO 3 or 52 IRET 27-39 Jcc rel8 4 or 14 JCXZ rel8 5 or 13 JMP rel8 12 JMP rel16 13 JMP r/m16 11/20-24 JMP ptr16:16 15 JMP m16:16 27-35 LAHF 2 LDS r16,m16:16 18-26 LES r16,m16:16 18-26 LEA r16,m 4 LEAVE 6/10 LODSB 7+9n !! LODSW 7+9n !! LOOP rel8 5 or 13 LOOPE rel8 5 or 14 LOOPNE rel8 5 or 14 MOV r/m8,r8 2/9 MOV r/m16,r16 2/13 MOV r8,r/m8 2/11 MOV r16,r/m16 2/15 MOV r/m16,sreg 2/10-14 MOV sreg,r/m16 2/11-15 MOV AL,moffs8 10 MOV AX,moffs16 14 MOV moffs8,AL 9 MOV moffs16,AX 13 MOV r8,imm8 4 MOV r16,imm16 4 MOV r/m8,imm8 4/11 MOV r/m16,imm16 4/15 MOVSB 11+8n !! MOVSW 11+8n !! MUL r/m8 21/27 MUL r/m16 30/36 NEG r/m8 2/16 NEG r/m16 2/24 NOP 3 NOT r/m8 2/16 NOT r/m16 2/24 OR AL,imm8 4 OR AX,imm16 4 OR r/m8,imm8 4/18 OR r/m16,imm16 4/26 OR r/m8,r8 2/15 OR r/m16,r16 2/24 OR r8,r/m8 2/11 OR r16,r/m16 2/15 OUT imm8,AL 8 OUT imm8,AX 12 OUT DX,AL 8 OUT DX,AX 12 OUTSB 9+8n !! OUTSW 9+8n !! POP m16 17-25 POP r16 8-12 POP sreg 8-12 POPA 43-75 POPF 8-12 PUSH r/m16 8-12/18-26 PUSH r16 8-12 PUSH imm8 7 PUSH imm16 12 PUSH sreg 8-12 PUSHA 35-67 PUSHF 8-12 RCL r/m8,1 2/2-4 RCL r/m16,1 2/2-4 RCL r/m8,CL 7+n/19+n RCL r/m16,CL 7+n/27+n RCL r/m8,imm8 7+n/19+n RCL r/m16,imm8 7+n/27+n RCR r/m8,1 2/16 RCR r/m16,1 2/24 RCR r/m8,CL 7+n/19+n RCR r/m16,CL 7+n/27+n RCR r/m8,imm8 7+n/19+n RCR r/m16,imm8 7+n/27+n ROL r/m8,1 2/16 ROL r/m16,1 2/24 ROL r/m8,CL 7+n/19+n ROL r/m16,CL 7+n/27+n ROL r/m8,imm8 7+n/19+n ROL r/m16,imm8 7+n/27+n ROR r/m8,1 2/16 ROR r/m16,1 2/24 ROR r/m8,CL 7+n/19+n ROR r/m16,CL 7+n/27+n ROR r/m8,imm8 2/16 ROR r/m16,imm8 2/24 RET (near) 15-19 RET (far) 21-29 RET imm16 (near) 20-24 RET imm16 (far) 24-32 SAHF 3 SAL r/m8,1 2/16 SAL r/m16,1 2/24 SAL r/m8,CL 7+n/19+n SAL r/m16,CL 7+n/27+n SAL r/m8,imm8 7+n/19+n SAL r/m16,imm8 7+n/27+n SAR r/m8,1 2/16 SAR r/m16,1 2/24 SAR r/m8,CL 7+n/19+n SAR r/m16,CL 7+n/27+n SAR r/m8,imm8 7+n/19+n SAR r/m16,imm8 7+n/27+n SHL r/m8,1 2/16 SHL r/m16,1 2/24 SHL r/m8,CL 7+n/19+n SHL r/m16,CL 7+n/27+n SHL r/m8,imm8 7+n/19+n SHL r/m16,imm8 7+n/27+n SHR r/m8,1 2/16 SHR r/m16,1 2/24 SHR r/m8,CL 7+n/19+n SHR r/m16,CL 7+n/27+n SHR r/m8,imm8 7+n/19+n SHR r/m16,imm8 7+n/27+n SBB AL,imm8 4 SBB AX,imm16 4 SBB r/m8,imm8 4/18 SBB r/m16,imm16 4/26 SBB r/m8,r8 2/15 SBB r/m16,r16 2/24 SBB r8,r/m8 2/11 SBB r16,r/m16 2/15 SCASB 7+10n !! SCASW 7+10n!! SETALC n/a STC 2 STD 2 STI 2 STOSB 7+4n !! STOSW 7+4n !! SUB AL,imm8 4 SUB AX,imm16 4 SUB r/m8,imm8 4/18 SUB r/m16,imm16 4/26 SUB r/m8,r8 2/15 SUB r/m16,r16 2/24 SUB r8,r/m8 2/11 SUB r16,r/m16 2/15 TEST AL,imm8 4 TEST AX,imm16 4 TEST r/m8,imm8 4/11 TEST r/m16,imm16 4/15 TEST r/m8,r8 2/10 TEST r/m16,r16 2/14 WAIT 2+5n (n = number of times POLL pin sampled) XCHG AX,r16 2 XCHG r/m8,r8 3/16 XCHG r/m16,r16 3/24 XLAT 9 XOR AL,imm8 4 XOR AX,imm16 4 XOR r/m8,imm8 4/18 XOR r/m16,imm16 4/26 XOR r/m8,r8 2/15 XOR r/m16,r16 2/24 XOR r8,r/m8 2/11 XOR r16,r/m16 2/15 (END) ---------------------------------------------------------- APPENDIX Y3 - Vendor Instruction Time for Intel i286 CPU AAA 3 AAD 14 AAD imm8 n/a AAM 16 AAM imm8 n/a AAS 3 ADC AL,imm8 3 ADC AX,imm16 3 ADC r/m8,imm8 3/7+EA ADC r/m16,imm16 3/7+EA ADC r/m8,r8 2/7+EA ADC r/m16,r16 2/7+EA ADC r8,r/m8 2/7+EA ADC r16,r/m16 2/7+EA ADD AL,imm8 3 ADD AX,imm16 3 ADD r/m8,imm8 3/7+EA ADD r/m16,imm16 3/7+EA ADD r/m8,r8 2/7+EA ADD r/m16,r16 2/7+EA ADD r8,r/m8 2/7+EA ADD r16,r/m16 2/7+EA AND AL,imm8 3 AND AX,imm16 3 AND r/m8,imm8 3/7+EA AND r/m16,imm16 3/7+EA AND r/m8,r8 2/7+EA AND r/m16,r16 2/7+EA AND r8,r/m8 2/7+EA AND r16,r/m16 2/7+EA ARPL r/m16,r16 10/11+EA BOUND r16,m16&16 13+EA CALL rel16 7+m CALL r/m16 7+m/11+m CALL ptr16:16 13+m CALL ptr16:16 (PM, direct segment) 26+m CALL ptr16:16 (PM, via call gate, same p 41+m CALL ptr16:16 (PM, via call gate, more p 82+m CALL ptr16:16 (PM, via call gate, more p 86+4*param+m CALL m16:16 16+m CALL m16:16 (PM, direct segment) 29+m CALL m16:16 (PM, via gate, same priveleg44+m CALL m16:16 (PM, via gate, more priveleg83+m CALL m16:16 (PM, via gate, more priveleg90+4*param+m CBW 2 CLC 2 CLD 2 CLI 3 CLTS 2 CMC 2 CMP AL,imm8 3 CMP AX,imm16 3 CMP r/m8,imm8 3/6+ CMP r/m16,imm8 3/6+EA CMP r/m16,imm16 3/6+EA CMP r/m8,r8 2/7+EA CMP r/m16,r16 2/7+EA CMP r8,r/m8 2/6+EA CMP r16,r/m16 2/6+EA CMPSB f CMPSW f CWD 2 DAA 3 DAS 3 DEC r/m8 2/7+EA DEC r/m16 2/7+EA DEC r16 2 DIV r/m8 14/17+EA DIV r/m16 22/25+EA ESC imm4,r/m (9-20)+EA ENTER imm16,0 11 ENTER imm16,1 15 ENTER imm16,imm8 16+4*(n-1) HLT 2 IDIV r/m8 17/20+EA IDIV r/m16 25/28+EA IMUL r/m8 13/16+EA IMUL r/m16 21/24+EA IMUL r16,r/m16 21/24+EA IMUL r16,imm8 ?? IMUL r16,imm16 ?? IMUL r16,r/m16,imm8 21/24+EA IMUL r16,r/m16,imm16 21/24+EA IN AL,imm8 5 IN AL,imm8 (PM, CPL <= IOPL) 5 IN AX,imm8 5 IN AX,imm8 (PM, CPL <= IOPL) 5 IN AL,DX 5 IN AL,DX (PM, CPL <= IOPL) 5 IN AX,DX 5 IN AX,DX (PM, CPL <= IOPL) 5 INC r/m8 2/7+EA INC r/m16 2/7+EA INC r16 2 INSB f INSW f INT 3 23+m INT 3 (PM, same privilege) 40+m INT 3 (PM, more privelege) 78+m INT imm8 23+m INT imm8 (PM, same privilege) 40+m INT imm8 (PM, more privelege) 78+m INTO 24+m or 3 INTO (PM, same privilege) 40+m or 3 INTO (PM, more privelege) 78+m or 3 IRET 17 IRET (PM, to same privilege) 31+m IRET (PM, to lesser privilege) 55+m Jcc rel8 7+m or 3 JCXZ rel8 8+m or 4 JMP rel8 7+m JMP rel16 7+m JMP r/m16 7/11+m JMP ptr16:16 11/23+m JMP ptr16:16 (PM, direct segment) f JMP ptr16:16 (PM, via call gate, same pr38+m JMP m16:16 15/26+m JMP m16:16 (PM, direct segment) f JMP m16:16 (PM, via call gate, same priv41+m LAHF 2 LAR r16,r/m16 14/16+ LDS r16,m16:16 7+/21+ LDS r16,m16:16 (PM) f LDS r32,m16:32 (PM) f LES r16,m16:16 7+/21+ LES r16,m16:16 (PM) f LES r32,m16:32 (PM) f LEA r16,m 3+ LEAVE 5 LGDT m16&32 11+ LIDT m16&32 12+ LLDT r/m16 17/19+ LMSW r/m16 3/6+ LOADALL f LODSB 5+4*n LODSW 5+4*n LOOP rel8 8/4 LOOPE rel8 8/4 LOOPNE rel8 8/4 LSL r16,r/m16 14/16 LTR r/m16 17/19+ MOV r/m8,r8 2/3+ MOV r/m16,r16 2/3+ MOV r8,r/m8 2/5+ MOV r16,r/m16 2/5+ MOV r/m16,sreg 2/3+ MOV sreg,r/m16 2/5+ MOV sreg,r/m16 (PM) 17/19+ MOV AL,moffs8 5 MOV AX,moffs16 5 MOV moffs8,AL 3 MOV moffs16,AX 3 MOV r8,imm8 2 MOV r16,imm16 2 MOV r/m8,imm8 2/3+ MOV r/m16,imm16 2/3+ MOVSB 5+4*n MOVSW 5 MUL r/m8 13/16+ MUL r/m16 21/24+ NEG r/m8 2/7 NEG r/m16 2/7 NOP 3 NOT r/m8 2/7 NOT r/m16 2/7 OR AL,imm8 3 OR AX,imm16 3 OR r/m8,imm8 3/7 OR r/m16,imm16 3/7 OR r/m8,r8 2/7 OR r/m16,r16 2/7 OR r8,r/m8 2/7 OR r16,r/m16 2/7 OUT imm8,AL 3 OUT imm8,AL (PM, CPL <= IOPL) 3 OUT imm8,AX 3 OUT imm8,AX (PM, CPL <= IOPL) 3 OUT DX,AL 3 OUT DX,AL (PM, CPL <= IOPL) 3 OUT DX,AX 3 OUT DX,AX (PM, CPL <= IOPL) 3 OUTSB 5+4*n OUTSW 5 POP m16 5+ POP r16 5 POP sreg 5/20 POP sreg (PM) 20 POPA 19 POPF 5 POPF (PM) 5 PUSH r/m16 5+ PUSH r16 3 PUSH imm8 3 PUSH imm16 3 PUSH sreg 3 PUSHA 17+ PUSHF 3 PUSHF (PM) 3 RCL r/m8,1 2/7 RCL r/m16,1 2/7 RCL r/m8,CL 5/8+n RCL r/m16,CL 5/8+n RCL r/m8,imm8 5/8+n RCL r/m16,imm8 5/8+n RCR r/m8,1 2/7 RCR r/m16,1 2/7 RCR r/m8,CL 5/8+n RCR r/m16,CL 5/8+n RCR r/m8,imm8 5/8+n RCR r/m16,imm8 5/8+n ROL r/m8,1 2/7 ROL r/m16,1 2/7 ROL r/m8,CL 5/8+n ROL r/m16,CL 5/8+n ROL r/m8,imm8 5/8+n ROL r/m16,imm8 5/8+n ROR r/m8,1 2/7 ROR r/m16,1 2/7 ROR r/m8,CL 5/8+n ROR r/m16,CL 5/8+n ROR r/m8,imm8 5/8+n ROR r/m16,imm8 5/8+n RDTSC f RET (near) 11+m RET (far) 15+m RET (PM, far, same PL) 25+m RET (PM, far, different PL) 55+m RET imm16 (near) 11+m RET imm16 (far) 15+m RET imm16 (PM, far, same PL) 25+m RET imm16 (PM, far, different PL) 55+m SAHF 2 SAL r/m8,1 2/7 SAL r/m16,1 2/7 SAL r/m8,CL 5/8+n SAL r/m16,CL 5/8+n SAL r/m8,imm8 5/8+n SAL r/m16,imm8 5/8+n SAR r/m8,1 2/7 SAR r/m16,1 2/7 SAR r/m8,CL 5/8+n SAR r/m16,CL 5/8+n SAR r/m8,imm8 5/8+n SAR r/m16,imm8 5/8+n SHL r/m8,1 2/7 SHL r/m16,1 2/7 SHL r/m8,CL 5/8+n SHL r/m16,CL 5/8+n SHL r/m8,imm8 5/8+n SHL r/m16,imm8 5/8+n SHR r/m8,1 2/7 SHR r/m16,1 2/7 SHR r/m8,CL 5/8+n SHR r/m16,CL 5/8+n SHR r/m8,imm8 5/8+n SHR r/m16,imm8 5/8+n SBB AL,imm8 3 SBB AX,imm16 3 SBB r/m8,imm8 3/7 SBB r/m16,imm16 3/7 SBB r/m8,r8 2/7 SBB r/m16,r16 2/7 SBB r8,r/m8 2/7 SBB r16,r/m16 2/7 SCASB 5+8*n SCASW 5+8*n SETALC f SGDT m16&32 11+ SIDT m16&32 12+ SLDT r/m16 2/3+ SMINT f SMSW r/m16 2/3+ STC 2 STD 2 STI 2 STOSB 4+3*n STOSW 4+3*n STR r/m16 2/3 SUB AL,imm8 3 SUB AX,imm16 3 SUB r/m8,imm8 2/7 SUB r/m16,imm16 2/7 SUB r/m8,r8 2/6 SUB r/m16,r16 2/6 SUB r8,r/m8 2/6 SUB r16,r/m16 2/6 TEST AL,imm8 3 TEST AX,imm16 3 TEST r/m8,imm8 3/6 TEST r/m16,imm16 3/6 TEST r/m8,r8 2/6 TEST r/m16,r16 2/6 VERR r/m16 14/16+ VERW r/m16 14/16+ WAIT 3 XCHG AX,r16 3 XCHG r/m8,r8 3/5+ XCHG r/m16,r16 3/5+ XLAT 5 XOR AL,imm8 3 XOR AX,imm16 3 XOR r/m8,imm8 2/7+ XOR r/m16,imm16 2/7+ XOR r/m8,r8 2/6 XOR r/m16,r16 2/6 XOR r8,r/m8 2/6 XOR r16,r/m16 2/6 (END) ---------------------------------------------------------- APPENDIX Y4 - Vendor Instruction Time for Intel i386DX CPU AAA 4 AAD 19 AAD imm8 n/a AAM 17 AAM imm8 m/a AAS 4 ADC AL,imm8 2 ADC AX,imm16 2 ADC EAX,imm32 2 ADC r/m8,imm8 2/7 ADC r/m16,imm8 2/7 ADC r/m32,imm8 2/7 ADC r/m16,imm16 2/7 ADC r/m32,imm32 2/7 ADC r/m8,r8 2/7 ADC r/m16,r16 2/7 ADC r/m32,r32 2/7 ADC r8,r/m8 2/6 ADC r16,r/m16 2/6 ADC r32,r/m32 2/6 ADD AL,imm8 2 ADD AX,imm16 2 ADD EAX,imm32 2 ADD r/m8,imm8 2/7 ADD r/m16,imm8 2/7 ADD r/m32,imm8 2/7 ADD r/m16,imm16 2/7 ADD r/m32,imm32 2/7 ADD r/m8,r8 2/7 ADD r/m16,r16 2/7 ADD r/m32,r32 2/7 ADD r8,r/m8 2/6 ADD r16,r/m16 2/6 ADD r32,r/m32 2/6 AND AL,imm8 2 AND AX,imm16 2 AND EAX,imm32 2 AND r/m8,imm8 2/7 AND r/m16,imm8 2/7 AND r/m32,imm8 2/7 AND r/m16,imm16 2/7 AND r/m32,imm32 2/7 AND r/m8,r8 2/7 AND r/m16,r16 2/7 AND r/m32,r32 2/7 AND r8,r/m8 2/6 AND r16,r/m16 2/6 AND r32,r/m32 2/6 ARPL r/m16,r16 20/21 BOUND r16,m16&16 10 or 44 BOUND r32,m32&32 10 or 44 BSF r16,r/m16 11+3*n BSF r32,r/m32 11+3*n BSR r16,r/m16 9+3*n BSR r32,r/m32 9+3*n BT r/m16,r16 3/12 BT r/m32,r32 3/12 BT r/m16,imm8 3/6 BT r/m16,imm8 3/6 BTC r/m16,r16 6/13 BTC r/m32,r32 6/13 BTC r/m16,imm8 6/8 BTC r/m16,imm8 6/8 BTR r/m16,r16 6/13 BTR r/m32,r32 6/13 BTR r/m16,imm8 6/8 BTR r/m16,imm8 6/8 BTS r/m16,r16 6/13 BTS r/m32,r32 6/13 BTS r/m16,imm8 6/8 BTS r/m16,imm8 6/8 CALL rel16 7+m CALL r/m16 7+m/10+m CALL ptr16:16 17+m CALL ptr16:16 (PM, direct segment) 34+m CALL ptr16:16 (PM, via call gate, same p52+m CALL ptr16:16 (PM, via call gate, more p86+m CALL ptr16:16 (PM, via call gate, more p94+m+4*x CALL m16:16 22+m CALL m16:16 (PM, direct segment) 38+m CALL m16:16 (PM, via gate, same priveleg56+m CALL m16:16 (PM, via gate, more priveleg90+m CALL m16:16 (PM, via gate, more priveleg98+m+4*x CALL rel32 7+m CALL r/m32 7+m/10+m CALL ptr16:32 17+m CALL ptr16:32 (PM, direct segment) 34+m CALL ptr16:32 (PM, via gate, same privel52+m CALL ptr16:32 (PM, via gate, more privel86+m CALL ptr16:32 (PM, via gate, more privel94+m+4*x CALL m16:32 22+m CALL m16:32 (PM, direct segment) 38+m CALL m16:32 (PM, via gate, same priveleg56+m CALL m16:32 (PM, via gate, more priveleg90+m CALL m16:32 (PM, via gate, more priveleg98+m+4*x CBW 3 CWDE 2 CLC 2 CLD 2 CLI 3 CLTS 5 CMC 2 CMP AL,imm8 2 CMP AX,imm16 2 CMP EAX,imm32 2 CMP r/m8,imm8 2/5 CMP r/m16,imm8 2/5 CMP r/m32,imm8 2/5 CMP r/m16,imm16 2/5 CMP r/m32,imm32 2/5 CMP r/m8,r8 2/5 CMP r/m16,r16 2/5 CMP r/m32,r32 2/5 CMP r8,r/m8 2/6 CMP r16,r/m16 2/6 CMP r32,r/m32 2/6 CMPSB 10 CMPSW 10 CMPSD 10 CWD 2 CDQ 2 DAA 4 DAS 4 DEC r/m8 2/6 DEC r/m16 2/6 DEC r/m32 2/6 DEC r16 2 DEC r32 2 DIV r/m8 14/17 DIV r/m16 22/25 DIV r/m32 38/41 ESC imm4,r/m f ENTER imm16,0 10 ENTER imm16,1 12 ENTER imm16,imm8 15+4*(n-1) HLT 5 IBTS r/m16,AX,CL,r16 12/19 IBTS r/m32,EAX,CL,r32 12/19 IDIV r/m8 19/22 IDIV r/m16 27/30 IDIV r/m32 43/46 IMUL r/m8 12-17/15-20 IMUL r/m16 12-25/15-28 IMUL r/m32 12-41/15-44 IMUL r16,r/m16 12-17/15-20 IMUL r32,r/m32 12-41/15-44 IMUL r16,imm8 12-26/14-27 IMUL r32,imm8 13-42/14-43 IMUL r16,imm16 9/22-12/25 IMUL r32,imm32 9/38-12/41 IMUL r16,r/m16,imm8 9-14/12-17 IMUL r32,r/m32,imm8 9-14/12-17 IMUL r16,r/m16,imm16 9-22/12-25 IMUL r32,r/m32,imm32 9-38/12-41 IN AL,imm8 12 IN AL,imm8 (PM, CPL <= IOPL) 6/26 IN AL,imm8 (VM) 26 IN AX,imm8 12 IN AX,imm8 (PM, CPL <= IOPL) 6/26 IN AX,imm8 (VM) 26 IN EAX,imm8 12 IN EAX,imm8 (PM, CPL <= IOPL) 6/26 IN EAX,imm8 (VM) 26 IN AL,DX 13 IN AL,DX (PM, CPL <= IOPL) 7/27 IN AL,DX (VM) 27 IN AX,DX 13 IN AX,DX (PM, CPL <= IOPL) 7/27 IN AX,DX (VM) 27 IN EAX,DX 13 IN EAX,DX (PM, CPL <= IOPL) 7/27 IN EAX,DX (VM) 27 INC r/m8 2/6 INC r/m16 2/6 INC r/m32 2/6 INC r16 2 INC r32 2 INSB 15 INSW 15 INSD 15 INT 3 33 INT 3 (PM, same privilege) 59 INT 3 (PM, more privelege) 99 INT imm8 37 INT imm8 (PM, same privilege) 59 INT imm8 (PM, more privelege) 99 INTO 3/35 INTO (PM, same privilege) 3/59 INTO (PM, more privelege) 3/99 IRET 22/38 IRET (PM, to same privilege) 22/38 IRET (PM, to lesser privilege) 82 IRETD 22/38 IRETD (PM, to same privilege) 22/38 IRETD (PM, to lesser privilege) 82 Jcc rel8 7+m/3 Jcc rel16 7+m/3 Jcc rel32 7+m/3 JCXZ rel8 9+m/5 JECXZ rel8 9+m/5 JMP rel8 7+m JMP rel16 7+m JMP r/m16 7+m/10+m JMP ptr16:16 12/27+m JMP ptr16:16 (PM, direct segment) 12/27+m JMP ptr16:16 (PM, via call gate, same pr45+m JMP m16:16 43/31+m JMP m16:16 (PM, direct segment) 43/31+m JMP m16:16 (PM, via call gate, same priv49+m JMP rel32 7+m JMP r/m32 (7/10)+m JMP ptr16:32 12/27+m JMP ptr16:32 (PM, direct segment) 12/27+m JMP ptr16:32 (PM, via call gate, same pr45+m JMP m16:32 43/31+m JMP m16:32 (PM, direct segment) 43/31+m JMP m16:32 (PM, via call gate, same priv49+m LAHF 2 LAR r16,r/m16 15/16 LAR r32,r/m32 15/16 LDS r16,m16:16 7/22 LDS r32,m16:32 7/22 LDS r16,m16:16 (PM) 7/22 LDS r32,m16:32 (PM) f LSS r16,m16:16 7/22 LSS r32,m16:32 7/22 LSS r16,m16:16 (PM) 7/22 LSS r32,m16:32 (PM) f LES r16,m16:16 7/22 LES r32,m16:32 7/22 LES r16,m16:16 (PM) 7/22 LES r32,m16:32 (PM) f LFS r16,m16:16 7/25 LFS r32,m16:32 7/25 LFS r16,m16:16 (PM) 7/22 LFS r32,m16:32 (PM) f LGS r16,m16:16 7/25 LGS r32,m16:32 7/25 LGS r16,m16:16 (PM) 7/22 LGS r32,m16:32 (PM) f LEA r16,m 2 LEA r32,m 2 LEAVE 4 LGDT m16&32 11 LIDT m16&32 11 LLDT r/m16 20 LMSW r/m16 10/13 LOADALL f LODSB 5 LODSW 5 LODSD 5 LOOP rel8 11+m LOOPE rel8 11+m LOOPNE rel8 11+m LSL r16,r/m16 20/21 LSL r32,r/m32 20/21 LTR r/m16 23/27 MOV r/m8,r8 2/2 MOV r/m16,r16 2/2 MOV r/m32,r32 2/2 MOV r8,r/m8 2/4 MOV r16,r/m16 2/4 MOV r32,r/m32 2/4 MOV r/m16,sreg 2/2 MOV sreg,r/m16 2/5 18/19 MOV sreg,r/m16 (PM) f MOV AL,moffs8 4 MOV AX,moffs16 4 MOV EAX,moffs32 4 MOV moffs8,AL 2 MOV moffs16,AX 2 MOV moffs32,EAX 2 MOV r8,imm8 2 MOV r16,imm16 2 MOV r32,imm32 2 MOV r/m8,imm8 2/2 MOV r/m16,imm16 2/2 MOV r/m32,imm32 2/2 MOV CR0,r32 10 MOV CR2,r32 4/5 MOV CR3,r32 4/5 MOV CR4,r32 f MOV r32,CRi 6 MOV r32,DR0-DR3 22 MOV r32,DR4-DR5 f MOV r32,DR6-DR7 14 MOV DR0-DR3,r32 22 MOV DR4-DR5,r32 f MOV DR6-DR7,r32 16 MOV r32,TR4-TR7 12 MOV TR4-TR7,r32 12 MOVSB 7 MOVSW 7 MOVSD 7 MOVSX r16,r/m8 3/6 MOVSX r32,r/m8 3/6 MOVSX r32,r/m16 3/6 MOVZX r16,r/m8 3/6 MOVZX r32,r/m8 3/6 MOVZX r32,r/m16 3/6 MUL r/m8 9/14-12/17 MUL r/m16 9/22-12/25 MUL r/m32 9/38-12/41 NEG r/m8 2/6 NEG r/m16 2/6 NEG r/m32 2/6 NOP 3 NOT r/m8 2/6 NOT r/m16 2/6 NOT r/m32 2/6 OR AL,imm8 2 OR AX,imm16 2 OR EAX,imm32 2 OR r/m8,imm8 2/7 OR r/m16,imm8 2/7 OR r/m32,imm8 2/7 OR r/m16,imm16 2/7 OR r/m32,imm32 2/7 OR r/m8,r8 2/7 OR r/m16,r16 2/7 OR r/m32,r32 2/7 OR r8,r/m8 2/6 OR r16,r/m16 2/6 OR r32,r/m32 2/6 OUT imm8,AL 10 OUT imm8,AL (PM, CPL <= IOPL) 4/24 OUT imm8,AL (VM) 4/24 OUT imm8,AX 10 OUT imm8,AX (PM, CPL <= IOPL) 4/24 OUT imm8,AX (VM) 4/24 OUT imm8,EAX 10 OUT imm8,EAX (PM, CPL <= IOPL) 4/24 OUT imm8,EAX (VM) 4/24 OUT DX,AL 11 OUT DX,AL (PM, CPL <= IOPL) 5/25 OUT DX,AL (VM) 5/25 OUT DX,AX 11 OUT DX,AX (PM, CPL <= IOPL) 5/25 OUT DX,AX (VM) 5/25 OUT DX,EAX 11 OUT DX,EAX (PM, CPL <= IOPL) 5/25 OUT DX,EAX (VM) 5/25 OUTSB 14 OUTSW 14 OUTSD 14 POP m16 5 POP m32 5 POP r16 4 POP r32 4 POP sreg 7/21 POP sreg (PM) 7/21 POPA 24 POPAD 24 POPF 5 POPF (PM) 5 POPF (VM) ?? POPFD 5 POPFD (PM) 5 POPFD (VM) ?? PUSH r/m16 5 PUSH r/m32 5 PUSH r16 2 PUSH r32 2 PUSH imm8 2 PUSH imm16 2 PUSH imm32 2 PUSH sreg 2 PUSHA 18 PUSHAD 18 PUSHF 4 PUSHF (PM) 4 PUSHF (VM) 4 ?? PUSHFD 4 PUSHFD (PM) 4 PUSHFD (VM) 4 ?? RCL r/m8,1 9/10 RCL r/m16,1 9/10 RCL r/m32,1 9/10 RCL r/m8,CL 9/10 RCL r/m16,CL 9/10 RCL r/m32,CL 9/10 RCL r/m8,imm8 9/10 RCL r/m16,imm8 9/10 RCL r/m32,imm8 9/10 RCR r/m8,1 9/10 RCR r/m16,1 9/10 RCR r/m32,1 9/10 RCR r/m8,CL 9/10 RCR r/m16,CL 9/10 RCR r/m32,CL 9/10 RCR r/m8,imm8 9/10 RCR r/m16,imm8 9/10 RCR r/m32,imm8 9/10 ROL r/m8,1 3/7 ROL r/m16,1 3/7 ROL r/m32,1 3/7 ROL r/m8,CL 3/7 ROL r/m16,CL 3/7 ROL r/m32,CL 3/7 ROL r/m8,imm8 3/7 ROL r/m16,imm8 3/7 ROL r/m32,imm8 3/7 ROR r/m8,1 3/7 ROR r/m16,1 3/7 ROR r/m32,1 3/7 ROR r/m8,CL 3/7 ROR r/m16,CL 3/7 ROR r/m32,CL 3/7 ROR r/m8,imm8 3/7 ROR r/m16,imm8 3/7 ROR r/m32,imm8 3/7 RDTSC f RET (near) 10+m RET (far) 18+m RET (PM, far, same PL) 32+m RET (PM, far, different PL) 68 RET imm16 (near) 10+m RET imm16 (far) 18+m RET imm16 (PM, far, same PL) 32+m RET imm16 (PM, far, different PL) 68 SAHF 3 SAL r/m8,1 3/7 SAL r/m16,1 3/7 SAL r/m32,1 3/7 SAL r/m8,CL 3/7 SAL r/m16,CL 3/7 SAL r/m32,CL 3/7 SAL r/m8,imm8 3/7 SAL r/m16,imm8 3/7 SAL r/m32,imm8 3/7 SAR r/m8,1 3/7 SAR r/m16,1 3/7 SAR r/m32,1 3/7 SAR r/m8,CL 3/7 SAR r/m16,CL 3/7 SAR r/m32,CL 3/7 SAR r/m8,imm8 3/7 SAR r/m16,imm8 3/7 SAR r/m32,imm8 3/7 SHL r/m8,1 3/7 SHL r/m16,1 3/7 SHL r/m32,1 3/7 SHL r/m8,CL 3/7 SHL r/m16,CL 3/7 SHL r/m32,CL 3/7 SHL r/m8,imm8 3/7 SHL r/m16,imm8 3/7 SHL r/m32,imm8 3/7 SHR r/m8,1 3/7 SHR r/m16,1 3/7 SHR r/m32,1 3/7 SHR r/m8,CL 3/7 SHR r/m16,CL 3/7 SHR r/m32,CL 3/7 SHR r/m8,imm8 3/7 SHR r/m16,imm8 37/ SHR r/m32,imm8 3/7 SBB AL,imm8 2 SBB AX,imm16 2 SBB EAX,imm32 2 SBB r/m8,imm8 2/7 SBB r/m16,imm8 2/7 SBB r/m32,imm8 2/7 SBB r/m16,imm16 2/7 SBB r/m32,imm32 2/7 SBB r/m8,r8 2/7 SBB r/m16,r16 2/7 SBB r/m32,r32 2/7 SBB r8,r/m8 2/6 SBB r16,r/m16 2/6 SBB r32,r/m32 2/6 SCASB 7 SCASW 7 SCASD 7 SETALC f SETcc r/m8 4/5 SGDT m16&32 9 SIDT m16&32 9 SHLD r/m16,r16,imm8 3/7 SHLD r/m32,r32,imm8 3/7 SHLD r/m16,r16,CL 3/7 SHLD r/m32,r32,CL 3/7 SHRD r/m16,r16,imm8 3/7 SHRD r/m32,r32,imm8 3/7 SHRD r/m16,r16,CL 3/7 SHRD r/m32,r32,CL 3/7 SLDT r/m16 2/2 SLDT r/m32 f SMINT f SMSW r/m16 2/3 2/2 STC 2 STD 2 STI 2 STOSB 4 STOSW 4 STOSD 4 STR r/m16 23/27 SUB AL,imm8 2/8 SUB AX,imm16 2/7 SUB EAX,imm32 2/7 SUB r/m8,imm8 2/7 SUB r/m16,imm8 2/7 SUB r/m32,imm8 2/7 SUB r/m16,imm16 2/7 SUB r/m32,imm32 2/7 SUB r/m8,r8 2/7 SUB r/m16,r16 2/7 SUB r/m32,r32 2/7 SUB r8,r/m8 2/6 SUB r16,r/m16 2/6 SUB r32,r/m32 2/6 TEST AL,imm8 2 TEST AX,imm16 2 TEST EAX,imm32 2 TEST r/m8,imm8 2/5 TEST r/m16,imm16 2/5 TEST r/m32,imm32 2/5 TEST r/m8,r8 2/5 TEST r/m16,r16 2/5 TEST r/m32,r32 2/5 UMOV r8,r/m8 f UMOV r16,r/m16 f UMOV r32,r/m32 f UMOV r/m8,r8 f UMOV r/m16,r16 f UMOV r/m32,r32 f VERR r/m16 10/11 VERW r/m16 15/16 WAIT 6min XBTS r16,r/m16,AX,CL 6/13 XBTS r32,r/m32,EAX,CL 6/13 XCHG AX,r16 3 XCHG EAX,r32 3 XCHG r/m8,r8 3/5 XCHG r/m16,r16 3/5 XCHG r/m32,r32 3/5 XLAT 5 XOR AL,imm8 2 XOR AX,imm16 2 XOR EAX,imm32 2 XOR r/m8,imm8 2 XOR r/m16,imm8 2/7 XOR r/m32,imm8 2/7 XOR r/m16,imm16 2/7 XOR r/m32,imm32 2/7 XOR r/m8,r8 2/7 XOR r/m16,r16 2/7 XOR r/m32,r32 2/7 XOR r8,r/m8 2/6 XOR r16,r/m16 2/6 XOR r32,r/m32 2/6 (END) ---------------------------------------------------------- APPENDIX Y5 - Vendor Instruction Time for Intel i486DX CPU AAA 3 AAD 14 AAD imm8 n/a AAM 15 AAM imm8 n/a AAS 3 ADC AL,imm8 1 ADC AX,imm16 1 ADC EAX,imm32 1 ADC r/m8,imm8 1/3 ADC r/m16,imm8 1/3 ADC r/m32,imm8 1/3 ADC r/m16,imm16 1/3 ADC r/m32,imm32 f ADC r/m8,r8 1/3 ADC r/m16,r16 1/3 ADC r/m32,r32 f ADC r8,r/m8 1/2 ADC r16,r/m16 1/2 ADC r32,r/m32 1/2 ADD AL,imm8 1 ADD AX,imm16 1 ADD EAX,imm32 1 ADD r/m8,imm8 1/3 ADD r/m16,imm8 1/3 ADD r/m32,imm8 1/3 ADD r/m16,imm16 1/3 ADD r/m32,imm32 1/3 ADD r/m8,r8 1/3 ADD r/m16,r16 1/3 ADD r/m32,r32 1/3 ADD r8,r/m8 1/2 ADD r16,r/m16 1/2 ADD r32,r/m32 1/2 AND AL,imm8 1 AND AX,imm16 1 AND EAX,imm32 1 AND r/m8,imm8 1/3 AND r/m16,imm8 1/3 AND r/m32,imm8 1/3 AND r/m16,imm16 1/3 AND r/m32,imm32 1/3 AND r/m8,r8 1/3 AND r/m16,r16 1/3 AND r/m32,r32 1/3 AND r8,r/m8 1/2 AND r16,r/m16 1/2 AND r32,r/m32 1/2 ARPL r/m16,r16 9/9 BOUND r16,m16&16 7 BOUND r32,m32&32 7 BSF r16,r/m16 6-42/7-43 BSF r32,r/m32 6-42/7-43 BSR r16,r/m16 6-103/7-104 BSR r32,r/m32 6-103/7-104 BSWAP r32 1 BT r/m16,r16 3/8 BT r/m32,r32 3/8 BT r/m16,imm8 3/3 BT r/m16,imm8 3/3 BTC r/m16,r16 6/13 BTC r/m32,r32 6/13 BTC r/m16,imm8 6/8 BTC r/m16,imm8 6/8 BTR r/m16,r16 6/13 BTR r/m32,r32 6/13 BTR r/m16,imm8 6/8 BTR r/m16,imm8 6/8 BTS r/m16,r16 6/13 BTS r/m32,r32 6/13 BTS r/m16,imm8 6/8 BTS r/m16,imm8 6/8 CALL rel16 3 CALL r/m16 5/5 CALL ptr16:16 18 CALL ptr16:16 (PM, direct segment) 20 CALL ptr16:16 (PM, via call gate, same p35 CALL ptr16:16 (PM, via call gate, more p69 CALL ptr16:16 (PM, via call gate, more p77+4*p CALL m16:16 17 CALL m16:16 (PM, direct segment) 20 CALL m16:16 (PM, via gate, same priveleg35 CALL m16:16 (PM, via gate, more priveleg69 CALL m16:16 (PM, via gate, more priveleg77+4*p CALL rel32 3 CALL r/m32 5/5 CALL ptr16:32 18 CALL ptr16:32 (PM, direct segment) 20 CALL ptr16:32 (PM, via gate, same privel35 CALL ptr16:32 (PM, via gate, more privel69 CALL ptr16:32 (PM, via gate, more privel77+4*p CALL m16:32 17 CALL m16:32 (PM, direct segment) 20 CALL m16:32 (PM, via gate, same priveleg35 CALL m16:32 (PM, via gate, more priveleg69 CALL m16:32 (PM, via gate, more priveleg77+4*p CBW 3 CWDE 3 CLC 2 CLD 2 CLI 5 CLTS 7 CMC 2 CMOVcc r16,r/m16 f CMOVcc r32,r/m32 f CMP AL,imm8 1 CMP AX,imm16 1 CMP EAX,imm32 1 CMP r/m8,imm8 1/2 CMP r/m16,imm8 1/2 CMP r/m32,imm8 1/2 CMP r/m16,imm16 1/2 CMP r/m32,imm32 