Intel 64 and IA-32 Architectures. Software Developer’s Manual (Collection, 2023)

ARCHITECTURE COMPATIBILITY

instructions are guaranteed to be monotonic, with respect to the input operands, throughout the domain supported

by the instruction.

Transcendental instructions may generate different results in the round-up flag (C1) on the 32-bit x87 FPUs. The

round-up flag is undefined for these instructions on the 16-bit IA-32 math coprocessors. This difference has no

impact on existing software.

23.18.9 Obsolete Instructions and Undefined Opcodes

The 8087 math coprocessor instructions FENI and FDISI, and the Intel 287 math coprocessor instruction FSETPM

are treated as integer NOP instructions in the 32-bit x87 FPUs. If these opcodes are detected in the instruction

stream, no specific operation is performed and no internal states are affected. FSETPM informed the Intel 287 math

coprocessor that the processor was in protected mode. The 32-bit x87 FPUs handle all addressing and exception-

pointer information, whether in protected mode or not.

For compatibility with prior generations there are a few reserved x87 opcodes which do not result in an invalid-

opcode (#UD) exception, but rather result in the same behavior as existing defined x87 instructions. In the interest

of standardization, it is recommended that the opcodes defined in the Intel^® 64 and IA-32 Architectures Software

Developer’s Manual, Volumes 2A, 2B, 2C, & 2D, be used for these operations for standardization.

• DCD0H through DCD7H - Behaves the same as FCOM, D8D0H through D8D7H.

• DCD8H through DCDFH - Behaves the same as FCOMP, D8D8H through D8DFH.

• D0C8H through D0CFH - Behaves the same as FXCH, D9C8H through D9CFH.

• DED0H through DED7H - Behaves the same as FCOMP, D8D8H through D8DFH.

• DFD0H through DFD7H - Behaves the same as FSTP, DDD8H through DDDFH.

• DFC8H through DFCFH - Behaves the same as FXCH, D9C8H through D9CFH.

• DFD8H through DFDFH - Behaves the same as FSTP, DDD8H through DDDFH.

There are a few reserved x87 opcodes which provide unique behavior but do not provide capabilities which are not

already available in the main instructions defined in the Intel^® 64 and IA-32 Architectures Software Developer’s

Manual, Volumes 2A, 2B, 2C, & 2D.

• D9D8H through D9DFH - Behaves the same as FSTP (DDD8H through DDDFH) but won't cause a stack

underflow exception.

• DFC0H through DFC7H - Behaves the same as FFREE (DDC0H through DDD7H) with the addition of an x87

stack POP.

23.18.10 WAIT/FWAIT Prefix Differences

On the Intel486 processor, when a WAIT/FWAIT instruction precedes a floating-point instruction (one which itself

automatically synchronizes with the previous floating-point instruction), the WAIT/FWAIT instruction is treated as

a no-op. Pending floating-point exceptions from a previous floating-point instruction are processed not on the

WAIT/FWAIT instruction but on the floating-point instruction following the WAIT/FWAIT instruction. In such a case,

the report of a floating-point exception may appear one instruction later on the Intel486 processor than on a P6

family or Pentium FPU, or on Intel 387 math coprocessor.

23.18.11 Operands Split Across Segments and/or Pages

On the P6 family, Pentium, and Intel486 processor FPUs, when the first half of an operand to be written is inside a

page or segment and the second half is outside, a memory fault can cause the first half to be stored but not the

second half. In this situation, the Intel 387 math coprocessor stores nothing.

23.18.12 FPU Instruction Synchronization

On the 32-bit x87 FPUs, all floating-point instructions are automatically synchronized; that is, the processor auto-

matically waits until the previous floating-point instruction has completed before completing the next floating-point

Vol. 3B

23-15

ARCHITECTURE COMPATIBILITY

instruction. No explicit WAIT/FWAIT instructions are required to assure this synchronization. For the 8087 math

coprocessors, explicit waits are required before each floating-point instruction to ensure synchronization. Although

8087 programs having explicit WAIT instructions execute perfectly on the 32-bit IA-32 processors without reas-

sembly, these WAIT instructions are unnecessary.

23.19 SERIALIZING INSTRUCTIONS

Certain instructions have been defined to serialize instruction execution to ensure that modifications to flags, regis-

ters, and memory are completed before the next instruction is executed (or in P6 family processor terminology

“committed to machine state”). Because the P6 family processors use branch-prediction and out-of-order execu-

tion techniques to improve performance, instruction execution is not generally serialized until the results of an

executed instruction are committed to machine state (see Chapter 2, “Intel® 64 and IA-32 Architectures,” in the

Intel^® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1).

As a result, at places in a program or task where it is critical to have execution completed for all previous instruc-

tions before executing the next instruction (for example, at a branch, at the end of a procedure, or in multipro-

cessor dependent code), it is useful to add a serializing instruction. See Section 9.3, “Serializing Instructions,” for

more information on serializing instructions.

23.20 FPU AND MATH COPROCESSOR INITIALIZATION

Table 10-1 shows the states of the FPUs in the P6 family, Pentium, Intel486 processors and of the Intel 387 math

coprocessor and Intel 287 coprocessor following a power-up, reset, or INIT, or following the execution of an

FINIT/FNINIT instruction. The following is some additional compatibility information concerning the initialization of

x87 FPUs and math coprocessors.

23.20.1 Intel® 387 and Intel® 287 Math Coprocessor Initialization

Following an Intel386 processor reset, the processor identifies its coprocessor type (Intel^® 287 or Intel^® 387 DX

math coprocessor) by sampling its ERROR# input some time after the falling edge of RESET# signal and before

execution of the first floating-point instruction. The Intel 287 coprocessor keeps its ERROR# output in inactive

state after hardware reset; the Intel 387 coprocessor keeps its ERROR# output in active state after hardware

reset.

Upon hardware reset or execution of the FINIT/FNINIT instruction, the Intel 387 math coprocessor signals an error

condition. The P6 family, Pentium, and Intel486 processors, like the Intel 287 coprocessor, do not.

23.20.2 Intel486 SX Processor and Intel 487 SX Math Coprocessor Initialization

When initializing an Intel486 SX processor and an Intel 487 SX math coprocessor, the initialization routine should

check the presence of the math coprocessor and should set the FPU related flags (EM, MP, and NE) in control

gives the recommended settings for these flags when the math coprocessor is present. The FSTCW instruction will

give a value of FFFFH for the Intel486 SX microprocessor and 037FH for the Intel 487 SX math coprocessor.

23-16

Vol. 3B

ARCHITECTURE COMPATIBILITY

Table 23-2. Recommended Values of the EM, MP, and NE Flags for Intel486 SX Microprocessor/Intel 487 SX Math

Coprocessor System

CR0 Flags

Intel486 SX Processor Only

Intel 487 SX Math Coprocessor Present

0, for MS-DOS* systems

1, for user-defined exception handler

The EM and MP flags in register CR0 are interpreted as shown in Table 23-3.

Table 23-3. EM and MP Flag Interpretation

Interpretation

Floating-point instructions are passed to FPU; WAIT/FWAIT and other waiting-type instructions

ignore TS.

Floating-point instructions are passed to FPU; WAIT/FWAIT and other waiting-type instructions

test TS.

Floating-point instructions trap to emulator; WAIT/FWAIT and other waiting-type instructions

ignore TS.

Floating-point instructions trap to emulator; WAIT/FWAIT and other waiting-type instructions

test TS.

Following is an example code sequence to initialize the system and check for the presence of Intel486 SX

processor/Intel 487 SX math coprocessor.

fninit

fstcw mem_loc

mov ax, mem_loc

cmp ax, 037fh

jz Intel487_SX_Math_CoProcessor_present

;ax=037fh

jmp Intel486_SX_microprocessor_present

;ax=ffffh

If the Intel 487 SX math coprocessor is not present, the following code can be run to set the CR0 register for the

Intel486 SX processor.

mov eax, cr0

and eax, fffffffdh

;make MP=0

or eax, 0024h

;make EM=1, NE=1

mov cr0, eax

This initialization will cause any floating-point instruction to generate a device not available exception (#NH), inter-

rupt 7. The software emulation will then take control to execute these instructions. This code is not required if an

Intel 487 SX math coprocessor is present in the system. In that case, the typical initialization routine for the

Intel486 SX microprocessor will be adequate.

Also, when designing an Intel486 SX processor based system with an Intel 487 SX math coprocessor, timing loops

should be independent of frequency and clocks per instruction. One way to attain this is to implement these loops

in hardware and not in software (for example, BIOS).

