Intel486 DX2 Microprocessor Data Book Jul92

Intel486™ DX2 MICROPROCESSOR
• Software
Binary Compatible with Large
Base
• Compatibility
IEEE 1149.1 Boundary Scan
- MS-DOS·, OS/2··, Windows

- UNIX·*" System V/lnte1386
-iRMX®, iRMKTM Kernels
• -High50 Performance Design
MHz/66 MHz Core Speed Using
25 MHz/33 MHz Bus Clocks
• High Integration Enables On-Chip
- 8 Kbyte Code and Data Cache
- RISC Integer Core with Frequent
Instructions Executing in One Core
- Floating Point Unit Clock
- Paged, Virtual Memory Management - 80, 106 Mbyte/sec Burst Bus
- Dynamic Bus Sizing for 8-, 16-, and
• -EasyBuilt-In
To Use
Self Test 32-Bit Busses
- Complete 32-Bit Architecture
- Hardware Debugging Support
• -168-Pin Grid Array Package

Pin Compatible with Intel486TM OX
• -Multiprocessor Support
Cache Consistency Protocols
Microprocessor - Support for Second Level Cache
The Intel486 DX2 CPU offers the highest performance for DOS, OS/2, Windows, and UNIX System V/lntel386
applications. It is 100% binary compatible with the Intel386™ CPU. Over one million transistors integrate the
RISC integer core, 8 Kbyte cache memory, floating point hardware, and memory management on-chip while
retaining binary compatibility with previous members of the Inte1386/lnte1486 architectural family. The RISC
integer core executes frequently-used instructions in one core clock cycle, providing leadership performance
levels. An 8 Kbyte unified code and data cache allow the high performance levels to be sustained. A
106 MByte/sec burst bus at 33 MHz bus clock ensures high system throughput even with inexpensive DRAMs.
New features enhance multiprocessing systems; new instructions speed manipulation of memory-based sem-
aphores; and on-chip hardware ensures cache consistency and provides hooks for multilevel caches.
The built-in self-test extensively tests on-chip logic, cache memory, and the on-chip paging translation cache.
Debug features include breakpoint traps on code execution and data accesses.
Intel486™ DX2 Microprocessor Pipelined 32-Bit Microarchitecture

~i" Bit Interunit Transfer Bus
32-bit Data Bus Core

32
Clock
Clock I ClK
,---or-, 32 bit Data BUI
doubler
I
II II
32
II
-
Linear Address;::."":.'~_ _ _..,
Paging
.u. 32
PCD. PWT
II Bue Interface A2-A31,
B[0.-B[3.
~
Barrel Shifter Basel Unit cache Unit A.ddress Drivers
1-----1 Index
~ Descriptor Write Buffers
~
~ ------------
Register rne Registers 20 8k Byte
1-----1 32 .-.,,.--l
I--:l-:-,m""n Translation
Physical
Addreas
cache
"x 32
DO-03'
T:~~~:rs ~/R# D/e#
Al" Attribute Lockaside
~J
PLA Buffer
32 W/IO. PCO.PWT
1..F ~
llfIL_--:=__-.-:::,,--I---r--:~~-l
U 128 Bus Control
ROY. LOCk" PlOCK#
BOF'F# A,201ol# BREQ
~~~D NHw'iDA RESET
-to--"-.-.-.-.-
Request Sequencer
J-.m.'e<.o-.'.".,."ct.'o•• .-,D:iSPO::::I"_=mo,,,.,..::""::..+;3:22_1---,::P,::,",::O':::ChO::"_-I __ .. ________ .. ~IGNNE#

__
..:::::
-======:
r-~FI..~tI:--••.%-,
Point
Unit
Control and
Protection Test
1-_"_"_'--I Decodo' I
•
Instruction
Deoode
I I s;:em
24
32 ~:u;od.
2 x 16 Bytn
_~u:s~~:_~~r~I ~BLAST#
Bus Size Control
- - - - - ..... - - - - ....
8516" 9SS*
~FLUSH.
Instruction Cache Control AHOlD, EADS.
~i~ Regist.,. Co;,~ol Path L...._ _.J ____________ ~
::~t&~~~~ration ~3
------------- TCK
Bou=~a~can ~~~~
TOO
241245-1
Intel Corporation assumes no responsibility for the use of any circuitry other than Circuitry embodied in an Intel product. No other circuit patent
licenses are implied. Information contained herein supersedes previously published specffications on these devices from Intel. July 1992
© INTEL CORPORATION, 1992 Order Number: 241245.(102
infel . Intel486TM DX2 MICROPROCESSOR
Intel Corporation makes no warranty for the use of its products and assumes no responsibility for any errors which may
appear in this document nor does it make a commitment to update the information contained herein.
Intel retains the right to make changes to these specifications at any time, without notice.
Contact your local sales office to obtain the latest specifications before placing your order.
The following are trademarks of Intel Corporation and may only be used to identify Intel products:
376'" i7504!> MAPNET'"

Above'" i860'" Matched'"
ActionMedia4!> i960'" Media Mail'"
BITBUS'" Inte1287'" MCS@
Code Builder'" Inte1386'" NetPort'"
DeskWare'" Inte1387'" NetSentry'"
Digital Studio'" Inte1486'" OpenNET'"
DVI4!> Inte1487'" OverDrive'"
EtherExpress '" Intel4!> Paragon'"
ETOX'" intel inside. 'M ProSolver'"
ExCA'" Intellec4!> RapidCAD'"
Exchange and Go '" iPSC4!> READY-LAN'"
FaxBACK'" iRMX4!> Reference Point@
FlashFile'" iSBC4!> RMX/80'"
Grand Challenge'" iSBX'" RxServer'"
i4!> iWARP'" SatisFAXtion@
ICE'" LANDesk'" Snapln 386'"
iLBX'" LANPrini4!> Storage Broker'"
Inboard'" LAN Protect'" Sugarcube'"
i287'" LANSelect4l> The Computer Inside. '"
i386'" LANShell® TokenExpress'"
i387'" LAN Sight'" Visual Edge '"
i486'" LANSpace@ WYPIWYF®
i487'" LANSpool@
MDS is an ordering code only and is not used as a product name or trademark. MDS is a registered trademark of Mohawk
Data Sciences Corporation.
CHMOS and HMOS are patented processes of Intel Corp.
Intel Corporation and Intel's FASTPATH are not affiliated with Kinetics, a division of Excelan, Inc. or its FASTPATH trade-
mark or products.
Additional copies of this manual or other Intel literature may be obtained from:
Intel Corporation
LiteJature Sales
P.O. Box 7641
Mt. Prospect, IL 60056-7641
©INTEL CORPORATION 1992
iRMX, iRMK, Intel386, i386, Intel387, i387, Intel486, i486, Intel487, i487 are trademarks of Intel Corporation.
'MS-DOS@ is a registered trademark of Microsoft Corporation.
"OS/2TM and Windows™ are trademarks of Microsoft Corporation.
"'UNIXTM is a trademark of UNIX Systems Laboratories.
ii
Quick Reference to Chapters
CONTENTS PAGE CONTENTS PAGE
1.0 INTRODUCTION ..................... 1-1 10.0 INSTRUCTION SET SUMMARY ... 10-1
2.0 ARCHITECTURAL OVERViEW ...... 2-1 11.0 DIFFERENCES WITH THE

Intel386™ MICROPROCESSOR .... 11-1
3.0 REAL MODE ARCHITECTURE ....... 3-1
12.0 UPGRADE SOCKET ............... 12-1
4.0 PROTECTED MODE
ARCHITECTURE ...................... 4-1 13.0 CONVERTING AN EXISTING
Intel486TM CPU-BASED SYSTEM .... 13-1
5.0 ON-CHIP CACHE .................... 5-1
14.0 ELECTRICAL DATA ............... 14-1
6.0 HARDWARE INTERFACE ........... 6-1
15.0 MECHANICAL DATA .............. 15-1
7.0 BUS OPERATION .................... 7-1
16.0 SUGGESTED SOURCES FOR
8.0 TESTABILITy ........................ 8-1 Intel486 ACCESSORIES ............. 16-1
9.0 DEBUGGING SUPPORT ............. 9-1
iii
Intel486™ DX2 Microprocessor
2.7.8 Double Fault ................. 2-30
1.0 INTRODUCTION ..................... 1-1
2.7.9 Floating Point Interrupt
Pinout .................................. 1-1 Vectors ......................... 2-30
Brief Pin Descriptions .................. 1-4
3.0 REAL MODE ARCHITECTURE . ...... 3-1
2.0 ARCHITECTURAL OVERViEW ...... 2-1 3.1 Real Mode Introduction ............ 3-1
2.1 Register Set ....................... 2-1 3.2 Memory Addressing ............... 3-2
2.1.1 Base Architecture 3.3 Reserved Locations ............... 3-2
Registers ........................ 2-2
3.4 Interrupts .......................... 3-2
2.1.2 System Level Registers ....... 2-6
3.5 Shutdown and Halt ................ 3-2
2.1.3 Floating Point Registers ...... 2-10
2.1.4 Debug and Test Registers ... 2-17 4.0 PROTECTED MODE
2.1.5 Register Accessibility ........ 2-17 ARCHITECTURE ...................... 4-1
2.1.6 Compatibility ................. 2-18 4.1 Introduction ........................ 4-1
2.2 Instruction Set .................... 2-19 4.2 Addressing Mechanism ............ 4-1
2.3 Memory Organization ............. 2-19 4.3 Segmentation ..................... 4-2
2.3.1 Address Spaces ............. 2-19 4.3.1 Segmentation Introduction .... 4-2
2.3.2 Segment Register Usage .... 2-20 4.3.2 Terminology .................. 4-2
2.4 I/O Space ........................ 2-20 4.3.3 Descriptor Tables ............. 4-2
2.5 Addressing Modes ................ 2-21 4.3.4 Descriptors ................... 4-3
2.5.1 Addressing Modes 4.4 Protection ........................ 4-12

Overview ....................... 2-21 4.4.1 Protection Concepts ......... 4-12
2.5.2 Register and Immediate 4.4.2 Rules of Privilege ............ 4-12
Modes .......................... 2-21 4.4.3 Privilege Levels .............. 4-12
2.5.3 32-Bit Memory Addressing 4.4.4 Privilege Level Transfers ..... 4-15
Modes .......................... 2-21
4.4.5 Call Gates ................... 4-16
2.5.4 Differences between 16- and
32-Bit Addresses ................ 2-23 4.4.6 Task Switching .............. 4-16
2.6 Data Formats ..................... 2-23 4.4.7 Initialization and Transition to
Protected Mode ................. 4-17
2.6.1 Data Types .................. 2-23
4.4.8 Tools for Building Protected
2.6.2 Little Endian vs Big Endian Systems ........................ 4-18
Data Formats ................... 2-27
4.5 Paging ........................... 4-18
2.7 Interrupts ......................... 2-27
4.5.1 Paging Concepts ............ 4-18
2.7.1 Interrupts and Exceptions .... 2-27
4.5.2 Paging Organization ......... 4-19
2.7.2 Interrupt Processing ......... 2-27
4.5.3 Page Level Protection
2.7.3 Maskable Interrupt ........... 2-28 (R/W, U/S Bits) ................. 4-20
2.7.4 Non-Maskable Interrupt ...... 2-29 4.5.4 Page Cacheability
2.7.5 Software Interrupts .......... 2-29 (PWT, PCD Bits) ................ 4-21
2.7.6 Interrupt and Exception 4.5.5 Translation Lookaside
Priorities ........................ 2-29 Buffer ........................... 4-21
2.7.7 Instruction Restart ........... 2-30 4.5.6 Paging Operation ............ 4-22
4.5.7 Operating System
Responsibilities ................. 4-23
iv
4.6 Virtual 8086 Environment ......... 4-23 6.2.15 Address Bit 20 Mask
4.6.1 Executing 8086 Programs .... 4-23 (A20M#) ......................... 6-8
4.6.2 Virtual 8086 Addressing 6.2.16 Boundary Scan Test

Mechanism ..................... 4-23 Signals ........................... 6-8
4.6.3 Paging in Virtual Mode ....... 4-23 6.3 Write Buffers ...................... 6-9
4.6.4 Protection and Virtual 8086 6.3.1 Write Buffers and I/O
Mode to I/O Permission Cycles .......................... 6-10
Bitmap .......................... 4-24 6.3.2 Write Buffers Implications on
4.6.5 Interrupt Handling ............ 4-25 locked Bus Cycles .............. 6-10
4.6.6 Entering and leaving Virtual 6.4 Interrupt and Non-Maskable

8086 Mode ..................... 4-26 Interrupt Interface .................. 6-10
6.4.1 Interrupt logic ............... 6-10
5.0 ON-CHIP CACHE .................... 5-1 6.4.2 NMI logic ................... 6-11
5.1 Cache Organization ................ 5-1 6.5 Reset and Initialization ............ 6-11
5.2 Cache Control ..................... 5-2 6.5.1 Pin State during Reset ....... 6-12
5.3 Cache Line Fills .................... 5-2
5.4 Cache Line Invalidations ........... 5-3 7.0 BUS OPERATION .................... 7-1
5.5 Cache Replacement ............... 5-3 7.1 Data Transfer Mechanism .......... 7-1
5.6 Page Cacheability .................. 5-4 7.1.1 Memory and 1/0 Spaces ...... 7-1
5.7 Cache Flushing .................... 5-5 7.1.2 Memory and 1/0 Space
Organization ..................... 7-2
5.8 Caching Translation lookaside
Buffer Entries ....................... 5-5 7.1.3 Dynamic Data Bus Sizing ...... 7-3
7.1.4 Interfacing with 8-, 16- and 32-
6.0 HARDWARE INTERFACE ........... 6-1 bit Memories ..................... 7-4
6.1 Introduction ........................ 6-1 7.1.5 Dynamic Bus Sizing during
6.2 Signal Descriptions ................ 6-2 Cache Line Fills .................. 7-6
6.2.1 Clock (ClK) ................... 6-2 7.1.6 Operand Alignment ........... 7-6
6.2.2 Address Bus 7.2 Bus Functional Description ......... 7-7

(A31-A2, BEO#-BE3#) ......... 6-2 7.2.1 Non-Cacheable Non-Burst
6.2.3 Data Lines (D31-DO) ......... 6-3 Single Cycle ...................... 7-7
6.2.4 Parity ......................... 6-3 7.2.2 Multiple and Burst Cycle Bus
Transfers ........................ 7-8
6.2.5 Bus Cycle Definition ........... 6-3
7.2.3 Cacheable Cycles ........... 7-12
6.2.6 Bus Control ................... 6-4
7.2.4 Burst Mode Details .......... 7-15
6.2.7 Burst Control ................. 6-4
7.2.58- and 16-Bit Cycles ......... 7-19
6.2.8 Interrupt Signals .............. 6-5
7.2.6 locked Cycles ............... 7-21
6.2.9 Bus Arbitration Signals ........ 6-5
7.2.7 Pseudo-locked Cycles ....... 7-22
6.2.10 Cache Invalidation ........... 6-6
7.2.8 Invalidate Cycles ............. 7-22
6.2.11 Cache Control ............... 6-7
7.2.9 Bus Hold .................... 7-26
6.2.12 Page Cacheability Outputs
(PWT, PCD) ...................... 6-7 7.2.10 Interrupt Acknowledge ...... 7-26
6.2.13 Numeric Error Reporting ..... 6-7 7.2.11 Special Bus Cycles ......... 7-28
6.2.14 Bus Size Control 7.2.12 Bus Cycle Restart .......... 7-29
(BS16#, BS8#) .................. 6-8 7.2.13 Bus States ................. 7-30
7.2.14 Floating Point Error
Handling ........................ 7-31
v
8.0 TESTABILITY ........................ 8-1 10.0 INSTRUCTION SET SUMMARY ... 10-1
8.1 Built-In Self Test (BIST) ............ 8-1 10.1 Intel486TM DX2 Microprocessor
8.2 On-Chip Cache Testing ............ 8-1 Instruction Encoding and Clock
Count Summary .... . . . . . . . . . . . . . . .. 10-1
8.2.1 Cache Testing Registers TR3,
TR4 and TR5 .................... 8-1 10.2 Instruction Encoding ........... 10-20
8.2.2 Cache Testability Write ........ 8-2 10.2.1 Overview .................. 10-20
8.2.3 Cache Testability Read ....... 8-4 10.2.2 32-Bit Extensions of the
Instruction Set ................. 10-21
8.2.4 Flush Cache .................. 8-4
10.2.3 Encoding of Integer
8.3 Translation Lookaside Buffer (TLB) Instruction Fields ............... 10-21
Testing ............................. 8-4
10.2.4 Encoding of Floating Point
8.3.1 Translation Lookaside Buffer Instruction Fields ............... 10-27
Organization ..................... 8-4
8.3.2 TLB Test Registers: TR6 and 11.0 DIFFERENCES WITH THE
TR7 .............................. 8-5 Intel386TM MICROPROCESSOR ..... 11-1
8.3.3 TLB Write Test ................ 8-7 12.0 UPGRADE SOCKET ............... 12-1
8.3.4 TLB Lookup Test ............. 8-7 12.0.1 Upgrade Processor
8.4 3-state Output Test Mode .......... 8-7 Overview ....................... 12-2
8.5 Intel486TM DX2 Microprocessor 12.1 Upgrade Circuit Design .......... 12-2
Boundary Scan (JTAG) .............. 8-7 12.2 Socket Layout ................... 12-3
8.5.1 Boundary Scan 12.2.1 Backward Compatibility ..... 12-3
Architecture ...................... 8-8
12.2.2 Physical Dimensions ........ 12-3
8.5.2 Data Registers ................ 8-8
12.2.3 "End User Easy" ........... 12-4
8.5.3 Instruction Register ........... 8-9
12.2.4 LlF and ZIF Socket
8.5.4 Test Access Port (TAP) Vendors ........................ 12-5
Controller ....................... 8-11
12.3 Thermal Management ........... 12-5
8.5.5 Boundary Scan Register
Cell ............................. 8-14 12.3.1 Thermal Calculations for
Hypothetical System ............ 12-5
8.5.6 TAP Controller Initialization .. 8-14
12.3.2 Heat Sinks ................. 12-6
8.5.7 Boundary Scan Description
Language (BSDL) ............... 8-15 12.3.3 Airflow ..................... 12-6
12.4 BIOS and Software .............. 12-7
9.0 DEBUGGING SUPPORT ............. 9-1
12.4.1 Intel486 DX2 Upgrade
9.1 Breakpoint Instructions ............ 9-1 Processor Detection ............ 12-7
9.2 Single Step Instructions ............ 9-1 12.4.2 Timing Dependent Loops ... 12-7
9.3 Debug Registers ................... 9-1 12.5 Test Requirements .............. 12-7
9.3.1 Linear Address Breakpoint 12.6 Upgrade Socket Pinout .......... 12-7
Registers ........................ 9-2
12.6.1 Pinout ...................... 12-8
9.3.2 Debug Control Register ....... 9-2
12.6.2 Pin Description ............ 12-10
9.3.3 Debug Status Register ........ 9-5
12.6.3 Reserved Pin
9.3.4 Use of Resume Flag (RF) in Specification ................... 12-10
Flag Register ..................... 9-5
12.7 D.C.lA.C. Specifications ........ 12-11
vi
13.0 CONVERTING AN EXISTING 15.0 MECHANICAL DATA .............. 15-1

Intel486™ CPU-BASED SYSTEM .... 13-1 15.1 Package Thermal
Specifications ...................... 15-2
14.0 ELECTRICAL DATA ............... 14-1
14.1 Power and Grounding ........... 14-1 16.0 SUGGESTED SOURCES FOR
14.2 Maximum Ratings ............... 14-1 Intel486 DX2 ACCESSORIES ........ 16-1
14.3 D.C. Specifications .............. 14-2
14.4 A.C. Specifications .............. 14-2
vii
DATA SHEET DESIGNATONS
Intel uses various data sheet markings to designate each phase of the document as it relates to the product.