1/2 CMP r/m8,r8 1/2 CMP r/m16,r16 1/2 CMP r/m32,r32 1/2 CMP r8,r/m8 1/3 CMP r16,r/m16 1/3 CMP r32,r/m32 1/3 CMPSB 8 CMPSW 8 CMPSD 8 CMPXCHG r/m8,r8 6/7 6/10 CMPXCHG r/m16,r16 6/7 6/10 CMPXCHG r/m32,r32 6/7 6/10 CPUID (SL Enhanced only) CWD 3 CDQ 3 DAA 2 DAS 2 DEC r/m8 1/3 DEC r/m16 1/3 DEC r/m32 1/3 DEC r16 1 DEC r32 1 DIV r/m8 16/16 DIV r/m16 24/24 DIV r/m32 40/40 ESC imm4,r/m f ENTER imm16,0 14 ENTER imm16,1 17 ENTER imm16,imm8 17+3*n HLT 4 IDIV r/m8 19/20 IDIV r/m16 27/28 IDIV r/m32 43/44 IMUL r/m8 13-18/13-18 IMUL r/m16 13-26/13-26 IMUL r/m32 12-42/13-42 IMUL r16,r/m16 13-26/13-26 IMUL r32,r/m32 13-42/13-42 IMUL r16,imm8 13-26 IMUL r32,imm8 13-26 IMUL r16,imm16 13-26/13-26 IMUL r32,imm32 13-42/13-42 IMUL r16,r/m16,imm8 13-26/13-26 IMUL r32,r/m32,imm8 13-42/13-42 IMUL r16,r/m16,imm16 13-26/13-26 IMUL r32,r/m32,imm32 13-42/13-42 IN AL,imm8 14 IN AL,imm8 (PM, CPL <= IOPL) 8/28 IN AL,imm8 (VM) 27 IN AX,imm8 14 IN AX,imm8 (PM, CPL <= IOPL) 8/28 IN AX,imm8 (VM) 27 IN EAX,imm8 14 IN EAX,imm8 (PM, CPL <= IOPL) 8/28 IN EAX,imm8 (VM) 27 IN AL,DX 14 IN AL,DX (PM, CPL <= IOPL) 8/28 IN AL,DX (VM) 27 IN AX,DX 14 IN AX,DX (PM, CPL <= IOPL) 8/28 IN AX,DX (VM) 2 IN EAX,DX 14 IN EAX,DX (PM, CPL <= IOPL) 8/28 IN EAX,DX (VM) 27 INC r/m8 1/3 INC r/m16 1/3 INC r/m32 1/3 INC r16 1 INC r32 1 INSB 17 INSW 17 INSD 17 INT 3 26 INT 3 (PM, same privilege) 44 INT 3 (PM, more privelege) 71 INT imm8 30 INT imm8 (PM, same privilege) 44 INT imm8 (PM, more privelege) 71 INTO 3/28 INTO (PM, same privilege) 3/46 INTO (PM, more privelege) 3/73 INVD 4 INVLPG m 12 IRET 15 IRET (PM, to same privilege) 15 IRET (PM, to lesser privilege) 36 IRETD 15 IRETD (PM, to same privilege) 15 IRETD (PM, to lesser privilege) 36 Jcc rel8 3/1 Jcc rel16 3/1 Jcc rel32 3/1 JCXZ rel8 8/5 JECXZ rel8 8/5 JMP rel8 3 JMP rel16 3 JMP r/m16 5/5 JMP ptr16:16 17/19 JMP ptr16:16 (PM, direct segment) 17/19 JMP ptr16:16 (PM, via call gate, same pr32 JMP m16:16 13/18 JMP m16:16 (PM, direct segment) 13/18 JMP m16:16 (PM, via call gate, same priv31 JMP rel32 3 JMP r/m32 5/5 JMP ptr16:32 13/18 JMP ptr16:32 (PM, direct segment) 13/18 JMP ptr16:32 (PM, via call gate, same pr31 JMP m16:32 13/18 JMP m16:32 (PM, direct segment) 13/18 JMP m16:32 (PM, via call gate, same priv31 LAHF 3 LAR r16,r/m16 11/11 LAR r32,r/m32 11/11 LDS r16,m16:16 6/12p LDS r32,m16:32 6/12p LDS r16,m16:16 (PM) f LDS r32,m16:32 (PM) f LSS r16,m16:16 7/22p LSS r32,m16:32 7/22p LSS r16,m16:16 (PM) f LSS r32,m16:32 (PM) f LES r16,m16:16 7/22p LES r32,m16:32 7/22p LES r16,m16:16 (PM) f LES r32,m16:32 (PM) f LFS r16,m16:16 6/12p LFS r32,m16:32 6/12p LFS r16,m16:16 (PM) f LFS r32,m16:32 (PM) f LGS r16,m16:16 6/12p LGS r32,m16:32 6/12p LGS r16,m16:16 (PM) f LGS r32,m16:32 (PM) f LEA r16,m 1 LEA r32,m 1 LEAVE 5 LGDT m16&32 11 LIDT m16&32 11 LLDT r/m16 11/11 LMSW r/m16 13/13 LOADALL f LODSB 5 LODSW 5 LODSD 5 LOOP rel8 2,6 LOOPE rel8 9,6 LOOPNE rel8 9,6 LSL r16,r/m16 10/10 LSL r32,r/m32 10/10 LTR r/m16 20/20 MOV r/m8,r8 1 MOV r/m16,r16 1 MOV r/m32,r32 1 MOV r8,r/m8 1 MOV r16,r/m16 1 MOV r32,r/m32 1 MOV r/m16,sreg 3/3 MOV sreg,r/m16 3/9 MOV sreg,r/m16 (PM) f MOV AL,moffs8 1 MOV AX,moffs16 1 MOV EAX,moffs32 1 MOV moffs8,AL 1 MOV moffs16,AX 1 MOV moffs32,EAX 1 MOV r8,imm8 1 MOV r16,imm16 1 MOV r32,imm32 1 MOV r/m8,imm8 1 MOV r/m16,imm16 1 MOV r/m32,imm32 1 MOV CR0,r32 16 MOV CR2,r32 4 MOV CR3,r32 4 MOV CR4,r32 (SL Enhanced only) MOV r32,CRi 4 MOV r32,DR0-DR3 10 MOV r32,DR4-DR5 9 (alias to DR6-DR7) MOV r32,DR6-DR7 10 MOV DR0-DR3,r32 11 MOV DR4-DR5,r32 10 (alias to DR6-DR7) MOV DR6-DR7,r32 11 MOV r32,TR4-TR7 4 MOV r32,TR3 4 MOV TR3,r32 6 MOV TR4-TR7,r32 f MOVSB 7 MOVSW 7 MOVSD 7 MOVSX r16,r/m8 3/3 MOVSX r32,r/m8 3/3 MOVSX r32,r/m16 3/3 MOVZX r16,r/m8 3/3 MOVZX r32,r/m8 3/3 MOVZX r32,r/m16 3/3 MUL r/m8 13-18/ MUL r/m16 13-26/ MUL r/m32 13-42/ NEG r/m8 1/3 NEG r/m16 1/3 NEG r/m32 1/3 NOP 1 NOT r/m8 1/3 NOT r/m16 1/3 NOT r/m32 1/3 OR AL,imm8 1 OR AX,imm16 1 OR EAX,imm32 1 OR r/m8,imm8 1/3 OR r/m16,imm8 1/3 OR r/m32,imm8 1/3 OR r/m16,imm16 1/3 OR r/m32,imm32 1/3 OR r/m8,r8 1/3 OR r/m16,r16 1/3 OR r/m32,r32 1/3 OR r8,r/m8 1/2 OR r16,r/m16 1/2 OR r32,r/m32 1/2 OUT imm8,AL 16 OUT imm8,AL (PM, CPL <= IOPL) 11/31 OUT imm8,AL (VM) 25 OUT imm8,AX 16 OUT imm8,AX (PM, CPL <= IOPL) 11/31 OUT imm8,AX (VM) 25 OUT imm8,EAX 16 OUT imm8,EAX (PM, CPL <= IOPL) 11/31 OUT imm8,EAX (VM) 25 OUT DX,AL 16 OUT DX,AL (PM, CPL <= IOPL) 11/31 OUT DX,AL (VM) 25 OUT DX,AX 16 OUT DX,AX (PM, CPL <= IOPL) 11/31 OUT DX,AX (VM) 25 OUT DX,EAX 16 OUT DX,EAX (PM, CPL <= IOPL) 11/31 OUT DX,EAX (VM) 25 OUTSB 17 OUTSW 10/32 OUTSD 30 POP m16 6 POP m32 6 POP r16 4 POP r32 4 POP sreg 3 POP sreg (PM) f POPA 9 POPAD 9 POPF 9/6p POPF (PM) 6 POPF (VM) 9 POPFD 9/6p POPFD (PM) 6 POPFD (VM) 9 PUSH r/m16 4 PUSH r/m32 4 PUSH r16 1 PUSH r32 1 PUSH imm8 1 PUSH imm16 1 PUSH imm32 1 PUSH sreg 3 PUSHA 11 PUSHAD 11 PUSHF 4/3p PUSHF (PM) 3 PUSHF (VM) 4 PUSHFD 4/3p PUSHFD (PM) 3 PUSHFD (VM) 4 RCL r/m8,1 3/4 RCL r/m16,1 3/4 RCL r/m32,1 3/4 RCL r/m8,CL 8-30/9-31 RCL r/m16,CL 8-30/9-31 RCL r/m32,CL 8-30/9-31 RCL r/m8,imm8 8-30/9-31 RCL r/m16,imm8 8-30/9-31 RCL r/m32,imm8 8-30/9-31 RCR r/m8,1 3/4 RCR r/m16,1 3/4 RCR r/m32,1 3/4 RCR r/m8,CL 8-30/9-31 RCR r/m16,CL 8-30/9-31 RCR r/m32,CL 8-30/9-31 RCR r/m8,imm8 8-30/9-31 RCR r/m16,imm8 8-30/9-31 RCR r/m32,imm8 8-30/9-31 ROL r/m8,1 3/4 ROL r/m16,1 3/4 ROL r/m32,1 3/4 ROL r/m8,CL 3/4 ROL r/m16,CL 3/4 ROL r/m32,CL 3/4 ROL r/m8,imm8 2/4 ROL r/m16,imm8 2/4 ROL r/m32,imm8 2/4 ROR r/m8,1 3/4 ROR r/m16,1 3/4 ROR r/m32,1 3/4 ROR r/m8,CL 3/4 ROR r/m16,CL 3/4 ROR r/m32,CL 3/4 ROR r/m8,imm8 2/4 ROR r/m16,imm8 2/4 ROR r/m32,imm8 2/4 RET (near) 5 RET (far) 13 RET (PM, far, same PL) 18 RET (PM, far, different PL) 33 RET imm16 (near) 5 RET imm16 (far) 14 RET imm16 (PM, far, same PL) f RET imm16 (PM, far, different PL) f SAHF 2 SAL r/m8,1 3/4 SAL r/m16,1 3/4 SAL r/m32,1 3/4 SAL r/m8,CL 3/4 SAL r/m16,CL 3/4 SAL r/m32,CL 3/4 SAL r/m8,imm8 2/4 SAL r/m16,imm8 2/4 SAL r/m32,imm8 2/4 SAR r/m8,1 3/4 SAR r/m16,1 3/4 SAR r/m32,1 3/4 SAR r/m8,CL 3/4 SAR r/m16,CL 3/4 SAR r/m32,CL 3/4 SAR r/m8,imm8 2/4 SAR r/m16,imm8 2/4 SAR r/m32,imm8 2/4 SHL r/m8,1 3/4 SHL r/m16,1 3/4 SHL r/m32,1 3/4 SHL r/m8,CL 3/4 SHL r/m16,CL 3/4 SHL r/m32,CL 3/4 SHL r/m8,imm8 2/4 SHL r/m16,imm8 2/4 SHL r/m32,imm8 2/4 SHR r/m8,1 3/4 SHR r/m16,1 3/4 SHR r/m32,1 3/4 SHR r/m8,CL 3/4 SHR r/m16,CL 3/4 SHR r/m32,CL 3/4 SHR r/m8,imm8 2/4 SHR r/m16,imm8 2/4 SHR r/m32,imm8 2/4 SBB AL,imm8 1 SBB AX,imm16 1 SBB EAX,imm32 1 SBB r/m8,imm8 1/3 SBB r/m16,imm8 1/3 SBB r/m32,imm8 1/3 SBB r/m16,imm16 1/3 SBB r/m32,imm32 1/3 SBB r/m8,r8 1/3 SBB r/m16,r16 1/3 SBB r/m32,r32 1/3 SBB r8,r/m8 1/2 SBB r16,r/m16 1/2 SBB r32,r/m32 1/2 SCASB 6 SCASW 6 SCASD 6 SETALC f SETcc r/m8 4/3 SGDT m16&32 10 SIDT m16&32 10 SHLD r/m16,r16,imm8 2/3 SHLD r/m32,r32,imm8 2/3 SHLD r/m16,r16,CL 3/4 SHLD r/m32,r32,CL 3/4 SHRD r/m16,r16,imm8 2/3 SHRD r/m32,r32,imm8 2/3 SHRD r/m16,r16,CL 3/4 SHRD r/m32,r32,CL 3/4 SLDT r/m16 2/3 SLDT r/m32 2/3 SMINT f SMSW r/m16 2/3 STC 2 STD 2 STI 5 STOSB 5 STOSW 5 STOSD 5 STR r/m16 2/3 SUB AL,imm8 1 SUB AX,imm16 1 SUB EAX,imm32 1 SUB r/m8,imm8 1/3 SUB r/m16,imm8 1/3 SUB r/m32,imm8 1/3 SUB r/m16,imm16 1/3 SUB r/m32,imm32 1/3 SUB r/m8,r8 1/3 SUB r/m16,r16 1/3 SUB r/m32,r32 1/3 SUB r8,r/m8 1/2 SUB r16,r/m16 1/2 SUB r32,r/m32 1/2 TEST AL,imm8 1 TEST AX,imm16 1 TEST EAX,imm32 1 TEST r/m8,imm8 1/2 TEST r/m16,imm16 1/2 TEST r/m32,imm32 1/2 TEST r/m8,r8 1/2 TEST r/m16,r16 1/2 TEST r/m32,r32 1/2 UMOV r8,r/m8 ?? UMOV r16,r/m16 ?? UMOV r32,r/m32 ?? UMOV r/m8,r8 ?? UMOV r/m16,r16 ?? UMOV r/m32,r32 ?? VERR r/m16 11/11 VERW r/m16 11/11 WAIT 1-3 WBINVD 5 XADD r/m8,r8 3/4 XADD r/m16,r16 3/4 XADD r/m32,r32 3/4 XCHG AX,r16 3 XCHG EAX,r32 3 XCHG r/m8,r8 3/5 XCHG r/m16,r16 3/5 XCHG r/m32,r32 3/5 XLAT 4 XOR AL,imm8 1 XOR AX,imm16 1 XOR EAX,imm32 1 XOR r/m8,imm8 1/3 XOR r/m16,imm8 1/3 XOR r/m32,imm8 1/3 XOR r/m16,imm16 1/3 XOR r/m32,imm32 1/3 XOR r/m8,r8 1/3 XOR r/m16,r16 1/3 XOR r/m32,r32 1/3 XOR r8,r/m8 1/2 XOR r16,r/m16 1/2 XOR r32,r/m32 1/2 (END) ---------------------------------------------------------- APPENDIX Y6 - Vendor Instruction Time for Cyrix Cx486DX CPU AAA 4 AAD 4 AAD imm8 4 AAM 16 AAM imm8 16 AAS 4 ADC AL,imm8 1 ADC AX,imm16 1 ADC EAX,imm32 1 ADC r/m8,imm8 1/3 ADC r/m16,imm8 1/3 ADC r/m32,imm8 1/3 ADC r/m16,imm16 1/3 ADC r/m32,imm32 1/3 ADC r/m8,r8 1/3 ADC r/m16,r16 1/3 ADC r/m32,r32 1/3 ADC r8,r/m8 1/3 ADC r16,r/m16 1/3 ADC r32,r/m32 1/3 ADD AL,imm8 1 ADD AX,imm16 1 ADD EAX,imm32 1 ADD r/m8,imm8 1/3 ADD r/m16,imm8 1/3 ADD r/m32,imm8 1/3 ADD r/m16,imm16 1/3 ADD r/m32,imm32 1/3 ADD r/m8,r8 1/3 ADD r/m16,r16 1/3 ADD r/m32,r32 1/3 ADD r8,r/m8 1/3 ADD r16,r/m16 1/3 ADD r32,r/m32 1/3 AND AL,imm8 1 AND AX,imm16 1 AND EAX,imm32 1 AND r/m8,imm8 1/3 AND r/m16,imm8 1/3 AND r/m32,imm8 1/3 AND r/m16,imm16 1/3 AND r/m32,imm32 1/3 AND r/m8,r8 1/3 AND r/m16,r16 1/3 AND r/m32,r32 1/3 AND r8,r/m8 1/3 AND r16,r/m16 1/3 AND r32,r/m32 1/3 ARPL r/m16,r16 6/10 BOUND r16,m16&16 11 or 11+int BOUND r32,m32&32 11 or 11+int BSF r16,r/m16 5+n/7+n BSF r32,r/m32 5+n/7+n BSR r16,r/m16 5+n/7+n BSR r32,r/m32 5+n/7+n BSWAP r32 4 BT r/m16,r16 3/6 BT r/m32,r32 3/6 BT r/m16,imm8 3/4 BT r/m16,imm8 3/4 BTC r/m16,r16 5/8 BTC r/m32,r32 5/8 BTC r/m16,imm8 4/5 BTC r/m16,imm8 4/5 BTR r/m16,r16 5/8 BTR r/m32,r32 5/8 BTR r/m16,imm8 4/5 BTR r/m16,imm8 4/5 BTS r/m16,r16 4/7 BTS r/m32,r32 4/7 BTS r/m16,imm8 3/5 BTS r/m16,imm8 3/5 CALL rel16 7 CALL r/m16 8/9 CALL ptr16:16 12 CALL ptr16:16 (PM, direct segment) 30 CALL ptr16:16 (PM, via call gate, same p41 CALL ptr16:16 (PM, via call gate, more p83 CALL ptr16:16 (PM, via call gate, more p81+4*param CALL m16:16 14 CALL m16:16 (PM, direct segment) 14 CALL m16:16 (PM, via gate, same priveleg43 CALL m16:16 (PM, via gate, more priveleg85 CALL m16:16 (PM, via gate, more priveleg86+4*param CALL rel32 7 CALL r/m32 8/9 CALL ptr16:32 12 CALL ptr16:32 (PM, direct segment) 30 CALL ptr16:32 (PM, via gate, same privel41 CALL ptr16:32 (PM, via gate, more privel83 CALL ptr16:32 (PM, via gate, more privel81+4*param CALL m16:32 14 CALL m16:32 (PM, direct segment) 14 CALL m16:32 (PM, via gate, same priveleg43 CALL m16:32 (PM, via gate, more priveleg85 CALL m16:32 (PM, via gate, more priveleg86+4*param CBW 3 CWDE 3 CLC 1 CLD 1 CLI 7 CLTS 5 CMC 1 CMP AL,imm8 1 CMP AX,imm16 1 CMP EAX,imm32 1 CMP r/m8,imm8 1/3 CMP r/m16,imm8 1/3 CMP r/m32,imm8 1/3 CMP r/m16,imm16 1/3 CMP r/m32,imm32 1/3 CMP r/m8,r8 1/3 CMP r/m16,r16 1/3 CMP r/m32,r32 1/3 CMP r8,r/m8 1/3 CMP r16,r/m16 1/3 CMP r32,r/m32 1/3 CMPSB 7 CMPSW 7 CMPSD 7 CMPXCHG r/m8,r8 5/7 CMPXCHG r/m16,r16 5/7 CMPXCHG r/m32,r32 5/7 CWD 1 CDQ 1 DAA 4 DAS 4 DEC r/m8 1/3 DEC r/m16 1/3 DEC r/m32 1/3 DEC r16 1 DEC r32 1 DIV r/m8 14/15 DIV r/m16 22/23 DIV r/m32 38/39 ESC imm4,r/m n/a ENTER imm16,0 7 ENTER imm16,1 10 ENTER imm16,imm8 6+4*level HLT 3 IDIV r/m8 19/20 IDIV r/m16 27/28 IDIV r/m32 43/44 IMUL r/m8 3/5 IMUL r/m16 3/5 IMUL r/m32 7/9 IMUL r16,r/m16 3/5 IMUL r32,r/m32 7/9 IMUL r16,imm8 3/5 IMUL r32,imm8 7/9 IMUL r16,imm16 3/5 IMUL r32,imm32 7/9 IMUL r16,r/m16,imm8 3/5 IMUL r32,r/m32,imm8 7/9 IMUL r16,r/m16,imm16 3/5 IMUL r32,r/m32,imm32 7/9 IN AL,imm8 16 IN AL,imm8 (PM, CPL <= IOPL) 6 IN AL,imm8 (VM) 19 IN AX,imm8 16 IN AX,imm8 (PM, CPL <= IOPL) 6 IN AX,imm8 (VM) 19 IN EAX,imm8 16 IN EAX,imm8 (PM, CPL <= IOPL) 6 IN EAX,imm8 (VM) 19 IN AL,DX 16 IN AL,DX (PM, CPL <= IOPL) 6 IN AL,DX (VM) 19 IN AX,DX 16 IN AX,DX (PM, CPL <= IOPL) 6 IN AX,DX (VM) 19 IN EAX,DX 16 IN EAX,DX (PM, CPL <= IOPL) 6 IN EAX,DX (VM) 19 INC r/m8 1/3 INC r/m16 1/3 INC r/m32 1/3 INC r16 1 INC r32 1 INSB 20 INSW 20 INSD 20 INT 3 14 INT 3 (PM, same privilege) 49 INT 3 (PM, more privelege) 77 INT imm8 14 INT imm8 (PM, same privilege) 49 INT imm8 (PM, more privelege) 77 INTO 1 or 15 INTO (PM, same privilege) 1 or 49 INTO (PM, more privelege) 1 or 77 INVD 4 INVLPG m 4 IRET 14 IRET (PM, to same privilege) 31 IRET (PM, to lesser privilege) 66 IRETD 14 IRETD (PM, to same privilege) 31 IRETD (PM, to lesser privilege) 66 Jcc rel8 1 or 4 Jcc rel16 1 or 4 Jcc rel32 1 or 4 JCXZ rel8 3 or 7 JECXZ rel8 3 or 7 JMP rel8 4 JMP rel16 4 JMP r/m16 6/8 JMP ptr16:16 9 JMP ptr16:16 (PM, direct segment) 26 JMP ptr16:16 (PM, via call gate, same pr37 JMP m16:16 11 JMP m16:16 (PM, direct segment) 30 JMP m16:16 (PM, via call gate, same priv39 JMP rel32 4 JMP r/m32 6/8 JMP ptr16:32 9 JMP ptr16:32 (PM, direct segment) 26 JMP ptr16:32 (PM, via call gate, same pr37 JMP m16:32 11 JMP m16:32 (PM, direct segment) 30 JMP m16:32 (PM, via call gate, same priv39 LAHF 2 LAR r16,r/m16 11/12 LAR r32,r/m32 11/12 LDS r16,m16:16 6 LDS r32,m16:32 6 LDS r16,m16:16 (PM) 19 LDS r32,m16:32 (PM) 19 LSS r16,m16:16 6 LSS r32,m16:32 6 LSS r16,m16:16 (PM) 19 LSS r32,m16:32 (PM) 19 LES r16,m16:16 6 LES r32,m16:32 6 LES r16,m16:16 (PM) 19 LES r32,m16:32 (PM) 19 LFS r16,m16:16 6 LFS r32,m16:32 6 LFS r16,m16:16 (PM) 19 LFS r32,m16:32 (PM) 19 LGS r16,m16:16 6 LGS r32,m16:32 6 LGS r16,m16:16 (PM) 19 LGS r32,m16:32 (PM) 19 LEA r16,m 2 (w/o index)/3(with index) LEA r32,m 2 (w/o index)/3(with index) LEAVE 3 LGDT m16&32 9 LIDT m16&32 9 LLDT r/m16 16/17 LMSW r/m16 5 LODSB 4 LODSW 4 LODSD 4 LOOP rel8 3 or 7 LOOPE rel8 3 or 7 LOOPNE rel8 3 or 7 LSL r16,r/m16 14/15 LSL r32,r/m32 14/15 LTR r/m16 16/17 MOV r/m8,r8 1/2 MOV r/m16,r16 1/2 MOV r/m32,r32 1/2 MOV r8,r/m8 1/2 MOV r16,r/m16 1/2 MOV r32,r/m32 1/2 MOV r/m16,sreg 1/2 MOV sreg,r/m16 2/3 MOV sreg,r/m16 (PM) 15/16 MOV AL,moffs8 2 MOV AX,moffs16 2 MOV EAX,moffs32 2 MOV moffs8,AL 1/2 MOV moffs16,AX 1/2 MOV moffs32,EAX 1/2 MOV r8,imm8 1 MOV r16,imm16 1 MOV r32,imm32 1 MOV r/m8,imm8 1/2 MOV r/m16,imm16 1/2 MOV r/m32,imm32 1/2 MOV CR0,r32 11 MOV CR2,r32 3 MOV CR3,r32 3 MOV r32,CRi 1 (if CR0)/3 (if CR2,CR3) MOV r32,DR0-DR3 3 MOV r32,DR4-DR5 3 MOV r32,DR6-DR7 3 MOV DR0-DR3,r32 1 MOV DR4-DR5,r32 1 MOV DR6-DR7,r32 1 MOV r32,TR4-TR7 3 MOV r32,TR3 5 MOV TR3,r32 5 MOV TR4-TR7,r32 1 MOVSB 5 MOVSW 5 MOVSD 5 MOVSX r16,r/m8 1/3 MOVSX r32,r/m8 1/3 MOVSX r32,r/m16 1/3 MOVZX r16,r/m8 2/3 MOVZX r32,r/m8 2/3 MOVZX r32,r/m16 2/3 MUL r/m8 3/5 MUL r/m16 3/5 MUL r/m32 7/9 NEG r/m8 1/3 NEG r/m16 1/3 NEG r/m32 1/3 NOP 1 NOT r/m8 1/3 NOT r/m16 1/3 NOT r/m32 1/3 OR AL,imm8 1 OR AX,imm16 1 OR EAX,imm32 1 OR r/m8,imm8 1/3 OR r/m16,imm8 1/3 OR r/m32,imm8 1/3 OR r/m16,imm16 1/3 OR r/m32,imm32 1/3 OR r/m8,r8 1/3 OR r/m16,r16 1/3 OR r/m32,r32 1/3 OR r8,r/m8 1/3 OR r16,r/m16 1/3 OR r32,r/m32 1/3 OUT imm8,AL 18 OUT imm8,AL (PM, CPL <= IOPL) 4 OUT imm8,AL (VM) 17 OUT imm8,AX 18 OUT imm8,AX (PM, CPL <= IOPL) 4 OUT imm8,AX (VM) 17 OUT imm8,EAX 18 OUT imm8,EAX (PM, CPL <= IOPL) 4 OUT imm8,EAX (VM) 17 OUT DX,AL 18 OUT DX,AL (PM, CPL <= IOPL) 4 OUT DX,AL (VM) 17 OUT DX,AX 18 OUT DX,AX (PM, CPL <= IOPL) 4 OUT DX,AX (VM) 17 OUT DX,EAX 18 OUT DX,EAX (PM, CPL <= IOPL) 4 OUT DX,EAX (VM) 17 OUTSB 20 OUTSW 20 OUTSD 20 POP m16 5 POP m32 5 POP r16 3 POP r32 3 POP sreg 4 POP sreg (PM) 18 POPA 18 POPAD 18 POPF 4 POPF (PM) 4 POPF (VM) 4 POPFD 4 POPFD (PM) 4 POPFD (VM) 4 PUSH r/m16 2/4 PUSH r/m32 2/4 PUSH r16 2 PUSH r32 2 PUSH imm8 2 PUSH imm16 2 PUSH imm32 2 PUSH sreg 2 PUSHA 17 PUSHAD 17 PUSHF 2 PUSHF (PM) 2 PUSHF (VM) 2 PUSHFD 2 PUSHFD (PM) 2 PUSHFD (VM) 2 RCL r/m8,1 9/9 RCL r/m16,1 9/9 RCL r/m32,1 9/9 RCL r/m8,CL 9/9 RCL r/m16,CL 9/9 RCL r/m32,CL 9/9 RCL r/m8,imm8 9/9 RCL r/m16,imm8 9/9 RCL r/m32,imm8 9/9 RCR r/m8,1 9/9 RCR r/m16,1 9/9 RCR r/m32,1 9/9 RCR r/m8,CL 9/9 RCR r/m16,CL 9/9 RCR r/m32,CL 9/9 RCR r/m8,imm8 9/9 RCR r/m16,imm8 9/9 RCR r/m32,imm8 9/9 ROL r/m8,1 2/4 ROL r/m16,1 2/4 ROL r/m32,1 2/4 ROL r/m8,CL 3/5 ROL r/m16,CL 3/5 ROL r/m32,CL 3/5 ROL r/m8,imm8 2/4 ROL r/m16,imm8 2/4 ROL r/m32,imm8 2/4 ROR r/m8,1 2/4 ROR r/m16,1 2/4 ROR r/m32,1 2/4 ROR r/m8,CL 3/5 ROR r/m16,CL 3/5 ROR r/m32,CL 3/5 ROR r/m8,imm8 2/4 ROR r/m16,imm8 2/4 ROR r/m32,imm8 2/4 RET (near) 10 RET (far) 13 RET (PM, far, same PL) 26 RET (PM, far, different PL) 61 RET imm16 (near) 10 RET imm16 (far) 13 RET imm16 (PM, far, same PL) 26 RET imm16 (PM, far, different PL) 61 RSDC m80,sreg 10 RSLDT m80 10 RSM 76 RSTS m80 10 SAHF 2 SAL r/m8,1 2/4 SAL r/m16,1 2/4 SAL r/m32,1 2/4 SAL r/m8,CL 3/5 SAL r/m16,CL 3/5 SAL r/m32,CL 3/5 SAL r/m8,imm8 2/4 SAL r/m16,imm8 2/4 SAL r/m32,imm8 2/4 SAR r/m8,1 2/4 SAR r/m16,1 2/4 SAR r/m32,1 2/4 SAR r/m8,CL 3/5 SAR r/m16,CL 3/5 SAR r/m32,CL 3/5 SAR r/m8,imm8 2/4 SAR r/m16,imm8 2/4 SAR r/m32,imm8 2/4 SHL r/m8,1 1/3 SHL r/m16,1 1/3 SHL r/m32,1 1/3 SHL r/m8,CL 2/4 SHL r/m16,CL 2/4 SHL r/m32,CL 2/4 SHL r/m8,imm8 1/3 SHL r/m16,imm8 1/3 SHL r/m32,imm8 1/3 SHR r/m8,1 1/3 SHR r/m16,1 1/3 SHR r/m32,1 1/3 SHR r/m8,CL 2/4 SHR r/m16,CL 2/4 SHR r/m32,CL 2/4 SHR r/m8,imm8 1/3 SHR r/m16,imm8 1/3 SHR r/m32,imm8 1/3 SBB AL,imm8 1 SBB AX,imm16 1 SBB EAX,imm32 1 SBB r/m8,imm8 1/3 SBB r/m16,imm8 1/3 SBB r/m32,imm8 1/3 SBB r/m16,imm16 1/3 SBB r/m32,imm32 1/3 SBB r/m8,r8 1/3 SBB r/m16,r16 1/3 SBB r/m32,r32 1/3 SBB r8,r/m8 1/3 SBB r16,r/m16 1/3 SBB r32,r/m32 1/3 SCASB 5 SCASW 5 SCASD 5 SETALC n/a SETcc r/m8 2/2 SGDT m16&32 6 SIDT m16&32 6 SHLD r/m16,r16,imm8 1/3 SHLD r/m32,r32,imm8 1/3 SHLD r/m16,r16,CL 3/5 SHLD r/m32,r32,CL 3/5 SHRD r/m16,r16,imm8 1/3 SHRD r/m32,r32,imm8 1/3 SHRD r/m16,r16,CL 3/5 SHRD r/m32,r32,CL 3/5 SLDT r/m16 1/2 SLDT r/m32 1/2 SMINT 24 SMSW r/m16 1/2 STC 1 STD 1 STI 7 STOSB 3 STOSW 3 STOSD 3 STR r/m16 1/2 SUB AL,imm8 1 SUB AX,imm16 1 SUB EAX,imm32 1 SUB r/m8,imm8 1/3 SUB r/m16,imm8 1/3 SUB r/m32,imm8 1/3 SUB r/m16,imm16 1/3 SUB r/m32,imm32 1/3 SUB r/m8,r8 1/3 SUB r/m16,r16 1/3 SUB r/m32,r32 1/3 SUB r8,r/m8 1/3 SUB r16,r/m16 1/3 SUB r32,r/m32 1/3 SVDC sreg,m80 18 SVLDT m80 18 SVTS m80 18 TEST AL,imm8 1 TEST AX,imm16 1 TEST EAX,imm32 1 TEST r/m8,imm8 1/3 TEST r/m16,imm16 1/3 TEST r/m32,imm32 1/3 TEST r/m8,r8 1/3 TEST r/m16,r16 1/3 TEST r/m32,r32 1/3 UMOV r8,r/m8 n/a UMOV r16,r/m16 n/a UMOV r32,r/m32 n/a UMOV r/m8,r8 n/a UMOV r/m16,r16 n/a UMOV r/m32,r32 n/a VERR r/m16 9/10 VERW r/m16 9/10 WAIT 5 WBINVD 4 XADD r/m8,r8 3/6 XADD r/m16,r16 3/6 XADD r/m32,r32 3/6 XCHG AX,r16 3 XCHG EAX,r32 3 XCHG r/m8,r8 3/4 XCHG r/m16,r16 3/4 XCHG r/m32,r32 3/4 XLAT 3 XOR AL,imm8 1 XOR AX,imm16 1 XOR EAX,imm32 1 XOR r/m8,imm8 1/3 XOR r/m16,imm8 1/3 XOR r/m32,imm8 1/3 XOR r/m16,imm16 1/3 XOR r/m32,imm32 1/3 XOR r/m8,r8 1/3 XOR r/m16,r16 1/3 XOR r/m32,r32 1/3 XOR r8,r/m8 1/3 XOR r16,r/m16 1/3 XOR r32,r/m32 1/3 (END) ---------------------------------------------------------- APPENDIX Y7 - Vendor Instruction Time for Intel Pentium Processor AAA 3 AAD 10 AAD imm8 n/a AAM 18 AAM imm8 n/a AAS 3 ADC AL,imm8 1 ADC AX,imm16 1 ADC EAX,imm32 1 ADC r/m8,imm8 1/3 ADC r/m16,imm8 1/3 ADC r/m32,imm8 1/3 ADC r/m16,imm16 1/3 ADC r/m32,imm32 1/3 ADC r/m8,r8 1/3 ADC r/m16,r16 1/3 ADC r/m32,r32 1/3 ADC r8,r/m8 1/2 ADC r16,r/m16 1/2 ADC r32,r/m32 1/2 ADD AL,imm8 1 ADD AX,imm16 1 ADD EAX,imm32 1 ADD r/m8,imm8 1/3 ADD r/m16,imm8 1/3 ADD r/m32,imm8 1/3 ADD r/m16,imm16 1/3 ADD r/m32,imm32 1/3 ADD r/m8,r8 1/3 ADD r/m16,r16 1/3 ADD r/m32,r32 1/3 ADD r8,r/m8 1/2 ADD r16,r/m16 1/2 ADD r32,r/m32 1/2 AND AL,imm8 1 AND AX,imm16 1 AND EAX,imm32 1 AND r/m8,imm8 1/3 AND r/m16,imm8 1/3 AND r/m32,imm8 1/3 AND r/m16,imm16 1/3 AND r/m32,imm32 1/3 AND r/m8,r8 1/3 AND r/m16,r16 1/3 AND r/m32,r32 1/3 AND r8,r/m8 1/2 AND r16,r/m16 1/2 AND r32,r/m32 1/2 ARPL r/m16,r16 f BOUND r16,m16&16 8/int+32 BOUND r32,m32&32 f BSF r16,r/m16 6-34/6-35 BSF r32,r/m32 6-42/6-43 BSR r16,r/m16 7-39/7-40 BSR r32,r/m32 7-71/7-72 BSWAP r32 1 BT r/m16,r16 4/9 BT r/m32,r32 4/9 BT r/m16,imm8 4 BT r/m16,imm8 4 BTC r/m16,r16 7/13 BTC r/m32,r32 7/13 BTC r/m16,imm8 7/8 BTC r/m16,imm8 7/8 BTR r/m16,r16 7/13 BTR r/m32,r32 7/13 BTR r/m16,imm8 7/8 BTR r/m16,imm8 7/8 BTS r/m16,r16 7/13 BTS r/m32,r32 7/13 BTS r/m16,imm8 7/8 BTS r/m16,imm8 7/8 CALL rel16 1 CALL r/m16 2 CALL ptr16:16 4 CALL ptr16:16 (PM, direct segment) f CALL ptr16:16 (PM, via call gate, same p22 CALL ptr16:16 (PM, via call gate, more p44 CALL ptr16:16 (PM, via call gate, more p45+2*x CALL m16:16 5 CALL m16:16 (PM, direct segment) f CALL m16:16 (PM, via gate, same priveleg22 CALL m16:16 (PM, via gate, more priveleg44 CALL m16:16 (PM, via gate, more priveleg45+2*x CALL rel32 1 CALL r/m32 2 CALL ptr16:32 4 CALL ptr16:32 (PM, direct segment) f CALL ptr16:32 (PM, via gate, same privel22 CALL ptr16:32 (PM, via gate, more privel44 CALL ptr16:32 (PM, via gate, more privel45+2*x CALL m16:32 5 CALL m16:32 (PM, direct segment) f CALL m16:32 (PM, via gate, same priveleg22 CALL m16:32 (PM, via gate, more priveleg44 CALL m16:32 (PM, via gate, more priveleg45+2*x CBW 3 CWDE 3 CLC 2 CLD 2 CLI 7 CLTS 10 CMC 2 CMOVcc r16,r/m16 f CMOVcc r32,r/m32 f CMP AL,imm8 1 CMP AX,imm16 1 CMP EAX,imm32 1 CMP r/m8,imm8 1/2 CMP r/m16,imm8 1/2 CMP r/m32,imm8 1/2 CMP r/m16,imm16 1/2 CMP r/m32,imm32 1/2 CMP r/m8,r8 1/2 CMP r/m16,r16 1/2 CMP r/m32,r32 1/2 CMP r8,r/m8 1/2 CMP r16,r/m16 1/2 CMP r32,r/m32 1/2 CMPSB 5 CMPSW 5 CMPSD 5 CMPXCHG r/m8,r8 6 CMPXCHG r/m16,r16 6 CMPXCHG r/m32,r32 6 CMPXCHG8B r/m32 10 CPUID 14 CWD 2 CDQ 2 DAA 3 DAS 3 DEC r/m8 1/3 DEC r/m16 1/3 DEC r/m32 1/3 DEC r16 1 DEC r32 1 DIV r/m8 17 DIV r/m16 25 DIV r/m32 41 ESC imm4,r/m f ENTER imm16,0 11 ENTER imm16,1 15 ENTER imm16,imm8 15+2*n HLT imfinity IBTS r/m16,AX,CL,r16 None IBTS r/m32,EAX,CL,r32 f IDIV r/m8 22 IDIV r/m16 30 IDIV r/m32 46 IMUL r/m8 11 IMUL r/m16 11 IMUL r/m32 10 IMUL r16,r/m16 10 IMUL r32,r/m32 10 IMUL r16,imm8 10 IMUL r32,imm8 10 IMUL r16,imm16 10 IMUL r32,imm32 10 IMUL r16,r/m16,imm8 