23.21 CONTROL REGISTERS

The following sections identify the new control registers and control register flags and fields that were introduced

to the 32-bit IA-32 in various processor families. See Figure 2-7 for the location of these flags and fields in the

control registers.

Vol. 3B

23-17

ARCHITECTURE COMPATIBILITY

The Pentium III processor introduced one new control flag in control register CR4:

• OSXMMEXCPT (bit 10) — The OS will set this bit if it supports unmasked SIMD floating-point exceptions.

The Pentium II processor introduced one new control flag in control register CR4:

• OSFXSR (bit 9) — The OS supports saving and restoring the Pentium III processor state during context

switches.

The Pentium Pro processor introduced three new control flags in control register CR4:

• PAE (bit 5) — Physical address extension. Enables paging mechanism to reference extended physical addresses

when set; restricts physical addresses to 32 bits when clear (see also: Section 23.22.1.1, “Physical Memory

Addressing Extension”).

• PGE (bit 7) — Page global enable. Inhibits flushing of frequently-used or shared pages on CR3 writes (see also:

Section 23.22.1.2, “Global Pages”).

• PCE (bit 8) — Performance-monitoring counter enable. Enables execution of the RDPMC instruction at any

protection level.

The content of CR4 is 0H following a hardware reset.

Control register CR4 was introduced in the Pentium processor. This register contains flags that enable certain new

extensions provided in the Pentium processor:

• VME — Virtual-8086 mode extensions. Enables support for a virtual interrupt flag in virtual-8086 mode (see

Section 21.3, “Interrupt and Exception Handling in Virtual-8086 Mode”).

• PVI — Protected-mode virtual interrupts. Enables support for a virtual interrupt flag in protected mode (see

Section 21.4, “Protected-Mode Virtual Interrupts”).

• TSD — Time-stamp disable. Restricts the execution of the RDTSC instruction to procedures running at

privileged level 0.

• DE — Debugging extensions. Causes an undefined opcode (#UD) exception to be generated when debug

registers DR4 and DR5 are references for improved performance (see Section 23.23.3, “Debug Registers DR4

and DR5”).

• PSE — Page size extensions. Enables 4-MByte pages with 32-bit paging when set (see Section 4.3, “32-Bit

Paging”).

• MCE — Machine-check enable. Enables the machine-check exception, allowing exception handling for certain

hardware error conditions (see Chapter 16, “Machine-Check Architecture”).

The Intel486 processor introduced five new flags in control register CR0:

• NE — Numeric error. Enables the normal mechanism for reporting floating-point numeric errors.

• WP — Write protect. Write-protects read-only pages against supervisor-mode accesses.

• AM — Alignment mask. Controls whether alignment checking is performed. Operates in conjunction with the AC

(Alignment Check) flag.

• NW — Not write-through. Enables write-throughs and cache invalidation cycles when clear and disables invali-

dation cycles and write-throughs that hit in the cache when set.

• CD — Cache disable. Enables the internal cache when clear and disables the cache when set.

The Intel486 processor introduced two new flags in control register CR3:

• PCD — Page-level cache disable. The state of this flag is driven on the PCD# pin during bus cycles that are not

paged, such as interrupt acknowledge cycles, when paging is enabled. The PCD# pin is used to control caching

in an external cache on a cycle-by-cycle basis.

• PWT — Page-level write-through. The state of this flag is driven on the PWT# pin during bus cycles that are not

paged, such as interrupt acknowledge cycles, when paging is enabled. The PWT# pin is used to control write

through in an external cache on a cycle-by-cycle basis.

23-18

Vol. 3B

ARCHITECTURE COMPATIBILITY

23.22 MEMORY MANAGEMENT FACILITIES

The following sections describe the new memory management facilities available in the various IA-32 processors

and some compatibility differences.

23.22.1 New Memory Management Control Flags

The Pentium Pro processor introduced three new memory management features: physical memory addressing

extension, the global bit in page-table entries, and general support for larger page sizes. These features are only

available when operating in protected mode.

23.22.1.1 Physical Memory Addressing Extension

The new PAE (physical address extension) flag in control register CR4, bit 5, may enable additional address lines

on the processor, allowing extended physical addresses. This option can only be used when paging is enabled,

using a new page-table mechanism provided to support the larger physical address range (see Section 4.1, “Paging

Modes and Control Bits”).

23.22.1.2 Global Pages

The new PGE (page global enable) flag in control register CR4, bit 7, provides a mechanism for preventing

frequently used pages from being flushed from the translation lookaside buffer (TLB). When this flag is set,

frequently used pages (such as pages containing kernel procedures or common data tables) can be marked global

by setting the global flag in a page-directory or page-table entry.

On a task switch or a write to control register CR3 (which normally causes the TLBs to be flushed), the entries in

the TLB marked global are not flushed. Marking pages global in this manner prevents unnecessary reloading of the

TLB due to TLB misses on frequently used pages. See Section 4.10, “Caching Translation Information,” for a

detailed description of this mechanism.

23.22.1.3 Larger Page Sizes

The P6 family processors support large page sizes. For 32-bit paging, this facility is enabled with the PSE (page size

extension) flag in control register CR4, bit 4. When this flag is set, the processor supports either 4-KByte or 4-

MByte page sizes. PAE paging and 4-level paging¹ support 2-MByte pages regardless of the value of CR4.PSE (see

Section 4.4, “PAE Paging,” and Section 4.5, “4-Level Paging and 5-Level Paging”). See Chapter 4, “Paging,” for

more information about large page sizes.

23.22.2 CD and NW Cache Control Flags

The CD and NW flags in control register CR0 were introduced in the Intel486 processor. In the P6 family and

Pentium processors, these flags are used to implement a writeback strategy for the data cache; in the Intel486

processor, they implement a write-through strategy. See Table 12-5 for a comparison of these bits on the P6 family,

Pentium, and Intel486 processors. For complete information on caching, see Chapter 12, “Memory Cache Control.”

23.22.3 Descriptor Types and Contents

Operating-system code that manages space in descriptor tables often contains an invalid value in the access-rights

field of descriptor-table entries to identify unused entries. Access rights values of 80H and 00H remain invalid for

the P6 family, Pentium, Intel486, Intel386, and Intel 286 processors. Other values that were invalid on the Intel

286 processor may be valid on the 32-bit processors because uses for these bits have been defined.

1. Earlier versions of this manual used the term “IA-32e paging” to identify 4-level paging.

Vol. 3B

23-19

ARCHITECTURE COMPATIBILITY

23.22.4 Changes in Segment Descriptor Loads

On the Intel386 processor, loading a segment descriptor always causes a locked read and write to set the accessed

bit of the descriptor. On the P6 family, Pentium, and Intel486 processors, the locked read and write occur only if the

bit is not already set.

23.23 DEBUG FACILITIES

The P6 family and Pentium processors include extensions to the Intel486 processor debugging support for break-

points. To use the new breakpoint features, it is necessary to set the DE flag in control register CR4.

23.23.1 Differences in Debug Register DR6

It is not possible to write a 1 to reserved bit 12 in debug status register DR6 on the P6 family and Pentium proces-

sors; however, it is possible to write a 1 in this bit on the Intel486 processor. See Table 10-1 for the different setting

of this register following a power-up or hardware reset.

23.23.2 Differences in Debug Register DR7

The P6 family and Pentium processors determines the type of breakpoint access by the R/W0 through R/W3 fields

in debug control register DR7 as follows:

Break on instruction execution only.

Break on data writes only.

Undefined if the DE flag in control register CR4 is cleared; break on I/O reads or writes but not instruction

fetches if the DE flag in control register CR4 is set.

Break on data reads or writes but not instruction fetches.

On the P6 family and Pentium processors, reserved bits 11, 12, 14, and 15 are hard-wired to 0. On the Intel486

processor, however, bit 12 can be set. See Table 10-1 for the different settings of this register following a power-up

or hardware reset.

23.23.3 Debug Registers DR4 and DR5

Although the DR4 and DR5 registers are documented as reserved, previous generations of processors aliased refer-

ences to these registers to debug registers DR6 and DR7, respectively. When debug extensions are not enabled

(the DE flag in control register CR4 is cleared), the P6 family and Pentium processors remain compatible with

existing software by allowing these aliased references. When debug extensions are enabled (the DE flag is set),

attempts to reference registers DR4 or DR5 will result in an invalid-opcode exception (#UD).

23.24 RECOGNITION OF BREAKPOINTS

For the Pentium processor, it is recommended that debuggers execute the LGDT instruction before returning to the

program being debugged to ensure that breakpoints are detected. This operation does not need to be performed

on the P6 family, Intel486, or Intel386 processors.