The marking appears in the upper, right-hand corner of the data sheet. The following is the definition of these
markings:
Data Sheet Marking Description

Product Preview Contains information on products in the design phase of development. Do not
finalize a deSign with this information. Revised information will be published when
the product becomes available.
Advanced Information Contains information on products being sampled or in the initial production phase
of development. •
Preliminary Contains preliminary information on new products in production.'
No Marking Contains information on products in full production. •
'Specifications within these data sheets are subject to change without notice. Verify with your local Intel sales
office that you have the latest data sheet before finalizing a design.
int:eL Intel486TM DX2 MICROPROCESSOR
1.0 INTRODUCTION
A B C D E F G H J K L M N P Q R S
1 020 019 011 09 VSS OPl VSS VSS VCC VSS VSS VSS 02 DO A31 A28 A27 1
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
2 022 021 018 013 VCC 08 VCC 03 05 VCC 06 VCC 01 A29 VSS A25 A26 2
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
3 TCK VSS ClK 017 010 015 012 OP2 016 014 07 04 OPO A30 A17 VCC A23 3
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
4 023 VSS VCC A19 VSS NC 4
0 0 0 0 0 0
5 OP3 VSS VCC A21 A18 A14 5
0 0 0 0 0 0
6 024 025 027 A24 VCC VSS 6
0 0 0 0 0 0
7 vss VCC 026 A22 A15 A12 7
0 0 0 0 0 0
8 029 031 028 A20 VCC VSS 8
0 0 0 0 0 0
Intel486 DX2 MICROPROCESSOR
9 vss VCC 030 A16 vcc vss 9
0 0 0 PIN SIDE VIEW 0 0 0
10 NC NC NC A13 VCC VSS 10
0 0 0 0 0 0
11 vss VCC UP# A9 vce vss 11
0 0 0 0 0 0
12 Ne NC NC A5 All vss 12
0 0 0 0 0 0
13 NC NC NC A7 A8 Al0 13
0 0 0 0 0 0
14 TOI TMS FERR# A2 VCC vss 14
0 0 0 0 0 0
15 IGNNE# NMI FlUSH# A20t.t# HOlO KEN# NC BROY# BE2# BEO# PWT o/c# lOCK# HlOA BREQ A3 A6 15
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
16 INTR TOO RESET BS8# vec ROY# VCC vee BE1# VCC VCC VCC M/IO# VCC PLOCK# BLAST# A4 16
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
17 AHOLO EADS# 8516# BOFF# VSS BE3# VSS VSS PCO VSS VSS VSS W/R# VSS PCHK# NC AOS# 17
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
A B C D E F G H J K L M N P Q R S
241245-2
Figure 1.1
1-1
S R Q P N M L K J H G F E D C B A
1 A27 A28 A31 00 02 VSS VSS VSS VCC VSS VSS OPl VSS 09 011 019 020 1
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
2 A26 A25 VSS A29 01 VCC 06 VCC 05 03 VCC 08 VCC 013 018 021 022 2
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
3 A23 VCC A17 A30 OPO 04 07 014 016 OP2 012 015 010 017 CLK VSS TCK 3
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
4 NC VSS A19 VCC VSS 023 4
0 0 0 0 0 0
5 AU A18 A21 VCC VSS OP3 5
0 0 0 0 0 0
6 vss vcc A24 027 025 024 6
0 0 0 0 0 0
7 A12 A15 A22 026 VCC VSS 7
0 0 0 0 0 0
8 vss VCC A20 028 031 029 8
0 0 0 0 0 0
9 vss VCC A16 Intel486 DX2 MICROPROCESSOR 030 vcc VSS 9
0 0 0 0 0 0
TOP SIDE VIEW
10 vss VCC A13 NC NC NC 10
0 0 0 0 0 0
11 vss VCC A9 UP# VCC vss 11
0 0 0 0 0 0
12 VSS All AS NC NC NC 12
0 0 0 0 0 0
13 Al0 A8 A7 NC NC NC 13
0 0 0 0 0 0
14 vss VCC A2 FERR# TMS TOI 14
0 0 0 0 0 0
15 A6 A3 BREQ HLOA LOCK# o/c# PWT BEO# BE2# BROY# NC KEN# HOLD A20M# FLUSH# NMI IGNNE# 15
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
16 A4 BlAST# PLOCK# VCC M/IO# VCC VCC VCC BE1# vcc VCC RDY# vcc BS8# RESET TOO INTR 16
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
17 AOS# NC PCHK# vss W/R# VSS VSS vss pco vss VSS BE3# vss BOFf# 8516# EADS# AHOLD 17
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
S R Q P N M L K J H G F E D C B A
241245-3
Figure 1.2
1-2
intet Intel486TM DX2 MICROPROCESSOR
Pin Cross Reference by Pin Name

Address Data Control Test(1) N/C Vee Vss
A2 014 Do Pi A20M# 015 TCK A3 A10 B7 A7
A3 R15 01 N2 A08# 817 TDI A14 A12 B9 A9
A4 816 02 N1 AHOLO A17 TOO B16 A13 B11 A11
A5 012 03 H2 BEO# K15 TM8 B14 B12 C4 B3
A6 815 04 M3 BE1# J16 B13 C5 B4
A7 013 05 J2 BE2# J15 C10 E2 B5
A8 R13 06 L2 BE3# F17 C13 E16 E1
A9 011 07 L3 BLA8T# R16 G15 G2 E17
AlO 813 08 F2 BOFF# 017 R17 G16 G1
A11 R12 09 01 BROY# H15 84 H16 G17
A12 87 010 E3 BREO# 015 J1 Hi
A13 010 011 C1 B88# 016 K2 H17
A14 85 012 G3 B816# C17 K16 K1
A15 R7 013 02 CLK C3 L16 K17
A16 09 014 K3 O/C# M15 M2 L1
A17 03 015 F3 OPO N3 M16 L17
A18 R5 016 J3 OP1 F1 P16 M1
A19 04 017 03 OP2 H3 R3 M17
A20 08 018 C2 OP3 A5 R6 P17
A21 05 019 B1 EA08# B17 R8 02
A22 07 020 A1 FERR# C14 R9 R4
A23 83 021 B2 FLU8H# C15 RiO 86
A24 06 022 A2 HLOA P15 R11 88
A25 R2 023 A4 HOLD E15 R14 89
A26 82 024 A6 IGNNE# A15 810
A27 81 025 B6 INTR A16 811
A28 R1 026 C7 KEN# F15 812
A29 P2 027 C6 LOCK# N15 814
A30 P3 028 C8 M/IO# N16
A31 01 029 A8 NMI B15
030 C9 PCO J17
031 B8 PCHK# 017
PWT L15
PLOCK# 016
ROY# F16
RE8ET C16
RE8J{I) B10
RE8_B(1) C12
UP#(1) C11
W/R# N17
NOTE:
1. These pins were No-Connects on the 25 MHz and 33 MHz Intel486 OX microprocessors. For compatibility with old
designs they can still be left unconnected.
1-3
intel . Intel486TM DX2 MICROPROCESSOR
QUICK PIN REFERENCE

What follows is a brief pin description. For detailed signal descriptions refer to Section 6.
Symbol Type Name and Function
ClK I Clock provides the fundamental timing for the bus interface unit and is multiplied by
two (2x) to provide the internal frequency for the Intel486 OX2. All external timing
parameters are specified with respect to the rising edge of ClK.
ADDRESS BUS
A31-A4 1/0 A31-A2 are the address lines of the microprocessor. A31-A2, together with the
A2-A3 a byte enables BEO # - BE3 #, define the physical area of memory or inputloutput
space accessed. Address lines A31-A4 are used to drive addresses into the
microprocessor to perform cache line invalidations. Input signals must meet setup
and hold times t22 and t23' A31-A2 are not driven during bus or address hold.
BEO-3# a The byte enable signals indicate active bytes during read and write cycles. Ouring
the first cycle of a cache fill, the external system should assume that all byte
enables are active. BE3# applies to 024-031, BE2# applies to 016-023, BE1 #
applies to 08-015 and BEO# applies to 00-07. BEO#-BE3# are active lOW and
are not driven during bus hold.
DATA BUS
031-00 1/0 These are the data lines for the Intel486 OX2 microprocessor. Lines 00-07 define
the least significant byte of the data bus while lines 024-031 define the most
significant byte of the data bus. These signals must meet setup and hold times t22
and t23 for proper operation on reads. These pins are driven during the second and
subsequent clocks of write cycles.
DATA PARITY
OPO-OP3 1/0 There is one data parity pin for each byte of the data bus. Oata parity is generated
on all write data cycles with the same timing as the data driven by the Intel486 OX2
microprocessor. Even parity information must be driven back into the
microprocessor on the data parity pins with the same timing as read information to
insure that the correct parity check status is indicated by the Intel486 OX2
microprocessor. The signals read on these pins do not affect program execution.
Input signals must meet setup and hold times t22 and t23' OPO-OP3 should be
connected to Vee through a pullup resistor in systems which do not use parity.
OPO-OP3 are active HIGH and are driven during the second and subsequent clocks
of write cycles.
PCHK# a Parity Status is driven on the PCHK # pin the clock after ready for read operations.
The parity status is for data sampled at the end of the previous clock. A parity error
is indicated by PCHK# being lOW. Parity status is only checked for enabled bytes
as indicated by the byte enable and bus size signals. PCH K # is valid only in the
clock immediately after read data is returned to the microprocessor. At all other
times PCHK # is inactive (HIGH). PCHK # is never floated.
1-4
int'eL Intel486™ DX2 MICROPROCESSOR
QUICK PIN REFERENCE (Continued)

BUS CYCLE DEFINITION
M/IO# 0 The memory/input-output, data/control and write/read lines are the primary bus
O/C# 0 definition signals. These signals are driven valid as the AOS# signal is asserted.
W/R# 0 M/IO# D/C# W/R# Bus Cycle Initiated
0 0 0 Interrupt Acknowledge
0 0 1 Halt/Special Cycle
0 1 0 1/0 Read
0 1 1 110 Write
1 0 0 Code Read
1 0 1 Reserved
1 1 0 Memory Read
1 1 1 Memory Write
The bus definition signals are not driven during bus hold and follow the timing of the
address bus. Refer to Section 7.2.11 for a description of the special bus cycles.
LOCK# 0 The bus lock pin indicates that the current bus cycle is locked. The Intel486 OX2
microprocessor will not allow a bus hold when LOCK # is asserted (but address
holds are allowed). LOCK # goes active in the first clock of the first locked bus cycle
and goes inactive after the last clock of the last locked bus cycle. The last locked
cycle ends when ready is returned. LOCK # is active LOW and is not driven during
bus hold. Locked read cycles will not be transformed into cache fill cycles if KEN# is
returned active.
PLOCK # 0 The pseudo-lock pin indicates that the current bus transaction requires more than
one bus cycle to complete. Examples of such operations are floating point long
reads and writes (64 bits), segment table descriptor reads (64 bits), in addition to
cache line fills (128 bits). The Intel486 OX2 microprocessor will drive PLOCK # active
until the addresses for the last bus cycle of the transaction have been driven
regardless of whether ROY # or BROY # have been returned.
Normally PLOCK # and BLAST # are inverse of each other. However during the first
bus cycle of a 64-bit floating point write, both PLOCK # and BLAST # will be
asserted.
PLOCK# is a function of the BS8#, BS16# and KEN# inputs. PLOCK# should be
sampled only in the clock ready is returned. PLOCK # is active LOW and is not
driven during bus hold.
BUS CONTROL
AOS# 0 The address status output indicates that a valid bus cycle definition and address are
available on the cycle definition lines and address bus. AOS# is driven active in the
same clock as the addresses are driven. ADS # is active LOW and is not driven
during bus hold.
ROY# I The non-burst ready input indicates that the current bus cycle is complete. ROY #
indicates that the external system has presented valid data on the data pins in
response to a read or that the external system has accepted data from the Intel486
OX2 microprocessor in response to a write. ROY # is ignored when the bus is idle
and at the end of the first clock of the bus cycle.
ROY # is active during address hold. Data can be returned to the processor while
AHOLO is active.
ROY # is active LOW, and is not provided with an internal pull up resistor. ROY #
must satisfy setup and hold times t16 and t17 for proper chip operation.
1-5
intel~ Intel486™ DX2 MICROPROCESSOR

BURST CONTROL
BRDY# I The burst ready input performs the same function during a burst cycle that RDY #
performs during a non-burst cycle. BRDY # indicates that the external system has
presented valid data in response to a read or that the external system has accepted data
in response to a write. BRDY # is ignored when the bus is idle and at the end of the first
clock in a bus cycle.
BRDY # is sampled in the second and subsequent clocks of a burst cycle. The data
presented on the data bus will be strobed into the microprocessor when BRDY # is
sampled active. If RDY # is returned simultaneously with BRDY #, BRDY # is ignored
and the burst cycle is prematurely interrupted
BRDY # is active LOW and is provided with a small pullup resistor. BRDY # must satisfy
the setup and hold times t16 and t17.
BLAST # a The burst last signal indicates that the next time BRDY # is returned the burst bus cycle
is complete. BLAST # is active for both burst and non-burst bus cycles. BLAST # is
active LOW and is not driven during bus hold.
INTERRUPTS
RESET I The reset input forces the Intel486 DX2 microprocessor to begin execution at a known
state. The microprocessor cannot begin execution of instructions until at least 1 ms after
Vee and CLK have reached their proper DC and AC specifications. The RESET pin
should remain active during this time to insure proper microprocessor operation. RESET
is active HIGH. RESET is asynchronous but must meet setup and hold times t20 and t21
for recognition in any specific clock.
INTR I The maskable interrupt indicates that an external interrupt has been generated. If the
internal interrupt flag is set in EFLAGS, active interrupt processing will be initiated. The
Intel486 DX2 microprocessor will generate two locked interrupt acknowledge bus cycles
in response to the INTR pin going active. INTR must remain active until the interrupt
acknowledges have been performed to assure that the interrupt is recognized.
INTR is active HIGH and is not provided with an internal pulldown resistor. INTR is
asynchronous, but must meet setup and hold times t20 and t21 for recognition in any
specific clock.
NMI I The non-maskable interrupt request signal indicates that an external non-maskable
interrupt has been generated. NMI is rising edge sensitive. NMI must be held LOW for at
least four CLK periods before this rising edge. NMI is not provided with an internal
pulldown resistor. NMI is asynchronous, but must meet setup and hold times t20 and t21
for recognition in any specific clock.
BUS ARBITRATION
BREQ a The internal cycle pending signal indicates that the Intel486 DX2 microprocessor has
internally generated a bus request. BREQ is generated whether or not the Intel486 DX2
microprocessor is driving the bus. BREQ is active HIGH and is never floated.
HOLD I The bus hold request allows another bus master complete control of the Intel486 DX2
microprocessor bus. In response to HOLD going active the Intel486 DX2 microprocessor
will float most of its output and input/output pins. HLDA will be asserted after completing
the current bus cycle, burst cycle or sequence of locked cycles. The Intel486 DX2
microprocessor will remain in this state until HOLD is deasserted. HOLD is active high
and is not provided with an internal pulldown resistor. HOLD must satisfy setup and hold
times t18 and t19 for proper operation.
HLDA a Hold acknowledge goes active in response to a hold request presented on the HOLD
pin. HLDA indicates that the Intel486 DX2 microprocessor has given the bus to another
local bus master. HLDA is driven active in the same clock that the Intel486 DX2
microprocessor floats its bus. HLDA is driven inactive when leaving bus hold. HLDA is
active HIGH and remains driven during bus hold.
1-6
intel· Intel486TM DX2 MICROPROCESSOR

BUS ARBITRATION (Continued)
BOFF# I The backoffinput forces the Intel486 DX2 microprocessor to float its bus in the next
clock. The microprocessor will float all pins normally floated during bus hold but HLDA
will not be asserted in response to BOFF #. BOFF # has higher priority than RDY # or
BRDY #; if both are returned in the same clock, BOFF # takes effect. The
microprocessor remains in bus hold until BOFF # is negated. If a bus cycle was in
progress when BOFF # was asserted the cycle will be restarted. BOFF # is active LOW
and must meet setup and hold times t18 and t19 for proper operation.
CACHE INVALIDATION
AHOLD I The address hold request allows another bus master access to the Intel486 DX2
microprocessor's address bus for a cache invalidation cycle. The Intel486 DX2
microprocessor will stop driving its address bus in the clock following AHOLD going
active. Only the addres.s bus will be floated during address hold, the remainder of the
bus will remain active. AHOLD is active HIGH and is provided with a small internal
pulldown resistor. For proper operation AHOLDmust meet setup and hold times t18 and
t19'
EADS# I This signal indicates that a valid external address has been driven onto the Intel486 DX2
microprocessor address pins. This address will be used to perform an internal cache
invalidation cycle. EADS# is active LOW and is provided with an internal pullup resistor.
EADS# must satisfy setup and hold times t12 and t13 for proper operation.
CACHE CONTROL
KEN# I The cache enable pin is used to determine whether the current cycle is cacheable.
When the Intel486 DX2 microprocessor generates a cycle that can be cached and
KEN # is active, the cycle will bec.ome a cache line .fill cycle. Returning KEN # active one
clock before ready during the last read in the cache line fill will cause the line to be
placed in the on-chip cache. KEN # is active LOW and is provided with a small internal
pullup resistor. KEN # must satisfy setup and hold times t14 and t15 for proper operation.
FLUSH# I The cache flush input forces the Intel486 DX2 microprocessor to flush its entire internal
cache. FLUSH # is active low and need only be asserted for one clock. FLUSH # is
asynchronous but setup and hold timest20 and t21 must be met for recognition in any
specific clock. FLUSH # being sampled low in the clock before the falling edge of
RESET causes the Intel486 DX2 microprocessor to enter the tri-state test mode.
PAGE CACHEABILITY
PWT 0 The page write-through and page cache disable pins reflect the state of the page
PCD 0 attribute bits, PWT and PCD, in the page table entry or page directory entry. If paging is
disabled or for cycles that are not paged, PWT and PCD reflect the state of the PWT and
PCD bits in control register 3. PWT and PCD have the same timing as the cycle definition
pins (M/IO#, D/C# and W/R#). PWT and PCD are active HIGH and are not driven
during bus hold. PCD is masked by the cache disable bit (CD) in Control Register O.
NUMERIC ERROR REPORTING
FERR# 0 The floating point error pin is driven active when a floating point error occurs. FERR # is
similar to the ERROR # pin on the Intel387TM math coprocessor. FERR # is included for
compatibility with systems using DOS type floating point error reporting. FERR # will not
go active if FP errors are masked in FPU register. FERR # is active LOW, and is not
floated during bus hold.
1-7
intel. Intel486TM DX2 MICROPROCESSOR

NUMERIC ERROR REPORTING (Continued)
IGNNE# I When the ignore numeric effor pin is asserted the Intel486 DX2 microprocessor will
ignore a numeric error and continue executing non-control floating point instructions, but
FERR # will still be activated by the Intel486 DX2. When IGNNE # is deasserted the
Intel486 DX2 microprocessor will freeze on a non-control floating point instruction, if a
previous floating point instruction caused an error. IGNNE # has no effect when the NE
bit in control register 0 is set. IGNNE # is active LOW and is provided with a small
internal pullup resistor. IGNNE# is asynchronous but setup and hold times t20 and t21
must be met to insure recognition on any specific clock.