10 IMUL r32,r/m32,imm8 10 IMUL r16,r/m16,imm16 10 IMUL r32,r/m32,imm32 10 IN AL,imm8 7 IN AL,imm8 (PM, CPL <= IOPL) 4/21 IN AL,imm8 (VM) 19 IN AX,imm8 7 IN AX,imm8 (PM, CPL <= IOPL) 4/21 IN AX,imm8 (VM) 19 IN EAX,imm8 7 IN EAX,imm8 (PM, CPL <= IOPL) 4/21 IN EAX,imm8 (VM) 19 IN AL,DX 7 IN AL,DX (PM, CPL <= IOPL) 4/21 IN AL,DX (VM) 19 IN AX,DX 7 IN AX,DX (PM, CPL <= IOPL) 4/21 IN AX,DX (VM) 19 IN EAX,DX 7 IN EAX,DX (PM, CPL <= IOPL) 4/21 IN EAX,DX (VM) 19 INC r/m8 1/3 INC r/m16 1/3 INC r/m32 1/3 INC r16 1 INC r32 1 INSB 9 INSW 9 INSD 9 INT 3 13 INT 3 (PM, same privilege) 27 INT 3 (PM, more privelege) 44 INT imm8 16 INT imm8 (PM, same privilege) 31 INT imm8 (PM, more privelege) 48 INTO 4/13 INTO (PM, same privilege) 4/27 INTO (PM, more privelege) 4/44 INVD 15 INVLPG m 25 IRET 10 IRET (PM, to same privilege) 10 IRET (PM, to lesser privilege) 27 IRETD 10 IRETD (PM, to same privilege) 10 IRETD (PM, to lesser privilege) 27 Jcc rel8 1 Jcc rel16 1 Jcc rel32 1 JCXZ rel8 6,5 JECXZ rel8 6,5 JMP rel8 1 JMP rel16 1 JMP r/m16 2 JMP ptr16:16 3 JMP ptr16:16 (PM, direct segment) 3 JMP ptr16:16 (PM, via call gate, same pr18 JMP m16:16 4 JMP m16:16 (PM, direct segment) 4 JMP m16:16 (PM, via call gate, same priv18 JMP rel32 1 JMP r/m32 2 JMP ptr16:32 3 JMP ptr16:32 (PM, direct segment) 3 JMP ptr16:32 (PM, via call gate, same pr18 JMP m16:32 4 JMP m16:32 (PM, direct segment) 4 JMP m16:32 (PM, via call gate, same priv18 LAHF 2 LAR r16,r/m16 8 LAR r32,r/m32 8 LDS r16,m16:16 4 LDS r32,m16:32 4 LDS r16,m16:16 (PM) f LDS r32,m16:32 (PM) f LSS r16,m16:16 4 LSS r32,m16:32 4 LSS r16,m16:16 (PM) 8 LSS r32,m16:32 (PM) 8 LES r16,m16:16 4 LES r32,m16:32 4 LES r16,m16:16 (PM) f LES r32,m16:32 (PM) f LFS r16,m16:16 4 LFS r32,m16:32 4 LFS r16,m16:16 (PM) f LFS r32,m16:32 (PM) f LGS r16,m16:16 4 LGS r32,m16:32 4 LGS r16,m16:16 (PM) f LGS r32,m16:32 (PM) f LEA r16,m 1 LEA r32,m 1 LEAVE 3 LGDT m16&32 6 LIDT m16&32 6 LLDT r/m16 9 LMSW r/m16 8 LOADALL f LODSB 2 LODSW 2 LODSD 2 LOOP rel8 5/6 LOOPE rel8 7/8 LOOPNE rel8 7/8 LSL r16,r/m16 8 LSL r32,r/m32 8 LTR r/m16 10 MOV r/m8,r8 1 MOV r/m16,r16 1 MOV r/m32,r32 1 MOV r8,r/m8 1 MOV r16,r/m16 1 MOV r32,r/m32 1 MOV r/m16,sreg 1 MOV sreg,r/m16 2/3 MOV sreg,r/m16 (PM) f MOV AL,moffs8 1 MOV AX,moffs16 1 MOV EAX,moffs32 1 MOV moffs8,AL 1 MOV moffs16,AX 1 MOV moffs32,EAX 1 MOV r8,imm8 1 MOV r16,imm16 1 MOV r32,imm32 1 MOV r/m8,imm8 1 MOV r/m16,imm16 1 MOV r/m32,imm32 1 MOV CR0,r32 22 MOV CR2,r32 12/21,46 MOV CR3,r32 12/21,46 MOV CR4,r32 14 MOV r32,CRi 4 MOV r32,DR0-DR3 11 MOV r32,DR4-DR5 11 MOV r32,DR6-DR7 11 MOV DR0-DR3,r32 11 MOV DR4-DR5,r32 12 MOV DR6-DR7,r32 11 MOV r32,TR4-TR7 None MOV r32,TR3 None MOV TR3,r32 None MOV TR4-TR7,r32 None MOVSB 4 MOVSW 4 MOVSD 4 MOVSX r16,r/m8 3 MOVSX r32,r/m8 3 MOVSX r32,r/m16 3 MOVZX r16,r/m8 3 MOVZX r32,r/m8 3 MOVZX r32,r/m16 3 MUL r/m8 11 MUL r/m16 11 MUL r/m32 10 NEG r/m8 1/3 NEG r/m16 1/3 NEG r/m32 1/3 NOP 1 NOT r/m8 1/3 NOT r/m16 1/3 NOT r/m32 1/3 OR AL,imm8 1 OR AX,imm16 1 OR EAX,imm32 1 OR r/m8,imm8 1/3 OR r/m16,imm8 1/3 OR r/m32,imm8 1/3 OR r/m16,imm16 1/3 OR r/m32,imm32 1/3 OR r/m8,r8 1/3 OR r/m16,r16 1/3 OR r/m32,r32 1/3 OR r8,r/m8 1/2 OR r16,r/m16 1/2 OR r32,r/m32 1/2 OUT imm8,AL 12 OUT imm8,AL (PM, CPL <= IOPL) 9/25 OUT imm8,AL (VM) 24 OUT imm8,AX 12 OUT imm8,AX (PM, CPL <= IOPL) 9/25 OUT imm8,AX (VM) 24 OUT imm8,EAX 12 OUT imm8,EAX (PM, CPL <= IOPL) 9/25 OUT imm8,EAX (VM) 24 OUT DX,AL 12 OUT DX,AL (PM, CPL <= IOPL) 9/25 OUT DX,AL (VM) 24 OUT DX,AX 12 OUT DX,AX (PM, CPL <= IOPL) 9/25 OUT DX,AX (VM) 24 OUT DX,EAX 12 OUT DX,EAX (PM, CPL <= IOPL) 9/25 OUT DX,EAX (VM) 24 OUTSB 13 OUTSW 13 OUTSD 13 POP m16 3 POP m32 3 POP r16 1 POP r32 1 POP sreg 3 POP sreg (PM) f POPA 5 POPAD 5 POPF f POPF (PM) 4 POPF (VM) 6 POPFD f POPFD (PM) 4 POPFD (VM) 6 PUSH r/m16 2 PUSH r/m32 2 PUSH r16 1 PUSH r32 1 PUSH imm8 1 PUSH imm16 1 PUSH imm32 1 PUSH sreg 1 PUSHA 5 PUSHAD 5 PUSHF f PUSHF (PM) 3 PUSHF (VM) 4 PUSHFD f PUSHFD (PM) 3 PUSHFD (VM) 4 RCL r/m8,1 1/3 RCL r/m16,1 1/3 RCL r/m32,1 1/3 RCL r/m8,CL 7-24/9-26 RCL r/m16,CL 7-24/9-26 RCL r/m32,CL 7-24/9-26 RCL r/m8,imm8 8-25/10-27 RCL r/m16,imm8 8-25/10-27 RCL r/m32,imm8 8-25/10-27 RCR r/m8,1 1/3 RCR r/m16,1 1/3 RCR r/m32,1 1/3 RCR r/m8,CL 7-24/9-26 RCR r/m16,CL 7-24/9-26 RCR r/m32,CL 7-24/9-26 RCR r/m8,imm8 8-25/10-27 RCR r/m16,imm8 8-25/10-27 RCR r/m32,imm8 8-25/10-27 ROL r/m8,1 1/3 ROL r/m16,1 1/3 ROL r/m32,1 1/3 ROL r/m8,CL 4 ROL r/m16,CL 4 ROL r/m32,CL 4 ROL r/m8,imm8 1/3 ROL r/m16,imm8 1/3 ROL r/m32,imm8 1/3 ROR r/m8,1 1/3 ROR r/m16,1 1/3 ROR r/m32,1 1/3 ROR r/m8,CL 4 ROR r/m16,CL 4 ROR r/m32,CL 4 ROR r/m8,imm8 1/3 ROR r/m16,imm8 1/3 ROR r/m32,imm8 1/3 RDMSR 20-24 RDTSC f RET (near) 3 RET (far) 4 RET (PM, far, same PL) 4 RET (PM, far, different PL) 23 RET imm16 (near) 4 RET imm16 (far) 4 RET imm16 (PM, far, same PL) 4 RET imm16 (PM, far, different PL) 23 RSDC m80,sreg f RSLDT m80 f RSM 83 RSTS m80 f SAHF 2 SAL r/m8,1 1/3 SAL r/m16,1 1/3 SAL r/m32,1 1/3 SAL r/m8,CL 4 SAL r/m16,CL 4 SAL r/m32,CL 4 SAL r/m8,imm8 1/3 SAL r/m16,imm8 1/3 SAL r/m32,imm8 1/3 SAR r/m8,1 1/3 SAR r/m16,1 1/3 SAR r/m32,1 1/3 SAR r/m8,CL 4 SAR r/m16,CL 4 SAR r/m32,CL 4 SAR r/m8,imm8 1/3 SAR r/m16,imm8 1/3 SAR r/m32,imm8 1/3 SHL r/m8,1 1/3 SHL r/m16,1 1/3 SHL r/m32,1 1/3 SHL r/m8,CL 4 SHL r/m16,CL 4 SHL r/m32,CL 4 SHL r/m8,imm8 1/3 SHL r/m16,imm8 1/3 SHL r/m32,imm8 1/3 SHR r/m8,1 1/3 SHR r/m16,1 1/3 SHR r/m32,1 1/3 SHR r/m8,CL 4 SHR r/m16,CL 4 SHR r/m32,CL 4 SHR r/m8,imm8 1/3 SHR r/m16,imm8 1/3 SHR r/m32,imm8 1/3 SBB AL,imm8 1 SBB AX,imm16 1 SBB EAX,imm32 1 SBB r/m8,imm8 1/3 SBB r/m16,imm8 1/3 SBB r/m32,imm8 1/3 SBB r/m16,imm16 1/3 SBB r/m32,imm32 1/3 SBB r/m8,r8 1/3 SBB r/m16,r16 1/3 SBB r/m32,r32 1/3 SBB r8,r/m8 1/2 SBB r16,r/m16 1/2 SBB r32,r/m32 1/2 SCASB 4 SCASW 4 SCASD 4 SETALC f SETcc r/m8 1/2 SGDT m16&32 4 SIDT m16&32 4 SHLD r/m16,r16,imm8 4 SHLD r/m32,r32,imm8 4 SHLD r/m16,r16,CL 4/5 SHLD r/m32,r32,CL 4/5 SHRD r/m16,r16,imm8 4 SHRD r/m32,r32,imm8 4 SHRD r/m16,r16,CL 4/5 SHRD r/m32,r32,CL 4/5 SLDT r/m16 2 SLDT r/m32 f SMINT f SMSW r/m16 4 STC 2 STD 2 STI 7 STOSB 3 STOSW 3 STOSD 3 STR r/m16 2 SUB AL,imm8 1 SUB AX,imm16 1 SUB EAX,imm32 1 SUB r/m8,imm8 1/3 SUB r/m16,imm8 1/3 SUB r/m32,imm8 1/3 SUB r/m16,imm16 1/3 SUB r/m32,imm32 1/3 SUB r/m8,r8 1/3 SUB r/m16,r16 1/3 SUB r/m32,r32 1/3 SUB r8,r/m8 1/2 SUB r16,r/m16 1/2 SUB r32,r/m32 1/2 SVDC sreg,m80 f SVLDT m80 f SVTS m80 f TEST AL,imm8 1 TEST AX,imm16 1 TEST EAX,imm32 1 TEST r/m8,imm8 1/2 TEST r/m16,imm16 1/2 TEST r/m32,imm32 1/2 TEST r/m8,r8 1/2 TEST r/m16,r16 1/2 TEST r/m32,r32 1/2 UMOV r8,r/m8 f UMOV r16,r/m16 f UMOV r32,r/m32 f UMOV r/m8,r8 f UMOV r/m16,r16 f UMOV r/m32,r32 f VERR r/m16 7 VERW r/m16 7 WAIT 1 WBINVD 2000+ WRMSR 30-45 XADD r/m8,r8 3/4 XADD r/m16,r16 3/4 XADD r/m32,r32 3/4 XCHG AX,r16 2 XCHG EAX,r32 2 XCHG r/m8,r8 3 XCHG r/m16,r16 3 XCHG r/m32,r32 3 XLAT 4 XOR AL,imm8 1 XOR AX,imm16 1 XOR EAX,imm32 1 XOR r/m8,imm8 1/3 XOR r/m16,imm8 1/3 XOR r/m32,imm8 1/3 XOR r/m16,imm16 1/3 XOR r/m32,imm32 1/3 XOR r/m8,r8 1/3 XOR r/m16,r16 1/3 XOR r/m32,r32 1/3 XOR r8,r/m8 1/2 XOR r16,r/m16 1/2 XOR r32,r/m32 1/2 (END) ---------------------------------------------------------- APPENDIX Y8 - Vendor Instruction Time for Cyrix Cx6x86 (M1) CPU AAA 7 AAD 7 AAD imm8 7 AAM 13-21 AAM imm8 13-21?? AAS 7 ADC AL,imm8 1 ADC AX,imm16 1 ADC EAX,imm32 1 ADC r/m8,imm8 1 ADC r/m16,imm8 1 ADC r/m32,imm8 1 ADC r/m16,imm16 1 ADC r/m32,imm32 1 ADC r/m8,r8 1 ADC r/m16,r16 1 ADC r/m32,r32 1 ADC r8,r/m8 1 ADC r16,r/m16 1 ADC r32,r/m32 1 ADD AL,imm8 1 ADD AX,imm16 1 ADD EAX,imm32 1 ADD r/m8,imm8 1 ADD r/m16,imm8 1 ADD r/m32,imm8 1 ADD r/m16,imm16 1 ADD r/m32,imm32 1 ADD r/m8,r8 1 ADD r/m16,r16 1 ADD r/m32,r32 1 ADD r8,r/m8 1 ADD r16,r/m16 1 ADD r32,r/m32 1 AND AL,imm8 1 AND AX,imm16 1 AND EAX,imm32 1 AND r/m8,imm8 1 AND r/m16,imm8 1 AND r/m32,imm8 1 AND r/m16,imm16 1 AND r/m32,imm32 1 AND r/m8,r8 1 AND r/m16,r16 1 AND r/m32,r32 1 AND r8,r/m8 1 AND r16,r/m16 1 AND r32,r/m32 1 ARPL r/m16,r16 9 BOUND r16,m16&16 11 or 20 BOUND r32,m32&32 11 or 20 BSF r16,r/m16 3 BSF r32,r/m32 3 BSR r16,r/m16 3 BSR r32,r/m32 3 BSWAP r32 4 BT r/m16,r16 5/6 BT r/m32,r32 5/6 BT r/m16,imm8 2 BT r/m16,imm8 2 BTC r/m16,r16 5/6 BTC r/m32,r32 5/6 BTC r/m16,imm8 3 BTC r/m16,imm8 3 BTR r/m16,r16 5/6 BTR r/m32,r32 5/6 BTR r/m16,imm8 3 BTR r/m16,imm8 3 BTS r/m16,r16 5/6 BTS r/m32,r32 5/6 BTS r/m16,imm8 3 BTS r/m16,imm8 3 CALL rel16 1 CALL r/m16 1/3 CALL ptr16:16 3 CALL ptr16:16 (PM, direct segment) 4 CALL ptr16:16 (PM, via call gate, same p15 CALL ptr16:16 (PM, via call gate, more p26 CALL ptr16:16 (PM, via call gate, more p35+2*param CALL m16:16 5 CALL m16:16 (PM, direct segment) 8 CALL m16:16 (PM, via gate, same priveleg20 CALL m16:16 (PM, via gate, more priveleg31 CALL m16:16 (PM, via gate, more priveleg40+2*param CALL rel32 1 CALL r/m32 1/3 CALL ptr16:32 3 CALL ptr16:32 (PM, direct segment) 4 CALL ptr16:32 (PM, via gate, same privel15 CALL ptr16:32 (PM, via gate, more privel26 CALL ptr16:32 (PM, via gate, more privel35+2*param CALL m16:32 5 CALL m16:32 (PM, direct segment) 8 CALL m16:32 (PM, via gate, same priveleg20 CALL m16:32 (PM, via gate, more priveleg31 CALL m16:32 (PM, via gate, more priveleg40+2*param CBW 3 CWDE 2 CLC 1 CLD 7 CLI 7 CLTS 10 CMC 2 CMP AL,imm8 1 CMP AX,imm16 1 CMP EAX,imm32 1 CMP r/m8,imm8 1 CMP r/m16,imm8 1 CMP r/m32,imm8 1 CMP r/m16,imm16 1 CMP r/m32,imm32 1 CMP r/m8,r8 1 CMP r/m16,r16 1 CMP r/m32,r32 1 CMP r8,r/m8 1 CMP r16,r/m16 1 CMP r32,r/m32 1 CMPSB 5 CMPSW 5 CMPSD 5 CMPXCHG r/m8,r8 11 CMPXCHG r/m16,r16 11 CMPXCHG r/m32,r32 11 CPUID 12 CWD 2 CDQ 2 DAA 9 DAS 9 DEC r/m8 1 DEC r/m16 1 DEC r/m32 1 DEC r16 1 DEC r32 1 DIV r/m8 13-17 DIV r/m16 13-25 DIV r/m32 13-41 ENTER imm16,0 10 ENTER imm16,1 13 ENTER imm16,imm8 10+level*3 HLT 5 IDIV r/m8 16-20 IDIV r/m16 16-28 IDIV r/m32 17-45 IMUL r/m8 4 IMUL r/m16 4 IMUL r/m32 10 IMUL r16,r/m16 4 IMUL r32,r/m32 10 IMUL r16,imm8 ?? IMUL r32,imm8 ?? IMUL r16,imm16 ?? IMUL r32,imm32 ?? IMUL r16,r/m16,imm8 5 IMUL r32,r/m32,imm8 11 IMUL r16,r/m16,imm16 5 IMUL r32,r/m32,imm32 11 IN AL,imm8 14 IN AL,imm8 (PM, CPL <= IOPL) 14 IN AL,imm8 (VM) 28 IN AX,imm8 14 IN AX,imm8 (PM, CPL <= IOPL) 14 IN AX,imm8 (VM) 28 IN EAX,imm8 14 IN EAX,imm8 (PM, CPL <= IOPL) 14 IN EAX,imm8 (VM) 28 IN AL,DX 14 IN AL,DX (PM, CPL <= IOPL) 14 IN AL,DX (VM) 28 IN AX,DX 14 IN AX,DX (PM, CPL <= IOPL) 14 IN AX,DX (VM) 28 IN EAX,DX 14 IN EAX,DX (PM, CPL <= IOPL) 14 IN EAX,DX (VM) 28 INC r/m8 1 INC r/m16 1 INC r/m32 1 INC r16 1 INC r32 1 INSB 14 INSW 14 INSD 14 INT 3 9 INT 3 (PM, same privilege) 21 INT 3 (PM, more privelege) 32 INT imm8 9 INT imm8 (PM, same privilege) 21 INT imm8 (PM, more privelege) 32 INTO 6 or ?? INTO (PM, same privilege) 6 or 15+21 INTO (PM, more privelege) 6 or 15+32 INVD 12 INVLPG m 13 IRET 7 IRET (PM, to same privilege) 10 IRET (PM, to lesser privilege) 26 IRETD 7 IRETD (PM, to same privilege) 10 IRETD (PM, to lesser privilege) 26 Jcc rel8 1 or 1 Jcc rel16 1 or 1 Jcc rel32 1 or 1 JCXZ rel8 1 or 1 JECXZ rel8 1 or 1 JMP rel8 1 JMP rel16 1 JMP r/m16 1/3 JMP ptr16:16 1 JMP ptr16:16 (PM, direct segment) 4 JMP ptr16:16 (PM, via call gate, same pr14 JMP m16:16 5 JMP m16:16 (PM, direct segment) 7 JMP m16:16 (PM, via call gate, same priv17 JMP rel32 1 JMP r/m32 1/3 JMP ptr16:32 1 JMP ptr16:32 (PM, direct segment) 4 JMP ptr16:32 (PM, via call gate, same pr14 JMP m16:32 5 JMP m16:32 (PM, direct segment) 7 JMP m16:32 (PM, via call gate, same priv17 LAHF 2 LAR r16,r/m16 8 LAR r32,r/m32 8 LDS r16,m16:16 2 LDS r32,m16:32 2 LDS r16,m16:16 (PM) 4 LDS r32,m16:32 (PM) 4 LSS r16,m16:16 2 LSS r32,m16:32 2 LSS r16,m16:16 (PM) 4 LSS r32,m16:32 (PM) 4 LES r16,m16:16 2 LES r32,m16:32 2 LES r16,m16:16 (PM) 4 LES r32,m16:32 (PM) 4 LFS r16,m16:16 2 LFS r32,m16:32 2 LFS r16,m16:16 (PM) 4 LFS r32,m16:32 (PM) 4 LGS r16,m16:16 2 LGS r32,m16:32 2 LGS r16,m16:16 (PM) 4 LGS r32,m16:32 (PM) 4 LEA r16,m 1 LEA r32,m 1 LEAVE 4 LGDT m16&32 8 LIDT m16&32 8 LLDT r/m16 5 LMSW r/m16 13 LOADALL None LODSB 3 LODSW 3 LODSD 3 LOOP rel8 1 LOOPE rel8 1 LOOPNE rel8 1 LSL r16,r/m16 8 LSL r32,r/m32 8 LTR r/m16 7 MOV r/m8,r8 1 MOV r/m16,r16 1 MOV r/m32,r32 1 MOV r8,r/m8 1 MOV r16,r/m16 1 MOV r32,r/m32 1 MOV r/m16,sreg 1 MOV sreg,r/m16 1 MOV sreg,r/m16 (PM) 1/3 MOV AL,moffs8 1 MOV AX,moffs16 1 MOV EAX,moffs32 1 MOV moffs8,AL 1 MOV moffs16,AX 1 MOV moffs32,EAX 1 MOV r8,imm8 1 MOV r16,imm16 1 MOV r32,imm32 1 MOV r/m8,imm8 1 MOV r/m16,imm16 1 MOV r/m32,imm32 1 MOV CR0,r32 20 MOV CR2,r32 5 MOV CR3,r32 5 MOV r32,CRi 6 MOV r32,DR0-DR3 14 MOV r32,DR4-DR5 14 MOV r32,DR6-DR7 14 MOV DR0-DR3,r32 16 MOV DR4-DR5,r32 16 MOV DR6-DR7,r32 16 MOV r32,TR4-TR7 6 MOV r32,TR3 5 MOV TR3,r32 10 MOV TR4-TR7,r32 10 MOVSB 4 MOVSW 4 MOVSD 4 MOVSX r16,r/m8 1 MOVSX r32,r/m8 1 MOVSX r32,r/m16 1 MOVZX r16,r/m8 1 MOVZX r32,r/m8 1 MOVZX r32,r/m16 1 MUL r/m8 4 MUL r/m16 4 MUL r/m32 10 NEG r/m8 1 NEG r/m16 1 NEG r/m32 1 NOP 1 NOT r/m8 1 NOT r/m16 1 NOT r/m32 1 OR AL,imm8 1 OR AX,imm16 1 OR EAX,imm32 1 OR r/m8,imm8 1 OR r/m16,imm8 1 OR r/m32,imm8 1 OR r/m16,imm16 1 OR r/m32,imm32 1 OR r/m8,r8 1 OR r/m16,r16 1 OR r/m32,r32 1 OR r8,r/m8 1 OR r16,r/m16 1 OR r32,r/m32 1 OUT imm8,AL 14 OUT imm8,AL (PM, CPL <= IOPL) 14 OUT imm8,AL (VM) 28 OUT imm8,AX 14 OUT imm8,AX (PM, CPL <= IOPL) 14 OUT imm8,AX (VM) 28 OUT imm8,EAX 14 OUT imm8,EAX (PM, CPL <= IOPL) 14 OUT imm8,EAX (VM) 28 OUT DX,AL 14 OUT DX,AL (PM, CPL <= IOPL) 14 OUT DX,AL (VM) 28 OUT DX,AX 14 OUT DX,AX (PM, CPL <= IOPL) 14 OUT DX,AX (VM) 28 OUT DX,EAX 14 OUT DX,EAX (PM, CPL <= IOPL) 14 OUT DX,EAX (VM) 28 OUTSB 14 OUTSW 14 OUTSD 14 POP m16 1 POP m32 1 POP r16 1 POP r32 1 POP sreg 1 POP sreg (PM) 3 POPA 6 POPAD 6 POPF 9 POPF (PM) 9 POPF (VM) 9 POPFD 9 POPFD (PM) 9 POPFD (VM) 9 PUSH r/m16 1 PUSH r/m32 1 PUSH r16 1 PUSH r32 1 PUSH imm8 1 PUSH imm16 1 PUSH imm32 1 PUSH sreg 1 PUSHA 6 PUSHAD 6 PUSHF 2 PUSHF (PM) 2 PUSHF (VM) 2 PUSHFD 2 PUSHFD (PM) 2 PUSHFD (VM) 2 RCL r/m8,1 3 RCL r/m16,1 3 RCL r/m32,1 3 RCL r/m8,CL 8 RCL r/m16,CL 8 RCL r/m32,CL 8 RCL r/m8,imm8 8 RCL r/m16,imm8 8 RCL r/m32,imm8 8 RCR r/m8,1 4 RCR r/m16,1 4 RCR r/m32,1 4 RCR r/m8,CL 9 RCR r/m16,CL 9 RCR r/m32,CL 9 RCR r/m8,imm8 9 RCR r/m16,imm8 9 RCR r/m32,imm8 9 ROL r/m8,1 1 ROL r/m16,1 1 ROL r/m32,1 1 ROL r/m8,CL 2 ROL r/m16,CL 2 ROL r/m32,CL 2 ROL r/m8,imm8 1 ROL r/m16,imm8 1 ROL r/m32,imm8 1 ROR r/m8,1 1 ROR r/m16,1 1 ROR r/m32,1 1 ROR r/m8,CL 2 ROR r/m16,CL 2 ROR r/m32,CL 2 ROR r/m8,imm8 1 ROR r/m16,imm8 1 ROR r/m32,imm8 1 RET (near) 3 RET (far) 4 RET (PM, far, same PL) 7 RET (PM, far, different PL) 23 RET imm16 (near) 4 RET imm16 (far) 4 RET imm16 (PM, far, same PL) 7 RET imm16 (PM, far, different PL) 23 RSDC m80,sreg 6 RSLDT m80 6 RSM 40 RSTS m80 6 SAHF 1 SAL r/m8,1 1 SAL r/m16,1 1 SAL r/m32,1 1 SAL r/m8,CL 2 SAL r/m16,CL 2 SAL r/m32,CL 2 SAL r/m8,imm8 1 SAL r/m16,imm8 1 SAL r/m32,imm8 1 SAR r/m8,1 1 SAR r/m16,1 1 SAR r/m32,1 1 SAR r/m8,CL 2 SAR r/m16,CL 2 SAR r/m32,CL 2 SAR r/m8,imm8 1 SAR r/m16,imm8 1 SAR r/m32,imm8 1 SHL r/m8,1 1 SHL r/m16,1 1 SHL r/m32,1 1 SHL r/m8,CL 2 SHL r/m16,CL 2 SHL r/m32,CL 2 SHL r/m8,imm8 1 SHL r/m16,imm8 1 SHL r/m32,imm8 1 SHR r/m8,1 1 SHR r/m16,1 1 SHR r/m32,1 1 SHR r/m8,CL 2 SHR r/m16,CL 2 SHR r/m32,CL 2 SHR r/m8,imm8 1 SHR r/m16,imm8 1 SHR r/m32,imm8 1 SBB AL,imm8 1 SBB AX,imm16 1 SBB EAX,imm32 1 SBB r/m8,imm8 1 SBB r/m16,imm8 1 SBB r/m32,imm8 1 SBB r/m16,imm16 1 SBB r/m32,imm32 1 SBB r/m8,r8 1 SBB r/m16,r16 1 SBB r/m32,r32 1 SBB r8,r/m8 1 SBB r16,r/m16 1 SBB r32,r/m32 1 SCASB 2 SCASW 2 SCASD 2 SETALC n/a SETcc r/m8 1 SGDT m16&32 4 SIDT m16&32 4 SHLD r/m16,r16,imm8 4 SHLD r/m32,r32,imm8 4 SHLD r/m16,r16,CL 5 SHLD r/m32,r32,CL 5 SHRD r/m16,r16,imm8 4 SHRD r/m32,r32,imm8 4 SHRD r/m16,r16,CL 5 SHRD r/m32,r32,CL 5 SLDT r/m16 1 SLDT r/m32 1 SMINT 55 SMSW r/m16 6 STC 1 STD 7 STI 7 STOSB 2 STOSW 2 STOSD 2 STR r/m16 4 SUB AL,imm8 1 SUB AX,imm16 1 SUB EAX,imm32 1 SUB r/m8,imm8 1 SUB r/m16,imm8 1 SUB r/m32,imm8 1 SUB r/m16,imm16 1 SUB r/m32,imm32 1 SUB r/m8,r8 1 SUB r/m16,r16 1 SUB r/m32,r32 1 SUB r8,r/m8 1 SUB r16,r/m16 1 SUB r32,r/m32 1 SVDC sreg,m80 12 SVLDT m80 12 SVTS m80 14 TEST AL,imm8 1 TEST AX,imm16 1 TEST EAX,imm32 1 TEST r/m8,imm8 1 TEST r/m16,imm16 1 TEST r/m32,imm32 1 TEST r/m8,r8 1 TEST r/m16,r16 1 TEST r/m32,r32 1 VERR r/m16 7 VERW r/m16 7 WAIT 5 WBINVD 15 XADD r/m8,r8 2 XADD r/m16,r16 2 XADD r/m32,r32 2 XCHG AX,r16 2 XCHG EAX,r32 2 XCHG r/m8,r8 2 XCHG r/m16,r16 2 XCHG r/m32,r32 2 XLAT 4 XOR AL,imm8 1 XOR AX,imm16 1 XOR EAX,imm32 1 XOR r/m8,imm8 1 XOR r/m16,imm8 1 XOR r/m32,imm8 1 XOR r/m16,imm16 1 XOR r/m32,imm32 1 XOR r/m8,r8 1 XOR r/m16,r16 1 XOR r/m32,r32 1 XOR r8,r/m8 1 XOR r16,r/m16 1 XOR r32,r/m32 1 (END) --------------------------------------------------------------- APPENDIX Z0 - Execution time for Intel 8087 FPU FLD1 26 FLDZ 21 FLDPI 26 FLDLG2 26 FLDL2T 26 FLDL2E 26 FLDLN2 26 FLD ST(0) 31 FST ST(1) 26 FSTP ST(0) 26 FSTP ST(1) 21 FLD ST(1) 26 FXCH ST(1) 21 FILD m16 58 FILD m32 64 FILD m64 74 FLD m32 49 FLD m64 54 FLD m80 59 FBLD m80 309 FIST m16 79 FIST m32 84 FST m32 89 FST m64 99 FISTP m16 79 FISTP m32 79 FISTP m64 88 FSTP m32 89 FSTP m64 93 FSTP m80 49 FBSTP m80 528 FINIT 11 FCLEX 11 FCHS 21 FABS 21 FXAM 21 FTST 51 FSTENV 54 FLDENV 48 FSAVE 214 FRSTOR 209 FSTSW [mem] 28 FSTSW AX FSTCW [mem] 28 FLDCW [mem] 19 FADD ST,ST(0) 86 FADD ST,ST(1) 85 FADD ST(1),ST 92 FADDP ST(1),ST 92 FADD m32 105 FADD m64 115 FIADD m16 115 FIADD m32 125 FSUB ST(1),ST 88 FSUBR ST(1),ST 96 FSUBRP ST(1),ST 99 FSUB m32 119 FSUB m64 129 FISUB m16 115 FISUB m32 125 FMUL ST,ST(1) 145 FMUL ST(1),ST 145 FMULP ST(1),ST 148 FIMUL m16 132 FIMUL m32 141 FMUL m32 125 FMUL m64 175 FDIV ST,ST(0) 201 FDIV ST,ST(1) 203 FDIV ST(1),ST 207 FDIVR ST(1),ST 201 FDIVRP ST(1),ST 201 FIDIV m16 237 FIDIV m32 246 FDIV m32 229 FDIV m64 236 FSQRT (0 0) 21 FSQRT (1 0) 186 FSQRT (L2T) 186 FXTRACT (L2T) 51 FSCALE (PI,5) 41 FRNDINT (PI) 51 FPREM (99,PI) 81 FPREM1(99,PI) N/A FCOM 56 FCOMP 61 FCOMPP 61 FICOM m16 79 FICOM m32 89 FCOM m32 74 FCOM m64 74 FSIN (0 0) N/A FSIN (1 0) N/A FSIN (PI) N/A FSIN (LG2) N/A FSIN (L2T) N/A FCOS (0 0) N/A FCOS (1 0) N/A FCOS (PI) N/A FCOS (LG2) N/A FCOS (L2T) N/A FSINCOS (0 0) N/A FSINCOS (1 0) N/A FSINCOS (PI) N/A FSINCOS (LG2) N/A FSINCOS (L2T) N/A FPTAN (0 0) 41 FPTAN (1 0) 581 FPTAN (PI) 606 FPTAN (LG2) 516 FPTAN (L2T) 576 FPATAN (0 0) 41 FPATAN (1 0) 736 FPATAN (PI) 206 FPATAN (LG2) 756 FPATAN (L2T) 206 F2XM1 (0 0) 16 F2XM1 (LN2) 631 F2XM1 (LG2) 611 FYL2X (1 0) 56 FYL2X (PI) 946 FYL2X (LG2) 1081 FYL2X (L2T) 926 FYL2XP1 (LG2) 1026 --------------------------------------------------------------- APPENDIX Z1 - Execution time for Intel 80287 FPU FLD1 26 FLDZ 21 FLDPI 26 FLDLG2 26 FLDL2T 26 FLDL2E 26 FLDLN2 26 FLD ST(0) 31 FST ST(1) 26 FSTP ST(0) 26 FSTP ST(1) 21 FLD ST(1) 26 FXCH ST(1) 21 FILD m16 58 FILD m32 64 FILD m64 74 FLD m32 49 FLD m64 54 FLD m80 59 FBLD m80 309 FIST m16 79 FIST m32 84 FST m32 89 FST m64 99 FISTP m16 79 FISTP m32 79 FISTP m64 88 FSTP m32 89 FSTP m64 93 FSTP m80 49 FBSTP m80 528 FINIT 11 FCLEX 11 FCHS 21 FABS 21 FXAM 21 FTST 51 FSTENV 54 FLDENV 48 FSAVE 214 FRSTOR 209 FSTSW [mem] 28 FSTSW AX FSTCW [mem] 28 FLDCW [mem] 19 FADD ST,ST(0) 86 FADD ST,ST(1) 85 FADD ST(1),ST 92 FADDP ST(1),ST 92 FADD m32 105 FADD m64 115 FIADD m16 115 FIADD m32 125 FSUB ST(1),ST 88 FSUBR ST(1),ST 96 FSUBRP ST(1),ST 99 FSUB m32 119 FSUB m64 129 FISUB m16 115 FISUB m32 125 FMUL ST,ST(1) 145 FMUL ST(1),ST 145 FMULP ST(1),ST 148 FIMUL m16 132 FIMUL m32 141 FMUL m32 125 FMUL m64 175 FDIV ST,ST(0) 201 FDIV ST,ST(1) 203 FDIV ST(1),ST 207 FDIVR ST(1),ST 201 FDIVRP ST(1),ST 201 FIDIV m16 237 FIDIV m32 246 FDIV m32 229 FDIV m64 236 FSQRT (0 0) 21 FSQRT (1 0) 186 FSQRT (L2T) 186 FXTRACT (L2T) 51 FSCALE (PI,5) 41 FRNDINT (PI) 51 FPREM (99,PI) 81 FPREM1(99,PI) N/A FCOM 56 FCOMP 61 FCOMPP 61 FICOM m16 79 FICOM m32 89 FCOM m32 74 FCOM m64 74 FSIN (0 0) N/A FSIN (1 0) N/A FSIN (PI) N/A FSIN (LG2) N/A FSIN (L2T) N/A FCOS (0 0) N/A FCOS (1 0) N/A FCOS (PI) N/A FCOS (LG2) N/A FCOS (L2T) N/A FSINCOS (0 0) N/A FSINCOS (1 0) N/A FSINCOS (PI) N/A FSINCOS (LG2) N/A FSINCOS (L2T) N/A FPTAN (0 0) 41 FPTAN (1 0) 581 FPTAN (PI) 606 FPTAN (LG2) 516 FPTAN (L2T) 576 FPATAN (0 0) 41 FPATAN (1 0) 736 FPATAN (PI) 206 FPATAN (LG2) 756 FPATAN (L2T) 206 F2XM1 (0 0) 16 F2XM1 (LN2) 631 F2XM1 (LG2) 611 FYL2X (1 0) 56 FYL2X (PI) 946 FYL2X (LG2) 1081 FYL2X (L2T) 926 FYL2XP1 (LG2) 1026 --------------------------------------------------------------- APPENDIX Z2 - Execution time for Intel 80387 FPU FLD1 1 FLDZ 1 FLDPI 3 FLDLG2 3 FLDL2T 3 FLDL2E 3 FLDLN2 3 FLD ST(0) 1 FST ST(1) 2 FSTP ST(0) 2 FSTP ST(1) 3 FLD ST(1) 1 FXCH ST(1) 1 FILD m16 1 FILD m32 1 FILD m64 1 FLD m32 1 FLD m64 1 FLD m80 3 FBLD m80 46 FIST m16 5 FIST m32 5 FST m32 1 FST m64 1 FISTP m16 8 FISTP m32 9 FISTP m64 8 FSTP m32 5 FSTP m64 5 FSTP m80 6 FBSTP m80 155 FINIT 21 FCLEX 8 FCHS 1 FABS 1 FXAM 16 FTST 1 FSTENV 60 FLDENV 37 FSAVE 154 FRSTOR 74 FSTSW [mem] 4 FSTSW AX 4 FSTCW [mem] 2 FLDCW [mem] 7 FADD ST,ST(0) 2 FADD ST,ST(1) 3 FADD ST(1),ST 3 FADDP ST(1),ST 3 FADD m32 1 FADD m64 1 FIADD m16 3 FIADD m32 3 FSUB ST(1),ST 3 FSUBR ST(1),ST 2 FSUBRP ST(1),ST 2 FSUB m32 2 FSUB m64 2 FISUB m16 3 FISUB m32 3 FMUL ST,ST(1) 2 FMUL ST(1),ST 3 FMULP ST(1),ST 2 FIMUL m16 3 FIMUL m32 3 FMUL m32 2 FMUL m64 2 FDIV ST,ST(0) 38 FDIV ST,ST(1) 38 FDIV ST(1),ST 38 FDIVR ST(1),ST 38 FDIVRP ST(1),ST 38 FIDIV m16 39 FIDIV m32 39 FDIV m32 38 FDIV m64 38 