The implementation of test registers on the Intel486 processor used for testing the cache and TLB has been rede-

signed using MSRs on the P6 family and Pentium processors. (Note that MSRs used for this function are different

on the P6 family and Pentium processors.) The MOV to and from test register instructions generate invalid-opcode

exceptions (#UD) on the P6 family processors.

23-20

Vol. 3B

ARCHITECTURE COMPATIBILITY

23.25 EXCEPTIONS AND/OR EXCEPTION CONDITIONS

This section describes the new exceptions and exception conditions added to the 32-bit IA-32 processors and

implementation differences in existing exception handling. See Chapter 6, “Interrupt and Exception Handling,” for

a detailed description of the IA-32 exceptions.

The Pentium III processor introduced new state with the XMM registers. Computations involving data in these regis-

ters can produce exceptions. A new MXCSR control/status register is used to determine which exception or excep-

tions have occurred. When an exception associated with the XMM registers occurs, an interrupt is generated.

• SIMD floating-point exception (#XM, interrupt 19) — New exceptions associated with the SIMD floating-point

registers and resulting computations.

No new exceptions were added with the Pentium Pro and Pentium II processors. The set of available exceptions is

the same as for the Pentium processor. However, the following exception condition was added to the IA-32 with the

Pentium Pro processor:

• Machine-check exception (#MC, interrupt 18) — New exception conditions. Many exception conditions have

been added to the machine-check exception and a new architecture has been added for handling and reporting

on hardware errors. See Chapter 16, “Machine-Check Architecture,” for a detailed description of the new

conditions.

The following exceptions and/or exception conditions were added to the IA-32 with the Pentium processor:

• Machine-check exception (#MC, interrupt 18) — New exception. This exception reports parity and other

hardware errors. It is a model-specific exception and may not be implemented or implemented differently in

future processors. The MCE flag in control register CR4 enables the machine-check exception. When this bit is

clear (which it is at reset), the processor inhibits generation of the machine-check exception.

• General-protection exception (#GP, interrupt 13) — New exception condition added. An attempt to write a 1 to

a reserved bit position of a special register causes a general-protection exception to be generated.

• Page-fault exception (#PF, interrupt 14) — New exception condition added. When a 1 is detected in any of the

reserved bit positions of a page-table entry, page-directory entry, or page-directory pointer during address

translation, a page-fault exception is generated.

The following exception was added to the Intel486 processor:

• Alignment-check exception (#AC, interrupt 17) — New exception. Reports unaligned memory references when

alignment checking is being performed.

The following exceptions and/or exception conditions were added to the Intel386 processor:

• Divide-error exception (#DE, interrupt 0)

— Change in exception handling. Divide-error exceptions on the Intel386 processors always leave the saved

CS:IP value pointing to the instruction that failed. On the 8086 processor, the CS:IP value points to the next

instruction.

— Change in exception handling. The Intel386 processors can generate the largest negative number as a

quotient for the IDIV instruction (80H and 8000H). The 8086 processor generates a divide-error exception

instead.

• Invalid-opcode exception (#UD, interrupt 6) — New exception condition added. Improper use of the LOCK

instruction prefix can generate an invalid-opcode exception.

• Page-fault exception (#PF, interrupt 14) — New exception condition added. If paging is enabled in a 16-bit

program, a page-fault exception can be generated as follows. Paging can be used in a system with 16-bit tasks

if all tasks use the same page directory. Because there is no place in a 16-bit TSS to store the PDBR register,

switching to a 16-bit task does not change the value of the PDBR register. Tasks ported from the Intel 286

processor should be given 32-bit TSSs so they can make full use of paging.

• General-protection exception (#GP, interrupt 13) — New exception condition added. The Intel386 processor

sets a limit of 15 bytes on instruction length. The only way to violate this limit is by putting redundant prefixes

before an instruction. A general-protection exception is generated if the limit on instruction length is violated.

The 8086 processor has no instruction length limit.

Vol. 3B

23-21

ARCHITECTURE COMPATIBILITY

23.25.1 Machine-Check Architecture

The Pentium Pro processor introduced a new architecture to the IA-32 for handling and reporting on machine-check

exceptions. This machine-check architecture (described in detail in Chapter 16, “Machine-Check Architecture”)

greatly expands the ability of the processor to report on internal hardware errors.

23.25.2 Priority of Exceptions

The priority of exceptions are broken down into several major categories:

1. Traps on the previous instruction

2. External interrupts

3. Faults on fetching the next instruction

4. Faults in decoding the next instruction

5. Faults on executing an instruction

There are no changes in the priority of these major categories between the different processors, however, excep-

tions within these categories are implementation dependent and may change from processor to processor.

23.25.3 Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers

MMX instructions and a subset of SSE, SSE2, SSSE3 instructions operate on MMX registers. The exception condi-

tions of these instructions are described in the following tables.

Table 23-4. Exception Conditions for Legacy SIMD/MMX Instructions with FP Exception and 16-Byte Alignment

Exception

Cause of Exception

If an unmasked SIMD floating-point exception and CR4.OSXMMEXCPT[bit 10] = 0.

If CR0.EM[bit 2] = 1.

Invalid Opcode,

If CR4.OSFXSR[bit 9] = 0.

#UD

If preceded by a LOCK prefix (F0H)

If any corresponding CPUID feature flag is ‘0’

#MF

If there is a pending X87 FPU exception

#NM

If CR0.TS[bit 3]=1

For an illegal address in the SS segment

Stack, SS(0)

If a memory address referencing the SS segment is in a non-canonical form

Legacy SSE: Memory operand is not 16-byte aligned

General Protec-

For an illegal memory operand effective address in the CS, DS, ES, FS or GS segments.

tion, #GP(0)

If the memory address is in a non-canonical form.

If any part of the operand lies outside the effective address space from 0 to FFFFH

#PF(fault-code)

For a page fault

#XM

If an unmasked SIMD floating-point exception and CR4.OSXMMEXCPT[bit 10] = 1

Applicable

CVTPD2PI, CVTTPD2PI

Instructions

23-22

Vol. 3B

ARCHITECTURE COMPATIBILITY

Table 23-5. Exception Conditions for Legacy SIMD/MMX Instructions with XMM and FP Exception

Exception

Cause of Exception

If an unmasked SIMD floating-point exception and CR4.OSXMMEXCPT[bit 10] = 0.

If CR0.EM[bit 2] = 1.

Invalid Opcode, #UD

If CR4.OSFXSR[bit 9] = 0.

If preceded by a LOCK prefix (F0H)

If any corresponding CPUID feature flag is ‘0’

#MF

If there is a pending X87 FPU exception

#NM

If CR0.TS[bit 3]=1

For an illegal address in the SS segment

Stack, SS(0)

If a memory address referencing the SS segment is in a non-canonical form

For an illegal memory operand effective address in the CS, DS, ES, FS or GS seg-

ments.

General Protection,

If the memory address is in a non-canonical form.

#GP(0)

If any part of the operand lies outside the effective address space from 0 to

FFFFH

#PF(fault-code)

For a page fault

Alignment Check

If alignment checking is enabled and an unaligned memory reference is made while

#AC(0)

the current privilege level is 3.

SIMD Floating-point

If an unmasked SIMD floating-point exception and CR4.OSXMMEXCPT[bit 10] = 1

Exception, #XM

Applicable Instruc-

CVTPI2PS, CVTPS2PI, CVTTPS2PI

tions

Vol. 3B

23-23

ARCHITECTURE COMPATIBILITY

Table 23-6. Exception Conditions for Legacy SIMD/MMX Instructions with XMM and without FP Exception

Exception

Cause of Exception

If CR0.EM[bit 2] = 1.

If CR4.OSFXSR[bit 9] = 0.

Invalid Opcode, #UD

If preceded by a LOCK prefix (F0H)

If any corresponding CPUID feature flag is ‘0’

#MF¹

If there is a pending X87 FPU exception

#NM

If CR0.TS[bit 3]=1

For an illegal address in the SS segment

Stack, SS(0)

If a memory address referencing the SS segment is in a non-canonical form

For an illegal memory operand effective address in the CS, DS, ES, FS or GS seg-

ments.

General Protection,

If the memory address is in a non-canonical form.

#GP(0)

If any part of the operand lies outside the effective address space from 0 to

FFFFH

#PF(fault-code)

For a page fault

Alignment Check

If alignment checking is enabled and an unaligned memory reference is made

#AC(0)

while the current privilege level is 3.