BUS SIZE CONTROL
8516# I The bus size 16 and bus size 8 pins (bus sizing pins) cause the Intel486 DX2
858# I microprocessor to run multiple bus cycles to complete a request from devices that
cannot provide or accept 32 bits of data i'1 a single cycle. The bus sizing pins are
sampled every clock. The state of these pins in the clock before ready is used by the
Intel486 DX2 microprocessor to determine the bus size. These signals are active LOW
and are provided with internal pullup resistors. These inputs must satisfy setup and hold
times t14 and t15 for proper operation.
ADDRESS MASK
A20M# I When the address bit 20 mask pin is asserted, the Intel486 DX2 microprocessor masks
physical address bit 20 (A20) before performing a lookup to the internal cache or driving
a memory cycle on the bus. A20M # emulates the address wraparound at one Mbyte
which occurs on the 8086. A20M # is active LOW and should be asserted only when the
processor is in real mode. This pin is asynchronous but should meet setup and hold
times t20 and t21 for recognition in any specific clock. For proper operation, A20M #
should be sampled high at the falling edge of RESET.
TEST ACCESS PORT
TCK I Test Clock is an input to the Intel486 DX2 CPU and provides the clocking function
required by the JTAG boundary scan feature. TCK is used to clock state information and
data into and out of the component. State select information and data are clocked into
the component on the rising edge of TCK on TMS and TDI, respectively. Data is clocked
out of the part on the falling edge of TCK on TOO.
TOI I Test Data Input is the serial input used to shift JTAG instructions and data into the
component. TOI is sampled on the rising edge of TCK, during the SHIFT-IR and the
SHIFT-DR TAP controller states. During all other tap controller states, TOI is a "don't
care".
TOO 0 Test Data Output is the serial output used to shift JTAG instructions and data out of the
component. TOO is driven on the falling edge of TCK during the SHIFT-IR and
SHIFT-DR TAP controller states. At all other times TOO is driven to the high impedance
state.
TMS I Test Mode Select is decoded by the JTAG TAP (Tap Access Port) to select the
operation of the test logic. TMS is sampled on the rising edge of TCK. To guarantee
deterministic behavior of the TAP controller TMS is provided with an internal pull-up
resistor.
1-8

POWER DOWN MODE (UPGRADE PROCESSOR SUPPORT)
UP# I The Upgrade Present pin forces the Intel486 DX2 to 3-state all of its outputs and enter
the power down mode. When the Upgrade Present pin is sampled asserted by the CPU in
the clock before the falling edge of RESET, the power down mode is enabled. UP# has
no effect on the power down status except during this edge. The CPU is also forced to 3-
state all of it's outputs immediately in response to this signal. The UP# signal must
remain asserted in order to keep the pins 3-stated. UP# is active low and is provided with
an internal pull-up resistor.
Table 1.1. Output Pins Table 1.2. Input Pins

Active When Active Synchronousl
Name Name
Level Floated Level Asynchronous
BREQ HIGH CLK
HLDA HIGH RESET HIGH Asynchronous
BEO#-BE3# LOW Bus Hold HOLD HIGH Synchronous
PWT,PCD HIGH Bus Hold AHOLD HIGH Synchronous
W/R#, D/C#, M/IO# HIGH Bus Hold EADS# LOW Synchronous
LOCK# LOW Bus Hold BOFF# LOW Synchronous
PLOCK # LOW Bus Hold FLUSH# LOW Asynchronous
ADS# LOW Bus Hold A20M# LOW Asynchronous
BLAST # LOW Bus Hold BS16#, BS8# LOW Synchronous
PCHK# LOW KEN# LOW Synchronous
FERR# LOW RDY# LOW Synchronous
RES_B LOW BRDY# LOW Synchronous
A2-A3 HIGH Bus, Address Hold INTR HIGH Asynchronous
NMI HIGH Asynchronous
IGNNE# LOW Asynchronous
RESJ LOW Asynchronous
UP# LOW Asynchronous
Table 1.3.lnput/Output Pins Table 1-4. Test Pins

Active When Input or Sampledl
Name Name
Level Floated Output Driven On
DO-D31 HIGH Bus Hold TCK Input N/A
DPO-DP3 HIGH Bus Hold
TOI Input Rising Edge of TCK
A4-A31 HIGH Bus, Address Hold
TOO Output Falling Edge of TCK
TMS Input RiSing Edge of TCK
1-9
infel . Intel486™ DX2 MICROPROCESSOR
2.0 ARCHITECTURAL OVERVIEW

The Intel486 OX2 microprocessor is a fully compati- The segmentation unit provides four-levels of pro-
ble member of the Intel486 family. tection for isolating and protecting applications and
the operating system from each other. The hardware
The Intel486 microprocessor family is a 32-bit archi- enforced protection allows the deSign of systems
tecture with on-chip memory management, floating with a high degree of integrity.
point and cache memory units.
The Intel486 OX microprocessor has two modes of
The Intel486 OX microprocessor contains all the operation: Real Address Mode (Real Mode) and Pro-
features of the Intel386TM microprocessor with en- tected Mode Virtual Address Mode (Protected
hancements to increase performance. The instruc- Mode). In Real Mode the Intel486 OX microproces-
tion set includes the complete Intel386 microprocessor operates as a very fast 8086. Real Mode is re-
sor instruction set along with extensions to serve quired primarily to set up the processor for Protected
new applications. The on-chip memory management Mode operation. Protected Mode provides access to
unit (MMU) is completely compatible with the In- the sophisticated memory management paging and
tel386 microprocessor MMU. The Intel486 OX mi- privilege capabilities of the processor.
croprocessor brings theintel387™ math coproces-
sor on-chip. All software written for the Intel386 mi- Within Protected Mode, software can perform a task
croprocessor, Intel387 math coprocessor and previ- switch to enter into tasks deSignated as Virtual 8086
ous members of the 86/87 architectural family will Mode tasks. Each virtual 8086 task behaves with
run on the Intel486 OX microprocessor without any 8086 semantics, allowing 8086 software (an applica-
modifications. tion program or an entire operating system) to exe-
cute.
Several enhancements have been added to the In-
tel486 OX microprocessor to increase performance. The on-chip floating point unit operates in parallel
On-chip cache memory allows frequently used data with the arithmetic and logiC unit and provides arith-
and code to be stored on-chip reducing accesses to metic instructions for a variety of numeric data types.
the external bus. A clock doubler has been added to It executes numerous built-in transcendental func-
speed up internal operations to twice that of an In- tions (e.g., tangent, sine, cosine, and log functions).
tel486 OX microprocessor running with the same The floating point unit fully conforms to the ANSI!
bus clock. RiSe design techniques have been used IEEE standard 754-1985 for floating point arithmetic.
to reduce instruction cycle times. A burst bus feature
The on-chip cache is 8 Kbytes in size. It is 4-way set
enables fast cache fills. All of these features, com-
associative and follows a write-through policy. The
bined, lead to performance greater than triple that of
on-chip cache includes features to provide flexibility
a Intel386 microprocessor.
in external memory system design. Individual pages
can be designated as cacheable or non-cacheable
The memory management unit (MMU) consists of a
by software or hardware. The cache can also be en-
segmentation unit and a paging unit. Segmentation
abled and disabled by software or hardware.
allows management of the logical address space by
providing easy data and code relocatibility and effi-
Finally the Intel486 OX2 microprocessor has fea-
cient sharing of global resources. The paging mech-
tures to facilitate high performance hardware de-
anism operates beneath segmentation and is trans-
signs. The 1x bus clock eases high frequency board
parent to the segmentation process. Paging is op-
level designs. While the 2x clock doubler improves
tional and can be disabled by system software. Each
execution performance without increasing the board
segment can be divided into one or more 4 Kbyte
design complexity. This 2x clock doubler enhances
segments. To implement a virtual memory system,
all operations operating out of the cache and/or not
the Intel486 OX microprocessor supports full restart-
blocked by external bus accesses. The burst bus
ability for all page and segment faults.
feature enables fast cache fills. These features are
described beginning in Section 6.
Memory is organized into one or more variable
length segments, each up to four gigabytes (232
bytes) in size. A segment can have attributes associ- 2.1 Register Set
ated with it which include its location, size, type (i.e.,
stack, code or data), and protection characteristics. The Intel486 OX microprocessor register set in-
Each task on a Intel486 OX microprocessor can cludes all the registers contained in the Intel386 mi-
have a maximum of 16,381 segments, each up to croprocessor and the Intel387 math coprocessor.
four gigabytes in size. Thus each task has a maxi-
mum of 64 terabytes (trinion bytes) of virtual memo-
ry.
2-1
Intel486TM DX2 MICROPROCESSOR
The register set can be split into the following cate- The base architecture and floating point registers
gories: are accessible by the applications program. The sys-
tem level registers are only accessible at privilege
Base Architecture Registers level 0 and are used by the systems level program.
General Purpose Registers The debug and test registers are also only accessi-
ble at privilege level o.
Instruction Pointer
Flags Register
Segment Registers 2.1.1 BASE ARCHITECTURE REGISTERS
Figure 2.1 shows the Intel486 DX2 microprocessor
Systems Level Registers
base architecture registers. The contents of these
Control Registers registers are task-specific and are automatically
System Address Registers loaded with a new context upon a task switch opera-
tion.
Floating Point Registers
Data Registers The base architecture includes six directly accessi-
ble descriptors, each specifying a segment up to
Tag Word 4 Gbytes in size. The descriptors are indicated by
Status Word the selector values placed in the Intel486 DX2 mi-
Instruction and Data Pointers croprocessor segment registers. Various selector
values can be loaded as a program executes.
Control Word
The selectors are also task-specific, so the segment
Debug and Test Registers registers are automatically loaded with new context
upon a task switch operation.
General Purpose Registers
31 24123 16 15 al7 0 2.1.1.1 General Purpose Registers
AH AX AL EAX
The eight 32-bit general purpose registers are
BH BX BL EBX shown in Figure 2.1. These registers hold data or
CH CX CL ECX
address quantities. The general purpose registers
can support data operands of 1, 8, 16 and 32 bits,
OH OX OL EOX
and bit fields of 1 to 32 bits. Address operands of 16
Sl ESI and 32 bits are supported. The 32-bit registers are
01 EOI named EAX, EBX, ECX, EDX, ESI, EDI, EBP and
ESP.
BP EBP
SP ESP The least significant 16 bits of the general purpose
registers can be accessed separately by using the
Segment Registers 16-bit names of the registers AX, BX, CX, OX, 51, 01,
15 0 BP and SP. The upper 16 bits of the register are not
CS Code Segment
changed when the lower 16 bits are accessed sepa-
rately.
SS Stack Segment
Finally 8-bit operations can individually access the

00)
ES
Data Segments
lowest byte (bits 0-7) and the higher byte (bits 8-
15) of the general purpose registers AX, BX, CX and
FS
OX. The lowest bytes are named AL, BL, CL and DL
GS
respectively. The higher bytes are named AH, BH,
CH and DH respectively. The individual byte acces-
Instruction Pointer sibility offers additional flexibility for data operations
31 16 15 0 but is not used for effective address calculation.
I I IP I EIP
2.1.1.2 Instruction Pointer
Flags Register
I I FLAGS I EFLAGS
The instruction pointer, shown in Figure 2.1, is a 32-
bit register named EIP. EIP holds the offset of the
next instruction to be executed. The offset is always
Figure 2.1. Base Architecture Registers relative to the base of the code segment (CS). The
lower 16 bits (bits 0-15) of the EIP contain the 16-bit
2-2
FLAGS
3322222222221111111111
10987654321098765432109876543210
[FlAGS RESERVED FOR INTEL
ALlGN~ENT CHE~~K====~J
VIRTUAL MODE
RESUIiIE FLAG
NESTED TASK FLAG ------~
I/o PRIVILEGE LEVEL -------~
OVERFLOW ~~~=========~J
DIRECTION FLAG
INTERRUPT ENABLE
241245-4
NOTE:
~indicates Intel Reserved: do not define; see Section 2.1.6.
Figure 2.2. Flags Register
instruction pointer named IP, which is used for 16-bit register and it enables faults on accesses to misa-
addressing. ligned data.
AC (Alignment Check, bit 18)
2.1.1.3 Flags Register The AC bit enables the generation of faults if a
memory reference is to a misaligned address.
The flags register is a 32-bit register named Alignment faults are enabled when AC is set
EFLAGS. The defined bits and bit fields within to 1. A mis-aligned address is a word access
EFLAGS control certain operations and indicate to an odd address, a dword access to an ad-
status of the Intel486 DX2 microprocessor. The low- dress that is not on a dword boundary, or an
er 16 bits (bits 0-15) of EFLAGS contain the 16·bit 8-byte reference to an address that is not on a
register named FLAGS, which is most useful when 64·bit word boundary. See Section 7.1.6 for
executing 8086 and 80286 code. EFLAGS is shown more information on operand alignment.
in Figure 2.2.
Alignment faults are only generated by pro-
grams running at privilege level 3. The AC bit
EFLAGS bits 1, 3, 5,15 and 19-31 are "undefined".
When these bits are stored during interrupt process· setting is ignored at privilege levels 0, 1 and 2.
ing or with a PUSHF instruction (push flags onto Note that references to the descriptor tables
stack), a one is stored in bit 1 and zeros in bits 3, 5, (for selector loads), or the task state segment
15 and 19-31. (TSS) , are implicitly level 0 references even if
the instructions causing the references are
The EFLAGS register in the Intel486 OX microproc- executed at level 3. Alignment faults are re-
essor contains a new bit not previously defined. The ported through interrupt 17, with an error code
new bit, AC, is defined in the upper 16 bits of the of O. Table 2.1 gives the alignment required
for the Intel486 OX microprocessor data
types.
Table 2.1. Data Type Alignment Requirements

Memory Access Alignment (Byte Boundary)
Word 2
Dword 4
Single Precision Real 4
Double Precision Real 8
Extended Precision Real 8
Selector 2
48-Bit Segmented Pointer 4
32-Bit Flat Pointer 4
32-Bit Segmented Pointer 2
48-Bit "Pseudo-Descriptor" 4
FSTENVIFLDENV Save Area 4/2 (On Operand Size)
FSAVE/FRSTOR Save Area 4/2 (On Operand Size)
Bit String 4
2-3
IMPLEMENTATION NOTE: that the current nested task's Task State Seg-
Several instructions on the Intel486 DX microproc- ment (TSS) has a valid back link to the previ-
essor generate misaligned references, even if their ous task's TSS. This bit is set or reset by con-
memory address is aligned. For example, on the In- trol transfers to other tasks. The value of NT
tel486 DX microprocessor, the SGDT/SIDT (store in EFLAGS is tested by the IRET instruction to
global/interrupt descriptor table) instruction reads/ determine whether to do an inter-task return
writes two bytes, and then reads/writes four bytes or an intra-task return. A POPF or an IRET
from a "pseudo-descriptor" at the given address. instruction will affect the setting of this bit ac-
The Intel486 DX microprocessor will generate misa- cording to the image popped, at any privilege
ligned references unless the address is on a 2 mod level.
4 boundary. The FSAVE and FRSTOR instructions 10PL (Input/Output Privilege Level, bits 12-13)
(floating point save and restore state) will generate
misaligned references for one-half of the register This two-bit field applies to Protected Mode.
save/restore cycles. The Intel486 DX microproces- 10PL indicates the numerically maximum CPL
sor will not cause any AC faults if the effective ad- (current privilege level) value permitted to ex-
dress given in the instruction has the proper align- ecute I/O instructions without generating an
ment. exception 13 fault or consulting the I/O Per-
mission Bitmap. It also indicates the maximum
VM (Virtual 8086 Mode, bit 17) CPL value allowing alteration of the IF (INTR
The VM bit provides Virtual 8086 Mode within Enable Flag) bit when new values are popped
Protected Mode. If set while the Intel486 DX into the EFLAG register. POPF and IRET in-
microprocessor is in Protected Mode, the In- struction can alter the 10PL field when execut-
tel486 DX microprocessor will switch to Virtual ed at CPL = O. Task switches can always al-
8086 operation, handling segment loads as ter the 10PL field, when the new flag image is
the 8086 does, but generating exception 13 loaded from the incoming task's TSS.
faults on privileged opcodes. The VM bit can OF (Overflow Flag, bit 11)
be set only in Protected Mode, by the IRET
instruction (if current privilege level = 0) and OF is set if the operation resulted in a signed
by task switches at any privilege level. The overflow. Signed overflow occurs when the
VM bit is unaffected by POPF. PUSHF always operation resulted in carry/borrow into the
pushes a a in this bit, even if executing in Vir- sign bit (high-order bit) of the result but did not
tual 8086 Mode. The EFLAGS image pushed result in a carry/borrow out of the high-order
during interrupt processing or saved during bit, or vice-versa. For 8-, 16-, 32-bit opera-
task switches will contain a 1 in this bit if the tions, OF is set according to overflow at bit 7,
interrupted code was executing as a Virtual 15,31, respectively.
8086 Task. DF (Direction Flag, bit 10)
RF (Resume Flag, bit 16) DF defines whether ESI and/or EDI registers
The RF flag is used in conjunction with the postdecrement or postincrement during the
debug register breakpoints. It is checked at string instructions. Postincrement occurs if DF
instruction boundaries before breakpoint pro- is reset. Postdecrement occurs if DF is set.
cessing. When RF is set, it causes any debug IF (INTR Enable Flag, bit 9)
fault to be ignored on the next instruction. RF The IF flag, when set, allows recognition of
is then automatically reset at the successful external interrupts signalled on the INTR pin.
completion of every instruction (no faults are When IF is reset, external interrupts signalled
signalled) except the IRET instruction, the on the INTR are not recognized. 10PL indi-
POPF instruction, (and JMP, CALL, and INT cates the maximum CPL value allowing altera-
instructions causing a task switch). These in- tion of the IF bit when new values are popped
structions set RF to the value specified by the into EFLAGS or FLAGS.
memory image. For example, at the end of the
breakpoint service routine, the IRET instruc- TF (Trap Enable Flag, bit 8)
tion can pop an EFLAG image having the RF TF controls the generation of exception 1 trap
bit set and resume the program's execution at when single-stepping through code. When TF
the breakpoint address without generating an- is set, the Intel486 DX microprocessor gener-
other breakpoint fault on the same location. ates an exception 1 trap after the next instruc-
NT (Nested Task, bit 14) tion is executed. When TF is reset, exception
1 traps occur only as a function of the break-
This flag applies to Protected Mode. NT is set point addresses loaded into debug registers
to indicate that the execution of this task is DRO-DR3.
nested within another task. If set, it indicates
2-4
SF (Sign Flag, bit 7) NOTE:

SF is set if the high-order bit of the result is In these descriptions, "set" means "set to 1," and
set, it is reset otherwise. For 8-, 16-, 32-bit "reset" means "reset to 0."
operations, SF reflects the state of bit 7, 15,
31 respectively. 2.1.1.4 Segment Registers
ZF (Zero Flag, bit 6)
Six 16-bit segment registers hold segment selector
ZF is set if all bits of the result are o. Other-
values identifying the currently addressable memory
wise it is reset. segments. In protected mode, each segment may
AF (Auxiliary Carry Flag, bit 4) range in size from one byte up to the entire linear
The Auxiliary Flag is used to simplify the addi- and physical address space of the machine, 4
tion and subtraction of packed BCD quanti- Gbytes (2 32 bytes). In real address mode, the maxi-
ties. AF is set if the operation resulted in a mum segment size is fixed at 64 Kbytes (216 bytes).
carry out of bit 3 (addition) or a borrow into bit
3 (subtraction). Otherwise AF is reset. AF is The six addressable segments are defined by the
affected by carry out of, or borrow into bit 3 segment registers CS, SS, DS, ES, FS and GS. The
only, regardless of overall operand length: 8, selector in CS indicates the current code segment;
16 or 32 bits. the selector in SS indicates the current stack seg-
ment; the selectors in DS, ES, FS and GS indicate
PF (Parity Flags, bit 2)
the current data segments.