FSQRT (0 0) 4 FSQRT (1 0) 70 FSQRT (L2T) 70 FXTRACT (L2T) 12 FSCALE (PI,5) 31 FRNDINT (PI) 19 FPREM (99,PI) 27 FPREM1(99,PI) 41 FCOM 1 FCOMP 2 FCOMPP 2 FICOM m16 FICOM m32 FCOM m32 FCOM m64 FSIN (0 0) 17 FSIN (1 0) 98 FSIN (PI) 73 FSIN (LG2) 82 FSIN (L2T) 72 FCOS (0 0) 18 FCOS (1 0) 96 FCOS (PI) 72 FCOS (LG2) 83 FCOS (L2T) 72 FSINCOS (0 0) 15 FSINCOS (1 0) 107 FSINCOS (PI) 93 FSINCOS (LG2) 91 FSINCOS (L2T) 93 FPTAN (0 0) 15 FPTAN (1 0) 142 FPTAN (PI) 125 FPTAN (LG2) 126 FPTAN (L2T) 125 FPATAN (0 0) 25 FPATAN (1 0) 93 FPATAN (PI) 132 FPATAN (LG2) 129 FPATAN (L2T) 135 F2XM1 (0 0) 14 F2XM1 (LN2) 52 F2XM1 (LG2) 52 FYL2X (1 0) 39 FYL2X (PI) 104 FYL2X (LG2) 104 FYL2X (L2T) 104 FYL2XP1 (LG2) 103 --------------------------------------------------------------- APPENDIX Z3 - Execution time for Intel 387DX FPU FLD1 1 FLDZ 1 FLDPI 3 FLDLG2 3 FLDL2T 3 FLDL2E 3 FLDLN2 3 FLD ST(0) 1 FST ST(1) 2 FSTP ST(0) 2 FSTP ST(1) 3 FLD ST(1) 1 FXCH ST(1) 1 FILD m16 1 FILD m32 1 FILD m64 1 FLD m32 1 FLD m64 1 FLD m80 3 FBLD m80 46 FIST m16 5 FIST m32 5 FST m32 1 FST m64 1 FISTP m16 8 FISTP m32 9 FISTP m64 8 FSTP m32 5 FSTP m64 5 FSTP m80 6 FBSTP m80 155 FINIT 21 FCLEX 8 FCHS 1 FABS 1 FXAM 16 FTST 1 FSTENV 60 FLDENV 37 FSAVE 154 FRSTOR 74 FSTSW [mem] 4 FSTSW AX 4 FSTCW [mem] 2 FLDCW [mem] 7 FADD ST,ST(0) 2 FADD ST,ST(1) 3 FADD ST(1),ST 3 FADDP ST(1),ST 3 FADD m32 1 FADD m64 1 FIADD m16 3 FIADD m32 3 FSUB ST(1),ST 3 FSUBR ST(1),ST 2 FSUBRP ST(1),ST 2 FSUB m32 2 FSUB m64 2 FISUB m16 3 FISUB m32 3 FMUL ST,ST(1) 2 FMUL ST(1),ST 3 FMULP ST(1),ST 2 FIMUL m16 3 FIMUL m32 3 FMUL m32 2 FMUL m64 2 FDIV ST,ST(0) 38 FDIV ST,ST(1) 38 FDIV ST(1),ST 38 FDIVR ST(1),ST 38 FDIVRP ST(1),ST 38 FIDIV m16 39 FIDIV m32 39 FDIV m32 38 FDIV m64 38 FSQRT (0 0) 4 FSQRT (1 0) 70 FSQRT (L2T) 70 FXTRACT (L2T) 12 FSCALE (PI,5) 31 FRNDINT (PI) 19 FPREM (99,PI) 27 FPREM1(99,PI) 41 FCOM 1 FCOMP 2 FCOMPP 2 FICOM m16 FICOM m32 FCOM m32 FCOM m64 FSIN (0 0) 17 FSIN (1 0) 98 FSIN (PI) 73 FSIN (LG2) 82 FSIN (L2T) 72 FCOS (0 0) 18 FCOS (1 0) 96 FCOS (PI) 72 FCOS (LG2) 83 FCOS (L2T) 72 FSINCOS (0 0) 15 FSINCOS (1 0) 107 FSINCOS (PI) 93 FSINCOS (LG2) 91 FSINCOS (L2T) 93 FPTAN (0 0) 15 FPTAN (1 0) 142 FPTAN (PI) 125 FPTAN (LG2) 126 FPTAN (L2T) 125 FPATAN (0 0) 25 FPATAN (1 0) 93 FPATAN (PI) 132 FPATAN (LG2) 129 FPATAN (L2T) 135 F2XM1 (0 0) 14 F2XM1 (LN2) 52 F2XM1 (LG2) 52 FYL2X (1 0) 39 FYL2X (PI) 104 FYL2X (LG2) 104 FYL2X (L2T) 104 FYL2XP1 (LG2) 103 --------------------------------------------------------------- APPENDIX Z4 - Execution time for IIT 3C87 FPU FLD1 1 FLDZ 1 FLDPI 3 FLDLG2 3 FLDL2T 3 FLDL2E 3 FLDLN2 3 FLD ST(0) 1 FST ST(1) 2 FSTP ST(0) 2 FSTP ST(1) 3 FLD ST(1) 1 FXCH ST(1) 1 FILD m16 1 FILD m32 1 FILD m64 1 FLD m32 1 FLD m64 1 FLD m80 3 FBLD m80 46 FIST m16 5 FIST m32 5 FST m32 1 FST m64 1 FISTP m16 8 FISTP m32 9 FISTP m64 8 FSTP m32 5 FSTP m64 5 FSTP m80 6 FBSTP m80 155 FINIT 21 FCLEX 8 FCHS 1 FABS 1 FXAM 16 FTST 1 FSTENV 60 FLDENV 37 FSAVE 154 FRSTOR 74 FSTSW [mem] 4 FSTSW AX 4 FSTCW [mem] 2 FLDCW [mem] 7 FADD ST,ST(0) 2 FADD ST,ST(1) 3 FADD ST(1),ST 3 FADDP ST(1),ST 3 FADD m32 1 FADD m64 1 FIADD m16 3 FIADD m32 3 FSUB ST(1),ST 3 FSUBR ST(1),ST 2 FSUBRP ST(1),ST 2 FSUB m32 2 FSUB m64 2 FISUB m16 3 FISUB m32 3 FMUL ST,ST(1) 2 FMUL ST(1),ST 3 FMULP ST(1),ST 2 FIMUL m16 3 FIMUL m32 3 FMUL m32 2 FMUL m64 2 FDIV ST,ST(0) 38 FDIV ST,ST(1) 38 FDIV ST(1),ST 38 FDIVR ST(1),ST 38 FDIVRP ST(1),ST 38 FIDIV m16 39 FIDIV m32 39 FDIV m32 38 FDIV m64 38 FSQRT (0 0) 4 FSQRT (1 0) 70 FSQRT (L2T) 70 FXTRACT (L2T) 12 FSCALE (PI,5) 31 FRNDINT (PI) 19 FPREM (99,PI) 27 FPREM1(99,PI) 41 FCOM 1 FCOMP 2 FCOMPP 2 FICOM m16 FICOM m32 FCOM m32 FCOM m64 FSIN (0 0) 17 FSIN (1 0) 98 FSIN (PI) 73 FSIN (LG2) 82 FSIN (L2T) 72 FCOS (0 0) 18 FCOS (1 0) 96 FCOS (PI) 72 FCOS (LG2) 83 FCOS (L2T) 72 FSINCOS (0 0) 15 FSINCOS (1 0) 107 FSINCOS (PI) 93 FSINCOS (LG2) 91 FSINCOS (L2T) 93 FPTAN (0 0) 15 FPTAN (1 0) 142 FPTAN (PI) 125 FPTAN (LG2) 126 FPTAN (L2T) 125 FPATAN (0 0) 25 FPATAN (1 0) 93 FPATAN (PI) 132 FPATAN (LG2) 129 FPATAN (L2T) 135 F2XM1 (0 0) 14 F2XM1 (LN2) 52 F2XM1 (LG2) 52 FYL2X (1 0) 39 FYL2X (PI) 104 FYL2X (LG2) 104 FYL2X (L2T) 104 FYL2XP1 (LG2) 103 --------------------------------------------------------------- APPENDIX Z5 - Execution time for ULSI 83C87 FPU FLD1 1 FLDZ 1 FLDPI 3 FLDLG2 3 FLDL2T 3 FLDL2E 3 FLDLN2 3 FLD ST(0) 1 FST ST(1) 2 FSTP ST(0) 2 FSTP ST(1) 3 FLD ST(1) 1 FXCH ST(1) 1 FILD m16 1 FILD m32 1 FILD m64 1 FLD m32 1 FLD m64 1 FLD m80 3 FBLD m80 46 FIST m16 5 FIST m32 5 FST m32 1 FST m64 1 FISTP m16 8 FISTP m32 9 FISTP m64 8 FSTP m32 5 FSTP m64 5 FSTP m80 6 FBSTP m80 155 FINIT 21 FCLEX 8 FCHS 1 FABS 1 FXAM 16 FTST 1 FSTENV 60 FLDENV 37 FSAVE 154 FRSTOR 74 FSTSW [mem] 4 FSTSW AX 4 FSTCW [mem] 2 FLDCW [mem] 7 FADD ST,ST(0) 2 FADD ST,ST(1) 3 FADD ST(1),ST 3 FADDP ST(1),ST 3 FADD m32 1 FADD m64 1 FIADD m16 3 FIADD m32 3 FSUB ST(1),ST 3 FSUBR ST(1),ST 2 FSUBRP ST(1),ST 2 FSUB m32 2 FSUB m64 2 FISUB m16 3 FISUB m32 3 FMUL ST,ST(1) 2 FMUL ST(1),ST 3 FMULP ST(1),ST 2 FIMUL m16 3 FIMUL m32 3 FMUL m32 2 FMUL m64 2 FDIV ST,ST(0) 38 FDIV ST,ST(1) 38 FDIV ST(1),ST 38 FDIVR ST(1),ST 38 FDIVRP ST(1),ST 38 FIDIV m16 39 FIDIV m32 39 FDIV m32 38 FDIV m64 38 FSQRT (0 0) 4 FSQRT (1 0) 70 FSQRT (L2T) 70 FXTRACT (L2T) 12 FSCALE (PI,5) 31 FRNDINT (PI) 19 FPREM (99,PI) 27 FPREM1(99,PI) 41 FCOM 1 FCOMP 2 FCOMPP 2 FICOM m16 FICOM m32 FCOM m32 FCOM m64 FSIN (0 0) 17 FSIN (1 0) 98 FSIN (PI) 73 FSIN (LG2) 82 FSIN (L2T) 72 FCOS (0 0) 18 FCOS (1 0) 96 FCOS (PI) 72 FCOS (LG2) 83 FCOS (L2T) 72 FSINCOS (0 0) 15 FSINCOS (1 0) 107 FSINCOS (PI) 93 FSINCOS (LG2) 91 FSINCOS (L2T) 93 FPTAN (0 0) 15 FPTAN (1 0) 142 FPTAN (PI) 125 FPTAN (LG2) 126 FPTAN (L2T) 125 FPATAN (0 0) 25 FPATAN (1 0) 93 FPATAN (PI) 132 FPATAN (LG2) 129 FPATAN (L2T) 135 F2XM1 (0 0) 14 F2XM1 (LN2) 52 F2XM1 (LG2) 52 FYL2X (1 0) 39 FYL2X (PI) 104 FYL2X (LG2) 104 FYL2X (L2T) 104 FYL2XP1 (LG2) 103 --------------------------------------------------------------- APPENDIX Z6 - Execution time for ULSI DX/DLC FPU FLD1 1 FLDZ 1 FLDPI 3 FLDLG2 3 FLDL2T 3 FLDL2E 3 FLDLN2 3 FLD ST(0) 1 FST ST(1) 2 FSTP ST(0) 2 FSTP ST(1) 3 FLD ST(1) 1 FXCH ST(1) 1 FILD m16 1 FILD m32 1 FILD m64 1 FLD m32 1 FLD m64 1 FLD m80 3 FBLD m80 46 FIST m16 5 FIST m32 5 FST m32 1 FST m64 1 FISTP m16 8 FISTP m32 9 FISTP m64 8 FSTP m32 5 FSTP m64 5 FSTP m80 6 FBSTP m80 155 FINIT 21 FCLEX 8 FCHS 1 FABS 1 FXAM 16 FTST 1 FSTENV 60 FLDENV 37 FSAVE 154 FRSTOR 74 FSTSW [mem] 4 FSTSW AX 4 FSTCW [mem] 2 FLDCW [mem] 7 FADD ST,ST(0) 2 FADD ST,ST(1) 3 FADD ST(1),ST 3 FADDP ST(1),ST 3 FADD m32 1 FADD m64 1 FIADD m16 3 FIADD m32 3 FSUB ST(1),ST 3 FSUBR ST(1),ST 2 FSUBRP ST(1),ST 2 FSUB m32 2 FSUB m64 2 FISUB m16 3 FISUB m32 3 FMUL ST,ST(1) 2 FMUL ST(1),ST 3 FMULP ST(1),ST 2 FIMUL m16 3 FIMUL m32 3 FMUL m32 2 FMUL m64 2 FDIV ST,ST(0) 38 FDIV ST,ST(1) 38 FDIV ST(1),ST 38 FDIVR ST(1),ST 38 FDIVRP ST(1),ST 38 FIDIV m16 39 FIDIV m32 39 FDIV m32 38 FDIV m64 38 FSQRT (0 0) 4 FSQRT (1 0) 70 FSQRT (L2T) 70 FXTRACT (L2T) 12 FSCALE (PI,5) 31 FRNDINT (PI) 19 FPREM (99,PI) 27 FPREM1(99,PI) 41 FCOM 1 FCOMP 2 FCOMPP 2 FICOM m16 FICOM m32 FCOM m32 FCOM m64 FSIN (0 0) 17 FSIN (1 0) 98 FSIN (PI) 73 FSIN (LG2) 82 FSIN (L2T) 72 FCOS (0 0) 18 FCOS (1 0) 96 FCOS (PI) 72 FCOS (LG2) 83 FCOS (L2T) 72 FSINCOS (0 0) 15 FSINCOS (1 0) 107 FSINCOS (PI) 93 FSINCOS (LG2) 91 FSINCOS (L2T) 93 FPTAN (0 0) 15 FPTAN (1 0) 142 FPTAN (PI) 125 FPTAN (LG2) 126 FPTAN (L2T) 125 FPATAN (0 0) 25 FPATAN (1 0) 93 FPATAN (PI) 132 FPATAN (LG2) 129 FPATAN (L2T) 135 F2XM1 (0 0) 14 F2XM1 (LN2) 52 F2XM1 (LG2) 52 FYL2X (1 0) 39 FYL2X (PI) 104 FYL2X (LG2) 104 FYL2X (L2T) 104 FYL2XP1 (LG2) 103 --------------------------------------------------------------- APPENDIX Z7 - Execution time for C&T 38700 FPU FLD1 1 FLDZ 1 FLDPI 3 FLDLG2 3 FLDL2T 3 FLDL2E 3 FLDLN2 3 FLD ST(0) 1 FST ST(1) 2 FSTP ST(0) 2 FSTP ST(1) 3 FLD ST(1) 1 FXCH ST(1) 1 FILD m16 1 FILD m32 1 FILD m64 1 FLD m32 1 FLD m64 1 FLD m80 3 FBLD m80 46 FIST m16 5 FIST m32 5 FST m32 1 FST m64 1 FISTP m16 8 FISTP m32 9 FISTP m64 8 FSTP m32 5 FSTP m64 5 FSTP m80 6 FBSTP m80 155 FINIT 21 FCLEX 8 FCHS 1 FABS 1 FXAM 16 FTST 1 FSTENV 60 FLDENV 37 FSAVE 154 FRSTOR 74 FSTSW [mem] 4 FSTSW AX 4 FSTCW [mem] 2 FLDCW [mem] 7 FADD ST,ST(0) 2 FADD ST,ST(1) 3 FADD ST(1),ST 3 FADDP ST(1),ST 3 FADD m32 1 FADD m64 1 FIADD m16 3 FIADD m32 3 FSUB ST(1),ST 3 FSUBR ST(1),ST 2 FSUBRP ST(1),ST 2 FSUB m32 2 FSUB m64 2 FISUB m16 3 FISUB m32 3 FMUL ST,ST(1) 2 FMUL ST(1),ST 3 FMULP ST(1),ST 2 FIMUL m16 3 FIMUL m32 3 FMUL m32 2 FMUL m64 2 FDIV ST,ST(0) 38 FDIV ST,ST(1) 38 FDIV ST(1),ST 38 FDIVR ST(1),ST 38 FDIVRP ST(1),ST 38 FIDIV m16 39 FIDIV m32 39 FDIV m32 38 FDIV m64 38 FSQRT (0 0) 4 FSQRT (1 0) 70 FSQRT (L2T) 70 FXTRACT (L2T) 12 FSCALE (PI,5) 31 FRNDINT (PI) 19 FPREM (99,PI) 27 FPREM1(99,PI) 41 FCOM 1 FCOMP 2 FCOMPP 2 FICOM m16 FICOM m32 FCOM m32 FCOM m64 FSIN (0 0) 17 FSIN (1 0) 98 FSIN (PI) 73 FSIN (LG2) 82 FSIN (L2T) 72 FCOS (0 0) 18 FCOS (1 0) 96 FCOS (PI) 72 FCOS (LG2) 83 FCOS (L2T) 72 FSINCOS (0 0) 15 FSINCOS (1 0) 107 FSINCOS (PI) 93 FSINCOS (LG2) 91 FSINCOS (L2T) 93 FPTAN (0 0) 15 FPTAN (1 0) 142 FPTAN (PI) 125 FPTAN (LG2) 126 FPTAN (L2T) 125 FPATAN (0 0) 25 FPATAN (1 0) 93 FPATAN (PI) 132 FPATAN (LG2) 129 FPATAN (L2T) 135 F2XM1 (0 0) 14 F2XM1 (LN2) 52 F2XM1 (LG2) 52 FYL2X (1 0) 39 FYL2X (PI) 104 FYL2X (LG2) 104 FYL2X (L2T) 104 FYL2XP1 (LG2) 103 --------------------------------------------------------------- APPENDIX Z8 - Execution time for Cyrix 387+ FPU FLD1 1 FLDZ 1 FLDPI 3 FLDLG2 3 FLDL2T 3 FLDL2E 3 FLDLN2 3 FLD ST(0) 1 FST ST(1) 2 FSTP ST(0) 2 FSTP ST(1) 3 FLD ST(1) 1 FXCH ST(1) 1 FILD m16 1 FILD m32 1 FILD m64 1 FLD m32 1 FLD m64 1 FLD m80 3 FBLD m80 46 FIST m16 5 FIST m32 5 FST m32 1 FST m64 1 FISTP m16 8 FISTP m32 9 FISTP m64 8 FSTP m32 5 FSTP m64 5 FSTP m80 6 FBSTP m80 155 FINIT 21 FCLEX 8 FCHS 1 FABS 1 FXAM 16 FTST 1 FSTENV 60 FLDENV 37 FSAVE 154 FRSTOR 74 FSTSW [mem] 4 FSTSW AX 4 FSTCW [mem] 2 FLDCW [mem] 7 FADD ST,ST(0) 2 FADD ST,ST(1) 3 FADD ST(1),ST 3 FADDP ST(1),ST 3 FADD m32 1 FADD m64 1 FIADD m16 3 FIADD m32 3 FSUB ST(1),ST 3 FSUBR ST(1),ST 2 FSUBRP ST(1),ST 2 FSUB m32 2 FSUB m64 2 FISUB m16 3 FISUB m32 3 FMUL ST,ST(1) 2 FMUL ST(1),ST 3 FMULP ST(1),ST 2 FIMUL m16 3 FIMUL m32 3 FMUL m32 2 FMUL m64 2 FDIV ST,ST(0) 38 FDIV ST,ST(1) 38 FDIV ST(1),ST 38 FDIVR ST(1),ST 38 FDIVRP ST(1),ST 38 FIDIV m16 39 FIDIV m32 39 FDIV m32 38 FDIV m64 38 FSQRT (0 0) 4 FSQRT (1 0) 70 FSQRT (L2T) 70 FXTRACT (L2T) 12 FSCALE (PI,5) 31 FRNDINT (PI) 19 FPREM (99,PI) 27 FPREM1(99,PI) 41 FCOM 1 FCOMP 2 FCOMPP 2 FICOM m16 FICOM m32 FCOM m32 FCOM m64 FSIN (0 0) 17 FSIN (1 0) 98 FSIN (PI) 73 FSIN (LG2) 82 FSIN (L2T) 72 FCOS (0 0) 18 FCOS (1 0) 96 FCOS (PI) 72 FCOS (LG2) 83 FCOS (L2T) 72 FSINCOS (0 0) 15 FSINCOS (1 0) 107 FSINCOS (PI) 93 FSINCOS (LG2) 91 FSINCOS (L2T) 93 FPTAN (0 0) 15 FPTAN (1 0) 142 FPTAN (PI) 125 FPTAN (LG2) 126 FPTAN (L2T) 125 FPATAN (0 0) 25 FPATAN (1 0) 93 FPATAN (PI) 132 FPATAN (LG2) 129 FPATAN (L2T) 135 F2XM1 (0 0) 14 F2XM1 (LN2) 52 F2XM1 (LG2) 52 FYL2X (1 0) 39 FYL2X (PI) 104 FYL2X (LG2) 104 FYL2X (L2T) 104 FYL2XP1 (LG2) 103 --------------------------------------------------------------- APPENDIX Z9 - Execution time for Cyrix 83D87 FPU FLD1 1 FLDZ 1 FLDPI 3 FLDLG2 3 FLDL2T 3 FLDL2E 3 FLDLN2 3 FLD ST(0) 1 FST ST(1) 2 FSTP ST(0) 2 FSTP ST(1) 3 FLD ST(1) 1 FXCH ST(1) 1 FILD m16 1 FILD m32 1 FILD m64 1 FLD m32 1 FLD m64 1 FLD m80 3 FBLD m80 46 FIST m16 5 FIST m32 5 FST m32 1 FST m64 1 FISTP m16 8 FISTP m32 9 FISTP m64 8 FSTP m32 5 FSTP m64 5 FSTP m80 6 FBSTP m80 155 FINIT 21 FCLEX 8 FCHS 1 FABS 1 FXAM 16 FTST 1 FSTENV 60 FLDENV 37 FSAVE 154 FRSTOR 74 FSTSW [mem] 4 FSTSW AX 4 FSTCW [mem] 2 FLDCW [mem] 7 FADD ST,ST(0) 2 FADD ST,ST(1) 3 FADD ST(1),ST 3 FADDP ST(1),ST 3 FADD m32 1 FADD m64 1 FIADD m16 3 FIADD m32 3 FSUB ST(1),ST 3 FSUBR ST(1),ST 2 FSUBRP ST(1),ST 2 FSUB m32 2 FSUB m64 2 FISUB m16 3 FISUB m32 3 FMUL ST,ST(1) 2 FMUL ST(1),ST 3 FMULP ST(1),ST 2 FIMUL m16 3 FIMUL m32 3 FMUL m32 2 FMUL m64 2 FDIV ST,ST(0) 38 FDIV ST,ST(1) 38 FDIV ST(1),ST 38 FDIVR ST(1),ST 38 FDIVRP ST(1),ST 38 FIDIV m16 39 FIDIV m32 39 FDIV m32 38 FDIV m64 38 FSQRT (0 0) 4 FSQRT (1 0) 70 FSQRT (L2T) 70 FXTRACT (L2T) 12 FSCALE (PI,5) 31 FRNDINT (PI) 19 FPREM (99,PI) 27 FPREM1(99,PI) 41 FCOM 1 FCOMP 2 FCOMPP 2 FICOM m16 FICOM m32 FCOM m32 FCOM m64 FSIN (0 0) 17 FSIN (1 0) 98 FSIN (PI) 73 FSIN (LG2) 82 FSIN (L2T) 72 FCOS (0 0) 18 FCOS (1 0) 96 FCOS (PI) 72 FCOS (LG2) 83 FCOS (L2T) 72 FSINCOS (0 0) 15 FSINCOS (1 0) 107 FSINCOS (PI) 93 FSINCOS (LG2) 91 FSINCOS (L2T) 93 FPTAN (0 0) 15 FPTAN (1 0) 142 FPTAN (PI) 125 FPTAN (LG2) 126 FPTAN (L2T) 125 FPATAN (0 0) 25 FPATAN (1 0) 93 FPATAN (PI) 132 FPATAN (LG2) 129 FPATAN (L2T) 135 F2XM1 (0 0) 14 F2XM1 (LN2) 52 F2XM1 (LG2) 52 FYL2X (1 0) 39 FYL2X (PI) 104 FYL2X (LG2) 104 FYL2X (L2T) 104 FYL2XP1 (LG2) 103 --------------------------------------------------------------- APPENDIX Z10 - Execution time for Intel RapidCAD FPU FLD1 1 FLDZ 1 FLDPI 3 FLDLG2 3 FLDL2T 3 FLDL2E 3 FLDLN2 3 FLD ST(0) 1 FST ST(1) 2 FSTP ST(0) 2 FSTP ST(1) 3 FLD ST(1) 1 FXCH ST(1) 1 FILD m16 1 FILD m32 1 FILD m64 1 FLD m32 1 FLD m64 1 FLD m80 3 FBLD m80 46 FIST m16 5 FIST m32 5 FST m32 1 FST m64 1 FISTP m16 8 FISTP m32 9 FISTP m64 8 FSTP m32 5 FSTP m64 5 FSTP m80 6 FBSTP m80 155 FINIT 21 FCLEX 8 FCHS 1 FABS 1 FXAM 16 FTST 1 FSTENV 60 FLDENV 37 FSAVE 154 FRSTOR 74 FSTSW [mem] 4 FSTSW AX 4 FSTCW [mem] 2 FLDCW [mem] 7 FADD ST,ST(0) 2 FADD ST,ST(1) 3 FADD ST(1),ST 3 FADDP ST(1),ST 3 FADD m32 1 FADD m64 1 FIADD m16 3 FIADD m32 3 FSUB ST(1),ST 3 FSUBR ST(1),ST 2 FSUBRP ST(1),ST 2 FSUB m32 2 FSUB m64 2 FISUB m16 3 FISUB m32 3 FMUL ST,ST(1) 2 FMUL ST(1),ST 3 FMULP ST(1),ST 2 FIMUL m16 3 FIMUL m32 3 FMUL m32 2 FMUL m64 2 FDIV ST,ST(0) 38 FDIV ST,ST(1) 38 FDIV ST(1),ST 38 FDIVR ST(1),ST 38 FDIVRP ST(1),ST 38 FIDIV m16 39 FIDIV m32 39 FDIV m32 38 FDIV m64 38 FSQRT (0 0) 4 FSQRT (1 0) 70 FSQRT (L2T) 70 FXTRACT (L2T) 12 FSCALE (PI,5) 31 FRNDINT (PI) 19 FPREM (99,PI) 27 FPREM1(99,PI) 41 FCOM 1 FCOMP 2 FCOMPP 2 FICOM m16 FICOM m32 FCOM m32 FCOM m64 FSIN (0 0) 17 FSIN (1 0) 98 FSIN (PI) 73 FSIN (LG2) 82 FSIN (L2T) 72 FCOS (0 0) 18 FCOS (1 0) 96 FCOS (PI) 72 FCOS (LG2) 83 FCOS (L2T) 72 FSINCOS (0 0) 15 FSINCOS (1 0) 107 FSINCOS (PI) 93 FSINCOS (LG2) 91 FSINCOS (L2T) 93 FPTAN (0 0) 15 FPTAN (1 0) 142 FPTAN (PI) 125 FPTAN (LG2) 126 FPTAN (L2T) 125 FPATAN (0 0) 25 FPATAN (1 0) 93 FPATAN (PI) 132 FPATAN (LG2) 129 FPATAN (L2T) 135 F2XM1 (0 0) 14 F2XM1 (LN2) 52 F2XM1 (LG2) 52 FYL2X (1 0) 39 FYL2X (PI) 104 FYL2X (LG2) 104 FYL2X (L2T) 104 FYL2XP1 (LG2) 103 --------------------------------------------------------------- APPENDIX Z11 - Execution time for Intel i486 FPU FLD1 1 FLDZ 1 FLDPI 3 FLDLG2 3 FLDL2T 3 FLDL2E 3 FLDLN2 3 FLD ST(0) 1 FST ST(1) 2 FSTP ST(0) 2 FSTP ST(1) 3 FLD ST(1) 1 FXCH ST(1) 1 FILD m16 1 FILD m32 1 FILD m64 1 FLD m32 1 FLD m64 1 FLD m80 3 FBLD m80 46 FIST m16 5 FIST m32 5 FST m32 1 FST m64 1 FISTP m16 8 FISTP m32 9 FISTP m64 8 FSTP m32 5 FSTP m64 5 FSTP m80 6 FBSTP m80 155 FINIT 21 FCLEX 8 FCHS 1 FABS 1 FXAM 16 FTST 1 FSTENV 60 FLDENV 37 FSAVE 154 FRSTOR 74 FSTSW [mem] 4 FSTSW AX 4 FSTCW [mem] 2 FLDCW [mem] 7 FADD ST,ST(0) 2 FADD ST,ST(1) 3 FADD ST(1),ST 3 FADDP ST(1),ST 3 FADD m32 1 FADD m64 1 FIADD m16 3 FIADD m32 3 FSUB ST(1),ST 3 FSUBR ST(1),ST 2 FSUBRP ST(1),ST 2 FSUB m32 2 FSUB m64 2 FISUB m16 3 FISUB m32 3 FMUL ST,ST(1) 2 FMUL ST(1),ST 3 FMULP ST(1),ST 2 FIMUL m16 3 FIMUL m32 3 FMUL m32 2 FMUL m64 2 FDIV ST,ST(0) 38 FDIV ST,ST(1) 38 FDIV ST(1),ST 38 FDIVR ST(1),ST 38 FDIVRP ST(1),ST 38 FIDIV m16 39 FIDIV m32 39 FDIV m32 38 FDIV m64 38 FSQRT (0 0) 4 FSQRT (1 0) 70 FSQRT (L2T) 70 FXTRACT (L2T) 12 FSCALE (PI,5) 31 FRNDINT (PI) 19 FPREM (99,PI) 27 FPREM1(99,PI) 41 FCOM 1 FCOMP 2 FCOMPP 2 FICOM m16 FICOM m32 FCOM m32 FCOM m64 FSIN (0 0) 17 FSIN (1 0) 98 FSIN (PI) 73 FSIN (LG2) 82 FSIN (L2T) 72 FCOS (0 0) 18 FCOS (1 0) 96 FCOS (PI) 72 FCOS (LG2) 83 FCOS (L2T) 72 FSINCOS (0 0) 15 FSINCOS (1 0) 107 FSINCOS (PI) 93 FSINCOS (LG2) 91 FSINCOS (L2T) 93 FPTAN (0 0) 15 FPTAN (1 0) 142 FPTAN (PI) 125 FPTAN (LG2) 126 FPTAN (L2T) 125 FPATAN (0 0) 25 FPATAN (1 0) 93 FPATAN (PI) 132 FPATAN (LG2) 129 FPATAN (L2T) 135 F2XM1 (0 0) 14 F2XM1 (LN2) 52 F2XM1 (LG2) 52 FYL2X (1 0) 39 FYL2X (PI) 104 FYL2X (LG2) 104 FYL2X (L2T) 104 FYL2XP1 (LG2) 103 --------------------------------------------------------------- APPENDIX Z12 - Execution time for Intel Pentium FPU FLD1 1 FLDZ 1 FLDPI 3 FLDLG2 3 FLDL2T 3 FLDL2E 3 FLDLN2 3 FLD ST(0) 1 FST ST(1) 2 FSTP ST(0) 2 FSTP ST(1) 3 FLD ST(1) 1 FXCH ST(1) 1 FILD m16 1 FILD m32 1 FILD m64 1 FLD m32 1 FLD m64 1 FLD m80 3 FBLD m80 46 FIST m16 5 FIST m32 5 FST m32 1 FST m64 1 FISTP m16 8 FISTP m32 9 FISTP m64 8 FSTP m32 5 FSTP m64 5 FSTP m80 6 FBSTP m80 155 FINIT 21 FCLEX 8 FCHS 1 FABS 1 FXAM 16 FTST 1 FSTENV 60 FLDENV 37 FSAVE 154 FRSTOR 74 FSTSW [mem] 4 FSTSW AX 4 FSTCW [mem] 2 FLDCW [mem] 7 FADD ST,ST(0) 2 FADD ST,ST(1) 3 FADD ST(1),ST 3 FADDP ST(1),ST 3 FADD m32 1 FADD m64 1 FIADD m16 3 FIADD m32 3 FSUB ST(1),ST 3 FSUBR ST(1),ST 2 FSUBRP ST(1),ST 2 FSUB m32 2 FSUB m64 2 FISUB m16 3 FISUB m32 3 FMUL ST,ST(1) 2 FMUL ST(1),ST 3 FMULP ST(1),ST 2 FIMUL m16 3 FIMUL m32 3 FMUL m32 2 FMUL m64 2 FDIV ST,ST(0) 38 FDIV ST,ST(1) 38 FDIV ST(1),ST 38 FDIVR ST(1),ST 38 FDIVRP ST(1),ST 38 FIDIV m16 39 FIDIV m32 39 FDIV m32 38 FDIV m64 38 FSQRT (0 0) 4 FSQRT (1 0) 70 FSQRT (L2T) 70 FXTRACT (L2T) 12 FSCALE (PI,5) 31 FRNDINT (PI) 19 FPREM (99,PI) 27 FPREM1(99,PI) 41 FCOM 1 FCOMP 2 FCOMPP 2 FICOM m16 FICOM m32 FCOM m32 FCOM m64 FSIN (0 0) 17 FSIN (1 0) 98 FSIN (PI) 73 FSIN (LG2) 82 FSIN (L2T) 72 FCOS (0 0) 18 FCOS (1 0) 96 FCOS (PI) 72 FCOS (LG2) 83 FCOS (L2T) 72 FSINCOS (0 0) 15 FSINCOS (1 0) 107 FSINCOS (PI) 93 FSINCOS (LG2) 91 FSINCOS (L2T) 93 FPTAN (0 0) 15 FPTAN (1 0) 142 FPTAN (PI) 125 FPTAN (LG2) 126 FPTAN (L2T) 125 FPATAN (0 0) 25 FPATAN (1 0) 93 FPATAN (PI) 132 FPATAN (LG2) 129 FPATAN (L2T) 135 F2XM1 (0 0) 14 F2XM1 (LN2) 52 F2XM1 (LG2) 52 FYL2X (1 0) 39 FYL2X (PI) 104 FYL2X (LG2) 104 FYL2X (L2T) 104 FYL2XP1 (LG2) 103 --------------------------------------------------------- APPENDIX _A PENTIUM PRO/PENTIUM II RISC-CORE INSTRUCTIONS INFO & TIMES Format of Data Below: --------------------------------- H: Name of x86 Instruction N: Number of RISC operation per this x86 instruction (in case of comlex microcode = 0) { D:destination regs | retry this data for each P:port | RISC core instruction O:operation | L:latency | A:arguments | } \n --------------------------------- Example: H:ADD r8,r/m8 N:1 D: REG_ddd O: P:01 L:1 A: REG_ddd, REG_sss ---------------------------------- Means: ADD r8,r/m8 Latency ROP1: REG_ddd = ALU.port(1 or 0)(REG_ddd,REG_sss) 1 ---------------------------------- H:ADD r8,r/m8 N:1 D: REG_ddd O: P:01 L:1 A: REG_ddd, REG_sss H:ADD r16,r/m16 N:1 D: REG_ddd O: P:01 L:1 A: REG_ddd, REG_sss H:ADD r32,r/m32 N:1 D: REG_ddd O: P:01 L:1 A: REG_ddd, REG_sss H:SUB r8,r/m8 N:1 D: REG_ddd O: P:01 L:1 A: REG_ddd, REG_sss H:SUB r16,r/m16 N:1 D: REG_ddd O: P:01 L:1 A: REG_ddd, REG_sss H:SUB r32,r/m32 N:1 D: REG_ddd O: P:01 L:1 A: REG_ddd, REG_sss H:AND r8,r/m8 N:1 D: REG_ddd O: P:01 L:1 A: REG_ddd, REG_sss H:AND r16,r/m16 N:1 D: REG_ddd O: P:01 L:1 A: REG_ddd, REG_sss H:AND r32,r/m32 N:1 D: REG_ddd O: P:01 L:1 A: REG_ddd, REG_sss H:OR r8,r/m8 N:1 D: REG_ddd O: P:01 L:1 A: REG_ddd, REG_sss H:OR r16,r/m16 N:1 D: REG_ddd O: P:01 L:1 A: REG_ddd, REG_sss H:OR r32,r/m32 N:1 D: REG_ddd O: P:01 L:1 A: REG_ddd, REG_sss H:XOR r8,r/m8 N:1 D: REG_ddd O: P:01 L:1 A: REG_ddd, REG_sss H:XOR r16,r/m16 N:1 D: REG_ddd O: P:01 L:1 A: REG_ddd, REG_sss H:XOR r32,r/m32 N:1 D: REG_ddd O: P:01 L:1 A: REG_ddd, REG_sss H:ADD r8,m8 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: REG_ddd O: P:01 L:1 A: REG_ddd, TMP0 H:ADD r16,m16 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: REG_ddd O: P:01 L:1 A: REG_ddd, TMP0 H:ADD r32,m32 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: REG_ddd O: P:01 L:1 A: REG_ddd, TMP0 H:SUB r8,m8 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: REG_ddd O: P:01 L:1 A: REG_ddd, TMP0 H:SUB r16,m16 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: REG_ddd O: P:01 L:1 A: REG_ddd, TMP0 H:SUB r32,m32 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: REG_ddd O: P:01 L:1 A: REG_ddd, TMP0 H:AND r8,m8 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: REG_ddd O: P:01 L:1 A: REG_ddd, TMP0 H:AND r16,m16 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: REG_ddd O: P:01 L:1 A: REG_ddd, TMP0 H:AND r32,m32 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: REG_ddd O: P:01 L:1 A: REG_ddd, TMP0 H:OR r8,m8 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: REG_ddd O: P:01 L:1 A: REG_ddd, TMP0 H:OR r16,m16 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: REG_ddd O: P:01 L:1 A: REG_ddd, TMP0 H:OR r32,m32 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: REG_ddd O: P:01 L:1 A: REG_ddd, TMP0 H:XOR r8,m8 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: REG_ddd O: P:01 L:1 A: REG_ddd, TMP0 H:XOR r16,m16 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: REG_ddd O: P:01 L:1 A: REG_ddd, TMP0 H:XOR r32,m32 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: REG_ddd O: P:01 L:1 A: REG_ddd, TMP0 H:ADC r8,r/m8 N:2 D: TMP0 O: P:01 L:1 A: ArithFLAGS, REG_ddd D: REG_ddd O: P:01 L:1 A: TMP0, REG_sss H:ADC r16,r/m16 N:2 D: TMP0 O: P:01 L:1 A: ArithFLAGS, REG_ddd D: REG_ddd O: P:01 L:1 A: TMP0, REG_sss H:ADC r32,r/m32 N:2 D: TMP0 O: P:01 L:1 A: ArithFLAGS, REG_ddd D: REG_ddd O: P:01 L:1 A: TMP0, REG_sss H:SBB r8,r/m8 N:2 D: TMP0 O: P:01 L:1 A: ArithFLAGS, REG_ddd D: REG_ddd O: P:01 L:1 A: TMP0, REG_sss H:SBB r16,r/m16 N:2 D: TMP0 O: P:01 L:1 A: ArithFLAGS, REG_ddd D: REG_ddd O: P:01 L:1 A: TMP0, REG_sss H:SBB r32,r/m32 N:2 D: TMP0 O: P:01 L:1 A: ArithFLAGS, REG_ddd D: REG_ddd O: P:01 L:1 A: TMP0, REG_sss H:ADC r8,m8 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP1 O: P:01 L:1 A: ArithFLAGS, REG_ddd D: REG_ddd O: P:01 L:1 A: TMP1, TMP0 H:ADC r16,m16 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP1 O: P:01 L:1 A: ArithFLAGS, REG_ddd D: REG_ddd O: P:01 L:1 A: TMP1, TMP0 H:ADC r32,m32 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP1 O: P:01 L:1 A: ArithFLAGS, REG_ddd D: REG_ddd O: P:01 L:1 A: TMP1, TMP0 H:SBB r8,m8 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP1 O: P:01 L:1 A: ArithFLAGS, REG_ddd D: REG_ddd O: P:01 L:1 A: TMP1, TMP0 H:SBB r16,m16 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP1 O: P:01 L:1 A: ArithFLAGS, REG_ddd D: REG_ddd O: P:01 L:1 A: TMP1, TMP0 H:SBB r32,m32 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP1 O: P:01 L:1 A: ArithFLAGS, REG_ddd D: REG_ddd O: P:01 L:1 A: TMP1, TMP0 H:ADD r/m8,r8 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, REG_ddd H:ADD r/m16,r16 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, REG_ddd H:ADD r/m32,r32 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, REG_ddd H:SUB r/m8,r8 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, REG_ddd H:SUB r/m16,r16 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, REG_ddd H:SUB r/m32,r32 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, REG_ddd H:AND r/m8,r8 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, REG_ddd H:AND r/m16,r16 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, REG_ddd H:AND r/m32,r32 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, REG_ddd H:OR r/m8,r8 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, REG_ddd H:OR r/m16,r16 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, REG_ddd H:OR r/m32,r32 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, REG_ddd H:XOR r/m8,r8 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, REG_ddd H:XOR r/m16,r16 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, REG_ddd H:XOR r/m32,r32 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, REG_ddd H:ADD m8,r8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, REG_ddd D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:ADD m16,r16 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, REG_ddd D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:ADD m32,r32 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, REG_ddd D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SUB m8,r8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, REG_ddd D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SUB m16,r16 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, REG_ddd D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SUB m32,r32 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, REG_ddd D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:AND m8,r8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, REG_ddd D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:AND m16,r16 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, REG_ddd D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:AND m32,r32 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, REG_ddd D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:OR m8,r8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, REG_ddd D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:OR m16,r16 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, REG_ddd D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:OR m32,r32 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, REG_ddd D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:XOR m8,r8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, REG_ddd D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:XOR m16,r16 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, REG_ddd D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:XOR m32,r32 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, REG_ddd D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:LOCK ADD m8,r8 N:0 H:LOCK ADD m16,r16 N:0 H:LOCK ADD m32,r32 N:0 H:LOCK SUB m8,r8 N:0 H:LOCK SUB m16,r16 N:0 H:LOCK SUB m32,r32 N:0 H:LOCK AND m8,r8 N:0 H:LOCK AND m16,r16 N:0 H:LOCK AND m32,r32 N:0 H:LOCK OR m8,r8 N:0 H:LOCK OR m16,r16 N:0 H:LOCK OR m32,r32 N:0 H:LOCK XOR m8,r8 N:0 H:LOCK XOR m16,r16 N:0 H:LOCK XOR m32,r32 N:0 H:ADC r/m8,r8 N:2 D: TMP0 O: P:01 L:1 A: ArithFLAGS, REG_sss D: REG_sss O: P:01 L:1 A: TMP0, REG_ddd H:ADC r/m16,r16 N:2 D: TMP0 O: P:01 L:1 A: ArithFLAGS, REG_sss D: REG_sss O: P:01 L:1 A: TMP0, REG_ddd H:ADC r/m32,r32 N:2 D: TMP0 O: P:01 L:1 A: ArithFLAGS, REG_sss D: REG_sss O: P:01 L:1 A: TMP0, REG_ddd H:SBB r/m8,r8 N:2 D: TMP0 O: P:01 L:1 A: ArithFLAGS, REG_sss D: REG_sss O: P:01 L:1 A: TMP0, REG_ddd H:SBB r/m16,r16 N:2 D: TMP0 O: P:01 L:1 A: ArithFLAGS, REG_sss D: REG_sss O: P:01 L:1 A: TMP0, REG_ddd H:SBB r/m32,r32 N:2 D: TMP0 O: P:01 L:1 A: ArithFLAGS, REG_sss D: REG_sss O: P:01 L:1 A: TMP0, REG_ddd H:ADC m8,r8 N:0 H:ADC m16,r16 N:0 H:ADC m32,r32 N:0 H:SBB m8,r8 N:0 H:SBB m16,r16 N:0 H:SBB m32,r32 N:0 H:LOCK ADC m8,r8 N:0 H:LOCK ADC m16,r16 N:0 H:LOCK ADC m32,r32 N:0 H:LOCK SBB m8,r8 N:0 H:LOCK SBB m16,r16 N:0 H:LOCK SBB m32,r32 N:0 H:ADD r8,imm8 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, IMM H:ADD r16,imm16 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, IMM H:ADD r32,imm32 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, IMM H:ADD r16,imm8 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, IMM H:ADD r32,imm8 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, IMM H:SUB r8,imm8 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, IMM H:SUB r16,imm16 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, IMM H:SUB r32,imm32 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, IMM H:SUB r16,imm8 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, IMM H:SUB r32,imm8 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, IMM H:AND r8,imm8 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, IMM H:AND r16,imm16 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, IMM H:AND r32,imm32 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, IMM H:AND r16,imm8 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, IMM H:AND r32,imm8 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, IMM H:OR r8,imm8 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, IMM H:OR r16,imm16 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, IMM H:OR r32,imm32 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, IMM H:OR r16,imm8 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, IMM H:OR r32,imm8 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, IMM H:XOR r8,imm8 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, IMM H:XOR r16,imm16 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, IMM H:XOR r32,imm32 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, IMM H:XOR r16,imm8 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, IMM H:XOR r32,imm8 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, IMM H:ADD m8,imm8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, IMM D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:ADD m16,imm16 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, IMM D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:ADD m32,imm32 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, IMM D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SUB m8,imm8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, IMM D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SUB m16,imm16 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, IMM D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SUB m32,imm32 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, IMM D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:AND m8,imm8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, IMM D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:AND m16,imm16 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, IMM D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:AND m32,imm32 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, IMM D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:OR m8,imm8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, IMM D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:OR m16,imm16 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, IMM D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:OR m32,imm32 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, IMM D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:XOR m8,imm8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, IMM D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:XOR m16,imm16 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, IMM D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:XOR m32,imm32 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, IMM D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:LOCK ADD m8,imm8 N:0 H:LOCK ADD m16,imm16 N:0 H:LOCK ADD m32,imm32 N:0 H:LOCK SUB m8,imm8 N:0 H:LOCK SUB m16,imm16 N:0 H:LOCK SUB m32,imm32 N:0 H:LOCK AND m8,imm8 N:0 H:LOCK AND m16,imm16 N:0 H:LOCK AND m32,imm32 N:0 H:LOCK OR m8,imm8 N:0 H:LOCK OR m16,imm16 N:0 H:LOCK OR m32,imm32 N:0 H:LOCK XOR m8,imm8 N:0 H:LOCK XOR m16,imm16 N:0 H:LOCK XOR m32,imm32 N:0 H:ADC r8,imm8 N:2 D: TMP0 O: P:01 L:1 A: ArithFLAGS, REG_sss D: REG_sss O: P:01 L:1 A: TMP0, IMM H:ADC r16,imm16 N:2 D: TMP0 O: P:01 L:1 A: ArithFLAGS, REG_sss D: REG_sss O: P:01 L:1 A: TMP0, IMM H:ADC r32,imm32 N:2 D: TMP0 O: P:01 L:1 A: ArithFLAGS, REG_sss D: REG_sss O: P:01 L:1 A: TMP0, IMM H:SBB r8,imm8 N:2 D: TMP0 O: P:01 L:1 A: ArithFLAGS, REG_sss D: REG_sss O: P:01 L:1 A: TMP0, IMM H:SBB r16,imm16 N:2 D: TMP0 O: P:01 L:1 A: ArithFLAGS, REG_sss D: REG_sss O: P:01 L:1 A: TMP0, IMM H:SBB r32,imm32 N:2 D: TMP0 O: P:01 L:1 A: ArithFLAGS, REG_sss D: REG_sss O: P:01 L:1 A: TMP0, IMM H:ADC m8,imm8 N:0 H:ADC m16,imm16 N:0 H:ADC m32,imm32 N:0 H:SBB m8,imm8 N:0 H:SBB m16,imm16 N:0 H:SBB m32,imm32 N:0 H:LOCK ADC m8,imm8 N:0 H:LOCK ADC m16,imm16 N:0 H:LOCK ADC m32,imm32 N:0 H:LOCK SBB m8,imm8 N:0 H:LOCK SBB m16,imm16 N:0 H:LOCK SBB m32,imm32 N:0 H:ADD AL,imm8 N:1 D: EAX O: P:01 L:1 A: EAX, IMM H:SUB AL,imm8 N:1 D: EAX O: P:01 L:1 A: EAX, IMM H:AND AL,imm8 N:1 D: EAX O: P:01 L:1 A: EAX, IMM H:OR AL,imm8 N:1 D: EAX O: P:01 L:1 A: EAX, IMM H:XOR AL,imm8 N:1 D: EAX O: P:01 L:1 A: EAX, IMM H:ADD eAX,imm16 N:1 D: EAX O: P:01 L:1 A: EAX, IMM H:ADD eAX,imm32 N:1 D: EAX O: P:01 L:1 A: EAX, IMM H:SUB eAX,imm16 N:1 D: EAX O: P:01 L:1 A: EAX, IMM H:SUB eAX,imm32 N:1 D: EAX O: P:01 L:1 A: EAX, IMM H:AND eAX,imm16 N:1 D: EAX O: P:01 L:1 A: EAX, IMM H:AND eAX,imm32 N:1 D: EAX O: P:01 L:1 A: EAX, IMM H:OR eAX,imm16 N:1 D: EAX O: P:01 L:1 A: EAX, IMM H:OR eAX,imm32 N:1 D: EAX O: P:01 L:1 A: EAX, IMM H:XOR eAX,imm16 N:1 D: EAX O: P:01 L:1 A: EAX, IMM H:XOR eAX,imm32 N:1 D: EAX O: P:01 L:1 A: EAX, IMM H:ADC AL,imm8 N:2 D: TMP0 O: P:01 L:1 A: ArithFLAGS, EAX D: EAX O: P:01 L:1 A: TMP0, IMM H:SBB AL,imm8 N:2 D: TMP0 O: P:01 L:1 A: ArithFLAGS, EAX D: EAX O: P:01 L:1 A: TMP0, IMM H:ADC eAX,imm16 N:2 D: TMP0 O: P:01 L:1 A: ArithFLAGS, EAX D: EAX O: P:01 L:1 A: TMP0, IMM H:ADC eAX,imm32 N:2 D: TMP0 O: P:01 L:1 A: ArithFLAGS, EAX D: EAX O: P:01 L:1 A: TMP0, IMM H:SBB eAX,imm16 N:2 D: TMP0 O: P:01 L:1 A: ArithFLAGS, EAX D: EAX O: P:01 L:1 A: TMP0, IMM H:SBB eAX,imm32 N:2 D: TMP0 O: P:01 L:1 A: ArithFLAGS, EAX D: EAX O: P:01 L:1 A: TMP0, IMM H:INC r/m8 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, CONST H:INC r/m16 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, CONST H:INC r/m32 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, CONST H:DEC r/m8 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, CONST H:DEC r/m16 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, CONST H:DEC r/m32 N:1 D: REG_sss O: P:01 L:1 A: REG_sss, CONST H:INC m8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:INC m16 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:INC m32 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:DEC m8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:DEC m16 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:DEC m32 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:01 L:1 A: TMP0, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:LOCK INC m8 N:0 H:LOCK INC m16 N:0 H:LOCK INC m32 N:0 H:LOCK DEC m8 N:0 H:LOCK DEC m16 N:0 H:LOCK DEC m32 N:0 H:INC r16 N:1 D: REG_ddd O: P:01 L:1 A: REG_ddd, CONST H:INC r32 N:1 D: REG_ddd O: P:01 L:1 A: REG_ddd, CONST H:DEC r16 N:1 D: REG_ddd O: P:01 L:1 A: REG_ddd, CONST H:DEC r32 N:1 D: REG_ddd O: P:01 L:1 A: REG_ddd, CONST H:NOT r/m8 N:1 D: REG_sss O: xor P:01 L:1 A: REG_sss, CONST H:NOT r/m16 N:1 D: REG_sss O: xor P:01 L:1 A: REG_sss, CONST H:NOT r/m32 N:1 D: REG_sss O: xor P:01 L:1 A: REG_sss, CONST H:NOT m8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: xor P:01 L:1 A: TMP0, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:NOT m16 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: xor P:01 L:1 A: TMP0, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:NOT m32 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: xor P:01 L:1 A: TMP0, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:LOCK NOT m8 N:0 H:LOCK NOT m16 N:0 H:LOCK NOT m32 N:0 H:NEG r/m8 N:1 D: REG_sss O: sub P:01 L:1 A: CONST, REG_sss H:NEG r/m16 N:1 D: REG_sss O: sub P:01 L:1 A: CONST, REG_sss H:NEG r/m32 N:1 D: REG_sss O: sub P:01 L:1 A: CONST, REG_sss H:NEG m8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: sub P:01 L:1 A: CONST, TMP0 D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:NEG m16 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: sub P:01 L:1 A: CONST, TMP0 D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:NEG m32 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: sub P:01 L:1 A: CONST, TMP0 D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:LOCK NEG m8 N:0 H:LOCK NEG m16 N:0 H:LOCK NEG m32 N:0 H:AAS N:1 D: AX O: P:1 L:1 A: ArithFLAGS, AX H:DAA N:1 D: AL O: P:1 L:1 A: ArithFLAGS, AL H:DAS N:1 D: AL O: P:1 L:1 A: ArithFLAGS, AL H:AAD N:3 D: TMP0 O: mul P:0 L:4 A: AH, IMM D: AH O: move P:01 L:1 A: CONST D: AL O: add P:01 L:1 A: AL, TMP0 H:AAM N:4 D: TMP0 O: div P:0 L:99 A: AL, IMM D: AH O: move P:01 L:1 A: TMP0 D: TMP0 O: P:0 L:1 A: TMP0, CONST D: AL O: add P:01 L:1 A: TMP0, CONST H:INVD N:0 H:WBINVD N:0 H:INVLPG m N:0 H:CMP AL,imm8 N:1 D: sink O: sub P:01 L:1 A: EAX, IMM H:CMP eAX,imm16 N:1 D: sink O: sub P:01 L:1 A: EAX, IMM H:CMP eAX,imm32 N:1 D: sink O: sub P:01 L:1 A: EAX, IMM H:CMP r/m8,imm8 N:1 D: sink O: sub P:01 L:1 A: REG_sss, IMM H:CMP r/m8,imm8 N:1 D: sink O: sub P:01 L:1 A: REG_sss, IMM H:CMP r/m16,imm16 N:1 D: sink O: sub P:01 L:1 A: REG_sss, IMM H:CMP r/m32,imm32 N:1 D: sink O: sub P:01 L:1 A: REG_sss, IMM H:CMP r/m16,imm8 N:1 D: sink O: sub P:01 L:1 A: REG_sss, IMM H:CMP r/m32,imm8 N:1 D: sink O: sub P:01 L:1 A: REG_sss, IMM H:CMP m8,imm8 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: sink O: sub P:01 L:1 A: TMP0, IMM) H:CMP m8,imm8 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: sink O: sub P:01 L:1 A: TMP0, IMM) H:CMP m16,imm16 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: sink O: sub P:01 L:1 A: TMP0, IMM) H:CMP m32,imm32 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: sink O: sub P:01 L:1 A: TMP0, IMM) H:CMP m16,imm8 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: sink O: sub P:01 L:1 A: TMP0, IMM) H:CMP m32,imm8 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: sink O: sub P:01 L:1 A: TMP0, IMM) H:CMP r/m8,r8 N:1 D: sink O: sub P:01 L:1 A: REG_sss, REG_ddd H:CMP r/m16,r16 N:1 D: sink O: sub P:01 L:1 A: REG_sss, REG_ddd H:CMP r/m32,r32 N:1 D: sink O: sub P:01 L:1 A: REG_sss, REG_ddd H:CMP m8,r8 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: sink O: sub P:01 L:1 A: TMP0, REG_ddd H:CMP m16,r16 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: sink O: sub P:01 L:1 A: TMP0, REG_ddd H:CMP m32,r32 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: sink O: sub P:01 L:1 A: TMP0, REG_ddd H:CMP r8,r/m8 N:1 D: sink O: sub P:01 L:1 A: REG_ddd, REG_sss H:CMP r16,r/m16 N:1 D: sink O: sub P:01 L:1 A: REG_ddd, REG_sss H:CMP r32,r/m32 N:1 D: sink O: sub P:01 L:1 A: REG_ddd, REG_sss H:CMP r8,m8 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: sink O: sub P:01 L:1 A: REG_ddd, TMP0 H:CMP r16,m16 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: sink O: sub P:01 L:1 A: REG_ddd, TMP0 H:CMP r32,m32 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: sink O: sub P:01 L:1 A: REG_ddd, TMP0 H:TEST r/m8,r8 N:1 D: sink O: and P:01 L:1 A: REG_ddd, REG_sss H:TEST r/m16,r16 N:1 D: sink O: and P:01 L:1 A: REG_ddd, REG_sss H:TEST r/m32,r32 N:1 D: sink O: and P:01 L:1 A: REG_ddd, REG_sss H:TEST m8,r8 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: sink O: and P:01 L:1 A: REG_ddd, TMP0 H:TEST m16,r16 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: sink O: and P:01 L:1 A: REG_ddd, TMP0 H:TEST m32,r32 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: sink O: and P:01 L:1 A: REG_ddd, TMP0 H:TEST AL,imm8 N:1 D: sink O: and P:01 L:1 A: EAX, IMM H:TEST eAX,imm16 N:1 D: sink O: and P:01 L:1 A: EAX, IMM H:TEST eAX,imm32 N:1 D: sink O: and P:01 L:1 A: EAX, IMM H:TEST r/m8,imm8 N:1 D: sink O: and P:01 L:1 A: REG_sss, IMM H:TEST r/m16,imm16 N:1 D: sink O: and P:01 L:1 A: REG_sss, IMM H:TEST r/m32,imm32 N:1 D: sink O: and P:01 L:1 A: REG_sss, IMM H:TEST m8,imm8 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: sink O: and P:01 L:1 A: TMP0, IMM H:TEST m8,imm8 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: sink O: and P:01 L:1 A: TMP0, IMM H:TEST m16,imm16 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: sink O: and P:01 L:1 A: TMP0, IMM H:TEST m32,imm32 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: sink O: and P:01 L:1 A: TMP0, IMM H:TEST m16,imm16 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: sink O: and P:01 L:1 A: TMP0, IMM H:TEST m32,imm32 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: sink O: and P:01 L:1 A: TMP0, IMM H:SETO r/m8 N:1 D: REG_sss O: P:01 L:1 A: ArithFLAGS, CONST H:SETNO r/m8 N:1 D: REG_sss O: P:01 L:1 A: ArithFLAGS, CONST H:SETB r/m8 N:1 D: REG_sss O: P:01 L:1 A: ArithFLAGS, CONST H:SETNAE r/m8 N:1 D: REG_sss O: P:01 L:1 A: ArithFLAGS, CONST H:SETC r/m8 N:1 D: REG_sss O: P:01 L:1 A: ArithFLAGS, CONST H:SETNB r/m8 N:1 D: REG_sss O: P:01 L:1 A: ArithFLAGS, CONST H:SETAE r/m8 N:1 D: REG_sss O: P:01 L:1 A: ArithFLAGS, CONST H:SETNC r/m8 N:1 D: REG_sss O: P:01 L:1 A: ArithFLAGS, CONST H:SETE r/m8 N:1 D: REG_sss O: P:01 L:1 A: ArithFLAGS, CONST H:SETZ r/m8 N:1 D: REG_sss O: P:01 L:1 A: ArithFLAGS, CONST H:SETNE r/m8 N:1 D: REG_sss O: P:01 L:1 A: ArithFLAGS, CONST H:SETNZ r/m8 N:1 D: REG_sss O: P:01 L:1 A: ArithFLAGS, CONST H:SETBE r/m8 N:1 D: REG_sss O: P:01 L:1 A: ArithFLAGS, CONST H:SETNA r/m8 N:1 D: REG_sss O: P:01 L:1 A: ArithFLAGS, CONST H:SETNBE r/m8 N:1 D: REG_sss O: P:01 L:1 A: ArithFLAGS, CONST H:SETNA r/m8 N:1 D: REG_sss O: P:01 L:1 A: ArithFLAGS, CONST H:SETS r/m8 N:1 D: REG_sss O: P:01 L:1 A: ArithFLAGS, CONST H:SETNS r/m8 N:1 D: REG_sss O: P:01 L:1 A: ArithFLAGS, CONST H:SETP r/m8 N:1 D: REG_sss O: P:01 L:1 A: ArithFLAGS, CONST H:SETPE r/m8 N:1 D: REG_sss O: P:01 L:1 A: ArithFLAGS, CONST H:SETNP r/m8 N:1 D: REG_sss O: P:01 L:1 A: ArithFLAGS, CONST H:SETPO r/m8 N:1 D: REG_sss O: P:01 L:1 A: ArithFLAGS, CONST H:SETL r/m8 N:1 D: REG_sss O: P:01 L:1 A: ArithFLAGS, CONST H:SETNGE r/m8 N:1 D: REG_sss O: P:01 L:1 A: ArithFLAGS, CONST H:SETNL r/m8 N:1 D: REG_sss O: P:01 L:1 A: ArithFLAGS, CONST H:SETGE r/m8 N:1 D: REG_sss O: P:01 L:1 A: ArithFLAGS, CONST H:SETLE r/m8 N:1 D: REG_sss O: P:01 L:1 A: ArithFLAGS, CONST H:SETNG r/m8 N:1 D: REG_sss O: P:01 L:1 A: ArithFLAGS, CONST H:SETNLE r/m8 N:1 D: REG_sss O: P:01 L:1 A: ArithFLAGS, CONST H:SETG r/m8 N:1 D: REG_sss O: P:01 L:1 A: ArithFLAGS, CONST H:SETO m8 N:3 D: TMP0 O: P:01 L:1 A: ArithFLAGS, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SETNO m8 N:3 D: TMP0 O: P:01 L:1 A: ArithFLAGS, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SETB m8 N:3 D: TMP0 O: P:01 L:1 A: ArithFLAGS, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SETNAE m8 N:3 D: TMP0 O: P:01 L:1 A: ArithFLAGS, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SETC m8 N:3 D: TMP0 O: P:01 L:1 A: ArithFLAGS, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SETNB m8 N:3 D: TMP0 O: P:01 L:1 A: ArithFLAGS, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SETAE m8 N:3 D: TMP0 O: P:01 L:1 A: ArithFLAGS, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SETNC m8 N:3 D: TMP0 O: P:01 L:1 A: ArithFLAGS, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SETE m8 N:3 D: TMP0 O: P:01 L:1 A: ArithFLAGS, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SETZ m8 N:3 D: TMP0 O: P:01 L:1 A: ArithFLAGS, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SETNE m8 N:3 D: TMP0 O: P:01 L:1 A: ArithFLAGS, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SETNZ m8 N:3 D: TMP0 O: P:01 L:1 A: ArithFLAGS, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SETBE m8 N:3 D: TMP0 O: P:01 L:1 A: ArithFLAGS, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SETNA m8 N:3 D: TMP0 O: P:01 L:1 A: ArithFLAGS, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SETNBE m8 N:3 D: TMP0 O: P:01 L:1 A: ArithFLAGS, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SETNA m8 N:3 D: TMP0 O: P:01 L:1 A: ArithFLAGS, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SETS m8 N:3 D: TMP0 O: P:01 L:1 A: ArithFLAGS, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SETNS m8 N:3 D: TMP0 O: P:01 L:1 A: ArithFLAGS, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SETP m8 N:3 D: TMP0 O: P:01 L:1 A: ArithFLAGS, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SETPE m8 N:3 D: TMP0 O: P:01 L:1 A: ArithFLAGS, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SETNP m8 N:3 D: TMP0 O: P:01 L:1 A: ArithFLAGS, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SETPO m8 N:3 D: TMP0 O: P:01 L:1 A: ArithFLAGS, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SETL m8 N:3 D: TMP0 O: P:01 L:1 A: ArithFLAGS, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SETNGE m8 N:3 D: TMP0 O: P:01 L:1 A: ArithFLAGS, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SETNL m8 N:3 D: TMP0 O: P:01 L:1 A: ArithFLAGS, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SETGE m8 N:3 D: TMP0 O: P:01 L:1 A: ArithFLAGS, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SETLE m8 N:3 D: TMP0 O: P:01 L:1 A: ArithFLAGS, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SETNG m8 N:3 D: TMP0 O: P:01 L:1 A: ArithFLAGS, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SETNLE m8 N:3 D: TMP0 O: P:01 L:1 A: ArithFLAGS, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SETG m8 N:3 D: TMP0 O: P:01 L:1 A: ArithFLAGS, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:BT r/m16,r16 N:1 D: sink O: test_bit P:01 L:1 A: REG_sss, REG_ddd H:BT r/m32,r32 N:1 D: sink O: test_bit P:01 L:1 A: REG_sss, REG_ddd H:BT m16,r16 N:0 H:BT m32,r32 N:0 H:BT r/m16,imm8 N:1 D: sink O: test_bit P:01 L:1 A: REG_sss, IMM H:BT r/m32,imm8 N:1 D: sink O: test_bit P:01 L:1 A: REG_sss, IMM H:BT m16,imm8 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: sink O: test_bit P:01 L:1 A: TMP0, IMM H:BT m32,imm8 N:2 D: TMP0 O: load P:2 L:1 A: MEM D: sink O: test_bit P:01 L:1 A: TMP0, IMM H:BTC r/m16,r16 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, REG_ddd H:BTC r/m32,r32 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, REG_ddd H:BTR r/m16,r16 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, REG_ddd H:BTR r/m32,r32 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, REG_ddd H:BTS r/m16,r16 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, REG_ddd H:BTS r/m32,r32 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, REG_ddd H:BTC m16,r16 N:0 H:BTC m32,r32 N:0 H:BTR m16,r16 N:0 H:BTR m32,r32 N:0 H:BTS m16,r16 N:0 H:BTS m32,r32 N:0 H:LOCK BTC m16,r16 N:0 H:LOCK BTC m32,r32 N:0 H:LOCK BTR m16,r16 N:0 H:LOCK BTR m32,r32 N:0 H:LOCK BTS m16,r16 N:0 H:LOCK BTS m32,r32 N:0 H:BTC r/m16,imm8 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, IMM H:BTC r/m32,imm8 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, IMM H:BTR r/m16,imm8 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, IMM H:BTR r/m32,imm8 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, IMM H:BTS r/m16,imm8 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, IMM H:BTS r/m32,imm8 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, IMM H:BTC m16,imm8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP1 O: P:0 L:1 A: TMP0, IMM) D: sink O: store_data P:4 L:1 A: TMP1) D: sink O: store_address P:3 L:1 A: MEM H:BTC m32,imm8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP1 O: P:0 L:1 A: TMP0, IMM) D: sink O: store_data P:4 L:1 A: TMP1) D: sink O: store_address P:3 L:1 A: MEM H:BTR m16,imm8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP1 O: P:0 L:1 A: TMP0, IMM) D: sink O: store_data P:4 L:1 A: TMP1) D: sink O: store_address P:3 L:1 A: MEM H:BTR m32,imm8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP1 O: P:0 L:1 A: TMP0, IMM) D: sink O: store_data P:4 L:1 A: TMP1) D: sink O: store_address P:3 L:1 A: MEM H:BTS m16,imm8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP1 O: P:0 L:1 A: TMP0, IMM) D: sink O: store_data P:4 L:1 A: TMP1) D: sink O: store_address P:3 L:1 A: MEM H:BTS m32,imm8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP1 O: P:0 L:1 A: TMP0, IMM) D: sink O: store_data P:4 L:1 A: TMP1) D: sink O: store_address P:3 L:1 A: MEM H:LOCK BTC m16,imm8 N:0 H:LOCK BTC m32,imm8 N:0 H:LOCK BTR m16,imm8 N:0 H:LOCK BTR m32,imm8 N:0 H:LOCK BTS m16,imm8 N:0 H:LOCK BTS m32,imm8 N:0 H:BSF r16,r/m16 N:2 D: TMP0 O: P:1 L:1 A: REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd H:BSF r32,r/m32 N:2 D: TMP0 O: P:1 L:1 A: REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd H:BSF r16,m16 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP1 O: P:1 L:1 A: TMP0 D: REG_ddd O: P:01 L:1 A: TMP1, REG_ddd H:BSF r32,m32 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP1 O: P:1 L:1 A: TMP0 D: REG_ddd O: P:01 L:1 A: TMP1, REG_ddd H:BSR r16,r/m16 N:2 D: TMP1 O: P:1 L:1 A: REG_sss D: REG_ddd O: P:01 L:1 A: TMP1, REG_ddd H:BSR r32,r/m32 N:2 D: TMP1 O: P:1 L:1 A: REG_sss D: REG_ddd O: P:01 L:1 A: TMP1, REG_ddd H:BSR r16,m16 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP1 O: P:1 L:1 A: TMP0 D: REG_ddd O: P:01 L:1 A: TMP1, REG_ddd H:BSR r32,m32 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP1 O: P:1 L:1 A: TMP0 D: REG_ddd O: P:01 L:1 A: TMP1, REG_ddd H:PUSHF N:0 H:PUSHFD N:0 H:POPFD N:0 H:POPF N:0 H:CLC N:1 D: sink O: add P:01 L:1 A: CONST, CONST_0 H:CMC N:1 D: sink O: P:01 L:1 A: ArithFLAGS, CONST H:STC N:1 D: sink O: P:01 L:1 A:CONST, CONST H:SAHF N:1 D: sink O: P:01 L:1 A: AH H:LAHF N:1 D: AH O: P:01 L:1 A: ArithFLAGS, CONST H:CLI N:0 H:STI N:0 H:CLD N:4 D: TMP5 O: P:01 L:1 A: ArithFLAGS, SystemFlags D: sink O: move P:01 L:1 A: CONST D: SystemFlags O: and P:01 L:1 A: TMP5, CONST D: sink O: move P:01 L:1 A: CONST H:STD N:4 D: TMP5 O: P:01 L:1 A: ArithFLAGS, SystemFlags D: TMP5 O: P:01 L:1 A: TMP5, 000010000 D: SystemFlags O: P:01 L:1 A: TMP5, 000001010 D: sink O: move P:01 L:1 A: CONST H:SALC N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, CONST D: AL O: P:01 L:1 A: TMP0, CONST H:Call rel16 near N:3 D: sink O: M_call P:1 L:1 A: virt_ip D: sink O: store_data P:4 L:1 A: next_virt_ip D: ESP O: sub P:01 L:1 A: ESP, REG_OP_Size H:Call rel32 near N:3 D: sink O: M_call P:1 L:1 A: virt_ip D: sink O: store_data P:4 L:1 A: next_virt_ip D: ESP O: sub P:01 L:1 A: ESP, REG_OP_Size H:Call r16 near N:0 H:Call r32 near N:0 H:Call m16 near N:0 H:Call m32 near N:0 H:Ret near N:4 D: TMP0 O: load P:2 L:1 A: (ESP D: sink O: P:01 L:1 A: TMP0, CONST D: ESP O: add P:01 L:1 A: ESP, D: sink O: P:1 L:1 A: virt_ip, TMP0 H:RET near iw N:0 H:JO rel8 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNO rel8 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JB rel8 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNAE rel8 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JC rel8 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNB rel8 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JAE rel8 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNC rel8 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JE rel8 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JZ rel8 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNE rel8 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNZ rel8 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JBE rel8 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNA rel8 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNBE rel8 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNA rel8 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JS rel8 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNS rel8 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JP rel8 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JPE rel8 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNP rel8 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JPO rel8 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JL rel8 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNGE rel8 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNL rel8 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JGE rel8 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JLE rel8 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNG rel8 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNLE rel8 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JG rel8 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JO rel16 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JO rel32 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNO rel16 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNO rel32 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JB rel16 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNAE rel16 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JC rel16 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JB rel32 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNAE rel32 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JC rel32 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNB rel16 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JAE rel16 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNC rel16 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNB rel32 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JAE rel32 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNC rel32 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JE rel16 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JZ rel16 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JE rel32 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JZ rel32 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNE rel16 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNZ rel16 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNE rel32 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNZ rel32 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JBE rel16 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNA rel16 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JBE rel32 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNA rel32 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNBE rel16 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNA rel16 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNBE rel32 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNA rel32 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JS rel16 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JS rel32 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNS rel16 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNS rel32 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JP rel16 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JPE rel16 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JP rel32 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JPE rel32 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNP rel16 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JPO rel16 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNP rel32 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JPO rel32 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JL rel16 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNGE rel16 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JL rel32 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNGE rel32 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNL rel16 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JGE rel16 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNL rel32 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JGE rel32 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JLE rel16 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNG rel16 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JLE rel32 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNG rel32 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNLE rel16 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JG rel16 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JNLE rel32 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JG rel32 N:1 D: sink O: P:1 L:1 A: ArithFLAGS, virt_ip H:JCXZ rel8 N:2 D: TMP0 O: sub P:01 L:1 A: ECX, CONST D: sink O: P:1 L:1 A: TMP0, virt_ip) H:JECXZ rel8 N:2 D: TMP0 O: sub P:01 L:1 A: ECX, CONST D: sink O: P:1 L:1 A: TMP0, virt_ip) H:JMP rel8 N:1 D: sink O: P:1 L:1 A: virt_ip H:JMP rel16 N:1 D: sink O: P:1 L:1 A: virt_ip H:JMP rel32 N:1 D: sink O: P:1 L:1 A: virt_ip H:JMP near reg16 N:1 D: sink O: P:1 L:1 A: virt_ip, REG_sss H:JMP near reg32 N:1 D: sink O: P:1 L:1 A: virt_ip, REG_sss H:JMP near m16 N:0 H:JMP near m32 N:0 H:LOOP rel8 N:0 H:LOOPE rel8 N:0 H:LOOPNE rel8 N:0 H:Halt N:0 H:BOUND r16,m16& 16 N:0 H:BOUND r16,m32& 32 N:0 H:INTn N:3 D: TMP0 O: move P:01 L:1 A: IMM D: TMP1 O: move P:01 L:1 A: 000110101 D: sink O: P:0 L:1 A: TMP0, TMP1) 1 H:INTO N:0 H:INT3 N:0 H:INT1 N:0 H:IN eAX,imm8 N:0 H:IN eAX,DX N:0 H:OUT imm8,eAX N:0 H:OUT DX,eAX N:0 H:INSB m8,DX N:0 H:INSB m16,DX N:0 H:INSB m32,DX N:0 H:INSW m8,DX N:0 H:INSW m16,DX N:0 H:INSW m32,DX N:0 H:INSD m8,DX N:0 H:INSD m16,DX N:0 H:INSD m32,DX N:0 H:OUTSB DX,m8 N:0 H:OUTSB DX,m16 N:0 H:OUTSB DX,m32 N:0 H:OUTSW DX,m8 N:0 H:OUTSW DX,m16 N:0 H:OUTSW DX,m32 N:0 H:OUTSD DX,m8 N:0 H:OUTSD DX,m16 N:0 H:OUTSD DX,m32 N:0 H:REP INSB m8,DX N:0 H:REP INSB m16,DX N:0 H:REP INSB m32,DX N:0 H:REP INSW m8,DX N:0 H:REP INSW m16,DX N:0 H:REP INSW m32,DX N:0 H:REP INSD m8,DX N:0 H:REP INSD m16,DX N:0 H:REP INSD m32,DX N:0 H:REP OUTSB DX,m8 N:0 H:REP OUTSB DX,m16 N:0 H:REP OUTSB DX,m32 N:0 H:REP OUTSW DX,m8 N:0 H:REP OUTSW DX,m16 N:0 H:REP OUTSW DX,m32 N:0 H:REP OUTSD DX,m8 N:0 H:REP OUTSD DX,m16 N:0 H:REP OUTSD DX,m32 N:0 H:LEA r16,m N:1 D: REG_ddd O: load_ea P:0 L:1 A:base_BBB H:LEA r32,m N:1 D: REG_ddd O: load_ea P:0 L:1 A:base_BBB H:NOP N:1 D: sink O: move P:01 L:1 A: CONST H:BSWAP r32 N:2 D: TMP0 O: move P:01 L:1 A: REG_ddd D: REG_ddd O: P:0 L:1 A: TMP0) H:XADD r/m8,r8 N:4 D: TMP0 O: move P:01 L:1 A: REG_sss D: TMP1 O: move P:01 L:1 A: REG_ddd D: REG_ddd O: move P:01 L:1 A: TMP0) D: REG_sss O: add P:01 L:1 A: TMP0, TMP1) 1 H:XADD r/m16,r16 N:4 D: TMP0 O: move P:01 L:1 A: REG_sss D: TMP1 O: move P:01 L:1 A: REG_ddd D: REG_ddd O: move P:01 L:1 A: TMP0) D: REG_sss O: add P:01 L:1 A: TMP0, TMP1) 1 H:XADD r/m32,r32 N:4 D: TMP0 O: move P:01 L:1 A: REG_sss D: TMP1 O: move P:01 L:1 A: REG_ddd D: REG_ddd O: move P:01 L:1 A: TMP0) D: REG_sss O: add P:01 L:1 A: TMP0, TMP1) 1 H:XADD m8,r8 N:0 H:XADD m16,r16 N:0 H:XADD m32,r32 N:0 H:LOCK XADD m8,r8 N:0 H:LOCK XADD m16,r16 N:0 H:LOCK XADD m32,r32 N:0 H:CMPXCHG r/m8,r8 N:0 H:CMPXCHG r/m16,r16 N:0 H:CMPXCHG r/m32,r32 N:0 H:CMPXCHG m8,r8 N:0 H:CMPXCHG m16,r16 N:0 H:CMPXCHG m32,r32 N:0 H:LOCK CMPXCHG m8,r8 N:0 H:LOCK CMPXCHG m16,r16 N:0 H:LOCK CMPXCHG m32,r32 N:0 H:CMPXCHG8B r/m64 N:0 H:LOCK CMPXCHG8B r/m64 N:0 H:XLAT N:2 D: TMP0 O: move P:01 L:1 A: AL D: AL O: load P:2 L:1 A: EBX H:XLATB N:2 D: TMP0 O: move P:01 L:1 A: AL D: AL O: load P:2 L:1 A: EBX H:CMOVO r16,r16 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVO r32,r32 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVNO r16,r16 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVNO r32,r32 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVB r16,r16 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVNAE r16,r16 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVC r16,r16 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVB r32,r32 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVNAE r32,r32 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVC r32,r32 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVNB r16,r16 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVAE r16,r16 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVNC r16,r16 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVNB r32,r32 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVAE r32,r32 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVNC r32,r32 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVE r16,r16 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVZ r16,r16 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVE r32,r32 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVZ r32,r32 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVNE r16,r16 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVNZ r16,r16 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVNE r32,r32 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVNZ r32,r32 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVBE r16,r16 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVNA r16,r16 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVBE r32,r32 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVNA r32,r32 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVNBE r16,r16 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVNA r16,r16 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVNBE r32,r32 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVNA r32,r32 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVS r16,r16 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVS r32,r32 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVNS r16,r16 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVNS r32,r32 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVP r16,r16 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVPE r16,r16 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVP r32,r32 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVPE r32,r32 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVNP r16,r16 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVPO r16,r16 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVNP r32,r32 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVPO r32,r32 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVL r16,r16 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVNGE r16,r16 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVL r32,r32 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVNGE r32,r32 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVNL r16,r16 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVGE r16,r16 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVNL r32,r32 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVGE r32,r32 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVLE r16,r16 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVNG r16,r16 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVLE r32,r32 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVNG r32,r32 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVNLE r16,r16 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVG r16,r16 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVNLE r32,r32 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVG r32,r32 N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, REG_sss D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) H:CMOVO r16,m16 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVO r32,m32 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVNO r16,m16 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVNO r32,m32 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVB r16,m16 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVNAE r16,m16 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVC r16,m16 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVB r32,m32 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVNAE r32,m32 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVC r32,m32 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVNB r16,m16 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVAE r16,m16 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVNC r16,m16 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVNB r32,m32 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVAE r32,m32 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVNC r32,m32 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVE r16,m16 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVZ r16,m16 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVE r32,m32 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVZ r32,m32 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVNE r16,m16 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVNZ r16,m16 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVNE r32,m32 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVNZ r32,m32 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVBE r16,m16 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVNA r16,m16 