Applicable Instruc-

CVTPI2PD

tions

NOTES:

1. Applies to “CVTPI2PD xmm, mm” but not “CVTPI2PD xmm, m64”.

23-24

Vol. 3B

ARCHITECTURE COMPATIBILITY

Table 23-7. Exception Conditions for SIMD/MMX Instructions with Memory Reference

Exception

Cause of Exception

If CR0.EM[bit 2] = 1.

Invalid Opcode, #UD

If preceded by a LOCK prefix (F0H)

If any corresponding CPUID feature flag is ‘0’

#MF

If there is a pending X87 FPU exception

#NM

If CR0.TS[bit 3]=1

For an illegal address in the SS segment

Stack, SS(0)

If a memory address referencing the SS segment is in a non-canonical form

For an illegal memory operand effective address in the CS, DS, ES, FS or GS seg-

ments.

General Protection,

#GP(0)

If the memory address is in a non-canonical form.

If any part of the operand lies outside the effective address space from 0 to FFFFH

#PF(fault-code)

For a page fault

Alignment Check

If alignment checking is enabled and an unaligned memory reference is made while

#AC(0)

the current privilege level is 3.

PABSB, PABSD, PABSW, PACKSSWB, PACKSSDW, PACKUSWB, PADDB, PADDD, PADDQ, PADDW, PADDSB,

PADDSW, PADDUSB, PADDUSW, PALIGNR, PAND, PANDN, PAVGB, PAVGW, PCMPEQB, PCMPEQD, PCMPEQW,

PCMPGTB, PCMPGTD, PCMPGTW, PHADDD, PHADDW, PHADDSW, PHSUBD, PHSUBW, PHSUBSW, PINSRW,

Applicable Instruc-

PMADDUBSW, PMADDWD, PMAXSW, PMAXUB, PMINSW, PMINUB, PMULHRSW, PMULHUW, PMULHW, PMULLW,

tions

PMULUDQ, PSADBW, PSHUFB, PSHUFW, PSIGNB PSIGND PSIGNW, PSLLW, PSLLD, PSLLQ, PSRAD, PSRAW,

PSRLW, PSRLD, PSRLQ, PSUBB, PSUBD, PSUBQ, PSUBW, PSUBSB, PSUBSW, PSUBUSB, PSUBUSW,

PUNPCKHBW, PUNPCKHWD, PUNPCKHDQ, PUNPCKLBW, PUNPCKLWD, PUNPCKLDQ, PXOR

Vol. 3B

23-25

ARCHITECTURE COMPATIBILITY

Table 23-8. Exception Conditions for Legacy SIMD/MMX Instructions without FP Exception

Exception

Cause of Exception

If CR0.EM[bit 2] = 1.

If ModR/M.mod ≠ 11b¹

Invalid Opcode, #UD

If preceded by a LOCK prefix (F0H)

If any corresponding CPUID feature flag is ‘0’

#MF

If there is a pending X87 FPU exception

#NM

If CR0.TS[bit 3]=1

For an illegal address in the SS segment

Stack, SS(0)

If a memory address referencing the SS segment is in a non-canonical form

For an illegal memory operand effective address in the CS, DS, ES, FS or GS seg-

ments.

If the destination operand is in a non-writable segment.²

#GP(0)

If the DS, ES, FS, or GS register contains a NULL segment selector.³

If the memory address is in a non-canonical form.

If any part of the operand lies outside the effective address space from 0 to FFFFH

#PF(fault-code)

For a page fault

If alignment checking is enabled and an unaligned memory reference is made while

#AC(0)

the current privilege level is 3.

Applicable Instruc-

MASKMOVQ, MOVNTQ, “MOVQ (mmreg)”

tions

NOTES:

1. Applies to MASKMOVQ only.

2. Applies to MASKMOVQ and MOVQ (mmreg) only.

3. Applies to MASKMOVQ only.

23-26

Vol. 3B

ARCHITECTURE COMPATIBILITY

Table 23-9. Exception Conditions for Legacy SIMD/MMX Instructions without Memory Reference

Exception

Cause of Exception

If CR0.EM[bit 2] = 1.

Invalid Opcode, #UD

If preceded by a LOCK prefix (F0H)

If any corresponding CPUID feature flag is ‘0’

#MF

If there is a pending X87 FPU exception

#NM

If CR0.TS[bit 3]=1

Applicable Instruc-

PEXTRW, PMOVMSKB

tions

23.26 INTERRUPTS

The following differences in handling interrupts are found among the IA-32

processors.

23.26.1 Interrupt Propagation Delay

External hardware interrupts may be recognized on different instruction boundaries on the P6 family, Pentium,

Intel486, and Intel386 processors, due to the superscaler designs of the P6 family and Pentium processors. There-

fore, the EIP pushed onto the stack when servicing an interrupt may be different for the P6 family, Pentium,

Intel486, and Intel386 processors.

23.26.2 NMI Interrupts

After an NMI interrupt is recognized by the P6 family, Pentium, Intel486, Intel386, and Intel 286 processors, the

NMI interrupt is masked until the first IRET instruction is executed, unlike the 8086 processor.

23.26.3 IDT Limit

The LIDT instruction can be used to set a limit on the size of the IDT. A double-fault exception (#DF) is generated

if an interrupt or exception attempts to read a vector beyond the limit. Shutdown then occurs on the 32-bit IA-32

processors if the double-fault handler vector is beyond the limit. (The 8086 processor does not have a shutdown

mode nor a limit.)

23.27 ADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)

The Advanced Programmable Interrupt Controller (APIC), referred to in this book as the local APIC, was intro-

duced into the IA-32 processors with the Pentium processor (beginning with the 735/90 and 815/100 models) and

is included in the Pentium 4, Intel Xeon, and P6 family processors. The features and functions of the local APIC are

derived from the Intel 82489DX external APIC, which was used with the Intel486 and early Pentium processors.

Additional refinements of the local APIC architecture were incorporated in the Pentium 4 and Intel Xeon processors.

Vol. 3B

23-27

ARCHITECTURE COMPATIBILITY

23.27.1 Software Visible Differences Between the Local APIC and the 82489DX

The following features in the local APIC features differ from those found in the 82489DX external APIC:

• When the local APIC is disabled by clearing the APIC software enable/disable flag in the spurious-interrupt

vector MSR, the state of its internal registers are unaffected, except that the mask bits in the LVT are all set to

block local interrupts to the processor. Also, the local APIC ceases accepting IPIs except for INIT, SMI, NMI, and

start-up IPIs. In the 82489DX, when the local unit is disabled, all the internal registers including the IRR, ISR,

and TMR are cleared and the mask bits in the LVT are set. In this state, the 82489DX local unit will accept only

the reset deassert message.

• In the local APIC, NMI and INIT (except for INIT deassert) are always treated as edge triggered interrupts, even

if programmed otherwise. In the 82489DX, these interrupts are always level triggered.

• In the local APIC, IPIs generated through the ICR are always treated as edge triggered (except INIT Deassert).

In the 82489DX, the ICR can be used to generate either edge or level triggered IPIs.

• In the local APIC, the logical destination register supports 8 bits; in the 82489DX, it supports 32 bits.

• In the local APIC, the APIC ID register is 4 bits wide; in the 82489DX, it is 8 bits wide.

• The remote read delivery mode provided in the 82489DX and local APIC for Pentium processors is not

supported in the local APIC in the Pentium 4, Intel Xeon, and P6 family processors.

• For the 82489DX, in the lowest priority delivery mode, all the target local APICs specified by the destination

field participate in the lowest priority arbitration. For the local APIC, only those local APICs which have free

interrupt slots will participate in the lowest priority arbitration.

23.27.2 New Features Incorporated in the Local APIC for the P6 Family and Pentium

Processors

The local APIC in the Pentium and P6 family processors have the following new features not found in the 82489DX

external APIC.

• Cluster addressing is supported in logical destination mode.

• Focus processor checking can be enabled/disabled.

• Interrupt input signal polarity can be programmed for the LINT0 and LINT1 pins.

• An SMI IPI is supported through the ICR and I/O redirection table.

• An error status register is incorporated into the LVT to log and report APIC errors.

In the P6 family processors, the local APIC incorporates an additional LVT register to handle performance moni-

toring counter interrupts.

23.27.3 New Features Incorporated in the Local APIC of the Pentium 4 and Intel Xeon

Processors

The local APIC in the Pentium 4 and Intel Xeon processors has the following new features not found in the P6 family

and Pentium processors and in the 82489DX.

• The local APIC ID is extended to 8 bits.

• An thermal sensor register is incorporated into the LVT to handle thermal sensor interrupts.

• The the ability to deliver lowest-priority interrupts to a focus processor is no longer supported.