PF is set if the low-order eight bits of the oper-
ation contains an even number of "1's" (even
parity). PF is reset if the low-order eight bits 2.1.1.5 Segment Descriptor Cache Registers
have odd parity. PF is a function of only the
low-order eight bits, regardless of operand The segment descriptor cache registers are not pro-
grammer visible, yet it is very useful to understand
size.
their content. A programmer invisible descriptor
CF (Carry Flag, bit 0) cache register is associated with each programmer-
CF is set if the operation resulted in a carry visible segment register, as shown by Figure 2.3.
out of (addition), or a borrow into (subtraction) Each descriptor cache register holds a 32-bit base
the high-order bit. Otherwise CF is reset. For address, a 32-bit segment limit, and the other neces-
8-, 16- or 32-bit operations, CF is set accord- sary segment attributes.
ing to carry/borrow at bit 7,15 or 31, respec-
tively.
SEGMENT
REGISTERS DESCRIPTOR REGISTERS (LOADED AUTOMATICALLY)
~ ~
r \ r Other \
Segment
15 0 Physical Base Address Segment Limit Attributes from Descriptor
Selector CS- -
Selector SS- - -
Selector DS- - - -
Selector ES- - - -
Selector FS- - - -
Selector GS- - - -
Figure 2.3. Intel486™ DX Microprocessor Segment Registers
and Associated Descriptor Cache Registers
2-5
int:et Intel486TM DX2 MICROPROCESSOR
When a selector value is loaded into a segment reg- unit (FPU) and the segmentation and paging mecha-
ister, the associated descriptor cache register is au- nisms. These registers are only accessible to pro-
tomatically updated with the correct information. In grams running at privilege level 0, the highest privi-
Real Address Mode, only the base address is updat- lege level.
ed directly (by shifting the selector value four bits to
the left), since the segment maximum limit and attri- The system level registers include three control reg-
butes are fixed in Real Mode. In Protected Mode, isters and four segmentation base registers. The
the base address, the limit, and the attributes are all three control registers are CRO, CR2 and CR3. CR1
updated per the contents of the segment descriptor is reserved for future Intel processors. The four seg-
indexed by the selector. mentation base registers are the Global Descriptor
Table Register (GDTR), the Interrupt Descriptor Ta-
Whenever a memory reference occurs, the segment ble Register (IDTR), the Local Descriptor Table Reg-
descriptor cache register associated with the seg- ister (LDTR) and the Task State Segment Register
ment being used is automatically involved with the (TR).
memory reference. The 32-bit segment base ad-
dress becomes a component of the linear address
calculation, the 32-bit limit is used for the limit-check 2.1.2.1 Control Registers
operation, and the attributes are checked against
Control Register 0 (CRO)
the type of memory reference requested.
CRO, shown in Figure 2.5, contains 10 bits for con-
2.1.2 SYSTEM LEVEL REGISTERS trol and status purposes. Five of the bits defined in
the Intel486 DX microprocessor's CRO are newly de-
The system level registers, Figure 2.4, control opera- fined. The new bits are CD, NW, AM, WP and NE.
tion of the on-chip cache, the on-chip floating point The function of the bits in CRO can be categorized
as follows:
31 24123 16115 al7 0

CRO
PAGE FAULT LINEAR ADDRESS REGISTER CR2
PAGE DIRECTORY BASE REGISTER I CR3
SYSTEM ADDRESS REGISTERS

47 32-BIT LINEAR BASE ADDRESS 16 15 LIMIT 0
GDTRI
IDTR I I
SYSTEM SEGMENT
REGISTERS DESCRIPTOR REGISTERS (AUTOMATICALLY LOADED)
• ;.
~5
(
0' 32-BIT LINEAR BASE ADDRESS 20·BIT SEGMENT LIMIT ATTRIBUTES'
TR I SELECTOR I
LDTR I SELECTOR I I I II II
Figure 2.4. System Level Registers
MSW
indicates Intel reserved: Do not define; See Section 2.1.6
Figure 2.5. Control Register 0

2-6
Intel486 DX Microprocessor Operating Modes: PG, The low-order 16 bits of CRO are also known as the
PE (Table 2.2) Machine Status Word (MSW), for compatibility with
On-Chip Cache Control Modes: CD, NW (Table 2.3) the 80286 protected mode. LMSW and SMSW (load
and store MSW) instructions are taken as special
On-Floating Point Unit Control: TS, EM, MP, NE aliases of the load and store CRO operations, where
(Table 2.4) only the low-order 16 bits of CRO are involved. The
Alignment Check Control: AM LMSW and SMSW instructions in the Intel486 DX
Supervisor Write Protect: WP microprocessor work in an identical fashion to the
LMSW and SMSW instructions in the 80286 (i.e.,
Table 2.2. Processor Operating Modes they only operate on the low-order 16 bits of CRO
and ignores the new bits). New Intel486 DX micro-
PG PE Mode processor operating systems should use the MOV
0 0 REAL Mode. Exact 8086 semantics, CRO, Reg instruction.
with 32-bit extensions available with
prefixes. The defined CRO bits are described below.
0 1 Protected Mode. Exact 80286 PG (Paging Enable, bit 31)
semantics, plus 32-bit extensions The PG bit is used to indicate whether paging is
through both prefixes and "default" enabled (PG= 1) or disabled (PG=O). See Ta-
prefix setting associated with code ble 2.2.
segment descriptors. Also, a sub- CD (Cache Disable, bit 30)
mode is defined to support a virtual
8086 within the context of the The CD bit is used to enable the on-chip cache.
extended 80286 protection model. When CD = 1, the cache will not be filled on
cache misses. When CD = 0, cache fills may be
1 0 UNDEFINED. Loading CRO with this performed on misses. See Table 2.3.
combination of PG and PE bits will
raise a GP fault with error code O. The state of the CD bit, the cache enable input
pin (KEN #), and the relevant page cache dis-
1 1 Paged Protected Mode. All the able (PCD) bit determine if a line read in re-
facilities of Protected mode, with sponse to a cache miss will be installed in the
paging enabled underneath cache. A line is installed in the cache only if
segmentation. CD = 0 and KEN # and PCD are both zero. The
relevant PCD bit comes from either the page
Table 2.3. On-Chip Cache Control Modes table entry, page directory entry or control reg-
ister 3. Refer to Section 5.6 for more details on
CD NW Operating Mode
page cacheability.
1 1 Cache fills disabled"write-through and CD is set to one after RESET.
invalidates disabled.
NW (Not Write-Through, bit 29)
1 0 Cache fills disabled, write-through and
invalidates enabled. The NW bit enables on-chip cache write-
throughs and write-invalidate cycles (NW = 0).
0 1 INVALID. If CRO is loaded with this When NW = 0, all writes, including cache hits,
configuration of bits, a GP fault with are sent out to the pins. Invalidate cycles are
error code is raised. enabled when NW = o. During an invalidate cy-
0 0 Cache fills enabled, write-through and cle a line will be removed from the cache if the
invalidates enabled. invalidate address hits in the cache. See Table
2.3.
Table 2.4. On-Chip Floating Point Unit Control When NW = 1, . write-throughs and write-invali-
date cycles are disabled. A write will not be sent
CROBIT Instruction Type to the pins ilthe write hits in the cache. With
EM TS MP Floating-Point Wait NW =1 the only Write cycles that reach the ex-
ternal bus are cache misses. Write hits with
0 0 0 Execute Execute NW = 1 will never update main memory. Invali-
0 0 1 Execute Execute date cycles are ignored when NW = 1.
0 1 0 Trap 7 Execute AM (Alignment Mask, bit 18)
0 1 1 Trap 7 Trap 7
. 1 The AM bit controls whether the alignment
0 0 Trap 7 Execute
check (AC) bit in the flag register (EFLAGS) can
1 0 1 Trap 7 Execute allow an alignment fault. AM = 0 disables the
1 1 0 Trap 7 Execute AC bit. AM = 1 enables the AC bit. AM = 0 is the
1 1 1 Trap 7 Trap 7 Intel386 microprocessor compatible mode.
2-7
intel . Intel486™ DX2 MICROPROCESSOR
Intel386 microprocessor software may load in- TS (Task Switched, bit 3)

correct data into the AC bit in the EFLAGS reg- The TS bit is set whenever a task switch opera-
ister. Setting AM = 0 will prevent AC faults from tion is performed. Execution of a floating point
occurring before the Intel486 OX microproces- instruction with TS = 1 will cause a device not
sor has created the AC interrupt service routine. available (DNA) fault (trap vector 7). If TS = 1
WP (Write Protect, bit 16) and MP= 1 (monitor coprocessor in CRO) a
WP protects read-only pages from supervisor WAIT instruction will cause a DNA fault. See
write access. The Intel386 microprocessor al- Table 2.4.
lows a read-only page to be written from privi- EM (Emulate Coprocessor, bit 2)
lege levels 0-2. The Intel486 OX microproces- The EM bit determines whether floating point
sor is compatible with the Intel386 microproces- instructions are trapped (EM = 1) or executed. If
sor when WP = O. WP = 1 forces a fault on a EM = 1, all floating point instructions will cause
write to a read-only page from any privilege lev- fault 7.
el. Operating systems with Copy-on-Write fea-
tures can be supported with the WP bit. Refer NOTE:
to Section 4.5.3 for further details on use of the WAIT instructions are not affected by the state
WPbit. of EM. See Table 2.4.
NE (Numerics Exception, bit 5) MP (Monitor Coprocessor, bit 1)
The NE bit controls whether unmasked floating The MP bit is used in conjunction with the TS bit
point exceptions (UFPE) are handled through to determine if WAIT instructions should trap. If
interrupt vector 16 (NE = 1) or through an exter- MP=1 and TS=1, WAIT instructions cause
nal interrupt (NE = 0). NE = 0 (default at reset) fault 7. Refer to Table 2.4. The TS bit is set to 1
supports the DOS operating system error re- on task switches by the Intel486 OX microproc-
porting scheme from the 8087, 80287 and In- essor. Floating point instructions are not affect-
tel387 math coprocessor. In DOS systems, ed by the state of the MP bit. It is recommended
math coprocessor errors are reported via exter- that the MP bit be set to one for the normal
nal interrupt vector 13. DOS uses interrupt vec- operation of the Intel486 OX microprocessor.
tor 16 for an operating system call. Refer to PE (Protection Enable, bit 0)
Sections 6.2.13 and 7.2.14 for more information
on floating point error reporting. The PE bit enables the segment based protec-
tion mechanism. If PE = 1 protection is enabled.
For any UFPE the floating pOint error output pin When PE = 0 the Intel486 OX microprocessor
(FERR#) will be driven active. operates in REAL mode, with segment based
For NE = 0, the Intel486 OX microprocessor protection disabled, and addresses formed as
works in conjunction with the ignore numeric er- in an 8086. Refer to Table 2.2.
ror input (IGNNE#) and the FERR# output
pins. When a UFPE occurs and the IGNNE# All new CRO bits added to the Intel386 and Intel486
input is inactive, the Intel486 OX microproces- OX microprocessors, except for ET and NE, are up-
sor freezes immediately before executing the ward compatible with the 80286 because they are in
next floating point instruction. An external inter- register bits not defined in the 80286. For strict com-
rupt controller will supply an interrupt vector patibility with the 80286, the load machine status
when FERR # is driven active. The UFPE is ig- word (LMSW) instruction is defined to not change
nored if IGNNE# is active and floating point ex- the ET or NE bits.
ecution continues.
Control Register 1 (CR1)
NOTE:
The freeze does not take place if the next in- CR1 is reserved for use in future Intel microproces-
struction is one of the control instructions sors.
FNCLEX, FNINIT, FNSAVE, FNSTENV,
FNSTCW, FNSTSW, FNSTSW AX, FNENI, Control Register 2 (CR2)
FNOISI and FNSETPM. The freeze does occur
if the next instruction is WAIT. CR2, shown in Figure 2.6, holds the 32-bit linear ad-
For NE = 1, any UFPE will result in a software dress that caused the last page fault detected. The
interrupt 16, immediately before executing the error code pushed onto the page fault handler's
next non-control floating point or WAIT instruc- stack when it is invoked provides additional status
tion. The ignore numeric error input (IGNNE#) information on this page fault.
signal will be ignored.
2-8
in1:et Intel486™ DX2 MICROPROCESSOR
31 0
LI_____________________PA_G_E__FA_U_L_T_L_IN_E_A_R__
A_D_D_R_ES_S_R_E_G_I_S_T_ER____________________ ~ICR2
31
PAGE DIRECTORY BASE REGISTER
NOTE:
P indicates Intel reserved: Do not define; See Section 2.1.6.
Figure 2.6. Control Registers 2 and 3
Control Register 3 (CR3) 2.1.2.2 System Address Registers
CR3, shown in Figure 2.6, contains the physical Four special registers are defined to reference the
base address of the page directory table. The In- tables or segments supported by the 80286, In-
tel486 OX microprocessor page directory is always tel386 and Intel486 OX microprocessor protection
page aligned (4 Kbyte-aligned). This alignment is en- model. These tables or segments are:
forced by only storing bits 20-31 in CR3.
GOT (Global Descriptor Table)
In the Intel486 OX microprocessor CR3 contains two lOT (Interrupt Descriptor Table)
new bits, page write-through (PWT) (bit 3) and page LOT (Local Descriptor Table)
cache disable (PC D) (bit 4). The page table entry TSS (Task State Segment)
(PTE) and page directory entry (POE) also contain
PWT and PCO bits. PWT and PCO control page The addresses of these tables and segments are
cacheability. When a page is accessed in external stored in special registers, the System Address and
memory, the state of PWT and PCO are driven out System Segment Registers, illustrated in Figure 2.4.
on the PWT and PCO pins. The source of PWT and These registers are named GOTR, 10TR, LOTR and
PCO can be CR3, the PTE or the POE. PWT and TR respectively. Section 4, Protected Mode Archi-
PCO are sourced from CR3 when the POE is being tecture, describes the use of these registers.
updated. When paging is disabled (PG = 0 in CRO),
PCO and PWT are assumed to be 0, regardless of System Address Registers: GDTR and IDTR
their state in CR3.
The GOTR and 10TR hold the 32-bit linear base ad-
A task switch through a task state segment (TSS) dress and 16-bit limit of the GOT and lOT, respec-
which changes the values in CR3, or an explicit load tively.
into CR3 with any value, will invalidate all cached
page table entries in the translation lookaside buffer Since the GOT and lOT segments are global to all
(TLB). tasks in the system, the GOT and lOT are defined by
32-bit linear addresses (subject to page translation if
The page directory base address in CR3 is a physi- paging is enabled) and 16-bit limit values.
cal address. The page directory can be paged out
while its associated task is suspended, but the oper- System Segment Registers: LDTR and TR
ating system must ensure that the page directory is
resident in physical memory before the task is dis- The LOTR and TR hold the 16-bit selector for the
patched. The entry in the TSS for CR3 has a physi- LOT descriptor and the TSS descriptor, respectively.
cal address, with no provision for a present bit. This
means that the page directory for a task must be Since the LOT and TSS segments are task specific
resident in physical memory. The CR3 image in a segments, the LOT and TSS are defined by selector
TSS must point to this area, before the task can be values stored in the system segment registers.
dispatched through its TSS.
NOTE:
A programmer-invisible segment descriptor register
is associated with each system segment register.
2-9
2.1.3 FLOATING POINT REGISTERS into "fields" corresponding to the FPU's extended-
precision data type.
Figure 2.7 shows the floating point register set. The
on·chip FPU contains eight data registers, a tag The FPU's register set can be accessed either as a
word, a control register, a status register, an instruc- stack, with instructions operating on the top one or
tion pointer and a data pointer. two stack elements, or as a fixed register set, with
instructions operating on explicitly designated regis-
ters. The TOP field in the status word identifies the
Tag current top-of-stack register. A "push" operation
Field decrements TOP by one and loads a value into the
79 78 64 63 0 1 0 new top register. A "pop" operation stores the value
,----
RO Sign Exponent Significand from the current top register and then increments
f--- TOP by one. Like other Intel486 OX microprocessor
R1
I--- stacks in memory, the FPU register stack grows
R2 "down" toward lower-addressed registers.
f---
R3
I--- Instructions may address the data registers either
R4
f--- implicitly or explicitly. Many instructions operate on
R5 the register at the TOP of the stack. These instruc-
f---
R6 tions implicitly address the register at which TOP
I--- points. Other instructions allow the programmer to
R7
'--- explicitly specify which register to use. This explicit
register addressing is also relative to TOP.
15 0 47 0
Control Register I Instruction Pointer I 2.1.3.2 Tag Word
Status Register I Data Pointer I The tag word marks the content of each numeric
Tag Word data register, as shown in Figure 2.8. Each two-bit
tag represents one of the eight data registers. The
Figure 2.7. Floating Point Registers principal function of the tag word is to optimize the
FPUs performance and stack handling by making it
The operation of the Intel486 OX microprocessor's possible to distinguish between empty and nonemp-
on-chip floating point unit is exactly the same as the ty register locations. It also enables exception han-
Intel387 math coprocessor. Software written for the dlers to check the contents of a stack location with-
Intel387 math coprocessor will run on the on-chip out the need to perform complex decoding of the
floating point unit (FPU) without any modifications. actual data.
2.1.3.1 Data Registers 2.1.3.3 Status Word
Floating point computations use the Intel486 OX mi- The 16-bit status word reflects the overall state of
croprocessor's FPU data registers. These eight 80- the FPU. The status word is shown in Figure 2.9 and
bit registers provide the equivalent capacity of twen- is located in the status register.
ty 32-bit registers. Each of the eight data registers is
divided
15 o
TAG (7) TAG (6) TAG (5) TAG (4) TAG (3) TAG (2) TAG (1) TAG (0)
NOTE:
The index i of tag(i) is not top-relative. A program typically uses the "top" field of Status Word to determine which tag(i)
field refers to logical top of stack.
TAG VALUES:
00 = Valid
01 = Zero
10 = ONaN. SNaN. Infinity. Denormal and Unsupported Formats
11 = Empty
Figure 2.8. FPU Tag Word
2-10
inteL Intel486™ DX2 MICROPROCESSOR
r---------------------------------------BUSY
r-,--.--------------------------- TOP OF STACK POINTER

r-+--+--+--r-.----.--------------------- CONDITION CODE
ERROR SUMMARY STATUS

STACK FLAG -----------------'
EXCEPTION FLAGS:
PRECISION -------------------'
UNDERFLOW
OVERFLOW
ZERO DIVIDE --------------------------'
DENORMALIZED OPERAND
INVALID OPERATION
241245-5
ES is set il any unmasked exception bit is set; cleared otherwise.
See Table 2.5 lor interpretation 01 condition code.
TOP values:
.
000 ~ Register a is Top 01 Stack
001 ~ Register 1 is Top 01 Stack
111 ~ Register 7 is Top 01 Stack

For delinitions 01 exceptions, reler to the Section entitled
"Exception Handling".
Figure 2.9. FPU Status Word
The B bit (Busy, bit 15) is included for 8087 compati- The four numeric condition code bits, CO-C3, are
bility. The B bit reflects the contents of the ES bit (bit similar to the flags in EFLAGS. Instructions that per·
7 of the status word). form arithmetic operations update CO-C3 to reflect
the outcome. The effects of these instructions on
Bits 13 -11 (TOP) point to the FPU register that is the condition codes are summarized in Tables 2.5
the current top-of-stack. through 2.8.