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVBE r32,m32 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVNA r32,m32 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVNBE r16,m16 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVNA r16,m16 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVNBE r32,m32 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVNA r32,m32 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVS r16,m16 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVS r32,m32 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVNS r16,m16 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVNS r32,m32 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVP r16,m16 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVPE r16,m16 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVP r32,m32 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVPE r32,m32 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVNP r16,m16 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVPO r16,m16 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVNP r32,m32 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVPO r32,m32 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVL r16,m16 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVNGE r16,m16 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVL r32,m32 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVNGE r32,m32 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVNL r16,m16 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVGE r16,m16 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVNL r32,m32 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVGE r32,m32 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVLE r16,m16 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVNG r16,m16 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVLE r32,m32 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVNG r32,m32 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVNLE r16,m16 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVG r16,m16 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVNLE r32,m32 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CMOVG r32,m32 N:3 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: ArithFLAGS, TMP0) D: REG_ddd O: P:01 L:1 A: TMP0, REG_ddd) 1 H:CPUID N:0 H:MOV r/m8,r8 N:1 D: REG_sss O: move P:01 L:1 A: REG_ddd H:MOV r/m16,r16 N:1 D: REG_sss O: move P:01 L:1 A: REG_ddd H:MOV r/m32,r32 N:1 D: REG_sss O: move P:01 L:1 A: REG_ddd H:MOV m8,r8 N:2 D: sink O: store_data P:4 L:1 A: REG_ddd D: sink O: store_address P:3 L:1 A: MEM H:MOV m16,r16 N:2 D: sink O: store_data P:4 L:1 A: REG_ddd D: sink O: store_address P:3 L:1 A: MEM H:MOV m32,r32 N:2 D: sink O: store_data P:4 L:1 A: REG_ddd D: sink O: store_address P:3 L:1 A: MEM H:MOV r8,r/m8 N:1 D: REG_ddd O: move P:01 L:1 A: REG_sss H:MOV r16,r/m16 N:1 D: REG_ddd O: move P:01 L:1 A: REG_sss H:MOV r32,r/m32 N:1 D: REG_ddd O: move P:01 L:1 A: REG_sss H:MOV r8,m8 N:1 D: REG_ddd O: load P:2 L:1 A: MEM H:MOV r16,m16 N:1 D: REG_ddd O: load P:2 L:1 A: MEM H:MOV r32,m32 N:1 D: REG_ddd O: load P:2 L:1 A: MEM H:MOV r/m8,imm8 N:1 D: REG_sss O: move P:01 L:1 A: IMM H:MOV r/m16,imm16 N:1 D: REG_sss O: move P:01 L:1 A: IMM H:MOV r/m32,imm32 N:1 D: REG_sss O: move P:01 L:1 A: IMM H:MOV m8,imm8 N:2 D: sink O: store_data P:4 L:1 A: IMM D: sink O: store_address P:3 L:1 A: MEM H:MOV m16,imm16 N:2 D: sink O: store_data P:4 L:1 A: IMM D: sink O: store_address P:3 L:1 A: MEM H:MOV m32,imm32 N:2 D: sink O: store_data P:4 L:1 A: IMM D: sink O: store_address P:3 L:1 A: MEM H:MOV r8,imm8 N:1 D: REG_ddd O: move P:01 L:1 A: IMM H:MOV r16,imm16 N:1 D: REG_ddd O: move P:01 L:1 A: IMM H:MOV r32,imm32 N:1 D: REG_ddd O: move P:01 L:1 A: IMM H:MOV AL,moffs8 N:1 D: EAX O: load P:2 L:1 A: SEG+ DISP H:MOV EAX,moffs16 N:1 D: EAX O: load P:2 L:1 A: SEG+ DISP H:MOV EAX,moffs32 N:1 D: EAX O: load P:2 L:1 A: SEG+ DISP H:MOV moffs8,AL N:2 D: sink O: store_data P:4 L:1 A: EAX D: sink O: store_address P:3 L:1 A: SEG+ DISP H:MOV moffs16,EAX N:2 D: sink O: store_data P:4 L:1 A: EAX D: sink O: store_address P:3 L:1 A: SEG+ DISP H:MOV moffs32,EAX N:2 D: sink O: store_data P:4 L:1 A: EAX D: sink O: store_address P:3 L:1 A: SEG+ DISP H:XCHG r/m8,r8 N:3 D: TMP0 O: move P:01 L:1 A: REG_ddd D: REG_ddd O: move P:01 L:1 A: REG_sss D: REG_sss O: move P:01 L:1 A: TMP0) H:XCHG r/m16,r16 N:3 D: TMP0 O: move P:01 L:1 A: REG_ddd D: REG_ddd O: move P:01 L:1 A: REG_sss D: REG_sss O: move P:01 L:1 A: TMP0) H:XCHG r/m32,r32 N:3 D: TMP0 O: move P:01 L:1 A: REG_ddd D: REG_ddd O: move P:01 L:1 A: REG_sss D: REG_sss O: move P:01 L:1 A: TMP0) H:XCHG eAX,r16 N:3 D: TMP0 O: move P:01 L:1 A: REG_ddd D: REG_ddd O: move P:01 L:1 A: EAX D: EAX O: move P:01 L:1 A: TMP0) H:XCHG eAX,r32 N:3 D: TMP0 O: move P:01 L:1 A: REG_ddd D: REG_ddd O: move P:01 L:1 A: EAX D: EAX O: move P:01 L:1 A: TMP0) H:XCHG m8,r8 N:0 H:XCHG m16,r16 N:0 H:XCHG m32,r32 N:0 H:LOCK XCHG m8,r8 N:0 H:LOCK XCHG m16,r16 N:0 H:LOCK XCHG m32,r32 N:0 H:MOV CR0,r32 N:0 H:MOV CR2,r32 N:0 H:MOV CR3,r32 N:0 H:MOV CR4,r32 N:0 H:LMSW r16 N:0 H:LMSW m16 N:0 H:SMSW m16 N:0 H:MOV DRx,r32 N:0 H:MOV r32,CR0 N:0 H:MOV r32,CR2 N:0 H:MOV r32,CR3 N:0 H:MOV r32,CR4 N:0 H:MOV r32,DRx N:0 H:WRMSR N:0 H:RDTSC N:0 H:RDPMC N:0 H:RDMSR N:0 H:CLTS N:0 H:IMUL r16,r/m16 N:1 D: REG_ddd O: int_mul P:0 L:4 A: REG_ddd, REG_sss H:IMUL r32,r/m32 N:1 D: REG_ddd O: int_mul P:0 L:4 A: REG_ddd, REG_sss H:IMUL r16,m16 N:2 D: TMP1 O: load P:2 L:1 A: MEM D: REG_ddd O: int_mul P:0 L:4 A: REG_ddd, TMP1 H:IMUL r32,m32 N:2 D: TMP1 O: load P:2 L:1 A: MEM D: REG_ddd O: int_mul P:0 L:4 A: REG_ddd, TMP1 H:IMUL r16,r/m16,imm8 N:1 D: REG_ddd O: int_mul P:0 L:4 A: REG_sss, IMM H:IMUL r32,r/m32,imm8 N:1 D: REG_ddd O: int_mul P:0 L:4 A: REG_sss, IMM H:IMUL r16,r/m16,imm16 N:1 D: REG_ddd O: int_mul P:0 L:4 A: REG_sss, IMM H:IMUL r32,r/m32,imm16 N:1 D: REG_ddd O: int_mul P:0 L:4 A: REG_sss, IMM H:IMUL r16,r/m16,imm32 N:1 D: REG_ddd O: int_mul P:0 L:4 A: REG_sss, IMM H:IMUL r32,r/m32,imm32 N:1 D: REG_ddd O: int_mul P:0 L:4 A: REG_sss, IMM H:IMUL r16,r/m16,imm8 N:2 D: TMP1 O: load P:2 L:1 A: MEM D: REG_ddd O: int_mul P:0 L:4 A: TMP1, IMM H:IMUL r32,r/m32,imm8 N:2 D: TMP1 O: load P:2 L:1 A: MEM D: REG_ddd O: int_mul P:0 L:4 A: TMP1, IMM H:IMUL r16,r/m16,imm16 N:2 D: TMP1 O: load P:2 L:1 A: MEM D: REG_ddd O: int_mul P:0 L:4 A: TMP1, IMM H:IMUL r32,r/m32,imm16 N:2 D: TMP1 O: load P:2 L:1 A: MEM D: REG_ddd O: int_mul P:0 L:4 A: TMP1, IMM H:IMUL r16,r/m16,imm32 N:2 D: TMP1 O: load P:2 L:1 A: MEM D: REG_ddd O: int_mul P:0 L:4 A: TMP1, IMM H:IMUL r32,r/m32,imm32 N:2 D: TMP1 O: load P:2 L:1 A: MEM D: REG_ddd O: int_mul P:0 L:4 A: TMP1, IMM H:IMUL r/m8 N:1 D: AX O: int_mul P:0 L:4 A: AL, REG_sss H:IMUL m8 N:2 D: TMP1 O: load P:2 L:1 A: MEM D: AX O: int_mul P:0 L:4 A: AL, TMP1 H:IMUL r/m16 N:3 D: TMP0 O: int_mul P:0 L:4 A: EAX, REG_sss D: EAX O: move P:01 L:1 A: TMP0 D: EDX O: P:0 L:1 A: TMP0, CONST H:IMUL m16 N:4 D: TMP1 O: load P:2 L:1 A: MEM D: TMP0 O: int_mul P:0 L:4 A: EAX, TMP1 D: EDX O: P:0 L:1 A: TMP0, CONST D: EAX O: move P:01 L:1 A: TMP0 H:IMUL r/m32 N:3 D: TMP0 O: int_mul P:0 L:4 A: EAX, REG_sss D: EAX O: move P:01 L:1 A: TMP0 D: EDX O: P:0 L:1 A: TMP0, CONST H:IMUL m32 N:4 D: TMP1 O: load P:2 L:1 A: MEM D: TMP0 O: int_mul P:0 L:4 A: EAX, TMP1 D: EDX O: P:0 L:1 A: TMP0, CONST D: EAX O: move P:01 L:1 A: TMP0 H:MUL AL,r/m8 N:1 D: AX O: mul P:0 L:4 A: AL, REG_sss H:MUL AL,m8 N:2 D: TMP1 O: load P:2 L:1 A: MEM D: AX O: mul P:0 L:4 A: AL, TMP1 H:MUL AX,r/m16 N:3 D: TMP0 O: mul P:0 L:4 A: EAX, REG_sss D: EAX O: move P:01 L:1 A: TMP0 D: EDX O: P:0 L:1 A: TMP0, CONST H:MUL AX,m16 N:4 D: TMP1 O: load P:2 L:1 A: MEM D: TMP0 O: mul P:0 L:4 A: EAX, TMP1 D: EDX O: P:0 L:1 A: TMP0, CONST D: EAX O: move P:01 L:1 A: TMP0 H:MUL EAX,r/m32 N:3 D: TMP0 O: mul P:0 L:4 A: EAX, REG_sss D: EAX O: move P:01 L:1 A: TMP0 D: EDX O: P:0 L:1 A: TMP0, CONST H:MUL EAX,m32 N:4 D: TMP1 O: load P:2 L:1 A: MEM D: TMP0 O: mul P:0 L:4 A: EAX, TMP1 D: EDX O: P:0 L:1 A: TMP0, CONST D: EAX O: move P:01 L:1 A: TMP0 H:IDIV AL,r/m8 N:3 D: TMP0 O: int_div P:0 L:99 A: AX, REG_sss D: AL O: move P:01 L:1 A: TMP0 D: AH O: P:0 L:1 A: TMP0, CONST H:IDIV AX,m8 N:4 D: TMP1 O: load P:2 L:1 A: MEM D: TMP0 O: int_div P:0 L:99 A: AX, TMP1 D: AL O: move P:01 L:1 A: TMP0 D: AH O: P:0 L:1 A: TMP0, CONST H:IDIV eAX,r/m16 N:4 D: TMP2 O: P:0 L:1 A: EDX, EAX D: TMP0 O: int_div P:0 L:99 A: TMP2, REG_sss D: EAX O: move P:01 L:1 A: TMP0 D: EDX O: P:0 L:1 A: TMP0, CONST H:IDIV eAX,r/m32 N:4 D: TMP2 O: P:0 L:1 A: EDX, EAX D: TMP0 O: int_div P:0 L:99 A: TMP2, REG_sss D: EAX O: move P:01 L:1 A: TMP0 D: EDX O: P:0 L:1 A: TMP0, CONST H:IDIV AX,m16 N:4 D: TMP1 O: load P:2 L:1 A: MEM D: TMP2 O: P:0 L:1 A: EDX, EAX D: TMP0 O: int_div P:0 L:99 A: TMP2, TMP1 D: EAX O: move P:01 L:1 A: TMP0 H:IDIV AX,m32 N:4 D: TMP1 O: load P:2 L:1 A: MEM D: TMP2 O: P:0 L:1 A: EDX, EAX D: TMP0 O: int_div P:0 L:99 A: TMP2, TMP1 D: EAX O: move P:01 L:1 A: TMP0 H:DIV AL,r/m8 N:3 D: TMP0 O: div P:0 L:99 A: AX, REG_sss D: AL O: move P:01 L:1 A: TMP0 D: AH O: P:0 L:1 A: TMP0, CONST H:DIV AX,m8 N:4 D: TMP1 O: load P:2 L:1 A: MEM D: TMP0 O: div P:0 L:99 A: AX, TMP1 D: AL O: move P:01 L:1 A: TMP0 D: AH O: P:0 L:1 A: TMP0, CONST H:DIV AX,r/m16 N:4 D: TMP2 O: P:0 L:1 A: EDX, EAX D: TMP0 O: div P:0 L:99 A: TMP2, REG_sss D: EAX O: move P:01 L:1 A: TMP0 D: EDX O: P:0 L:1 A: TMP0, CONST H:DIV AX,r/m32 N:4 D: TMP2 O: P:0 L:1 A: EDX, EAX D: TMP0 O: div P:0 L:99 A: TMP2, REG_sss D: EAX O: move P:01 L:1 A: TMP0 D: EDX O: P:0 L:1 A: TMP0, CONST H:DIV AX,m16 N:4 D: TMP1 O: load P:2 L:1 A: MEM D: TMP2 O: P:0 L:1 A: EDX, EAX D: TMP0 O: div P:0 L:99 A: TMP2, TMP1 D: EAX O: move P:01 L:1 A: TMP0 H:DIV AX,m32 N:4 D: TMP1 O: load P:2 L:1 A: MEM D: TMP2 O: P:0 L:1 A: EDX, EAX D: TMP0 O: div P:0 L:99 A: TMP2, TMP1 D: EAX O: move P:01 L:1 A: TMP0 H:SHL r/m8,1 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CONST H:SAL r/m8,1 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CONST H:SHL r/m16,1 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CONST H:SAL r/m16,1 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CONST H:SHL r/m32,1 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CONST H:SAL r/m32,1 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CONST H:SAR r/m8,1 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CONST H:SAR r/m16,1 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CONST H:SAR r/m32,1 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CONST H:SHR r/m8,1 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CONST H:SHR r/m16,1 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CONST H:SHR r/m32,1 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CONST H:SHL r/m8,1 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CONST H:SAL r/m8,1 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CONST H:SHL r/m16,1 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CONST H:SAL r/m16,1 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CONST H:SHL r/m32,1 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CONST H:SAL r/m32,1 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CONST H:SHL m8,1 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SAL m8,1 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SHL m16,1 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SAL m16,1 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SHL m32,1 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SAL m32,1 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SAR m8,1 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SAR m16,1 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SAR m32,1 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SHR m8,1 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SHR m16,1 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SHR m32,1 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SHL m8,1 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SAL m8,1 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SHL m16,1 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SAL m16,1 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SHL m32,1 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SAL m32,1 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SHL r/m8,CL N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CL H:SAL r/m8,CL N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CL H:SHL r/m16,CL N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CL H:SAL r/m16,CL N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CL H:SHL r/m32,CL N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CL H:SAL r/m32,CL N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CL H:SAR r/m8,CL N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CL H:SAR r/m16,CL N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CL H:SAR r/m32,CL N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CL H:SHR r/m8,CL N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CL H:SHR r/m16,CL N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CL H:SHR r/m32,CL N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CL H:SHL r/m8,CL N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CL H:SAL r/m8,CL N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CL H:SHL r/m16,CL N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CL H:SAL r/m16,CL N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CL H:SHL r/m32,CL N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CL H:SAL r/m32,CL N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CL H:SHL m8,CL N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CL D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SAL m8,CL N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CL D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SHL m16,CL N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CL D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SAL m16,CL N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CL D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SHL m32,CL N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CL D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SAL m32,CL N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CL D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SAR m8,CL N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CL D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SAR m16,CL N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CL D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SAR m32,CL N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CL D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SHR m8,CL N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CL D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SHR m16,CL N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CL D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SHR m32,CL N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CL D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SHL m8,CL N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CL D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SAL m8,CL N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CL D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SHL m16,CL N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CL D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SAL m16,CL N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CL D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SHL m32,CL N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CL D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SAL m32,CL N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CL D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SHL r/m8,imm8 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, IMM H:SAL r/m8,imm8 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, IMM H:SHL r/m16,imm8 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, IMM H:SAL r/m16,imm8 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, IMM H:SHL r/m32,imm8 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, IMM H:SAL r/m32,imm8 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, IMM H:SAR r/m8,imm8 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, IMM H:SAR r/m16,imm8 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, IMM H:SAR r/m32,imm8 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, IMM H:SHR r/m8,imm8 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, IMM H:SHR r/m16,imm8 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, IMM H:SHR r/m32,imm8 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, IMM H:SHL r/m8,imm8 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, IMM H:SAL r/m8,imm8 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, IMM H:SHL r/m16,imm8 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, IMM H:SAL r/m16,imm8 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, IMM H:SHL r/m32,imm8 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, IMM H:SAL r/m32,imm8 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, IMM H:SHL m8,imm8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, IMM D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SAL m8,imm8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, IMM D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SHL m16,imm8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, IMM D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SAL m16,imm8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, IMM D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SHL m32,imm8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, IMM D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SAL m32,imm8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, IMM D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SAR m8,imm8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, IMM D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SAR m16,imm8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, IMM D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SAR m32,imm8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, IMM D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SHR m8,imm8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, IMM D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SHR m16,imm8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, IMM D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SHR m32,imm8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, IMM D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SHL m8,imm8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, IMM D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SAL m8,imm8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, IMM D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SHL m16,imm8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, IMM D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SAL m16,imm8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, IMM D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SHL m32,imm8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, IMM D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:SAL m32,imm8 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, IMM D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:ROL r/m8,1 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CONST H:ROL r/m16,1 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CONST H:ROL r/m32,1 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CONST H:ROR r/m8,1 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CONST H:ROR r/m16,1 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CONST H:ROR r/m32,1 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CONST H:ROL m8,1 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:ROL m16,1 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:ROL m32,1 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:ROR m8,1 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:ROR m16,1 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:ROR m32,1 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CONST D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:ROL r/m8,CL N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CL H:ROL r/m16,CL N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CL H:ROL r/m32,CL N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CL H:ROR r/m8,CL N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CL H:ROR r/m16,CL N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CL H:ROR r/m32,CL N:1 D: REG_sss O: P:0 L:1 A: REG_sss, CL H:ROL m8,CL N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CL D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:ROL m16,CL N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CL D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:ROL m32,CL N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CL D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:ROR m8,CL N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CL D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:ROR m16,CL N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CL