• The flat cluster logical destination mode is not supported.

23.28 TASK SWITCHING AND TSS

This section identifies the implementation differences of task switching, additions to the TSS and the handling of

TSSs and TSS segment selectors.

23-28

Vol. 3B

ARCHITECTURE COMPATIBILITY

23.28.1 P6 Family and Pentium Processor TSS

When the virtual mode extensions are enabled (by setting the VME flag in control register CR4), the TSS in the P6

family and Pentium processors contain an interrupt redirection bit map, which is used in virtual-8086 mode to redi-

rect interrupts back to an 8086 program.

23.28.2 TSS Selector Writes

During task state saves, the Intel486 processor writes 2-byte segment selectors into a 32-bit TSS, leaving the

upper 16 bits undefined. For performance reasons, the P6 family and Pentium processors write 4-byte segment

selectors into the TSS, with the upper 2 bytes being 0. For compatibility reasons, code should not depend on the

value of the upper 16 bits of the selector in the TSS.

23.28.3 Order of Reads/Writes to the TSS

The order of reads and writes into the TSS is processor dependent. The P6 family and Pentium processors may

generate different page-fault addresses in control register CR2 in the same TSS area than the Intel486 and

Intel386 processors, if a TSS crosses a page boundary (which is not recommended).

23.28.4 Using A 16-Bit TSS with 32-Bit Constructs

Task switches using 16-bit TSSs should be used only for pure 16-bit code. Any new code written using 32-bit

constructs (operands, addressing, or the upper word of the EFLAGS register) should use only 32-bit TSSs. This is

due to the fact that the 32-bit processors do not save the upper 16 bits of EFLAGS to a 16-bit TSS. A task switch

back to a 16-bit task that was executing in virtual mode will never re-enable the virtual mode, as this flag was not

saved in the upper half of the EFLAGS value in the TSS. Therefore, it is strongly recommended that any code using

32-bit constructs use a 32-bit TSS to ensure correct behavior in a multitasking environment.

23.28.5 Differences in I/O Map Base Addresses

The Intel486 processor considers the TSS segment to be a 16-bit segment and wraps around the 64K boundary.

Any I/O accesses check for permission to access this I/O address at the I/O base address plus the I/O offset. If the

I/O map base address exceeds the specified limit of 0DFFFH, an I/O access will wrap around and obtain the permis-

sion for the I/O address at an incorrect location within the TSS. A TSS limit violation does not occur in this situation

on the Intel486 processor. However, the P6 family and Pentium processors consider the TSS to be a 32-bit segment

and a limit violation occurs when the I/O base address plus the I/O offset is greater than the TSS limit. By following

the recommended specification for the I/O base address to be less than 0DFFFH, the Intel486 processor will not

wrap around and access incorrect locations within the TSS for I/O port validation and the P6 family and Pentium

processors will not experience general-protection exceptions (#GP). Figure 23-1 demonstrates the different areas

accessed by the Intel486 and the P6 family and Pentium processors.

Vol. 3B

23-29

ARCHITECTURE COMPATIBILITY

Intel486 Processor

P6 family and Pentium Processors

FFFFH + 10H = Outside Segment

for I/O Validation

FFFFH

I/O Map

FFFFH

Base Addres

FFFFH + 10H = FH

for I/O Validation

I/O access at port 10H checks

bitmap at I/O map base address

bitmap at I/O address FFFFH + 10H,

FFFFH + 10H = offset 10H.

which exceeds segment limit.

Offset FH from beginning of

Wrap around does not occur,

TSS segment results because

general-protection exception (#GP)

wraparound occurs.

occurs.

Figure 23-1. I/O Map Base Address Differences

23.29 CACHE MANAGEMENT

The P6 family processors include two levels of internal caches: L1 (level 1) and L2 (level 2). The L1 cache is divided

into an instruction cache and a data cache; the L2 cache is a general-purpose cache. See Section 12.1, “Internal

Caches, TLBs, and Buffers,” for a description of these caches. (Note that although the Pentium II processor L2

cache is physically located on a separate chip in the cassette, it is considered an internal cache.)

The Pentium processor includes separate level 1 instruction and data caches. The data cache supports a writeback

(or alternatively write-through, on a line by line basis) policy for memory updates.

The Intel486 processor includes a single level 1 cache for both instructions and data.

The meaning of the CD and NW flags in control register CR0 have been redefined for the P6 family and Pentium

processors. For these processors, the recommended value (00B) enables writeback for the data cache of the

Pentium processor and for the L1 data cache and L2 cache of the P6 family processors. In the Intel486 processor,

setting these flags to (00B) enables write-through for the cache.

External system hardware can force the Pentium processor to disable caching or to use the write-through cache

policy should that be required. In the P6 family processors, the MTRRs can be used to override the CD and NW flags

(see Table 12-6).

The P6 family and Pentium processors support page-level cache management in the same manner as the Intel486

processor by using the PCD and PWT flags in control register CR3, the page-directory entries, and the page-table

entries. The Intel486 processor, however, is not affected by the state of the PWT flag since the internal cache of the

Intel486 processor is a write-through cache.

23.29.1 Self-Modifying Code with Cache Enabled

On the Intel486 processor, a write to an instruction in the cache will modify it in both the cache and memory. If the

instruction was prefetched before the write, however, the old version of the instruction could be the one executed.

To prevent this problem, it is necessary to flush the instruction prefetch unit of the Intel486 processor by coding a

jump instruction immediately after any write that modifies an instruction. The P6 family and Pentium processors,

however, check whether a write may modify an instruction that has been prefetched for execution. This check is

based on the linear address of the instruction. If the linear address of an instruction is found to be present in the

23-30

Vol. 3B

ARCHITECTURE COMPATIBILITY

prefetch queue, the P6 family and Pentium processors flush the prefetch queue, eliminating the need to code a

jump instruction after any writes that modify an instruction.

Because the linear address of the write is checked against the linear address of the instructions that have been

prefetched, special care must be taken for self-modifying code to work correctly when the physical addresses of the

instruction and the written data are the same, but the linear addresses differ. In such cases, it is necessary to

execute a serializing operation to flush the prefetch queue after the write and before executing the modified

instruction. See Section 9.3, “Serializing Instructions,” for more information on serializing instructions.

NOTE

The check on linear addresses described above is not in practice a concern for compatibility. Appli-

cations that include self-modifying code use the same linear address for modifying and fetching the

instruction. System software, such as a debugger, that might possibly modify an instruction using

a different linear address than that used to fetch the instruction must execute a serializing

operation, such as IRET, before the modified instruction is executed.

23.29.2 Disabling the L3 Cache

A unified third-level (L3) cache in processors based on Intel NetBurst microarchitecture (see Section 12.1,

“Internal Caches, TLBs, and Buffers”) provides the third-level cache disable flag, bit 6 of the IA32_MISC_ENABLE

MSR. The third-level cache disable flag allows the L3 cache to be disabled and enabled, independently of the L1 and

L2 caches (see Section 12.5.4, “Disabling and Enabling the L3 Cache”). The third-level cache disable flag applies

only to processors based on Intel NetBurst microarchitecture. Processors with L3 and based on other microarchi-

tectures do not support the third-level cache disable flag.

23.30 PAGING

This section identifies enhancements made to the paging mechanism and implementation differences in the paging

mechanism for various IA-32 processors.

23.30.1 Large Pages

The Pentium processor extended the memory management/paging facilities of the IA-32 to allow large (4 MBytes)

pages sizes (see Section 4.3, “32-Bit Paging”). The first P6 family processor (the Pentium Pro processor) added a

2 MByte page size to the IA-32 in conjunction with the physical address extension (PAE) feature (see Section 4.4,

“PAE Paging”).

The availability of large pages with 32-bit paging on any IA-32 processor can be determined via feature bit 3 (PSE)

of register EDX after the CPUID instruction has been execution with an argument of 1. (Large pages are always

available with PAE paging and 4-level paging.) Intel processors that do not support the CPUID instruction support

only 32-bit paging and do not support page size enhancements. (See “CPUID—CPU Identification” in Chapter 3,

“Instruction Set Reference, A-L,” in the Intel^® 64 and IA-32 Architectures Software Developer’s Manual, Volume

2A, for more information on the CPUID instruction.)

23.30.2 PCD and PWT Flags

The PCD and PWT flags were introduced to the IA-32 in the Intel486 processor to control the caching of pages:

• PCD (page-level cache disable) flag—Controls caching on a page-by-page basis.

• PWT (page-level write-through) flag—Controls the write-through/writeback caching policy on a page-by-page

basis. Since the internal cache of the Intel486 processor is a write-through cache, it is not affected by the state

of the PWT flag.