2-11
Table 2.5. FPU Condition Code Interpretation

Instruction CO(S) I C3(Z) C1 (A) C2(C)
FPREM, FPREM1 Three least significant bits
Reduction
(see Table 2.3) of quotient
0= complete
02 00 01
orO/U# 1 = incomplete
FCOM, FCOMP,
FCOMPP, FTST, Result of comparison Operand is not
Zero
FUCOM, FUCOMP, (see Table 2.7) comparable
orO/U#
FUCOMPP, FICOM, (Table 2.7)
FICOMP
FXAM Operand class Sign Operand class
(see Table 2.8) orO/U# (Table 2.8)
FCHS, FABS, FXCH,
FINCTOP, FDECTOP,
Constant loads, Zero
UNDEFINED UNDEFINED
FXTRACT, FLD, or O/U#
FILD, FBLD,
FSTP (ext real)
FIST, FBSTP,
FRNDINT, FST,
FSTP, FADD, FMUL,
FDIV, FDIVR, Roundup
UNDEFINED UNDEFINED
FSUB, FSUBR, orO/U#
FSCALE, FSORT,
FPATAN, F2XM1,
FYL2X, FYL2XP1
FPTAN, FSIN Roundup Reduction
FCOS, FSINCOS UNDEFINED orO/U#, 0= complete
undefined 1 = incomplete
ifC2 = 1
FLDENV, FRSTOR Each bit loaded from memory
FINIT Clears these bits
FLDCW, FSTENV,
FSTCW, FSTSW, UNDEFINED
FCLEX, FSAVE
O/U# When both IE and SF bits of status word are set, indicating a stack exception, this bit
distinguishes between stack overflow (C1 = 1) and underflow (C1 = 0).
Reduction If FPREM or FPREM1 produces a remainder that is less than the modulus, reduction is
complete. When reduction is incomplete the value at the top of the stack is a partial
remainder, which can be used as input to further reduction. For FPTAN, FSIN, FCOS, and
FSINCOS, the reduction bit is set if the operand at the top of the stack is too large. In this
case the original operand remains at the top of the stack.
Roundup When the PE bit of the status word is set, this bit indicates whether the last rounding in the
instruction was upward.
UNDEFINED Do not rely on finding any specific value in these bits.
2-12
Table 2.6. Condition Code Interpretation after FPREM and FPREM11nstructions

Condition Code
Interpretation after FPREM and FPREM1
C2 C3 C1 CO
Incomplete Reduction:
1 X X X further interaction required
for complete reduction
01 00 02 o MOD8
0 0 0 0
0 1 0 1
Complete Reduction:
1 0 0 2
0 CO, C3, C1 contain three least
1 1 0 3
significant bits of quotient
0 0 1 4
0 1 1 5
1 0 1 6
1 1 1 7
..
Table 2 7 Condition Code Resulting from Comparison
Order C3 C2 CO
TOP> Operand 0 0 0
TOP < Operand 0 0 1
TOP = Operand 1 0 0
Unordered 1 1 1
Table 2.8. Condition Code Defining Operand Class

C3 C2 C1 CO Value at TOP
0 0 0 0 + Unsupported
0 0 0 1 + NaN
0 0 1 0 - Unsupported
0 0 1 1 - NaN
0 1 0 0 + Normal
0 1 0 1 + Infinity
0 1 1 0 - Normal
0 1 1 1 - Infinity
1 0 0 0 +0
1 0 0 1 + Empty
1 0 1 0 -0
1 0 1 1 - Empty
1 1 0 0 + Denormal
1 1 1 0 - Denormal
2-13
Bit 7 is the error summary (ES) status bit. The ES bit register o. The exception condition must be resolved
is set if any unmasked exception bit (bits 0-5 in the via an interrupt service routine. The FPU saves the
status word) is set; ES is clear otherwise. The address of the floating point instruction that caused
FERR# (floating point error) signal is asserted when the exception and the address of any memory oper-
ES is set. and required by that instruction in the instruction and
data pointers (see Section 2.1.3.4).
Bit 6 is the stack flag (SF). This bit is used to distin-
guish invalid operations due to stack overflow or un- Note that when a new value is loaded into the status
derflow. When SF is set, bit 9 (C1) distinguishes be- word by the FLDENV (load environment) or
tween stack overflow (C1 = 1) and underflow FRSTOR (restore state) instruction, the value of ES
(C1 =0). (bit 7) and its reflection in the B bit (bit 15) are not
derived from the values loaded from memory. The
Table 2.9 shows the six exception flags in bits 0-5 values of ES and B are dependent upon the values
of the status word. Bits 0-5 are set to indicate that of the exception flags in the status word and their
the FPU has detected an exception while executing corresponding masks in the control word. If ES is set
an instruction. in such a case, the FERR# output of the Intel486
DX microprocessor is activated immediately.
The six exception flags in the status word can be
individually masked by mask bits in the FPU control
word. Table 2.9 lists the exception conditions, and 2.1.3.4 Instruction and Data Pointers
their causes in order of precedence. Table 2.9 also
Because the FPU operates in parallel with the ALU
shows the action taken by the FPU if the corre-
(in the Intel486 DX and Intel486 microprocessors
sponding exception flag is masked.
the arithmetic and logic unit (ALU) consists of the
base architecture registers), any errors detected by
An exception that is not masked by the control word
the FPU may be reported after the ALU has execut-
will cause three things to happen: the corresponding
ed the floating point instruction that caused it. To
exception flag in the status word will be set, the ES
allow identification of the failing numeric instruction,
bit in the status word will be set and the FERR#
the Intel486 DX microprocessor contains two pointer
output signal will be asserted. When the Intel486 DX
registers that supply the address of the failing nu-
microprocessor attempts to execute another floating
meric instruction and the address of its numeric
point or WAIT instruction, exception 16 occurs or an
memory operand (if appropriate).
external interrupt happens if the NE = 1 in control
Table 2.9. FPU Exceptions

Default Action
Exception Cause
(if exception is masked)
Invalid Operation on a Signaling NaN, unsupported format, Result is a quiet NaN, integer
Operation indeterminate form (0' 00, 0/0, (+ 00) + (- 00), etc.), or indefinite, or BCD indefinite
stack overflow/underflow (SF is also set).
Denormalized At least one of the operands is denormalized, i.e., it has Normal processing
Operand the smallest exponent but a nonzero significand. continues
Zero Divisor The divisor is zero while the dividend is a noninfinite, Result is 00
nonzero number.
Overflow The result is too large in magnitude to fit in the specified Result is largest finite value
format. or 00
Underflow The true result is nonzero but too small to be Result is denormalized or
represented in the specified format, and, if underflow zero
exception is masked, denormalization causes loss of
accuracy.
Inexact The true result is not exactly representable in the Normal processing
Result specified format (e.g., 1/3); the result is rounded continues
(Precision) according to the rounding mode.
2-14
int'et Intel486™ DX2 MICROPROCESSOR
The instruction and data pointers are provided for attribute in effect (32-bit operand or 16-bit operand).
user-written error handlers. These registers are ac- When the Intel486 DX microprocessor is in the virtu-
cessed by the FLDENV (load environment), al-86 mode, the real address mode formats are
FSTENV (store environment), FSAVE (save state) used. The four formats are shown in Figures 2.10-
and FRSTOR (restore state) instructions. Whenever 2.13. The floating point instructions FLDENV,
the Intel486 DX microprocessor decodes a new FSTENV, FSAVE and FRSTOR are used to transfer
floating point instruction, it saves the instruction (in- these values to and from memory. Note that the val-
cluding any prefixes that may be present), the ad- ue of the data pointer is undefined if the prior float-
dress of the operand (if present) and the opcode. ing point instruction did not have a memory operand.
The instruction and data pointers appear in one of NOTE:

four formats depending on the operating mode of The operand size attribute is the D bit in a segment
the Intel486 DX microprocessor (protected mode or descriptor.
real-address mode) and depending on the operand-
size
32-BIT PROTECTED MODE FORMAT

31 23 15 7 0
RESERVED CONTROL WORD 0
RESERVED STATUS WORD 4
RESERVED TAG WORD 8
IPOFFSET C
00000
I OPCODE10 .. 0 CSSELECTOR 10
DATA OPERAND OFFSET 14
RESERVED OPERAND SELECTOR 18
Figure 2.10. Protected Mode FPU Instruction and Data Pointer Image in Memory, 32-Bit Format
32-BIT REAL-ADDRESS MODE FORMAT

31 23 15 7 o
RESERVED CONTROL WORD o
RESERVED STATUS WORD 4
RESERVED TAG WORD 8
RESERVED INSTRUCTION POINTER 15 .. 0 C
0000
I INSTRUCTION POINTER 31 .. 16 I 0 I OPCODE 10 .. 0 10
RESERVED OPERAND POINTER 15.. 0 14
0000
I OPERAND POINTER 31..16
I 0000 00000000 18
Figure 2.11. Real Mode FPU Instruction and Data Pointer Image in Memory, 32-Bit Format
2-15
16-BIT PROTECTED MODE FORMAT 16-BIT REAL-ADDRESS MODE AND

15 7 0 VIRTUAL-SOS6 MODE FORMAT
15 7 o
CONTROL WORD o
CONTROL WORD o
STATUS WORD 2
STATUS WORD 2
TAG WORD 4
TAG WORD 4
IPOFFSET 6 INSTRUCTION POINTER 15.. 0 6
CSSELECTOR S IP19.16 101 OPCODE 10.. 0 S
OPERAND OFFSET A OPERAND POINTER 15.. 0 A
OPERAND SELECTOR C
DP 19.16 I0 I0 0 0 0 0 0 0 0 000 C
Figure 2.13. Real Mode FPU

Figure 2.12. Protected Mode FPU Instruction and Data Pointer
Instruction and Data Pointer Image in Memory, 16-Bit Format
Image in Memory, 16-Bit Format
2.1.3.5 FPU Control Word
The FPU provides several processing options that are selected by loading a control word from memory into
the control register. Figure 2.14 shows the format and encoding of fields in the control word.
r-,--,------------------ RESERVED
, - - - - - - - - - - - - - - - - RESERVED'
, - - , - - - - - - - - - - - - - - ROUNDING CONTROL
, - , - - - - - - - - - - - - PRECISION CONTROL
RESERVED _ _ _ _ _ _-'-..J
• "0" AFTER RESET OR FINIT;
CHANGEABLE UPON LOADING THE
EXCEPTION MASKS:
CONTROL WORD (CW). PROGRAMS
PRECISION - - - - - - - - - ' MUST IGNORE THIS BIT.
UNDERFLOW
OVERFLOW
ZERO DIVIDE - - - - - - - - - - - - - - '
DENORMALIZED OPERAND
INVALID OPERATION
241245-6
Precision Control Rounding Control
00-24 bits (single precision) OO-Round to nearest or even
01-(reserved) 01-Round down (toward - 00)
10-53 bits (double precision) 10-Round up (toward + 00)
11--.04 bits (extended precision) 11-Chop (truncate toward zero)
Figure 2.14. FPU Control Word
2-16
intel~ Intel486TM DX2 MICROPROCESSOR
The low-order byte of the FPU control word config-

ures the FPU error and exception masking. Bits 0-5 Debug Registers
of the control word contain individual masks for each
of the six exceptions that the FPU recognizes. LINEAR BREAKPOINT ADDRESS 0 DRO
LINEAR BREAKPOINT ADDRESS 1 DR1
The high-order byte of the control word configures LINEAR BREAKPOINT ADDRESS 2 DR2
the FPU operating mode, including precision and
rounding. LINEAR BREAKPOINT ADDRESS 3 DR3
RC (Rounding Control, bits 10-11) Intel Reserved Do Not Define DR4
The RC bits provide for directed rounding and Intel Reserved Do Not Define DR5
true chop, as well as the unbiased round to BREAKPOINT STATUS DR6
nearest even mode specified in the IEEE stan- BREAKPOINT CONTROL DR?
dard. Rounding control affects only those in-
structions that perform rounding at the end of
the operation (and thus can generate a preci- Test Registers
sion exception); namely, FST, FSTP, FIST, all CACHE TEST DATA TR3
arithmetic instructions (except FPREM,
FPREM1, FXTRACT, FABS and FCHS), and all CACHE TEST STATUS TR4
transcendental instructions. CACHE TEST CONTROL TR5
PC (Precision Control, bits 8-9) TLB TEST CONTROL TR6
The PC bits can be used to set the FPU internal TLB TEST STATUS TR?
operating precision of the significand at less TLB = Translation Lookaside Buffer
than the default of 64 bits (extended precision).
This can be useful in providing compatibility with Figure 2.15
early generation arithmetic processors of small-
er precision. PC affects only the instructions
ADD, SUB, DIV, MUL, and SORT. For all other 2.1.4.2 Test Registers
instructions, either the precision is determined
by the opcode or extended precision is used. The Intel486 OX microprocessor contains five test
registers. The test registers are shown in Figure
2.15. TR6 and TR7 are used to control the testing of
2.1.4 DEBUG AND TEST REGISTERS the translation lookaside buffer. TR3, TR4 and TR5
are used for testing the on-chip cache. The use of
2.1.4.1 Debug Registers the test registers is discussed in Section 8.
The six programmer accessible debug registers, Fig-

ure 2.15, provide on-chip support for debugging. De-
2.1.5 REGISTER ACCESSIBILITY
bug registers DRO-3 specify the four linear break- There are a few differences regarding the accessibil-
points. The Debug control register DR7, is used to ity of the registers in Real and Protected Mode. Ta-
set the breakpoints and the Debug Status Register, ble 2.10 summarizes these differences. See Section
DR6, displays the current state of the breakpoints. 4, Protected Mode Architecture, for further details.
The use of the Debug registers is described in Sec-
tion 9.
2-17
int'et Intel486TM DX2 MICROPROCESSOR
Table 2.10. Register Usage

Use in Use in Use in
Real Mode Protected Mode Virtual 8086 Mode
Register
Load Store Load Store Load Store
General Registers Yes Yes Yes Yes Yes Yes
Segment Register Yes Yes Yes Yes Yes Yes
Flag Register Yes Yes Yes Yes IOPL IOPL*
Control Registers Yes Yes PL = 0 PL = 0 No Yes
GDTR Yes Yes PL = 0 Yes No Yes
IDTR Yes Yes PL = 0 Yes No Yes
LDTR No No PL = 0 Yes No No
TR No No PL = 0 Yes No No
FPU Data Registers Yes Yes Yes Yes Yes Yes
FPU Control Registers Yes Yes Yes Yes Yes Yes
FPU Status Registers Yes Yes Yes Yes Yes Yes
FPU Instruction Pointer Yes Yes Yes Yes Yes Yes
FPU Data Pointer Yes Yes Yes Yes Yes Yes
Debug Registers Yes Yes PL = 0 PL = 0 No No
Test Registers Yes Yes PL = 0 PL = 0 No No
NOTES:
PL = 0: The registers can be accessed only when the current privilege level is zero.
*IOPL: The PUSHF and POPF instructions are made I/O Privilege Level sensitive in Virtual 86 Mode.
2.1.6 COMPATIBILITY 3) Do not depend on the ability to retain infor-

mation written into any undefined bits.
VERY IMPORTANT NOTE: 4) When loading registers always load the unde-
COMPATIBILITY WITH FUTURE PROCESSORS fined bits as zeros.
In the preceding register descriptions, note cer- 5) However, registers which have been previ-
tain Intel486 microprocessor register bits are ously stored may be reloaded without mask-
Intel reserved. When reserved bits are called ing.
out, treat them as fully undefined. This is essen-
tial for your software compatibility with future Depending upon the values of undefined regis-
processors! Follow the guidelines below: ter bits will make your software dependent upon
the unspecified Intel486 OX microprocessor
1) Do not depend on the states of any unde- handling of these bits. Depending on undefined
fined bits when testing the values of defined values risks making your software incompatible
register bits. Mask them out when testing. with future processors that define usages for
2) Do not depend on the states of any unde- the Intel486 microprocessor-undefined bits.
fined bits when storing them to memory or AVOID ANY SOFTWARE DEPENDENCE UPON
another register. THE STATE OF UNDEFINED Intel486 MICRO-
PROCESSOR REGISTER BITS.
2-18
2.2 Instruction Set byte at the high address. Dwords are stored in four
consecutive bytes in memory with the low-order byte
The Intel486 OX microprocessor instruction set can at the lowest address, the high-order byte at the
be divided into 11 categories of operations: highest address. The address of a word or dword is
the byte address of the low-order byte.
Data Transfer
Arithmetic In addition to these basic data types, the Intel486
Shift/Rotate OX microprocessor supports two larger units of
String Manipulation memory: pages and segments. Memory can be di-
Bit Manipulation vided up into one or more variable length segments,
Control Transfer which can be swapped to disk or shared between
High Level Language Support programs. Memory can also be organized into one
Operating System Support or more 4 Kbyte pages. Finally, both segmentation
Processor Control and paging can be combined, gaining the advan-
Floating Point tages of both systems. The Intel486 OX microproc-
Floating Point Control essor supports both pages and segments in order to
provide maximum flexibility to the system designer.
The Intel486 OX microprocessor instructions are list- Segmentation and paging are complementary. Seg-
ed in Section 10. Note that all floating point unit in- mentation is useful for organizing memory in logical
struction mnemonics begin with an F. modules, and as such is a tool for the application
programmer, while pages are useful for the system
All Intel486 OX microprocessor instructions operate programmer for managing the physical memory of a
on either 0, 1, 2 or 3 operands; where an operand system.
resides in a register, in the instruction itself or in
memory. Most zero operand instructions (e.g., CLI, 2.3.1 ADDRESS SPACES
STI) take only one byte. One operand instructions
generally are two bytes long. The average instruc- The Intel486 OX microprocessor has three distinct
tion is 3.2 bytes long. Since the Intel486 OX micro- address spaces: logical, linear, and physical. A
processor has a 32-byte instruction queue, an aver- logical address (also known as a virtual address)
age of 10 instructions will be prefetched. The use of consists of a selector and an offset. A selector is the
two operands permits the following types of com- contents of a segment register. An offset is formed
mon instructions: by summing all of the addressing components
(BASE, INDEX, DISPLACEMENT) discussed in Sec-
Register to Register tion 2.5.3 Memory Addressing Modes into an ef-
Memory to Register fective address. Since each task on the Intel486 OX
Memory to Memory microprocessor has a maximum of 16K (2 14 -1) se-
Immediate to Register lectors, and offsets can be 4 gigabytes, (2 32 bits)
Register to Memory this gives a total of 246 bits or 64 terabytes of logi-
Immediate to Memory cal address space per task. The programmer sees
this virtual address space.
The operands can be either 8, 16, or 32 bits long. As
a general rule, when executing code written for the The segmentation unit translates the logical ad-
Intel486 OX, Intel486 or Intel386 microprocessors dress space into a 32-bit linear address space. If the
(32-bit code), operands are 8 or 32 bits; when exe- paging unit is not enabled then the 32-bit linear ad-
cuting existing 80286 or 8086 code (16-bit code), dress corresponds to the physical address. The
operands are 8 or 16 bits. Prefixes can be added to paging unit translates the linear address space into
all instructions which override the default length of the physical address space. The physical address
the operands (Le., use 32-bit operands for 16-bit is what appears on the address pins.
code, or 16-bit operands for 32-bit code).
The primary difference between Real Mode and Pro-
tected Mode is how the segmentation unit performs
2.3 Memory Organization the translation of the logical address into the linear
address. In Real Mode, the segmentation unit shifts
the selector left four bits and adds the result to the
Introduction offset to form the linear address. While in Protected
Mode every selector has a linear base address as-
Memory on the Intel486 OX microprocessor is divid- sociated with it. The linear base address is stored in
ed up into 8-bit quantities (bytes), 16-bit quantities one of two operating system tables (Le., the Local
(words), and 32-bit quantities (dwords). Words are Descriptor Table or Global Descriptor Table). The
stored in two consecutive bytes in memory with the selector's linear base address is added to the offset
low-order byte at the lowest address, the high order to form the final linear address.