D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:ROR m32,CL N:4 D: TMP0 O: load P:2 L:1 A: MEM D: TMP0 O: P:0 L:1 A: TMP0, CL D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:ROL r/m8,imm8 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, IMM H:ROL r/m16,imm8 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, IMM H:ROL r/m32,imm8 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, IMM H:ROR r/m8,imm8 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, IMM H:ROR r/m16,imm8 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, IMM H:ROR r/m32,imm8 N:1 D: REG_sss O: P:0 L:1 A: REG_sss, IMM H:ROL m8,imm8 N:0 H:ROL m16,imm8 N:0 H:ROL m32,imm8 N:0 H:ROR m8,imm8 N:0 H:ROR m16,imm8 N:0 H:ROR m32,imm8 N:0 H:RCL r/m8,1 N:2 D: TMP0 O: P:01 L:1 A: ArithFLAGS, REG_sss D: REG_sss O: P:0 L:1 A: TMP0, CONST H:RCL r/m16,1 N:2 D: TMP0 O: P:01 L:1 A: ArithFLAGS, REG_sss D: REG_sss O: P:0 L:1 A: TMP0, CONST H:RCL r/m32,1 N:2 D: TMP0 O: P:01 L:1 A: ArithFLAGS, REG_sss D: REG_sss O: P:0 L:1 A: TMP0, CONST H:RCR r/m8,1 N:2 D: TMP0 O: P:01 L:1 A: ArithFLAGS, REG_sss D: REG_sss O: P:0 L:1 A: TMP0, CONST H:RCR r/m16,1 N:2 D: TMP0 O: P:01 L:1 A: ArithFLAGS, REG_sss D: REG_sss O: P:0 L:1 A: TMP0, CONST H:RCR r/m32,1 N:2 D: TMP0 O: P:01 L:1 A: ArithFLAGS, REG_sss D: REG_sss O: P:0 L:1 A: TMP0, CONST H:RCL m8,1 N:0 H:RCL m16,1 N:0 H:RCL m32,1 N:0 H:RCR m8,1 N:0 H:RCR m16,1 N:0 H:RCR m32,1 N:0 H:RCL r/m8,CL N:0 H:RCL r/m16,CL N:0 H:RCL r/m32,CL N:0 H:RCR r/m8,CL N:0 H:RCR r/m16,CL N:0 H:RCR r/m32,CL N:0 H:RCL m8,CL N:0 H:RCL m16,CL N:0 H:RCL m32,CL N:0 H:RCR m8,CL N:0 H:RCR m16,CL N:0 H:RCR m32,CL N:0 H:RCL r/m8,imm8 N:0 H:RCL r/m16,imm8 N:0 H:RCL r/m32,imm8 N:0 H:RCR r/m8,imm8 N:0 H:RCR r/m16,imm8 N:0 H:RCR r/m32,imm8 N:0 H:RCL m8,imm8 N:0 H:RCL m16,imm8 N:0 H:RCL m32,imm8 N:0 H:RCR m8,imm8 N:0 H:RCR m16,imm8 N:0 H:RCR m32,imm8 N:0 H:SHLD r/m16,r16,imm8 N:2 D: TMP0 O: P:0 L:1 A: REG_sss, IMM D: REG_sss O: shl_double P:0 L:1 A: TMP0, REG_ddd) H:SHLD r/m32,r32,imm8 N:2 D: TMP0 O: P:0 L:1 A: REG_sss, IMM D: REG_sss O: shl_double P:0 L:1 A: TMP0, REG_ddd) H:SHLD r/m16,r16,CL N:2 D: TMP0 O: P:0 L:1 A: REG_sss, CL D: REG_sss O: shl_double P:0 L:1 A: TMP0, REG_ddd) H:SHLD r/m32,r32,CL N:2 D: TMP0 O: P:0 L:1 A: REG_sss, CL D: REG_sss O: shl_double P:0 L:1 A: TMP0, REG_ddd) H:SHLD m16,r16,imm8 N:0 H:SHLD m32,r32,imm8 N:0 H:SHLD m16,r16,CL N:0 H:SHLD m32,r32,CL N:0 H:SHRD r/m16,r16,imm8 N:2 D: TMP0 O: P:0 L:1 A: REG_sss, IMM D: REG_sss O: shr_double P:0 L:1 A: TMP0, REG_ddd) H:SHRD r/m32,r32,imm8 N:2 D: TMP0 O: P:0 L:1 A: REG_sss, IMM D: REG_sss O: shr_double P:0 L:1 A: TMP0, REG_ddd) H:SHRD r/m16,r16,CL N:2 D: TMP0 O: P:0 L:1 A: REG_sss, CL D: REG_sss O: shr_double P:0 L:1 A: TMP0, REG_ddd) H:SHRD r/m32,r32,CL N:2 D: TMP0 O: P:0 L:1 A: REG_sss, CL D: REG_sss O: shr_double P:0 L:1 A: TMP0, REG_ddd) H:SHRD m16,r16,imm8 N:0 H:SHRD m32,r32,imm8 N:0 H:SHRD m16,r16,CL N:0 H:SHRD m32,r32,CL N:0 H:Push r16 N:3 D: sink O: store_data P:4 L:1 A: REG_ddd D: sink O: store_address P:3 L:1 A: (ESP D: ESP O: sub P:01 L:1 A: ESP, REG_OP_Size H:Push r32 N:3 D: sink O: store_data P:4 L:1 A: REG_ddd D: sink O: store_address P:3 L:1 A: (ESP D: ESP O: sub P:01 L:1 A: ESP, REG_OP_Size H:Push r16 N:3 D: sink O: store_data P:4 L:1 A: REG_sss D: sink O: store_address P:3 L:1 A: (ESP D: ESP O: sub P:01 L:1 A: ESP, REG_OP_Size H:Push r32 N:3 D: sink O: store_data P:4 L:1 A: REG_sss D: sink O: store_address P:3 L:1 A: (ESP D: ESP O: sub P:01 L:1 A: ESP, REG_OP_Size H:Push m16 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: sink O: store_data P:4 L:1 A: TMP0) D: sink O: store_address P:3 L:1 A: (ESP D: ESP O: sub P:01 L:1 A: ESP, REG_OP_Size H:Push m32 N:4 D: TMP0 O: load P:2 L:1 A: MEM D: sink O: store_data P:4 L:1 A: TMP0) D: sink O: store_address P:3 L:1 A: (ESP D: ESP O: sub P:01 L:1 A: ESP, REG_OP_Size H:Push imm8 N:3 D: sink O: store_data P:4 L:1 A: IMM D: sink O: store_address P:3 L:1 A: (ESP D: ESP O: sub P:01 L:1 A: ESP, REG_OP_Size H:Push imm16 N:3 D: sink O: store_data P:4 L:1 A: IMM D: sink O: store_address P:3 L:1 A: (ESP D: ESP O: sub P:01 L:1 A: ESP, REG_OP_Size H:Push imm32 N:3 D: sink O: store_data P:4 L:1 A: IMM D: sink O: store_address P:3 L:1 A: (ESP D: ESP O: sub P:01 L:1 A: ESP, REG_OP_Size H:Pop r16 N:2 D: REG_ddd O: load P:2 L:1 A: (ESP D: ESP O: add P:01 L:1 A: ESP, REG_OP_Size H:Pop r32 N:2 D: REG_ddd O: load P:2 L:1 A: (ESP D: ESP O: add P:01 L:1 A: ESP, REG_OP_Size H:Pop eSP N:3 D: TMP0 O: load P:2 L:1 A: (ESP D: ESP O: add P:01 L:1 A: ESP, REG_OP_Size D: ESP O: move P:01 L:1 A: TMP0 H:Pop r16 N:2 D: REG_sss O: load P:2 L:1 A: (ESP D: ESP O: add P:01 L:1 A: ESP, REG_OP_Size H:Pop r32 N:2 D: REG_sss O: load P:2 L:1 A: (ESP D: ESP O: add P:01 L:1 A: ESP, REG_OP_Size H:Pop m16 N:0 H:Pop m32 N:0 H:PUSHA N:0 H:PUSHAD N:0 H:POPA N:0 H:POPAD N:0 H:ENTER N:0 H:leave N:3 D: TMP0 O: move P:01 L:1 A: EBP D: EBP O: load P:2 L:1 A: (TMP0 D: ESP O: add P:01 L:1 A: TMP0, REG_OP_Size H:MOVSB m8,m8 N:0 H:MOVSB m16,m16 N:0 H:MOVSB m32,m32 N:0 H:MOVSW m8,m8 N:0 H:MOVSW m16,m16 N:0 H:MOVSW m32,m32 N:0 H:MOVSD m8,m8 N:0 H:MOVSD m16,m16 N:0 H:MOVSD m32,m32 N:0 H:CMPSB m8,m8 N:0 H:CMPSB m16,m16 N:0 H:CMPSB m32,m32 N:0 H:CMPSW m8,m8 N:0 H:CMPSW m16,m16 N:0 H:CMPSW m32,m32 N:0 H:CMPSD m8,m8 N:0 H:CMPSD m16,m16 N:0 H:CMPSD m32,m32 N:0 H:SCASB m8,m8 N:3 D: TMP1 O: load P:2 L:1 A:EDI D: TMP2 O: sub P:01 L:1 A: EAX, TMP1 D: EDI O: P:2 L:1 A: LINSEG_SUPOVR: (EDI H:SCASB m16,m16 N:3 D: TMP1 O: load P:2 L:1 A:EDI D: TMP2 O: sub P:01 L:1 A: EAX, TMP1 D: EDI O: P:2 L:1 A: LINSEG_SUPOVR: (EDI H:SCASB m32,m32 N:3 D: TMP1 O: load P:2 L:1 A:EDI D: TMP2 O: sub P:01 L:1 A: EAX, TMP1 D: EDI O: P:2 L:1 A: LINSEG_SUPOVR: (EDI H:SCASW m8,m8 N:3 D: TMP1 O: load P:2 L:1 A:EDI D: TMP2 O: sub P:01 L:1 A: EAX, TMP1 D: EDI O: P:2 L:1 A: LINSEG_SUPOVR: (EDI H:SCASW m16,m16 N:3 D: TMP1 O: load P:2 L:1 A:EDI D: TMP2 O: sub P:01 L:1 A: EAX, TMP1 D: EDI O: P:2 L:1 A: LINSEG_SUPOVR: (EDI H:SCASW m32,m32 N:3 D: TMP1 O: load P:2 L:1 A:EDI D: TMP2 O: sub P:01 L:1 A: EAX, TMP1 D: EDI O: P:2 L:1 A: LINSEG_SUPOVR: (EDI H:SCASD m8,m8 N:3 D: TMP1 O: load P:2 L:1 A:EDI D: TMP2 O: sub P:01 L:1 A: EAX, TMP1 D: EDI O: P:2 L:1 A: LINSEG_SUPOVR: (EDI H:SCASD m16,m16 N:3 D: TMP1 O: load P:2 L:1 A:EDI D: TMP2 O: sub P:01 L:1 A: EAX, TMP1 D: EDI O: P:2 L:1 A: LINSEG_SUPOVR: (EDI H:SCASD m32,m32 N:3 D: TMP1 O: load P:2 L:1 A:EDI D: TMP2 O: sub P:01 L:1 A: EAX, TMP1 D: EDI O: P:2 L:1 A: LINSEG_SUPOVR: (EDI H:LODSB m8,m8 N:2 D: EAX O: load P:2 L:1 A: ESI D: ESI O: P:2 L:1 A:* LINSEG_SUPOVR: (ESI H:LODSB m16,m16 N:2 D: EAX O: load P:2 L:1 A: ESI D: ESI O: P:2 L:1 A:* LINSEG_SUPOVR: (ESI H:LODSB m32,m32 N:2 D: EAX O: load P:2 L:1 A: ESI D: ESI O: P:2 L:1 A:* LINSEG_SUPOVR: (ESI H:LODSW m8,m8 N:2 D: EAX O: load P:2 L:1 A: ESI D: ESI O: P:2 L:1 A:* LINSEG_SUPOVR: (ESI H:LODSW m16,m16 N:2 D: EAX O: load P:2 L:1 A: ESI D: ESI O: P:2 L:1 A:* LINSEG_SUPOVR: (ESI H:LODSW m32,m32 N:2 D: EAX O: load P:2 L:1 A: ESI D: ESI O: P:2 L:1 A:* LINSEG_SUPOVR: (ESI H:LODSD m8,m8 N:2 D: EAX O: load P:2 L:1 A: ESI D: ESI O: P:2 L:1 A:* LINSEG_SUPOVR: (ESI H:LODSD m16,m16 N:2 D: EAX O: load P:2 L:1 A: ESI D: ESI O: P:2 L:1 A:* LINSEG_SUPOVR: (ESI H:LODSD m32,m32 N:2 D: EAX O: load P:2 L:1 A: ESI D: ESI O: P:2 L:1 A:* LINSEG_SUPOVR: (ESI H:STOSB m8,m8 N:3 D: sink O: store_data P:4 L:1 A: EAX D: sink O: store_address P:3 L:1 A: EDI D: EDI O: P:2 L:1 A:* LINSEG_SUPOVR: (EDI H:STOSB m16,m16 N:3 D: sink O: store_data P:4 L:1 A: EAX D: sink O: store_address P:3 L:1 A: EDI D: EDI O: P:2 L:1 A:* LINSEG_SUPOVR: (EDI H:STOSB m32,m32 N:3 D: sink O: store_data P:4 L:1 A: EAX D: sink O: store_address P:3 L:1 A: EDI D: EDI O: P:2 L:1 A:* LINSEG_SUPOVR: (EDI H:STOSW m8,m8 N:3 D: sink O: store_data P:4 L:1 A: EAX D: sink O: store_address P:3 L:1 A: EDI D: EDI O: P:2 L:1 A:* LINSEG_SUPOVR: (EDI H:STOSW m16,m16 N:3 D: sink O: store_data P:4 L:1 A: EAX D: sink O: store_address P:3 L:1 A: EDI D: EDI O: P:2 L:1 A:* LINSEG_SUPOVR: (EDI H:STOSW m32,m32 N:3 D: sink O: store_data P:4 L:1 A: EAX D: sink O: store_address P:3 L:1 A: EDI D: EDI O: P:2 L:1 A:* LINSEG_SUPOVR: (EDI H:STOSD m8,m8 N:3 D: sink O: store_data P:4 L:1 A: EAX D: sink O: store_address P:3 L:1 A: EDI D: EDI O: P:2 L:1 A:* LINSEG_SUPOVR: (EDI H:STOSD m16,m16 N:3 D: sink O: store_data P:4 L:1 A: EAX D: sink O: store_address P:3 L:1 A: EDI D: EDI O: P:2 L:1 A:* LINSEG_SUPOVR: (EDI H:STOSD m32,m32 N:3 D: sink O: store_data P:4 L:1 A: EAX D: sink O: store_address P:3 L:1 A: EDI D: EDI O: P:2 L:1 A:* LINSEG_SUPOVR: (EDI H:REP MOVSB m8,m8 N:0 H:REP MOVSB m16,m16 N:0 H:REP MOVSB m32,m32 N:0 H:REP MOVSW m8,m8 N:0 H:REP MOVSW m16,m16 N:0 H:REP MOVSW m32,m32 N:0 H:REP MOVSD m8,m8 N:0 H:REP MOVSD m16,m16 N:0 H:REP MOVSD m32,m32 N:0 H:REP CMPSB m8,m8 N:0 H:REP CMPSB m16,m16 N:0 H:REP CMPSB m32,m32 N:0 H:REP CMPSW m8,m8 N:0 H:REP CMPSW m16,m16 N:0 H:REP CMPSW m32,m32 N:0 H:REP CMPSD m8,m8 N:0 H:REP CMPSD m16,m16 N:0 H:REP CMPSD m32,m32 N:0 H:REP SCASB m8,m8 N:0 H:REP SCASB m16,m16 N:0 H:REP SCASB m32,m32 N:0 H:REP SCASW m8,m8 N:0 H:REP SCASW m16,m16 N:0 H:REP SCASW m32,m32 N:0 H:REP SCASD m8,m8 N:0 H:REP SCASD m16,m16 N:0 H:REP SCASD m32,m32 N:0 H:REP LODSB m8,m8 N:0 H:REP LODSB m16,m16 N:0 H:REP LODSB m32,m32 N:0 H:REP LODSW m8,m8 N:0 H:REP LODSW m16,m16 N:0 H:REP LODSW m32,m32 N:0 H:REP LODSD m8,m8 N:0 H:REP LODSD m16,m16 N:0 H:REP LODSD m32,m32 N:0 H:REP STOSB m8,m8 N:0 H:REP STOSB m16,m16 N:0 H:REP STOSB m32,m32 N:0 H:REP STOSW m8,m8 N:0 H:REP STOSW m16,m16 N:0 H:REP STOSW m32,m32 N:0 H:REP STOSD m8,m8 N:0 H:REP STOSD m16,m16 N:0 H:REP STOSD m32,m32 N:0 H:MOVSX r16,r/m8 N:1 D: REG_ddd O: move P:01 L:1 A: REG_sss H:MOVSX r32,r/m8 N:1 D: REG_ddd O: move P:01 L:1 A: REG_sss H:MOVSX r32,r/m16 N:1 D: REG_ddd O: move P:01 L:1 A: REG_sss H:MOVSX r16,m8 N:1 D: REG_ddd O: load P:2 L:1 A: MEM H:MOVSX r32,m8 N:1 D: REG_ddd O: load P:2 L:1 A: MEM H:MOVSX r16,m16 N:1 D: REG_ddd O: load P:2 L:1 A: MEM H:MOVSX r32,m16 N:1 D: REG_ddd O: load P:2 L:1 A: MEM H:MOVZX r16,r/m8 N:1 D: REG_ddd O: move P:01 L:1 A: REG_sss H:MOVZX r32,r/m8 N:1 D: REG_ddd O: move P:01 L:1 A: REG_sss H:MOVZX r32,r/m16 N:1 D: REG_ddd O: move P:01 L:1 A: REG_sss H:MOVZX r16,m8 N:1 D: REG_ddd O: load P:2 L:1 A: MEM H:MOVZX r32,m8 N:1 D: REG_ddd O: load P:2 L:1 A: MEM H:MOVZX r32,m16 N:1 D: REG_ddd O: load P:2 L:1 A: MEM H:CWD N:1 D: EDX O: sar P:0 L:1 A: EAX, CONST H:CDQ N:1 D: EDX O: sar P:0 L:1 A: EAX, CONST H:CBW N:1 D: AX O: move P:01 L:1 A: AL H:CWDE N:1 D: EAX O: move P:01 L:1 A: AX H:FADD ST,ST( i) N:1 D: ST0 O: P:0 L:4_or_5_or_99 A: ST0, ST( i) H:FMUL ST,ST( i) N:1 D: ST0 O: P:0 L:4_or_5_or_99 A: ST0, ST( i) H:FSUB ST,ST( i) N:1 D: ST0 O: P:0 L:4_or_5_or_99 A: ST0, ST( i) H:FDIV ST,ST( i) N:1 D: ST0 O: P:0 L:4_or_5_or_99 A: ST0, ST( i) H:FADD ST( i),ST N:1 D: ST( i) O: P:0 L:4_or_5_or_99 A: ST0, ST( i) H:FMUL ST( i),ST N:1 D: ST( i) O: P:0 L:4_or_5_or_99 A: ST0, ST( i) H:FSUBR ST( i),ST N:1 D: ST( i) O: P:0 L:4_or_5_or_99 A: ST0, ST( i) H:FDIVR ST( i),ST N:1 D: ST( i) O: P:0 L:4_or_5_or_99 A: ST0, ST( i) H:FADDP ST( i),ST N:1 D: ST( i) O: P:0 L:4_or_5_or_99 A: ST( i), ST0 H:FSUBP ST( i),ST N:1 D: ST( i) O: P:0 L:4_or_5_or_99 A: ST( i), ST0 H:FMULP ST( i),ST N:1 D: ST( i) O: P:0 L:4_or_5_or_99 A: ST( i), ST0 H:FDIVP ST( i),ST N:1 D: ST( i) O: P:0 L:4_or_5_or_99 A: ST( i), ST0 H:FSUB ST( i),ST N:1 D: ST( i) O: P:0 L:4_or_5_or_99 A: ST( i), ST0 H:FDIV ST( i),ST N:1 D: ST( i) O: P:0 L:4_or_5_or_99 A: ST( i), ST0 H:FSUBR ST,ST( i) N:1 D: ST0 O: P:0 L:4_or_5_or_99 A: ST( i), ST0 H:FDIVR ST,ST( i) N:1 D: ST0 O: P:0 L:4_or_5_or_99 A: ST( i), ST0 H:FSUBRP ST( i),ST N:1 D: ST( i) O: P:0 L:4_or_5_or_99 A: ST0, ST( i) H:FDIVRP ST( i),ST N:1 D: ST( i) O: P:0 L:4_or_5_or_99 A: ST0, ST( i) H:FADD m32real N:2 D: TMP0 O: fp_load P:2 L:1 A: MEM D: ST0 O: P:0 L:4_or_5_or_99 A: ST0, TMP0) H:FADD m64real N:2 D: TMP0 O: fp_load P:2 L:1 A: MEM D: ST0 O: P:0 L:4_or_5_or_99 A: ST0, TMP0) H:FSUB m32real N:2 D: TMP0 O: fp_load P:2 L:1 A: MEM D: ST0 O: P:0 L:4_or_5_or_99 A: ST0, TMP0) H:FSUB m64real N:2 D: TMP0 O: fp_load P:2 L:1 A: MEM D: ST0 O: P:0 L:4_or_5_or_99 A: ST0, TMP0) H:FMUL m32real N:2 D: TMP0 O: fp_load P:2 L:1 A: MEM D: ST0 O: P:0 L:4_or_5_or_99 A: ST0, TMP0) H:FMUL m64real N:2 D: TMP0 O: fp_load P:2 L:1 A: MEM D: ST0 O: P:0 L:4_or_5_or_99 A: ST0, TMP0) H:FDIV m32real N:2 D: TMP0 O: fp_load P:2 L:1 A: MEM D: ST0 O: P:0 L:4_or_5_or_99 A: ST0, TMP0) H:FDIV m64real N:2 D: TMP0 O: fp_load P:2 L:1 A: MEM D: ST0 O: P:0 L:4_or_5_or_99 A: ST0, TMP0) H:FSUBR m32real N:2 D: TMP0 O: fp_load P:2 L:1 A: MEM D: ST0 O: P:0 L:4_or_5_or_99 A: TMP0, ST0) H:FSUBR m64real N:2 D: TMP0 O: fp_load P:2 L:1 A: MEM D: ST0 O: P:0 L:4_or_5_or_99 A: TMP0, ST0) H:FDIVR m32real N:2 D: TMP0 O: fp_load P:2 L:1 A: MEM D: ST0 O: P:0 L:4_or_5_or_99 A: TMP0, ST0) H:FDIVR m64real N:2 D: TMP0 O: fp_load P:2 L:1 A: MEM D: ST0 O: P:0 L:4_or_5_or_99 A: TMP0, ST0) H:FIADD m32int N:0 H:FIADD m16int N:0 H:FISUB m32int N:0 H:FISUB m16int N:0 H:FIMUL m32int N:0 H:FIMUL m16int N:0 H:FIDIV m32int N:0 H:FIDIV m16int N:0 H:FISUBR m32int N:0 H:FISUBR m16int N:0 H:FIDIVR m32int N:0 H:FIDIVR m16int N:0 H:FSQRT N:1 D: ST0 O: fp_sqrt P:0 L:66 A: ST0, CONST H:FCOM m32real N:2 D: TMP0 O: fp_load P:2 L:1 A: MEM D: sink O: fp_compare P:0 L:1 A: ST0, TMP0 H:FCOM m64real N:2 D: TMP0 O: fp_load P:2 L:1 A: MEM D: sink O: fp_compare P:0 L:1 A: ST0, TMP0 H:FCOM STi N:1 D: sink O: fp_compare P:0 L:1 A: ST0, ST( i) H:FCOM2 STi N:1 D: sink O: fp_compare P:0 L:1 A: ST0, ST( i) H:FCOMP m32real N:2 D: TMP0 O: fp_load P:2 L:1 A: MEM D: sink O: fp_compare P:0 L:1 A: ST0, TMP0 H:FCOMP m64real N:2 D: TMP0 O: fp_load P:2 L:1 A: MEM D: sink O: fp_compare P:0 L:1 A: ST0, TMP0 H:FCOMP STi N:1 D: sink O: fp_compare P:0 L:1 A: ST0, ST( i) H:FCOMP3 STi N:1 D: sink O: fp_compare P:0 L:1 A: ST0, ST( i) H:FCOMP5 STi N:1 D: sink O: fp_compare P:0 L:1 A: ST0, ST( i) H:FCOMPP N:2 D: sink O: fp_compare P:0 L:1 A: ST0, ST1 D: sink O: move P:01 L:1 A: ST0 H:FICOM m32int N:0 H:FICOM m16int N:0 H:FICOMP m32int N:0 H:FICOMP m16int N:0 H:FTST N:1 D: sink O: fp_compare P:0 L:1 A: ST0, CONST H:FUCOM STi N:1 D: sink O: fp_compare P:0 L:1 A: ST0, ST( i) H:FUCOMP STi N:1 D: sink O: fp_compare P:0 L:1 A: ST0, ST( i) H:FUCOMPP N:2 D: sink O: fp_compare P:0 L:1 A: ST0, ST1 D: sink O: move P:01 L:1 A: ST0 H:FXAM N:1 D: sink O: fp_examine P:0 L:3 A: ST0 H:FCOMI STi N:1 D: sink O: fp_compare P:( not found) L:1 A: ST0, ST( i) H:FCOMIP STi N:1 D: sink O: fp_compare P:( not found) L:1 A: ST0, ST( i) H:FUCOMI STi N:1 D: sink O: fp_compare P:( not found) L:1 A: ST0, ST( i) H:FUCOMIP STi N:1 D: sink O: fp_compare P:( not found) L:1 A: ST0, ST( i) H:FLDZ N:1 D: ST7 O: fp_move P:0 L:1 A: CONST H:FLD1 N:2 D: TMP0 O: freadrom P:( not found) L:1 A: CONST D: ST7 O: fp_move P:0 L:1 A: TMP0) H:FLDPI N:2 D: TMP0 O: freadrom P:( not found) L:1 A: CONST D: ST7 O: fp_normalize P:0 L:3 A: TMP0 H:FLDL2T N:2 D: TMP0 O: freadrom P:( not found) L:1 A: CONST D: ST7 O: fp_normalize P:0 L:3 A: TMP0 H:FLDL2E N:2 D: TMP0 O: freadrom P:( not found) L:1 A: CONST D: ST7 O: fp_normalize P:0 L:3 A: TMP0 H:FLDLG2 N:2 D: TMP0 O: freadrom P:( not found) L:1 A: CONST D: ST7 O: fp_normalize P:0 L:3 A: TMP0 H:FLDLN2 N:2 D: TMP0 O: freadrom P:( not found) L:1 A: CONST D: ST7 O: fp_normalize P:0 L:3 A: TMP0 H:FNINIT N:0 H:FNSTCW m2byte N:3 D: TMP0 O: P:( not found) L:1 A: CONST, CONST D: sink O: store_data P:4 L:1 A: TMP0) D: sink O: store_address P:3 L:1 A: MEM H:FNSTENV m14byte N:0 H:FNSTENV m28byte N:0 H:FNSAVE m94byte N:0 H:FNSAVE m108byte N:0 H:FLDCW m2byte N:3 D: TMP0 O: load P:2 L:1 A: MEM D: sink O: P:( not found) L:1 A: CONST, TMP0 D: sink O: move P:01 L:1 A: CONST H:FRSTOR m14byte N:0 H:FRSTOR m28byte N:0 H:FRSTOR m94byte N:0 H:FRSTOR m108byte N:0 H:FNCLEX N:3 D: sink O: move P:01 L:1 A: CONST D: FSW O: and P:01 L:1 A: FSW, CONST D: sink O: move P:01 L:1 A: CONST H:FNSTSW m2byte N:3 D: TMP0 O: P:0 L:1 A: FCC, FSW D: sink O: store_data P:4 L:1 A: TMP0 D: sink O: store_address P:3 L:1 A: MEM H:FNSTSW AX N:3 D: TMP0 O: P:0 L:1 A: FCC, FSW D: TMP1 O: shr P:0 L:1 A: EAX, CONST D: EAX O: P:0 L:1 A: TMP1, TMP0 H:FDISI N:1 D: sink O: move P:01 L:1 A: CONST H:FENI N:1 D: sink O: move P:01 L:1 A: CONST H:FSETPM N:1 D: sink O: move P:01 L:1 A: CONST H:FINCSTP N:1 D: sink O: fp_move P:0 L:1 A: CONST H:FDECSTP N:1 D: sink O: fp_move P:0 L:1 A: CONST H:FFREE ST( i) N:1 D: sink O: fp_move P:0 L:1 A: ST( i) H:FFREEP ST( i) N:2 D: sink O: fp_move P:0 L:1 A: ST( i) D: sink O: fp_move P:0 L:1 A: ST0 H:FNOP N:1 D: sink O: fp_move P:0 L:1 A: CONST H:FWAIT N:2 D: sink O: move P:01 L:1 A: CONST D: sink O: move P:01 L:1 A: CONST H:FILD m16int N:4 D: TMP1 O: fp_load P:2 L:1 A: MEM D: TMP0 O: freadrom P:( not found) L:1 A: CONST D: TMP2 O: P:0 L:1 A: TMP1 D: ST7 O: fp_convert P:0 L:3 A: TMP0, TMP2 H:FILD m32int N:4 D: TMP1 O: fp_load P:2 L:1 A: MEM D: TMP0 O: freadrom P:( not found) L:1 A: CONST D: TMP2 O: P:0 L:1 A: TMP1 D: ST7 O: fp_convert P:0 L:3 A: TMP0, TMP2 H:FILD m64int N:4 D: TMP1 O: fp_load P:2 L:1 A: MEM D: TMP0 O: freadrom P:( not found) L:1 A: CONST D: TMP2 O: P:0 L:1 A: TMP1 D: ST7 O: fp_convert P:0 L:3 A: TMP0, TMP2 H:FLD m32real N:1 D: ST7 O: fp_load P:2 L:1 A: MEM H:FLD m64real N:1 D: ST7 O: fp_load P:2 L:1 A: MEM H:FLD m80real N:4 D: TMP2 O: fp_load P:2 L:1 A: MEM D: TMP0 O: load_ea P:0 L:1 A: base_BBB D: TMP3 O: fp_load P:2 L:1 A: TMP0 D: ST7 O: merge P:0 L:1 A: TMP3, TMP2 H:FLD STi N:1 D: ST7 O: fp_move P:0 L:1 A: ST( i) H:FIST m16int N:4 D: TMP0 O: freadrom P:( not found) L:1 A: CONST D: TMP1 O: fp_convert P:0 L:3 A: TMP0, ST0 D: sink O: fp_store_data P:4 L:1 A: TMP1 D: sink O: fp_store_address P:3 L:1 A: MEM H:FIST m32int N:4 D: TMP0 O: freadrom P:( not found) L:1 A: CONST D: TMP1 O: fp_convert P:0 L:3 A: TMP0, ST0 D: sink O: fp_store_data P:4 L:1 A: TMP1 D: sink O: fp_store_address P:3 L:1 A: MEM H:FISTP m16int N:4 D: TMP0 O: freadrom P:( not found) L:1 A: CONST D: TMP1 O: fp_convert P:0 L:3 A: TMP0, ST0 D: sink O: fp_store_data P:4 L:1 A: ST0, TMP1 D: sink O: fp_store_address P:3 L:1 A: MEM H:FISTP m32int N:4 D: TMP0 O: freadrom P:( not found) L:1 A: CONST D: TMP1 O: fp_convert P:0 L:3 A: TMP0, ST0 D: sink O: fp_store_data P:4 L:1 A: ST0, TMP1 D: sink O: fp_store_address P:3 L:1 A: MEM H:FISTP m64int N:4 D: TMP0 O: freadrom P:( not found) L:1 A: CONST D: TMP1 O: fp_convert P:0 L:3 A: TMP0, ST0 D: sink O: fp_store_data P:4 L:1 A: ST0, TMP1 D: sink O: fp_store_address P:3 L:1 A: MEM H:FST m32real N:2 D: sink O: fp_store_data P:4 L:1 A: ST0 D: sink O: fp_store_address P:3 L:1 A: MEM H:FST m64real N:2 D: sink O: fp_store_data P:4 L:1 A: ST0 D: sink O: fp_store_address P:3 L:1 A: MEM H:FST STi N:1 D: ST( i) O: fp_move P:0 L:1 A: ST0 H:FSTP m32real N:2 D: sink O: fp_store_data P:4 L:1 A: ST0 D: sink O: fp_store_address P:3 L:1 A: MEM H:FSTP m64real N:2 D: sink O: fp_store_data P:4 L:1 A: ST0 D: sink O: fp_store_address P:3 L:1 A: MEM H:FSTP m80real N:0 H:FSTP STi N:1 D: ST( i) O: fp_move P:0 L:1 A: ST0 H:FSTP8 STi N:1 D: ST( i) O: fp_move P:0 L:1 A: ST0 H:FSTP9 STi N:1 D: ST( i) O: fp_move P:0 L:1 A: ST0 H:FSTP1 STi N:1 D: ST( i) O: fp_move P:0 L:1 A: ST0 H:FXCH STi N:1 D: sink O: fp_exchange P:( none*) L:1 A: ST0, ST( i) H:FXCH4 STi N:1 D: sink O: fp_exchange P:( none*) L:1 A: ST0, ST( i) H:FXCH7 STi N:1 D: sink O: fp_exchange P:( none*) L:1 A: ST0, ST( i) H:FCMOVB STi N:2 D: MP0 O: merge P:0 L:1 A: ArithFLAGS, ST( i) D: ST0 O: fp_select P:0 L:1 A: TMP0, ST0 H:FCMOVE STi N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, ST( i) D: ST0 O: fp_select P:0 L:1 A: TMP0, ST0 H:FCMOVBE STi N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, ST( i) D: ST0 O: fp_select P:0 L:1 A: TMP0, ST0 H:FCMOVU STi N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, ST( i) D: ST0 O: fp_select P:0 L:1 A: TMP0, ST0 H:FCMOVNB STi N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, ST( i) D: ST0 O: fp_select P:0 L:1 A: TMP0, ST0 H:FCMOVNE STi N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, ST( i) D: ST0 O: fp_select P:0 L:1 A: TMP0, ST0 H:FCMOVNBE STi N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, ST( i) D: ST0 O: fp_select P:0 L:1 A: TMP0, ST0 H:FCMOVNU STi N:2 D: TMP0 O: merge P:0 L:1 A: ArithFLAGS, ST( i) D: ST0 O: fp_select P:0 L:1 A: TMP0, ST0 H:FABS N:1 D: ST0 O: fp_xor_sign P:0 L:1 A: ST0, ST0 H:FCHS N:3 D: TMP0 O: fp_move P:0 L:1 A: ST0 D: TMP1 O: freadrom P:( not found) L:1 A: CONST D: ST0 O: fp_xor P:0 L:1 A: TMP0, TMP1 H:FPREM N:0 H:FPREM1 N:0 H:FBLD m80dec N:0 H:FBSTP m80dec N:0 H:FRNDINT N:0 H:FSCALE N:0 H:FXTRACT N:0 H:F2XM1 N:0 H:FCOS N:0 H:FPATAN N:0 H:FPTAN N:0 H:FSIN N:0 H:FSINCOS N:0 H:FYL2X N:0 H:FYL2XP1 N:0 --------------------------------------------------------- --------------------------------------------------------- [Credits & Info]: So Long and Thaks for All the Fish, guys ;) ---------------------------------------------------------- Q&A: Q. - How to find latest version of OPCODE.LST ? A. - You may find it within Ralf's INTERxx.ZIP. Q. - Did PHG have WWW page, where placed OPCODE.LST ? A. - http://www.chat.ru/~phg ----------------------------------------------------------- [2 All] If You found some errors or incorrections in this text please send info 'bout it. ----------------------------------------------------------- Sorry, But EOF