Vol. 3B

23-31

ARCHITECTURE COMPATIBILITY

23.30.3 Enabling and Disabling Paging

Paging is enabled and disabled by loading a value into control register CR0 that modifies the PG flag. For backward

and forward compatibility with all IA-32 processors, Intel recommends that the following operations be performed

when enabling or disabling paging:

1. Execute a MOV CR0, REG instruction to either set (enable paging) or clear (disable paging) the PG flag.

2. Execute a near JMP instruction.

The sequence bounded by the MOV and JMP instructions should be identity mapped (that is, the instructions should

reside on a page whose linear and physical addresses are identical).

For the P6 family processors, the MOV CR0, REG instruction is serializing, so the jump operation is not required.

However, for backwards compatibility, the JMP instruction should still be included.

23.31 STACK OPERATIONS AND SUPERVISOR SOFTWARE

This section identifies the differences in the stack mechanism for the various IA-32 processors.

23.31.1 Selector Pushes and Pops

When pushing a segment selector onto the stack, the Pentium 4, Intel Xeon, P6 family, and Intel486 processors

decrement the ESP register by the operand size and then write 2 bytes. If the operand size is 32-bits, the upper two

bytes of the write are not modified. The Pentium processor decrements the ESP register by the operand size and

determines the size of the write by the operand size. If the operand size is 32-bits, the upper two bytes are written

as 0s.

When popping a segment selector from the stack, the Pentium 4, Intel Xeon, P6 family, and Intel486 processors

read 2 bytes and increment the ESP register by the operand size of the instruction. The Pentium processor deter-

mines the size of the read from the operand size and increments the ESP register by the operand size.

It is possible to align a 32-bit selector push or pop such that the operation generates an exception on a Pentium

processor and not on an Pentium 4, Intel Xeon, P6 family, or Intel486 processor. This could occur if the third and/or

fourth byte of the operation lies beyond the limit of the segment or if the third and/or fourth byte of the operation

is locate on a non-present or inaccessible page.

For a POP-to-memory instruction that meets the following conditions:

• The stack segment size is 16-bit.

• Any 32-bit addressing form with the SIB byte specifying ESP as the base register.

• The initial stack pointer is FFFCH (32-bit operand) or FFFEH (16-bit operand) and will wrap around to 0H as a

result of the POP operation.

The result of the memory write is implementation-specific. For example, in P6 family processors, the result of the

memory write is SS:0H plus any scaled index and displacement. In Pentium processors, the result of the memory

write may be either a stack fault (real mode or protected mode with stack segment size of 64 KByte), or write to

SS:10000H plus any scaled index and displacement (protected mode and stack segment size exceeds 64 KByte).

23.31.2 Error Code Pushes

The Intel486 processor implements the error code pushed on the stack as a 16-bit value. When pushed onto a 32-

bit stack, the Intel486 processor only pushes 2 bytes and updates ESP by 4. The P6 family and Pentium processors’

error code is a full 32 bits with the upper 16 bits set to zero. The P6 family and Pentium processors, therefore, push

4 bytes and update ESP by 4. Any code that relies on the state of the upper 16 bits may produce inconsistent

results.

23-32

Vol. 3B

ARCHITECTURE COMPATIBILITY

23.31.3 Fault Handling Effects on the Stack

During the handling of certain instructions, such as CALL and PUSHA, faults may occur in different sequences for

the different processors. For example, during far calls, the Intel486 processor pushes the old CS and EIP before a

possible branch fault is resolved. A branch fault is a fault from a branch instruction occurring from a segment limit

or access rights violation. If a branch fault is taken, the Intel486 and P6 family processors will have corrupted

memory below the stack pointer. However, the ESP register is backed up to make the instruction restartable. The

P6 family processors issue the branch before the pushes. Therefore, if a branch fault does occur, these processors

do not corrupt memory below the stack pointer. This implementation difference, however, does not constitute a

compatibility problem, as only values at or above the stack pointer are considered to be valid. Other operations

that encounter faults may also corrupt memory below the stack pointer and this behavior may vary on different

implementations.

23.31.4 Interlevel RET/IRET From a 16-Bit Interrupt or Call Gate

If a call or interrupt is made from a 32-bit stack environment through a 16-bit gate, only 16 bits of the old ESP can

be pushed onto the stack. On the subsequent RET/IRET, the 16-bit ESP is popped but the full 32-bit ESP is updated

since control is being resumed in a 32-bit stack environment. The Intel486 processor writes the SS selector into the

upper 16 bits of ESP. The P6 family and Pentium processors write zeros into the upper 16 bits.

23.32 MIXING 16- AND 32-BIT SEGMENTS

The features of the 16-bit Intel 286 processor are an object-code compatible subset of those of the 32-bit IA-32

processors. The D (default operation size) flag in segment descriptors indicates whether the processor treats a

code or data segment as a 16-bit or 32-bit segment; the B (default stack size) flag in segment descriptors indicates

whether the processor treats a stack segment as a 16-bit or 32-bit segment.

The segment descriptors used by the Intel 286 processor are supported by the 32-bit IA-32 processors if the Intel-

reserved word (highest word) of the descriptor is clear. On the 32-bit IA-32 processors, this word includes the

upper bits of the base address and the segment limit.

The segment descriptors for data segments, code segments, local descriptor tables (there are no descriptors for

global descriptor tables), and task gates are the same for the 16- and 32-bit processors. Other 16-bit descriptors

(TSS segment, call gate, interrupt gate, and trap gate) are supported by the 32-bit processors.

The 32-bit processors also have descriptors for TSS segments, call gates, interrupt gates, and trap gates that

support the 32-bit architecture. Both kinds of descriptors can be used in the same system.

For those segment descriptors common to both 16- and 32-bit processors, clear bits in the reserved word cause the

32-bit processors to interpret these descriptors exactly as an Intel 286 processor does, that is:

• Base Address — The upper 8 bits of the 32-bit base address are clear, which limits base addresses to 24 bits.

• Limit — The upper 4 bits of the limit field are clear, restricting the value of the limit field to 64 KBytes.

• Granularity bit — The G (granularity) flag is clear, indicating the value of the 16-bit limit is interpreted in units

of 1 byte.

• Big bit — In a data-segment descriptor, the B flag is clear in the segment descriptor used by the 32-bit

processors, indicating the segment is no larger than 64 KBytes.

• Default bit — In a code-segment descriptor, the D flag is clear, indicating 16-bit addressing and operands are

the default. In a stack-segment descriptor, the D flag is clear, indicating use of the SP register (instead of the

ESP register) and a 64-KByte maximum segment limit.

For information on mixing 16- and 32-bit code in applications, see Chapter 22, “Mixing 16-Bit and 32-Bit Code.”

23.33 SEGMENT AND ADDRESS WRAPAROUND

This section discusses differences in segment and address wraparound between the P6 family, Pentium, Intel486,

Intel386, Intel 286, and 8086 processors.

Vol. 3B

23-33

ARCHITECTURE COMPATIBILITY

23.33.1 Segment Wraparound

On the 8086 processor, an attempt to access a memory operand that crosses offset 65,535 or 0FFFFH or offset 0

(for example, moving a word to offset 65,535 or pushing a word when the stack pointer is set to 1) causes the

offset to wrap around modulo 65,536 or 010000H. With the Intel 286 processor, any base and offset combination

that addresses beyond 16 MBytes wraps around to the 1 MByte of the address space. The P6 family, Pentium,

Intel486, and Intel386 processors in real-address mode generate an exception in these cases:

• A general-protection exception (#GP) if the segment is a data segment (that is, if the CS, DS, ES, FS, or GS

• A stack-fault exception (#SS) if the segment is a stack segment (that is, if the SS register is being used).

An exception to this behavior occurs when a stack access is data aligned, and the stack pointer is pointing to the

last aligned piece of data that size at the top of the stack (ESP is FFFFFFFCH). When this data is popped, no

segment limit violation occurs and the stack pointer will wrap around to 0.

The address space of the P6 family, Pentium, and Intel486 processors may wraparound at 1 MByte in real-address

mode. An external A20M# pin forces wraparound if enabled. On Intel 8086 processors, it is possible to specify

addresses greater than 1 MByte. For example, with a selector value FFFFH and an offset of FFFFH, the effective

address would be 10FFEFH (1 MByte plus 65519 bytes). The 8086 processor, which can form addresses up to 20

bits long, truncates the uppermost bit, which “wraps” this address to FFEFH. However, the P6 family, Pentium, and

Intel486 processors do not truncate this bit if A20M# is not enabled.