2-19
EFFECTIVE ADDRESS CALCULATION
I INDEX
J
I BASE I~ I DISPLACEIIENT I
I SCALE
1,2,4,8
J 31
PHYSICAL
0
.~
IIEIIORY
8E3#- BEO#
-~ A31-A2
l32 EFFECTIVE
ADDRESS
15 320 SEGMENTATION 32 PAGING UNIT 32
LOGICAL OR
II RL1~VIRTUAL ADDRESS UNIT LINEAR (OPTIONAL USE) PHYSICAL
PL I
ADDRESS ADDRESS
SELECTOR DESCRIPTOR
INDEX
SEGIIENT
REGISTER
241245-7
Figure 2.16. Address Translation
Figure 2.16 shows the relationship between the vari- and create a system with a four gigabyte linear ad-
ous address spaces. dress space. This creates a system where the virtual
address space is the same as the linear address
space. Further details of segmentation are dis-
2.3.2 SEGMENT REGISTER USAGE cussed in Section 4.1.
The main data structure used to organize memory is
the segment. On the Intel486 OX microp~ocessor,
segments are variable sized blocks of linear ad- 2.4 I/O Space
dresses which have certain attributes associated
The Intel486 OX microprocessor has two distinct
with them. There are two main types of segments: physical address spaces: Memory and I/O. General-
code and data, the segments are of variable ~ize ly, peripherals are placed in I/O space although the
and can be as small as 1 byte or as large as 4 giga- Intel486 OX microprocessor also supports memory-
bytes (232 bytes). mapped peripherals. The I/O space consists of
64 Kbytes, it can be divided into 64K 8-bit ports, 32K
In order to provide compact instruction encoding, 16-bit ports, or 16K 32-bit ports, or any combination
and increase processor performance, instructions of ports which add up to less than 64 Kbytes. The
do not need to explicitly specify which segment reg- 64K I/O address space refers to physical memory
ister is used. A default segment register is automati- rather than linear address since I/O instructions do
cally chosen according to the rules of Table 2.11
not go through the segmentation or paging hard-
(Segment Register Selection Rules). In general, data
ware. The MIIO# pin acts as an additional address
references use the selector contained in the OS reg- line thus allowing the system designer to easily de-
ister; Stack references use the SS register and In-
termine which address space the processor is ac-
struction fetches use the CS register. The contents
cessing.
of the Instruction Pointer provide the offset. Special
segment override prefixes allow the ~xplicit u~e o! ~ The I/O ports are accessed via the IN and OUT 110
given segment register, and over~lde th~ ImpliCit instructions, with the port address supplied as an
rules listed in Table 2.11. The override prefixes also immediate 8-bit constant in the instruction or in the
allow the use of the ES, FS and GS segment regis- OX register. All 8- and 16-bit port addresses are zero
ters. extended on the upper address lines. The 110 in-
structions cause the M/IO# pin to be driven low.
There are no restrictions regarding the overlapping
of the base addresses of any segments. Thus, all 6 110 port addresses 00F8H through OOFFH are re-
segments could have the base address set to zero
served for use by Intel.
2-20
Table 2.11. Segment Register Selection Rules

Type of Implied (Default) Segment Override
Memory Reference Segment Use Prefixes Possible
Code Fetch CS None
Destination of PUSH, PUSHF, INT, SS None
CALL, PUSHA Instructions
Source of POP, POPA, POPF, SS None
IRET, RET instructions
Destination of STOS, MOVS, REP ES None
STOS, REP MOVS Instructions
(01 is Base Register)
Other Data References, with
Effective Address Using Base
Register of:
[EAX] OS
[EBX] OS
[ECX] OS
[EDX] OS
All
[ESi] OS
[EDI] OS
[EBP] ss
[ESP] ss
2.5 Addressing Modes 2.5.3 32-BIT MEMORY ADDRESSING MODES
The remaining 9 modes provide a mechanism for

2.5.1 ADDRESSING MODES OVERVIEW specifying the effective address of an operand. The
linear address consists of two components: the seg-
The Intel486 OX microprocessor provides a total of ment base address and an effective address. The
11 addressing modes for instructions to specify op- effective address is calculated by using combina-
erands. The addressing modes are optimized to al- tions of the following four address elements:
low the efficient execution of high level languages
such as C and FORTRAN, and they cover the vast DISPLACEMENT: An 8-, or 32-bit immediate value,
majority of data references needed by high-level lan- following the instruction.
guages.
BASE: The contents of any general purpose regis-
2.5.2 REGISTER AND IMMEDIATE MODES ter. The base registers are generally used by compil-
ers to point to the start of the local variable area.
Two of the addressing modes provide for instruc-
tions that operate on register or immediate oper- INDEX: The contents of any general purpose regis-
ands: ter except for ESP. The index registers are used to
access the elements of an array, or a string of char-
Register Operand Mode: The operand is located in acters.
one of the 8-, 16- or 32-bit general registers.
SCALE: The index register's value can be multiplied
Immediate Operand Mode: The operand is includ- by a scale factor, either 1, 2, 4 or 8. Scaled index
ed in the instruction as part of the opcode.
2-21
mode is especially useful for accessing arrays or Based Mode: A BASE register's contents is added
structures. to a DISPLACEMENT to form the operand's offset.
EXAMPLE: MOV ECX, [EAX + 24]
Combinations of these 4 components make up the 9
additional addressing modes. There is no perform- Index Mode: An INDEX register's contents is added
ance penalty for using any of these addressing com- to a DISPLACEMENT to form the operand's offset.
binations, since the effective address calculation is EXAMPLE: ADD EAX, TABLE[ESIl
pipelined with the execution of other instructions.
The one exception is the simultaneous use of Base Scaled Index Mode: An INDEX register's contents is
and Index components which requires one addition- multiplied by a scaling factor which is added to a
al clock. DISPLACEMENT to form the operand's offset.
EXAMPLE: IMUL EBX, TABLE[ESI*4],7
As shown in Figure 2.17, the effective address (EA)
of an operand is calculated according to the follow- Based Index Mode: The contents of a BASE register
ing formula. is added to the contents of an INDEX register to
form the effective address of an operand.
EA = Base Reg + (Index Reg * Scaling) + Displacement EXAMPLE: MOV EAX, [ESI] [EBX]
Direct Mode: The operand's offset is contained as Based Scaled Index Mode: The contents of an IN-
part of the instruction as an 8-, 16- or 32-bit dis- DEX register is multiplied by a SCALING factor and
placement. the result is added to the contents of a BASE regis-
EXAMPLE: INC Word PTR [500] ter to obtain the operand's offset.
EXAMPLE: MOV ECX, [EDX*S] [EAX]
Register Indirect Mode: A BASE register contains
the address of the operand.
EXAMPLE: MOV [ECX], EDX
SEGMENT REGISTER
SS
GS
FS
ES
EFFECTIVE
ADDRE SS SEGMENT
LIMIT
/'
"\
LINEAR
DESCRIPTOR REGISTERS ADDRESS
• TARGET ADDRESS
SS
GS SELECTED
FS SEGMENT
ES
DS
ACCESS RIGHTS CS
LIMIT
BASE ADDRESS ------~
./
SEGMENT BASE ADDRESS
241245-8
Figure 2.17. Addressing Mode Calculations
2-22
Based Index Mode with Displacement: The contents Address Length Prefix since, with D = 0, the default
of an INDEX Register and a BASE register's con- addressing mode is 16 bits.
tents and a DISPLACEMENT are all summed to-
gether to form the operand offset. Example: The D bit is 1, and the program wants to
EXAMPLE: ADD EDX, [ES!] [EBP + OOFFFFFOH] store a 16-bit quantity. The Operand Length Prefix is
used to specify only a 16-bit value; MOV MEM16,
Based Scaled Index Mode with Displacement: The DX.
contents of an INDEX register are multiplied by a
SCALING factor, the result is added to the contents The OPERAND LENGTH and Address Length Pre-
of a BASE register and a DISPLACEMENT to form fixes can be applied separately or in combination to
the operand~s offset. any instruction. The Address Length Prefix does not
EXAMPLE: MOV EAX, LOCALTABLE[EDI04] allow addresses over 64 Kbytes to be accessed in
[EBP+80] Real Mode. A memory address Which exceeds
FFFFH will result in a General Protection Fault. An
Address Length Prefix only allows the use of the ad-
2.5.4 DIFFERENCES BETWEEN 16- AND 32-BIT ditional Intel486 DX Microprocessor addressing
ADDRESSES modes.
In order to provide software compatibility with the
When executing 32-bit code, the Intel486 DX Micro-
80286 and the 8086, the Intel486 DX Microproces-
processor uses either 8-, or 32-bit displacements,
sor can execute 16-bit instructions in Real and Pro-
and any register can be used as base or index regis-
tected Modes. The processor determines the size of
the instructions it is executing by examining the D bit ters. When executing 16-bit code, the displacements
are either 8, or 16 bits, and the base and index regis-
in the CS segment Descriptor. If the D bit is 0 then
ter conform to the 80286 model. Table 2.12 illus-
all operand lengths and effective addresses are as-
trates the differences.
sumed to be 16 bits long. If the D bit is 1 then the
default length for operands and addresses is 32 bits.
In Real Mode the default size for operands and ad-
dresses is 16 bits. 2.6 Data. Formats
Regardless of the default precision of the operands 2.6.1 DATA TYPES
or addresses, the Intel486 DX Microprocessor is
able to execute either 16- or 32-bit instructions. This The Intel486 DX Microprocessor can support a wide
is specified via the use of override prefixes. Two pre- variety of data types. In the following descriptions,
fixes, the Operand Size Prefix and the Address the on-chip floating point unit (FPU) consists of the
Length Prefix, override the value of the D bit on an floating point registers. The central processing unit
individual instruction basis. These prefixes are auto- (CPU) consists of the base architecture registers.
matically added by Intel assemblers.
2.6.1.1 Unsigned Data Types
Example: The processor is executing in Real Mode
and the programmer needs to access the EAX regis- The FPU does not support unsigned data types. Re-
ters. The assembler code for this might be MOV fer to Table 2.13.
EAX, 32-bit MEMORYOP, ASM486 Macro Assem-
bler automatically determines that an Operand Size Byte: Unsigned 8-bit quantity
Prefix is needed and generates it. Word: Unsigned 16-bit quantity
Dword: Unsigned 32-bit quantity
Example: The D bit is 0, and the programmer wishes
to use Scaled Index addressing mode to access an The least significant bit (LSB) in a byte is bit 0, and
array. The Address Length Prefix allows the use of the most significant bit is 7.
MOV DX, TABLE[E51°2]. The assembler uses an
Table 2.12. BASE and INDEX Registers for 16- and 32-Blt Addresses
16-Bit Addressing 32-Bit Addressing
BASE REGISTER BX,BP Any 32-bit GP Register
INDEX REGISTER 51,DI Any 32-bit GP Register
Except ESP
SCALE FACTOR none 1,2,4,8
DISPLACEMENT 0,8,16 bits 0,8,32 bits
2-23
2.6.1.2 Signed Data Types 2.6.1.4 BCD Data Types

All signed data types assume 2's complement nota- The Intel486 OX microprocessor supports packed
tion. The signed data types contain two fields, a sign and unpacked binary coded decimal (BCD) data
bit and a magnitude. The sign bit is the most signifi- types. A packed BCD data type contains two digits
cant bit (MSB). The number is negative if the sign bit per byte, the lower digit is in bits 0-3 and the upper
is 1. If the sign bit is 0, the number is positive. The digit in bits 4-7. An unpacked BCD data type con-
magnitude field consists of the remaining bits in the tains 1 digit per byte stored in bits 0-3.
number. Refer to Table 2.13.
8-bit Integer: Signed 8-bit quantity The CPU supports 8-bit packed and unpacked BCD
data types. The FPU only supports 80-bit packed
16-bit Integer: Signed 16-bit quantity BCD data types. Refer to Table 2.13.
32-bit Integer: Signed 32-bit quantity
54-bit Integer: Signed 54-bit quantity 2.6.1.5 String Data Types
The FPU only supports 16-, 32- and 64-bit integers. A string data type is a contiguous sequence of bits,
The CPU only supports 8-, 16- and 32-bit integers. bytes, words or dwords. A string may contain be-
tween 1 byte and 4 Gbytes. Refer to Table 2.14.
2.6.1.3 Floating Point Data Types
String data types are only supported by the CPU.
Floating point data type in the Intel486 OX micro-
processor contain three fields, sign, significand and Byte String: Contiguous sequence of bytes.
exponent. The sign field is one bit and is the MSB of
the floating point number. The number is negative if Word String: Contiguous sequence of words.
the sign bit is 1. If the sign bit is 0, the number is
positive. The significand gives the significant bits of Dword String: Contiguous sequence of dwords.
the number. The exponent field contains the power
of 2 needed to scale the significand. Refer to Table Bit String: A set of contiguous bits. In the Intel486
2.13. OX microprocessor bit strings can be up to 4 gigabits
long.
Only the FPU supports floating point data types.
Single Precision Real: 23-bit significand and 8- 2.6.1.6 ASCII Data Types
bit exponent. 32 bits total.
The Intel486 OX microprocessor supports ASCII
Double Precision Real: 52-bit significand and 11-
(American Standard Code for Information Inter-
bit exponent. 64 bits total.
change) strings and can perform arithmetic opera-
Extended Precision Real: 64-bit significand and 15- tions (such as addition and division) on ASCII data.
bit exponent. 80 bits total. Refer to Table 2.14.
2-24
Table 2.13. Intel486TM OX Microprocessor Data Types

Supported by Supported by
Base Registers FPU Least Significant Byte
1. 1. 1.
Data Format Range Precision 7 017 017 017 017 017 017 017 017 017 0
Byte X 0-255 8 bits

C
15 0
Word X 0-64K 16 bits r

31 0
Dword X 0-4G 32 bits I
8-Bit Integer X 102 8 bits Two's

Complement
.cr
SignBil t
15 0
16-Bit Integer X X 104 16 bits Two's

Complement
II
SignBil t
31 0
32-Bit Integer X X 109 32 bits Two's

Complement
II
Sign Bft t
63 0
64-Bit Integer X 1019 64 bits Two's

Complement
II
Sign Bil t
7 0
8-Bit Unpacked BCD X 0-9 1 Digit One BCD Digit per Byte I
7 0
8-Bit Packed BCD X 0-9 2 Digits Two BCD Digits per Byte I
79 72 0
80-Bit Packed BCD X ±10±18 18 Digits I

Ignored I
t Sign Bft
31 23 0
Single Precision Real X ±10±38 24 Bits I IBms<dlExp.

Significand
SignBil t
63 52 0
Double Precision Real X ±10±308 53 Bits I IB~;'dl Significand
SignBil t
79 63 0
Biased
Extended Precision Real X ± 10±4932 64 Bits
t
I Exp.
SignBft
11
Significand
2-25
Table 2.14. String and ASCII Data Types
String Data Types

Address A+N A+1 A
CJ ...
1 0
Byte String 17 017 01
A+2N+1 A+2N A+3 A+2 A+1 A
Word String 115

N
I
01
... 115
I
1
0115
I
0
01
A+4N+3 A+4N+2 A+4N+1 A+4N A+7 A+6 A+5 A+4 A+3 A+2 A+1 A
Dword!
String 31
i
I
N
i
01
... 131
i
1
I i
0131
i
I
0
i
01
A+ 268,435,455 A- 268,435,456
-J, A+3 A+2 A+1 A A-1 A-2 A-3 -J,
Bit !
String 7
i
017 01 II 17 017 017 017 ... 1 017
i i i
017 017 01 II 17 017
i
01
+2,147,483,647 +7 +10 ~2,147,483,648
ASCII Data Types
ASCII Character
D
2.6.1.7 Pointer Data Types Table 2.15. Pointer Data Types
Least Sig Byte
A pointer data type contains a value that gives the -J,
address of a piece of data. The Intel486 OX micro-
processor supports two types of pointers. Refer to
Data Format I I I I I I I I I
Table 2.15, 47 31 0
48-Bit Pointer I Selector I Offset

48-bit Pointer: 16-bit selector and 32-bit offset
32-bit Pointer: 32-bit offset 31 0
32-Bit Pointer I Offset
2-26
2.6.2 LITTLE ENDIAN vs BIG ENDIAN Hardware interrupts occur as the result of an exter-
DATA FORMATS nal event and are classified into two types: maskable
or non-maskable. Interrupts are serviced after the
The Intel486 DX microprocessor, as well as all other execution of the current instruction. After the inter-
members of the 86 architecture use the "Iittle-endi- rupt handler is finished servicing the interrupt, exe-
an" method for storing data types that are larger cution proceeds with the instruction immediately af-
than one byte. Words are stored in two consecutive ter the interrupted instruction. Sections 2.7.3 and
bytes in memory with the low-order byte at the low- 2.7.4 discuss the differences between Maskable and
est address and the high order byte at the high ad- Non-Maskable interrupts.
dress. Dwords are stored in four consecutive bytes
in memory with the low-order byte at the lowest ad- Exceptions are classified as faults, traps, or aborts
dress and the high order byte at the highest address. depending on the way they are reported, and wheth-
The address of a word or dword data item is the byte er or not restart of the instruction causing the excep-
address of the low-order byte. tion is supported. Faults are exceptions that are de-
tected and serviced before the execution of the
Figure 2.18 illustrates the differences between the faulting instruction. A fault would occur in a virtual
big-end ian and little-end ian formats for dwords. The memory system, when the processor referenced a
32 bits of data are shown with the low order bit num- page or a segment which was not present. The oper-
bered bit 0 and the high order bit numbered 32. Big- ating system would fetch the page or segment from
end ian data is stored with the high-order bits at the disk, and then the Intel486 DX microprocessor
lowest addressed byte. Little-endian data is stored would restart the instruction. Traps are exceptions
with the high-order bits in the highest addressed that are reported immediately after the execution of
byte. the instruction which caused the problem. User de-
fined interrupts are examples of traps. Aborts are
The Intel486 DX microprocessor has two instruc- exceptions which do not permit the precise location
tions which can convert 16- or 32-bit data between of the instruction causing the exception to be deter-
the two byte orderings. BSWAP (byte swap) handles mined. Aborts are used to report severe errors, such
four byte values and XCHG (exchange) handles two as a hardware error, or illegal values in system ta-
byte values. bles.
Thus, when an interrupt service routine has been

m+3 m+2 m+1 m completed, execution proceeds from the instruction
31 24 23 16 15 8 7 0 immediately following the interrupted instruction. On
I
Dword in Little-Endlan Memory Format
the other hand, the return address from an excep-
tion fault routine will always point at the instruction
causing the exception and include any leading in-
m m+1 m+2 m+3 struction prefixes. Table 2.16 summarizes the possi-
31 24 23 16 15 8 7 0 ble interrupts for the Intel486 DX microprocessor
and shows where the return address points.
Dword in Big-Endian Memory Format
The Intel486 DX microprocessor has the ability to
handle up to 256 different interrupts/exceptions. In
Figure 2.18. Big vs Little Endian Memory Format order to service the interrupts, a table with up to 256
interrupt vectors must be defined. The interrupt vec-
tors are simply pointers to the appropriate interrupt
service routine. In Real Mode (see Section 3.1), the
2.7 Interrupts vectors are 4 byte quantities, a Code Segment plus
a 16-bit offset; in Protected Mode, the interrupt vec-
2.7.1 INTERRUPTS AND EXCEPTIONS tors are 8 byte quantities, which are put in an Inter-
rupt Descriptor Table (see Section 4.3.3.4). Of the
Interrupts and exceptions alter the normal program 256 possible interrupts, 32 are reserved for use by
flow, in order to handle external events, to report Intel, the remaining 224 are free to be used by the
errors or exceptional conditions. The difference be- system designer.
tween interrupts and exceptions is that interrupts are
used to handle asynchronous external events while
exceptions handle instruction faults. Although a pro- 2.7.2 INTERRUPT PROCESSING
gram can generate a software interrupt via an INT N
instruction, the processor treats software interrupts When an interrupt occurs the following actions hap-
as exceptions. pen. First, the current program address and the
Flags are saved on the stack to allow resumption of
the interrupted program. Next, an 8-bit vector is sup-
2-27
plied to the Intel486 DX microprocessor which iden- 2.7.3 MASKABLE INTERRUPT

tifies the appropriate entry in the interrupt table. The
table contains the starting address of the interrupt Maskable interrupts are the most common way used
service routine. Then, the user supplied interrupt by the Intel486 DX microprocessor to respond to
service routine is executed. Finally, when an IRET asynchronous external hardware events. A hard-
instruction is executed the old processor state is re- ware interrupt occurs when the INTR is pulled high
stored and program execution resumes at the appro- and the Interrupt Flag bit (IF) is enabled. The proc-
priate instruction. essor only responds to interrupts between instruc-
tions, (REPeat String instructions, have an "interrupt
The 8-bit interrupt vector is supplied to the Intel486 window", between memory moves, which allows in-
DX microprocessor in several different ways: excep- terrupts during long string moves). When an interrupt
tions supply the interrupt vector internally; software occurs the processor reads an 8-bit vector supplied
INT instructions contain or imply the vector; maska- by the hardware which identifies the source of the
ble hardware interrupts supply the 8-bit vector via interrupt, (one of 224 user defined interrupts). The
the interrupt acknowledge bus sequence. Non- exact nature of the interrupt sequence is discussed
Maskable hardware interrupts are assigned to inter- in Section 7.2.10.
rupt vector 2.
Table 2.16. Interrupt Vector Assignments

Return Address
Instruction Which
Interrupt Points to
Function Can Cause Type
Number Faulting
Exception
Instruction
Divide Error 0 DIV,IDIV YES FAULT
Debug Exception 1 Any Instruction YES TRAP'
NMllnterrupt 2 INT20rNMI NO NMI
One Byte Interrupt 3 INT NO TRAP
Interrupt on Overflow 4 INTO NO TRAP
Array Bounds Check 5 BOUND YES FAULT
Invalid OP-Code 6 Any Illegal Instruction YES FAULT
Device Not Available 7 ESC,WAIT YES FAULT
Double Fault 8 Any Instruction That Can ABORT
Generate an Exception
Intel Reserved 9
InvalidTSS 10 JMP, CALL, IRET, INT YES FAULT
Segment Not Present 11 Segment Register Instructions YES FAULT
Stack Fault 12 Stack References YES FAULT
General Protection Fault 13 Any Memory Reference YES FAULT
Page Fault 14 Any Memory Access or Code Fetch YES FAULT
Intel Reserved 15
Floating Point Error 16 Floating Point, WAIT YES FAULT
Alignment Check Interrupt 17 Unaligned Memory Access YES FAULT
Intel Reserved 18-31
Two Byte Interrupt 0-255 INTn NO TRAP
'Some debug exceptions may report both traps on the prevIous Instruction, and faults on the next Instruction.
2-28
The IF bit in the EFLAG registers is reset when an 2.7.6 INTERRUPT AND EXCEPTION
interrupt is being serviced. This effectively disables PRIORITIES
servicing additional interrupts during an interrupt
service routine. However, the IF may be set explicitly Interrupts are externally-generated events. Maska-
by the interrupt handler, to allow the nesting of inter- ble Interrupts (on the INTR input) and Non-Maskable
rupts. When an IRET instruction is executed the Interrupts (on the NMI input) are recognized at in-
original state of the IF is restored. struction boundaries. When NMI and maskable
INTR are both recognized at the same instruction
boundary, the Intel486 OX microprocessor invokes
2.7.4 NON-MASKABLE INTERRUPT the NMI service routine first. If, after the NMI service
routine has been invoked, maskable interrupts are
Non-maskable interrupts provide a method of servic-
still enabled, then the Intel486 OX microprocessor
ing very high priority interrupts. A common example
of the use of a non-maskable interrupt (NMI) would will invoke the appropriate interrupt service routine.
be to activate a power failure routine. When the NMI
Table 2.17a. Intel486TM OX Microprocessor
input is pulled high it causes an interrupt with an
internally supplied vector value of 2. Unlike a normal Priority for Invoking Service Routines in
hardware interrupt, no interrupt acknowledgment se- Case of Simultaneous External Interrupts
quence is performed for an NMI.
1. NMI
While executing the NMI servicing procedure, the In- 2.INTR
tel486 OX microprocessor will not service further
NMI requests until an interrupt return (IRET) instruc-
Exceptions are internally-generated events. Excep-
tion is executed or the processor is reset. If NMI
occurs while currently servicing an NMI, its presence tions are detected by the Intel486 OX microproces-
will be saved for servicing after executing the first sor if, in the course of executing an instruction, the
Intel486 OX microprocessor detects a problematic
IRET instruction. The IF bit is cleared at the begin-
ning of an NMI interrupt to inhibit further INTR inter- condition. The Intel486 OX microprocessor then im-
mediately invokes the appropriate exception service
rupts.
routine. The state of the Intel486 OX microprocessor
is such that the instruction causing the exception
2.7.5 SOFTWARE INTERRUPTS can be restarted. If the exception service routine has
taken care of the problematic condition, the instruc-
A third type of interrupt/exception for the Intel486 tion will execute without causing the same excep-
OX microprocessor is the software interrupt. An INT tion.
n instruction causes the processor to execute the
interrupt service routine pointed to by the nth vector It is possible for a single instruction to generate sev-
in the interrupt table. eral exceptions (for example, transferring a single
operand could generate two page faults if the oper-
A special case of the two byte software interrupt INT and location spans two "not present" pages). How-
n is the one byte INT 3, or breakpoint interrupt. By ever, only one exception is generated upon each at-
inserting this one byte instruction in a program, the tempt to execute the instruction. Each exception
user can set breakpoints in his program as a debug- service routine should correct its corresponding ex-
ging tool. ception, and restart the instruction. In this manner,
exceptions are serviced until the instruction exe-
A final type of software interrupt is the single step cutes successfully.
interrupt. It is discussed in Section 9.2.
As the Intel486 OX microprocessor executes instruc-
tions, it follows a consistent cycle in checking for
exceptions, as shown in Table 2.17b. This cycle is
repeated as each instruction is executed, and oc-
curs in parallel with instruction decoding and execu-
tion.
2-29
Table 2.17b. Sequence of Exception Checking 2.7.7 INSTRUCTION RESTART
Consider the case of the Intel486 DX microproc- The Intel486 DX microprocessor fully supports re-
essor having just completed an instruction. It starting all instructions after faults. If an exception is
then performs the following checks before reach- detected in the instruction to be executed (exception
ing the point where the next instruction is com- categories 4 through 10 in Table 2.17b), the Intel486
pleted: DX microprocessor invokes the appropriate excep-
tion service routine. The Intel486 DX microprocessor
1. Check for Exception 1 Traps from the instruc-
is in a state that permits restart of the instruction, for
tion just completed (single-step via Trap Flag,
all cases but those in Table 2.17 c. Note that all such
or Data Breakpoints set in the Debug Regis-
cases are easily avoided by proper design of the
ters).
operating system.
2. Check for Exception 1 Faults in the next in-
struction (Instruction Execution Breakpoint Table 2.17c. Conditions Preventing
set in the Debug Registers for the next in- Instruction Restart
struction).
3. Check for external NMI and INTR. An instruction causes a task switch to a task
4. Check for Segmentation Faults that prevent- whose Task State Segment is partially "not
ed fetching the entire next instruction (excep- present". (An entirely "not present" TSS is re-
tions 11 or 13). startable.) Partially present TSS's can be avoid-
5. Check for Page Faults that prevented fetching ed either by keeping the TSS's of such tasks
the entire next instruction (exception 14). present in memory, or by aligning TSS segments
to reside entirely within a single 4K page (for TSS
6. Check for Faults decoding the next instruction segments of 4 Kbytes or less).
(exception 6 if illegal opcode; exception 6 if in
Real Mode or in Virtual 8086 Mode and at- NOTE:
tempting to execute an instruction for Protect- These conditions are avoided by using the oper-
ed Mode only (see Section 4.6.4); or excep- ating system designs mentioned in this table.
tion 13 if instruction is longer than 15 bytes, or
privilege violation in Protected Mode (Le., not
at IOPL or at CPL = 0).
2.7.8 DOUBLE FAULT
7. If WAIT opcode, check if TS= 1 and MP= 1
(exception 7 if both are 1). A Double Fault (exception 8) results when the proc-
8. If opcode for Floating Point Unit, check if essor attempts to invoke an exception service rou-
EM = 1 or TS = 1 (exception 7 if either are 1). tine for the segment exceptions (10, 11, 12 or 13),
but in the process of doing so, detects an exception
9. If opcode for Floating Point Unit (FPU), check
other than a Page Fault (exception 14).
FPU error status (exception 16 if error status
is asserted).
A Double Fault (exception 8) will also be generated
10. Check in the following order for each memo- when the processor attempts to invoke the Page
ry reference required by the instruction: Fault (exception 14) service routine, and detects an
a. Check for Segmentation Faults that pre- exception other than a second Page Fault. In any
vent transferring the entire memory quan- functional system, the entire Page Fault service rou-
tity (exceptions 11, 12, 13). tine must remain "present" in memory.
b. Check for Page Faults that prevent trans-
When a Double Fault occurs, the Intel486 DX micro-
ferring the entire memory quantity (ex-
processor invokes the exception service routine for
ception 14).
exception 8.
NOTE:
The order stated supports the concept of the 2.7.9 FLOATING POINT INTERRUPT VECTORS
paging mechanism being "underneath" the seg-
mentation mechanism. Therefore, for any given Several interrupt vectors of the Intel486 DX micro-
code or data reference in memory, segmenta- processor are used to report exceptional conditions
tion exceptions are generated before paging ex- while executing numeric programs in either real or
ceptions are generated. protected mode. Table 2.18 shows these interrupts
and their causes.
2-30
int:et Intel486™ DX2 MICROPROCESSOR
Table 2.18. Interrupt Vectors Used by FPU

Interrupt
Cause of Interrupt
Number
7 A Floating Point instruction was encountered when EM or TS of the Intel486 DX processor
control register zero (CRO) was set. EM = 1 indicates that software emulation of the
instruction is required. When TS is set, either a Floating Point or WAIT instruction causes
interrupt 7. This indicates that the current FPU context may not belong to the current task.
13 The first word or doubleword of a numeric operand is not entirely within the limit of its
segment. The return address pushed onto the stack of the exception handler points at the
Floating Point instruction that caused the exception, including any prefixes. The FPU has
not executed this instruction; the instruction pointer and data pointer register refer to a
previous, correctly executed instruction.
16 The previous numerics instruction caused an unmasked exception. The address of the
faulty instruction and the address of its operand are stored in the instruction pointer and
data pointer registers. Only Floating Point and WAIT instructions can cause this interrupt.
The Intel486™ DX processor return address pushed onto the stack of the exception
handler points to a WAIT or Floating Point instruction (including prefixes). This instruction
can be restarted after clearing the exception condition in the FPU. The FNINIT, FNCLEX,
FNSTSW, FNSTENV, and FNSAVE instructions cannot cause this interrupt.
2-31
inteL Intel486TM DX2 MICROPROCESSOR
3.0 REAL MODE ARCHITECTURE

3.1 Real Mode Introduction These are the only instruction forms where the
LOCK prefix is legal on the Intel486 DX2 microproc-
When the processor is reset or powered up it is ini- essor:
tialized in Real Mode. Real Mode has the same base
architecture as the 8086, but allows access to the Operands
32-bit register set of the Intel486 microprocessor Opcode
(Dest, Source)
family. The addressing mechanism, memory size, in-
terrupt handling, are all identical to the Real Mode BIT Test and Mem, Reg/immed
on the 80286. SETIRESETICOMPLEMENT
XCHG Reg, Mem
All of the Intel486 microprocessor instructions are XCHG Mem, Reg
available in Real Mode (except those instructions ADD, OR, ADC, SBB, Mem, Reg/immed
listed in Section 4.6.4). The default operand size in
Real Mode is 16 bits, just like the 8086. In order to AND, SUB, XOR
use the 32-bit registers and addressing modes, over- NOT, NEG, INC, DEC Mem
ride prefixes must be used. In addition, the segment CMPXCHG, XADD Mem, Reg
size on the Intel486 microprocessor in Real Mode is
64 Kbytes so 32-bit effective addresses must have a An exception 6 will be generated if a LOCK prefix is
value less the OOOOFFFFH. The primary purpose of placed before any instruction form or opcode not
Real Mode is to set up the processor for Protected listed above. The LOCK prefix allows indivisible
Mode Operation. read/modify/write operations on memory operands
using the instructions above. For example, even the
The LOCK prefix on the Intel486 microprocessor, ADD Reg, Mem is not LOCKable, because the Mem
even in Real Mode, is more restrictive than on the operand is not the destination (and therefore no
80286. This is due to the addition of paging on the memory read/modify/operation is being performed).
Intel486 microprocessor in Protected Mode and Vir-
tual 8086 Mode. Paging makes it impossible to guar- Since, on the Intel486 microprocessor, repeated
antee that repeated string instructions can be string instructions are not LOCKable, it is not possi-
LOCKed. The Intel486 microprocessor can't require ble to LOCK the bus for a long period of time. There-
that all pages holding the string be physically pres- fore, the LOCK prefix is not IOPL-sensitive on the
ent in memory. Hence, a Page Fault (exception 14) Intel486 microprocessor. The LOCK prefix can be
might have to be taken during the repeated string used at any privilege level, but only on the instruc-
instruction. Therefore the LOCK prefix can't be sup- tion forms listed above.
ported during repeated string instructions.
15 o
19 o
SELECTED
SEGMENT
~----------~~--------~---
SEGMENT BASE
241245-9
Figure 3.1. Real Address Mode Addressing
3-1
3.2 Memory Addressing 3.4 Interrupts

In Real Mode the maximum memory size is limited to Many of the exceptions shown in Table 2.16 and
1 megabyte. Thus, only address lines A2 - A 19 are discussed in Section 2.7 are not applicable to Real
active. (Exception, after RESET address lines A20- Mode operation, in particular exceptions 10, 11, 14,
A31 are high during CS-relative memory cycles until 17, will not happen in Real Mode. Other exceptions
an intersegment jump or call is executed (see Sec- have slightly different meanings in Real Mode; Table
tion 6.5». 3.1 identifies these exceptions.
Since paging is not allowed in Real Mode the linear

addresses are the same as physical addresses. 3.5 Shutdown and Halt
Physical addresses are formed in Real Mode by
adding the contents of the appropriate segment reg- The HLT instruction stops program execution and
ister which is shifted left by four bits to an effective prevents the processor from using the local bus until
address. This addition results in a physical address restarted. Either NMI, INTR with interrupts enabled
from OOOOOOOOH to 0010FFEFH. This is compatible (IF= 1), or RESET will force the Intel486 DX2 micro-
with 80286 Real Mode. Since segment registers are processor out of halt. If interrupted, the saved CS:IP
shifted left by 4 bits, Real Mode segments always will point to the next instruction after the HLT.
start on 16 byte boundaries.
As in the case in protected mode, the shutdown will
All segments in Real Mode are exactly 64 Kbytes occur when a severe error is detected that prevents
long, and may be read, written, or executed. The further processing. In Real Mode, shutdown can oc-
Intel486 microprocessor will generate an exception cur under two conditions:
13 if a data operand or instruction fetch occurs past
the end of a segment (i.e., if an operand has an An interrupt or an exception occur (exceptions 8 or
offset greater than FFFFH, for example a word with 13) and the interrupt vector is larger than the Inter-
a low byte at FFFFH and the high byte at OOOOH). rupt Descriptor Table (i.e., there is not an interrupt
handler for the interrupt).
Segments may be overlapped in Real Mode. Thus, if
a particular segment does not use all 64 Kbytes an- A CALL, INT or PUSH instruction attempts to wrap
other segment can be overlayed on top of the un- around the stack segment when SP is not even (i.e.,
used portion of the previous segment. This allows pushing a value on the stack when SP = 0001 re-
the programmer to minimize the amount of physical sulting in a stack segment greater than FFFFH).
memory needed for a program.
An NMI input can bring the processor out of shut-
down if the Interrupt Descriptor Table limit is large
3.3 Reserved Locations enough to contain the NMI interrupt vector (at least
There are two fixed areas in memory which are re- 0017H) and the stack has enough room to contain
seNed in Real address mode: system initialization the vector and flag information (i.e., SP is greater
area and the interrupt table area. Locations OOOOOH than 0005H). If these conditions are not met, the
through 003FFH are reseNed for interrupt vectors. Intel486 DX2 CPU is unable to execute the NMI and
Each one of the 256 possible interrupts has a 4-byte executes another shutdown cycle. In this case, the
jump vector reseNed for it. Locations FFFFFFFOH processor remains in the shutdown and can only exit
through FFFFFFFFH are reseNed for system initiali- via the RESET input.
zation.
Table 3_1. Exceptions with Different Meanings in Real Mode (see Table 2.16)
Interrupt Related Return
Function
Number Instructions Address Location
Interrupt table limit too small 8 INT Vector is not Before
within table limit Instruction
CS, OS, ES, FS, GS 13 Word memory reference Before
Segment overrun exception beyond offset = FFFFH. Instruction
An attempt to execute
past the end of CS segment.
SS Segment overrun exception 12 Stack Reference Before
beyond offset = FFFFH Instruction
3-2
4.0 PROTECTED MODE ARCHITECTURE

4.1 Introduction 4.2 Addressing Mechanism
The complete capabilities of the Intel486 DX2 micro- Like Real Mode, Protected Mode uses two compo-
processor are unlocked when the processor oper- nents to form the logical address, a 16-bit selector is
ates in Protected Virtual Address Mode (Protected used to determine the linear base address of a seg-
Mode). Protected Mode vastly increases the linear ment, the base address is added to a 32-bit effective
address space to four gigabytes (232 bytes) and al- address to form a 32-bit linear address. The linear
lows the running of virtual memory programs of al- address is then either used as the 32-bit physical
most unlimited size (64 terabytes or 246 bytes). In address, or if paging is enabled the paging mecha-
addition Protected Mode allows the Intel486 DX2 mi- nism maps the 32-bit linear address into a 32-bit
croprocessor to run all of the existing 8086, 80286 physical address.
and Intel386 microprocessor software, while provid-
ing a sophisticated memory management and a The difference between the two modes lies in calcu-
hardware-assisted protection mechanism. Protected lating the base address. In Protected Mode the se-
Mode allows the use of additional instructions espe- lector is used to specify an index into an operating
cially optimized for supporting multitasking operating system defined table (see Figure 4.1). The table
systems. The base architecture of the Intel486 mi- contains the 32-bit base address of a given seg-
croprocessor remains the same, the registers, in- ment. The physical address is formed by adding the
structions, and addressing modes described in the base address obtained from the table to the offset.
previous sections are retained. The main difference
between Protected Mode, and Real Mode from a Paging provides an additional memory management
programmer's view is the increased address space, mechanism which operates only in Protected Mode.
and a different addressing mechanism. Paging provides a means of managing the very large
segments of the Intel486 microprocessor family. As
such, paging operates beneath segmentation. The
paging mechanism translates the protected linear
address which comes from the segmentation unit
into a physical address. Figure 4.2 shows the com-
plete Intel486 DX2 addressing mechanism with pag-
ing enabled.