If a stack operation wraps around the address limit, shutdown occurs. (The 8086 processor does not have a shut-

down mode or a limit.)

The behavior when executing near the limit of a 4-GByte selector (limit = FFFFFFFFH) is different between the

Pentium Pro and the Pentium 4 family of processors. On the Pentium Pro, instructions which cross the limit -- for

example, a two byte instruction such as INC EAX that is encoded as FFH C0H starting exactly at the limit faults for

a segment violation (a one byte instruction at FFFFFFFFH does not cause an exception). Using the Pentium 4 micro-

processor family, neither of these situations causes a fault.

Segment wraparound and the functionality of A20M# is used primarily by older operating systems and not used by

modern operating systems. On newer Intel 64 processors, A20M# may be absent.

23.34 STORE BUFFERS AND MEMORY ORDERING

The Pentium 4, Intel Xeon, and P6 family processors provide a store buffer for temporary storage of writes (stores)

to memory (see Section 12.10, “Store Buffer”). Writes stored in the store buffer(s) are always written to memory

in program order, with the exception of “fast string” store operations (see Section 9.2.4, “Fast-String Operation and

Out-of-Order Stores”).

The Pentium processor has two store buffers, one corresponding to each of the pipelines. Writes in these buffers

are always written to memory in the order they were generated by the processor core.

It should be noted that only memory writes are buffered and I/O writes are not. The Pentium 4, Intel Xeon, P6

family, Pentium, and Intel486 processors do not synchronize the completion of memory writes on the bus and

instruction execution after a write. An I/O, locked, or serializing instruction needs to be executed to synchronize

writes with the next instruction (see Section 9.3, “Serializing Instructions”).

The Pentium 4, Intel Xeon, and P6 family processors use processor ordering to maintain consistency in the order

that data is read (loaded) and written (stored) in a program and the order the processor actually carries out the

reads and writes. With this type of ordering, reads can be carried out speculatively and in any order, reads can pass

buffered writes, and writes to memory are always carried out in program order. (See Section 9.2, “Memory

Ordering,” for more information about processor ordering.) The Pentium III processor introduced a new instruction

to serialize writes and make them globally visible. Memory ordering issues can arise between a producer and a

consumer of data. The SFENCE instruction provides a performance-efficient way of ensuring ordering between

routines that produce weakly-ordered results and routines that consume this data.

No re-ordering of reads occurs on the Pentium processor, except under the condition noted in Section 9.2.1,

“Memory Ordering in the Intel® Pentium® and Intel486™ Processors,” and in the following paragraph describing

the Intel486 processor.

23-34

Vol. 3B

ARCHITECTURE COMPATIBILITY

Specifically, the store buffers are flushed before the IN instruction is executed. No reads (as a result of cache miss)

are reordered around previously generated writes sitting in the store buffers. The implication of this is that the

store buffers will be flushed or emptied before a subsequent bus cycle is run on the external bus.

On both the Intel486 and Pentium processors, under certain conditions, a memory read will go onto the external

bus before the pending memory writes in the buffer even though the writes occurred earlier in the program execu-

tion. A memory read will only be reordered in front of all writes pending in the buffers if all writes pending in the

buffers are cache hits and the read is a cache miss. Under these conditions, the Intel486 and Pentium processors

will not read from an external memory location that needs to be updated by one of the pending writes.

During a locked bus cycle, the Intel486 processor will always access external memory, it will never look for the

location in the on-chip cache. All data pending in the Intel486 processor's store buffers will be written to memory

before a locked cycle is allowed to proceed to the external bus. Thus, the locked bus cycle can be used for elimi-

nating the possibility of reordering read cycles on the Intel486 processor. The Pentium processor does check its

cache on a read-modify-write access and, if the cache line has been modified, writes the contents back to memory

before locking the bus. The P6 family processors write to their cache on a read-modify-write operation (if the

access does not split across a cache line) and does not write back to system memory. If the access does split across

a cache line, it locks the bus and accesses system memory.

I/O reads are never reordered in front of buffered memory writes on an IA-32 processor. This ensures an update of

all memory locations before reading the status from an I/O device.

23.35 BUS LOCKING

The Intel 286 processor performs the bus locking differently than the Intel P6 family, Pentium, Intel486, and

Intel386 processors. Programs that use forms of memory locking specific to the Intel 286 processor may not run

properly when run on later processors.

A locked instruction is guaranteed to lock only the area of memory defined by the destination operand, but may

lock a larger memory area. For example, typical 8086 and Intel 286 configurations lock the entire physical memory

space. Programmers should not depend on this.

On the Intel 286 processor, the LOCK prefix is sensitive to IOPL. If the CPL is greater than the IOPL, a general-

protection exception (#GP) is generated. On the Intel386 DX, Intel486, and Pentium, and P6 family processors, no

check against IOPL is performed.

The Pentium processor automatically asserts the LOCK# signal when acknowledging external interrupts. After

signaling an interrupt request, an external interrupt controller may use the data bus to send the interrupt vector to

the processor. After receiving the interrupt request signal, the processor asserts LOCK# to ensure that no other

data appears on the data bus until the interrupt vector is received. This bus locking does not occur on the P6 family

processors.

23.36 BUS HOLD

Unlike the 8086 and Intel 286 processors, but like the Intel386 and Intel486 processors, the P6 family and Pentium

processors respond to requests for control of the bus from other potential bus masters, such as DMA controllers,

between transfers of parts of an unaligned operand, such as two words which form a doubleword. Unlike the

Intel386 processor, the P6 family, Pentium, and Intel486 processors respond to bus hold during reset initialization.

23.37 MODEL-SPECIFIC EXTENSIONS TO THE IA-32

Certain extensions to the IA-32 are specific to a processor or family of IA-32 processors and may not be imple-

mented or implemented in the same way in future processors. The following sections describe these model-specific

extensions. The CPUID instruction indicates the availability of some of the model-specific features.

Vol. 3B

23-35

ARCHITECTURE COMPATIBILITY

23.37.1 Model-Specific Registers

The Pentium processor introduced a set of model-specific registers (MSRs) for use in controlling hardware functions

and performance monitoring. To access these MSRs, two new instructions were added to the IA-32 architecture:

read MSR (RDMSR) and write MSR (WRMSR). The MSRs in the Pentium processor are not guaranteed to be dupli-

cated or provided in the next generation IA-32 processors.

The P6 family processors greatly increased the number of MSRs available to software. See Chapter 2, “Model-

Specific Registers (MSRs)‚” in the Intel^® 64 and IA-32 Architectures Software Developer’s Manual, Volume 4, for a

complete list of the available MSRs. The new registers control the debug extensions, the performance counters, the

machine-check exception capability, the machine-check architecture, and the MTRRs. These registers are acces-

sible using the RDMSR and WRMSR instructions. Specific information on some of these new MSRs is provided in the

following sections. As with the Pentium processor MSR, the P6 family processor MSRs are not guaranteed to be

duplicated or provided in the next generation IA-32 processors.

23.37.2 RDMSR and WRMSR Instructions

The RDMSR (read model-specific register) and WRMSR (write model-specific register) instructions recognize a

much larger number of model-specific registers in the P6 family processors. (See “RDMSR—Read from Model

Specific Register” and “WRMSR—Write to Model Specific Register” in the Intel^® 64 and IA-32 Architectures Soft-

ware Developer’s Manual, Volumes 2A, 2B, 2C, & 2D, for more information.)

23.37.3 Memory Type Range Registers

Memory type range registers (MTRRs) are a new feature introduced into the IA-32 in the Pentium Pro processor.

MTRRs allow the processor to optimize memory operations for different types of memory, such as RAM, ROM, frame

buffer memory, and memory-mapped I/O.

MTRRs are MSRs that contain an internal map of how physical address ranges are mapped to various types of

memory. The processor uses this internal memory map to determine the cacheability of various physical memory

locations and the optimal method of accessing memory locations. For example, if a memory location is specified in

an MTRR as write-through memory, the processor handles accesses to this location as follows. It reads data from

that location in lines and caches the read data or maps all writes to that location to the bus and updates the cache

to maintain cache coherency. In mapping the physical address space with MTRRs, the processor recognizes five

types of memory: uncacheable (UC), uncacheable, speculatable, write-combining (WC), write-through (WT),

write-protected (WP), and writeback (WB).

Earlier IA-32 processors (such as the Intel486 and Pentium processors) used the KEN# (cache enable) pin and

external logic to maintain an external memory map and signal cacheable accesses to the processor. The MTRR

mechanism simplifies hardware designs by eliminating the KEN# pin and the external logic required to drive it.

See Chapter 10, “Processor Management and Initialization,” and Chapter 2, “Model-Specific Registers (MSRs)‚” in

the Intel^® 64 and IA-32 Architectures Software Developer’s Manual, Volume 4, for more information on the MTRRs.

23.37.4 Machine-Check Exception and Architecture

The Pentium processor introduced a new exception called the machine-check exception (#MC, interrupt 18). This

exception is used to detect hardware-related errors, such as a parity error on a read cycle.

The P6 family processors extend the types of errors that can be detected and that generate a machine-check

exception. It also provides a new machine-check architecture for recording information about a machine-check

error and provides extended recovery capability.

The machine-check architecture provides several banks of reporting registers for recording machine-check errors.

Each bank of registers is associated with a specific hardware unit in the processor. The primary focus of the

machine checks is on bus and interconnect operations; however, checks are also made of translation lookaside

buffer (TLB) and cache operations.

23-36

Vol. 3B

ARCHITECTURE COMPATIBILITY

The machine-check architecture can correct some errors automatically and allow for reliable restart of instruction

execution. It also collects sufficient information for software to use in correcting other machine errors not corrected

by hardware.

See Chapter 16, “Machine-Check Architecture,” for more information on the machine-check exception and the

machine-check architecture.

23.37.5 Performance-Monitoring Counters

The P6 family and Pentium processors provide two performance-monitoring counters for use in monitoring internal

hardware operations. The number of performance monitoring counters and associated programming interfaces

may be implementation specific for Pentium 4 processors, Pentium M processors. Later processors may have

implemented these as part of an architectural performance monitoring feature. The architectural and non-architec-

tural performance monitoring interfaces for different processor families are described in Chapter 20, “Performance

Monitoring.” https://perfmon-events.intel.com/ lists all the events that can be counted for architectural perfor-

mance monitoring events and non-architectural events. The counters are set up, started, and stopped using two

MSRs and the RDMSR and WRMSR instructions. For the P6 family processors, the current count for a particular

counter can be read using the new RDPMC instruction.

The performance-monitoring counters are useful for debugging programs, optimizing code, diagnosing system fail-

ures, or refining hardware designs. See Chapter 20, “Performance Monitoring,” for more information on these

counters.

23.38 TWO WAYS TO RUN INTEL 286 PROCESSOR TASKS

When porting 16-bit programs to run on 32-bit IA-32 processors, there are two approaches to consider:

• Porting an entire 16-bit software system to a 32-bit processor, complete with the old operating system, loader,

and system builder. Here, all tasks will have 16-bit TSSs. The 32-bit processor is being used as if it were a faster

version of the 16-bit processor.

• Porting selected 16-bit applications to run in a 32-bit processor environment with a 32-bit operating system,

loader, and system builder. Here, the TSSs used to represent 286 tasks should be changed to 32-bit TSSs. It is

possible to mix 16 and 32-bit TSSs, but the benefits are small and the problems are great. All tasks in a 32-bit

software system should have 32-bit TSSs. It is not necessary to change the 16-bit object modules themselves;

TSSs are usually constructed by the operating system, by the loader, or by the system builder. See Chapter 22,

“Mixing 16-Bit and 32-Bit Code,” for more detailed information about mixing 16-bit and 32-bit code.

Because the 32-bit processors use the contents of the reserved word of 16-bit segment descriptors, 16-bit

programs that place values in this word may not run correctly on the 32-bit processors.

23.39 INITIAL STATE OF PENTIUM, PENTIUM PRO AND PENTIUM 4 PROCESSORS

Table 23-10 shows the state of the flags and other registers following power-up for the Pentium, Pentium Pro and

Pentium 4 processors. The state of control register CR0 is 60000010H (see Figure 10-1 “Contents of CR0 Register

after Reset” in the Intel^®64 and IA-32 Architectures Software Developer’s Manual, Volume 3A). This places the

processor in real-address mode with paging disabled.

Table 23-10. Processor State Following Power-up/Reset/INIT for Pentium, Pentium Pro and Pentium 4 Processors

Pentium 4 Processor

Pentium Pro Processor

Pentium Processor

EFLAGS¹

00000002H

EIP

0000FFF0H

CR0

60000010H²

CR2, CR3, CR4

00000000H

Vol. 3B

23-37

ARCHITECTURE COMPATIBILITY

Table 23-10. Processor State Following Power-up/Reset/INIT for Pentium, Pentium Pro and Pentium 4 Processors

Pentium 4 Processor

Pentium Pro Processor

Pentium Processor

Selector = F000H

Base = FFFF0000H

Limit = FFFFH

AR = Present, R/W, Accessed

SS, DS, ES, FS, GS

Selector = 0000H

Base = 00000000H

Limit = FFFFH

AR = Present, R/W, Accessed

EDX

00000FxxH

000n06xxH³

000005xxH

EAX

0⁴

EBX, ECX, ESI, EDI, EBP,

00000000H

ESP

ST0 through ST7⁵

Pwr up or Reset: +0.0

FINIT/FNINIT: Unchanged

x87 FPU Control

Pwr up or Reset: 0040H

Word⁵

FINIT/FNINIT: 037FH

x87 FPU Status Word⁵

Pwr up or Reset: 0000H

FINIT/FNINIT: 0000H

x87 FPU Tag Word⁵

Pwr up or Reset: 5555H

FINIT/FNINIT: FFFFH

x87 FPU Data

Pwr up or Reset: 0000H

Operand and CS Seg.

FINIT/FNINIT: 0000H

Selectors⁵

x87 FPU Data

Pwr up or Reset:

Operand and Inst.

00000000H

Pointers⁵

FINIT/FNINIT: 00000000H

MM0 through MM7⁵

Pwr up or Reset:

Pentium II and Pentium III

Pentium with MMX Technology

0000000000000000H

Processors Only—

Only—

INIT or FINIT/FNINIT:

Pwr up or Reset:

Unchanged

0000000000000000H

INIT or FINIT/FNINIT:

Unchanged

XMM0 through XMM7

Pwr up or Reset: 0H

If CPUID.01H:SSE is 1 —

INIT: Unchanged

Pwr up or Reset: 0H

INIT: Unchanged

MXCSR

Pwr up or Reset: 1F80H

Pentium III processor only-

INIT: Unchanged

Pwr up or Reset: 1F80H

INIT: Unchanged

GDTR, IDTR

Base = 00000000H

Limit = FFFFH

AR = Present, R/W

LDTR, Task Register

Selector = 0000H

Base = 00000000H

Limit = FFFFH

AR = Present, R/W

DR0, DR1, DR2, DR3

00000000H

DR6

FFFF0FF0H

23-38

Vol. 3B

ARCHITECTURE COMPATIBILITY

Table 23-10. Processor State Following Power-up/Reset/INIT for Pentium, Pentium Pro and Pentium 4 Processors

Pentium 4 Processor

Pentium Pro Processor

Pentium Processor

DR7

00000400H

Time-Stamp Counter

Power up or Reset: 0H

INIT: Unchanged

Perf. Counters and

Power up or Reset: 0H

Event Select

INIT: Unchanged

All Other MSRs

Pwr up or Reset:

Undefined

INIT: Unchanged

Data and Code Cache,

Invalid⁶

TLBs

Fixed MTRRs

Pwr up or Reset: Disabled

Not Implemented

INIT: Unchanged

Variable MTRRs

Pwr up or Reset: Disabled

Not Implemented

INIT: Unchanged

Machine-Check

Pwr up or Reset:

Not Implemented

Architecture

Undefined

INIT: Unchanged

APIC

Pwr up or Reset: Enabled

INIT: Unchanged

R8-R15⁷

0000000000000000H

N.A.

XMM8-XMM15⁷

Pwr up or Reset: 0H

N.A.

INIT: Unchanged

NOTES:

1. The 10 most-significant bits of the EFLAGS register are undefined following a reset. Software should not depend on the states of

any of these bits.

2. The CD and NW flags are unchanged, bit 4 is set to 1, all other bits are cleared.

3. Where “n” is the Extended Model Value for the respective processor.

4. If Built-In Self-Test (BIST) is invoked on power up or reset, EAX is 0 only if all tests passed. (BIST cannot be invoked during an INIT.)

5. The state of the x87 FPU and MMX registers is not changed by the execution of an INIT.

6. Internal caches are invalid after power-up and RESET, but left unchanged with an INIT.

7. If the processor supports IA-32e mode.

Vol. 3B

23-39

Intel 64 and IA-32 Architectures. Software Developer’s Manual (Collection, 2023) - page 61