48/32 BIT POINTER

SEGMENT LIMIT
0------+ MEMORY OPERAND ,

SELECTED
SEGMENT
ACCESS RIGHTS
LIMIT
BASE ADDRESS
SEGMENT BASE
SEGMENT ADDRESS
DESCRIPTOR
241245-10
Figure 4.1. Protected Mode Addressing
4-1
,. 48 BIT POINTER
I SEGMENT
I OFFSET
"' PHYSICAL ADDRESS
4K BYTES
15 31
I 0
4K BYTES
Intol486 DX
CPU 4K BYTES
ACCESS RIGHTS PHYSICAL
PAGING
LIMIT ~ P MECHANISM ADDRESS
MEMORY OPERAND PHYSICAL PAGE:
~ BASE ADDRESS
~ LINEAR;'
PAGE FRAME
4K BYTES
SEGMENT ADDRESS ADDRESS

4K BYTES
DESCRIPTOR
4K BYTES
4K BYTES
241245-11
Figure 4.2. Paging and Segmentation
4.3 Segmentation CPL: Current Privilege Level-The privilege level at

which a task is currently executing, which equals the
privilege level of the code segment being executed.
4.3.1 SEGMENTATION INTRODUCTION CPL can also be determined by examining the low-
est 2 bits of the CS register, except for conforming
Segmentation is one method of memory manage-
code segments.
ment. Segmentation provides the basis for protec-
tion. Segments are used to encapsulate regions of EPL: Effective Privilege Level-The effective privi-
memory which have common attributes. For exam- lege level is the least privileged of the RPL and DPL.
ple, all of the code of a given program could be con- Since smaller privilege level values indicate greater
tained in a segment, or an operating system table privilege, EPL is the numerical maximum of RPL and
may reside in a segment. All information about a DPL.
segment is stored in an 8 byte data structure called
a descriptor. All of the descriptors in a system are Task: One instance of the execution of a program.
contained in tables recognized by hardware. Tasks are also referred to as processes.
4.3.2 TERMINOLOGY 4.3.3 DESCRIPTOR TABLES

The following terms are used throughout the discus-
sion of descriptors, privilege levels and protection: 4.3.3.1 Descriptor Tables Introduction
PL: Privilege Level-One of the four hierarchical The descriptor tables define all of the segments
privilege levels. Level 0 is the most privileged level which are used in a Intel486 microprocessor system.
and level 3 is the least privileged. More privileged There are three types of tables on the Intel486 DX2
levels are numerically smaller than less privileged microprocessor which hold descriptors: the Global
levels. Descriptor Table, Local Descriptor Table, and the In-
terrupt Descriptor Table. All of the tables are vari-
RPL: Requestor Privilege Level-The privilege level able length memory arrays. They can range in size
of the original supplier of the selector. RPL is deter- between 8 bytes and 64 Kbytes. Each table can hold
mined by the least two significant bits of a selector. up to 8192 8-byte descriptors. The upper 13 bits of a
selector are used as an index into the descriptor ta-
DPL: Descriptor Privilege Level-This is the least ble. The tables have registers associated with them
privileged level at which a task may access that de- which hold the 32-bit linear base address, and the
scriptor (and the segment associated with that de- 16-bit limit of each table.
scriptor). Descriptor Privilege Level is determined by
bits 6:5 in the Access Right Byte of a descriptor.
4-2
intel . Intel486™DX2 MICROPROCESSOR
Each of the tables has a register associated with it, nism for isolating a given task's code and data seg-
the GDTA, LDTA, and the IDTR (see Figure 4.3). ments from the rest of the operating system,. while
The LGDT, LLDT, and LlDT instructions, load the the GDT contains descriptors for segments. which
base and limit of the Global, Local, and Interrupt De- are common to all tasks. A segment cannot be ac-
scriptor Tables, respectively, into the appropriate cessed by a task if its segment descriptor does not
register. The SGDT, SLDT, and SIDT store the base exist in either the current LDT or the GDT. This pro-
and limit values. These tables are manipulated by vides both isolation and protection for a task's seg-
the operating system. Therefore, the load descriptor ments, while still allowing global data to be shared
table instructions are privileged instructions. among tasks.
Unlike the 6 byte GDT or IDT registers which contain
r-;..---.., :• •.---111!1----------
15 o
a base address and limit, the visible portion of the
LDT register contains only a 16-bit selector. This se-
LDTR LOT LIMIT
lector refers to a Local Descriptor Table descriptor in
'--_ _ _..I.
• the GDT.
,.-_ _ _.,0 :
•• 4.3.3.4 Interrupt Descriptor Table
lOT LIMIT
•• PROGRAM INVISIBLE The third table needed for Intel486 microprocessor
_.&------4 : AUTOMATICALLY LOADED systems is the Interrupt Descriptor Table. (See Fig-
IDTR ._------------ ..
• FROM LOT DESCRIPTOR
ure 4.4.) The IDT contains the descriptors which
point to the location of up to 256 interrupt service
o routines. The IDT may contain only task gates, inter-
rupt gates, and trap gates. The IDT should be at
least 256 bytes in size in order to hold the descrip-
tors for the 32 Intel Reserved Interrupts. Every inter-
rupt used by a system must have an entry in the lOT.
GDTR
The IDT entries are referenced via INT instructions,
external interrupt vectors, and exceptions. (See Sec-
tion 2.7 Interrupts).
J!41245-12
Figure 4.3. Descriptor Table Registers

GATE FOR
INTERRUPT #n
4.3.3.2 Global Descriptor Table
GATE FOR
INTERRUPT ....1
The Global Descriptor Table (GDT) contains de- INTERRUPT
scriptors which are possibly available to all of the DESCRIPTOR
TABLE
tasks in a system. The GDT can contain any type of (lOT)
GATE FOR
segment descriptor except for descriptors which are INTERRUPT .. 1
used for servicing interrupts (i.e., interrupt and trap
descriptors). Every Intel486 microprocessor system
contains a GDT. Generally the GDT contains code
and data segments used by the operating systems
and task state segments, and descriptors for the "" 241245-13
LDTs in a system.
Figure 4.4. Interrupt Descriptor
The first slot of the Global Descriptor Table corre- Table Register Use
sponds to the null selector and is not used. The null
selector defines a null pointer value.
4.3.4 DESCRIPTORS
4.3.3.3 Local Descriptor Table 4.3.4.1 Descriptor Attribute Bits

LDTs contain descriptors which are associated with The object to which the segment selector points to
a given task. Generally, operating systems are de- is called a descriptor. Descriptors are eight byte
signed so that each task has a separate LDT. The quantities which contain attributes about a given re-
LDT may contain only code, data, stack, task gate, gion of linear address space (i.e., a segment). These
and call gate descriptors. LOTs provide a mecha-
4-3
attributes include the 32-bit base linear address of The Intel486 OX microprocessor has two main cate-
the segment, the 20-bit length and granularity of the gories of segments: system segments and non-sys-
segment, the protection level, read, write or execute tem segments (for code and data). The segment S
privileges, the default size of the operands (16-bit or bit in the segment descriptor determines if a given
32-bit), and the type of segment. All of the attribute segment is a system segment or a code or data seg-
information about a segment is contained in 12 bits ment. If the S bit is 1 then the segment is either a
in the segment descriptor. Figure 4.5 shows the gen- code or data segment, if it is 0 then the segment is a
eral format of a descriptor. All segments on the In- system segment.
tel486 microprocessor have three attribute fields in
common: the P bit, the DPL bit, and the S bit. The
Present P bit is 1 if the segment is loaded in physical 4.3.4.2 Intel486 CPU Code, Data Descriptors
memory, if P = 0 then any attempt to access this (S= 1)
segment causes a not present exception (exception
Figure 4.6 shows the general format of a code and
11). The Descriptor Privilege Level DPL is a two-bit
data descriptor and Table 4.1 illustrates how the bits
field which specifies the protection level 0-3 associ-
in the Access Rights Byte are interpreted.
ated with a segment.
31 0 BYTE
ADDRESS
SEGMENT BASE 15 ... 0 SEGMENT LIMIT 15 ... 0
0
BASE 31. .. 24 1 G I D I 0 I AVL 11~~~~~6 pi DPL

IS I
TYPE I I
A 23BASE
... 16
+4
I I I
BASE Base Address of the segment
LIMIT The length of the segment
P Present Bit 1 = Present 0= Not Present
DPL Descriptor Privilege Level 0-3
S Segment Descriptor 0= System Descriptor 1 = Code or Data Segment Descriptor
TYPE Type of Segment
A Accessed Bit
G Granularity Bit 1 = Segment length is page granular 0= Segment length is byte granular
D Default Operation Size (recognized in code segment descriptors only)
1 = 32·bit segment 0= 16-bit segment
0 Bit must be zero (0) for compatibility with future processors
AVL Available field for user or as
NOTE:
In a maximum-size segment (i.e., a segment with G = 1 and segment limit 19... 0 = FFFFFH), the lowest 12 bits of the
segment base should be zero (i.e., segment base 11 ... 000=000H).
Figure 4.5. Segment Descriptors
31 0
SEGMENT BASE 15 ... 0 SEGMENT LIMIT 15 ... 0 0
ACCESS BASE
LIMIT
BASE 31 ... 24 G 0 0 AVL RIGHTS +4
19 ... 16 23 ... 16
BYTE
DIB 1 = Default Instruction Attributes are 32-Bits
0= Default Instruction Attributes are 16-Bits
AVL Available field for user or as
G Granularity Bit 1 = Segment length is page granular
0= Segment length is byte granular
0 Bit must be zero (0) for compatibility with future processors
Figure 4.6. Segment Descriptors
4-4
Table 4.1. Access Rights Byte Definition for Code and Data Descriptions
Bit
Name Function
Position
7 Present (P) P=1 Segment is mapped into physical memory.
P=O No mapping to physical memory exits, base and limit are
not used.
6-5 Descriptor Privilege Segment privilege attribute used in privilege tests.
r
Level (DPL)
4 Segment Descrip· S=1 Code or Data (includes stacks) segment descriptor.
tor (S) S=O System Segment Descriptor or Gate Descriptor.
3
2
Executable (E)
Expansion Direc·
E ~0
ED = 0
""-"" type • data ...ment
Expand up segment, offsets must be :s: limit. Data
tion (ED) ED = 1 Expand down segment, offsets must be > limit. Segment
1 Writeable (W) W= 0 Data segment may not be written into. (S = 1,
Type W= 1 Data segment may be written into. E = 0)
Field 3 Executable (E) E= 1 Descriptor type is code segment:
r
Definition C=1
2 Conforming (C) Code segment may only be executed Code
when CPL :?: DPL and CPL Segment
remains unchanged. (S = 1,
1 Readable (R) R=O Code segment may not be read. E = 1)
R = 1 Code segment may be read.
0 Accessed (A) A=O Segment has not been accessed.
A=1 Segment selector has been loaded into segment register
or used by selector test instructions.
Code and data segments have several descriptor The D bit indicates the default length for operands
fields in common. The accessed A bit is set whenev- and effective addresses. If D= 1 then 32-bit oper-
er the processor accesses a descriptor. The A bit is ands and' 32·bit addressing modes are assumed. If
used by operating system~ to keep usage statistics D = 0 then 16-bit operands and 16-bit addressing
on a given segment. The G bit, or granularity bit, modes are assumed. Therefore all existing 80286
specifies if a segment length is byte-granular or code segments will execute on the Intel486 DX mi-
page-granular. Intel486 DX microprocessor seg- croprocessor assuming the D bit is set o.
ments can be one megabyte long with byte granular-
ity (G = 0) or four gigabytes with page granularity Another attribute of code segments is determined by
(G = 1), (i.-e., 220 pages each page is 4 Kbytes in the conforming C bit. Conforming segments, C = 1,
length). The granularity is totally unrelated to paging. can be executed and shared by programs at differ-
A Intel486 DX microprocessor system can consist of ent privilege levels. (See Section 4.4 Protection.)
segments with byte granularity, and page granularity,
whether or not paging is enabled. Segments identified as data segments (E=O, S= 1)
are used for two types of Intel486 DX microproces-
The executable E bit tells if a segment is a code or sor segments: stack and data segments. The expan-
data segment. A code segment (E = 1, S = 1) may be sion direction (ED) bit specifies if a segment ex-
execute-only or execute/read as determined by the pands downward (stack) or upward (data). If a seg-
Read R bit. Code segments are execute only if ment is a stack segment all offsets must be greater
R = 0, and execute/read if R = 1. Code segments than the segment limit. On a data segment all off-
may never be written into. sets must be less than or equal to the limit. In other
words, stack segments start at the base linear ad-
NOTE: dress plus the maximum segment limit and grow
Code segments may be modified via aliases. Alias- down to the base linear address plus the limit. On
es are writeable data segments which occupy the the other hand, data segments start at the base lin-
same range of linear address space as the code ear address and expand to the base linear address
segment. plus limit.
4-5
The write W bit controls the ability to write into a permit nesting tasks. The TYPE field is used to indi-
segment. Data segments are read-only if W = O. The cate whether the task is currently BUSY (i.e., on a
stack segment must have W= 1. chain of active tasks) or the TSS is available. The
TYPE field also indicates if the segment contains a
The B bit controls the size of the stack pointer regis- 80286 or an Intel486 DX microprocessor TSS. The
ter. If B = 1, then PUSHes, POPs, and CALls all use Task Register (TR) contains the selector which
the 32-bit ESP register for stack references and as- points to the current Task State Segment.
sume an upper limit of FFFFFFFFH. If B = 0, stack
instructions all use the 16-bit SP register and as-
sume an upper limit of FFFFH. 4.3.4.6 Gate Descriptors (S = 0,
TVPE=4-7, C, F)
4.3.4.3 System Descriptor Formats Gates are used to control access to entry points
within the target code segment. The various types of
System segments describe information about oper- gate descriptors are call gates, task gates, inter-
ating system tables, tasks, and gates. Figure 4.7 rupt gates, and trap gates. Gates provide a level of
shows the general format of system segment de- indirection between the source and destination of
scriptors, and the various types of system segments. the control transfer. This indirection allows the proc-
Intel486 DX microprocessor system descriptors con- essor to automatically perform protection checks. It
tain a 32-bit base linear address and a 20-bit seg- also allows system designers to control entry points
ment limit. 80286 system descriptors have a 24-bit to the operating system. Call gates are used to
base address and a 16-bit segment limit. 80286 sys- change privilege levels (see Section 4.4 Protec-
tem descriptors are identified by the upper 16 bits tion), task gates are used to perform a task switch,
being all zero. and interrupt and trap gates are used to specify in-
terrupt service routines.
4.3.4.4 LDT Descriptors (S = 0, TYPE = 2) Figure 4.8 shows the format of the four types of gate
LDT descriptors (S = 0, TYPE = 2) contain informa- descriptors. Call gates are primarily used to transfer
tion about Local Descriptor Tables. LDTs contain a program control to a more privileged level. The call
gate descriptor consists of three fields: the access
table of segment descriptors, unique to a particular
task. Since the instruction to load the LDTR is only byte, a long pointer (selector and offset) which
available at privilege level 0, the DPL field is ignored. points to the start of a routine and a word count
which specifies how many parameters are to be cop-
LDT descriptors are only allowed in the Global De-
scriptor Table (GDT). ied from the caller's stack to the stack of the called
routine. The word count field is only used by call
gates when there is a change in the privilege level,
4.3.4.5 TSS Descriptors (S = 0, other types of gates ignore the word count field.
TVPE= 1,3,9, B)
Interrupt and trap gates use the destination selector
A Task State Segment (TSS) descriptor contains in- and destination offset fields of the gate descriptor as
formation about the location, size, and privilege level a pointer to the start of the interrupt or trap handler
of a Task State Segment (TSS). A TSS in turn is a routines. The difference between interrupt gates and
special fixed format segment which contains all the trap gates is that the interrupt gate disables inter-
state information for a task and a linkage field to rupts (resets the IF bit) while the trap gate does not.
31 16 0
BASE31 ... 24 1 G I 0 I 0 I 0 11i~~~~6 pi DPL I0 I TYPE I BASE

23 ... 16
+4
Type Defines Type Defines
0 Invalid 8 Invalid
1 Available 80286 TSS 9 Available Intel486TM DX CPU TSS
2 LDT A Undefined (Intel Reserved)
3 Busy 80286 TSS B Busy Intel486TM DX CPU TSS
4 80286 Call Gate C Intel486TM DX CPU Call Gate
5 Task Gate (for 80286 or Intel486™ DX CPU Task) D Undefined (Intel Reserved)
6 80286 Interrupt Gate E Intel486TM DX CPU Interrupt Gate
7 80286 Trap Gate F Intel486TM DX CPU Trap Gate
Figure 4.7. System Segment Descriptors
4-6
Task gates are used to switch tasks. Task gates 4.3.4.7 Differences Between Intel486 DX2
may only refer to a task state segment (see Section Microprocessor and 80286 Descriptors
4.4.6 Task Switching) therefore only the destination
selector portion of a task gate descriptor is used, In order to provide operating system compatibility
and the destination offset is ignored. between the 80286 and Intel486 DX2 microproces-
sor, the Intel486 DX microprocessor supports all of
Exception 13 is generated when a destination selec- the 80286 segment descriptors. Figure 4.9 shows
tor does not refer to a correct descriptor type, i.e., a the general format of an 80286 system segment de-
code segment for an interrupt, trap or call gate, a scriptor. The only differences between 80286 and
TSS for a task gate. Intel486 DX microprocessor descriptor formats are
that the values of the type fields, and the limit and
The access byte format is the same for all gate de- base address fields have been expanded for the In-
scriptors. P = 1 indicates that the gate contents are tel486 DX microprocessors. The 80286 system seg-
valid. P = 0 indicates the contents are not valid and ment descriptors contained a 24-bit base address
causes exception 11 if referenced. DPL is the de- and 16-bit limit, while the Intel486 DX microproces-
scriptor privilege level and specifies when this de- sor system segment descriptors have a 32-bit base
scriptor may be used by a task (see Section 4.4 Pro- address, a 20-bit limit field, and a granularity bit.
tection). The S field, bit 4 of the access rights byte,
must be 0 to indicate a system control descriptor.
The type field specifies the descriptor type as indi-
cated in Figure 4.8.
31 24 16 8 5 o
SELECTOR OFFSET 15 ... 0 o
WORD
OFFSET 31 ... 16 P DPL 0 TYPE 0 0 0 COUNT +4
4 ... 0
Gate Descriptor Fields
Name Value Description
Type 4 80286 call gate
5 Task gate (for 80286 or Intel486TM DX CPU task)
6 80286 interrupt gate
7 80286 trap gate
C Intel486™ DX CPU call gate
E Intel486™ DX CPU interrupt gate
F Intel486™ DX CPU trap gate
P o Descriptor contents are not valid
I Descriptor contents are valid
DPL-Ieast privileged level at which a task may access the gate. WORD COUNT 0-31-the number of parameters to copy from caller's stack
to the called procedure's stack. The parameters are 32-bit quantities for Intel486TM DX CPU gates, and 16-bit quantities for 80286 gates.
DESTINATION 16·bit Selector to the target code segment
SELECTOR selector or
Selector to the target task state segment for task gate
DESTINATION offset Entry point within the target code segment

OFFSET 16-bit 80286
32-bit Intel486™ DX CPU
Figure 4.8. Gate Descriptor Formats
31 0
Intel Reserved
BASE
Set to 0
Base Address of the segment
P I DPL
DPL
lsi TYPE I
Descriptor Privilege Level 0-3
BASE
23 ... 16
+4
LIMIT The length of the segment S System Descriptor O~System I ~User

P Present Bit I ~Present o ~ Not Present TYPE Type of Segment
Figure 4.9. 80286 Code and Data Segment Descriptors
4-7
By supporting 80286 system segments the Intel486 Entry Index (Index), and Requestor (the selector's)
OX microprocessor is able to execute 80286 appli- Privilege Level (RPL) as shown in Figure 4.10. The
cation programs on an Intel486 OX microprocessor TI bits select one of two memory-based tables of
operating system. This is possible because the proc- descriptors (the Global Descriptor Table or the Local
essor automatically understands which descriptors Descriptor Table). The Index selects one of 8K de-
are 80286-style descriptors and which descriptors scriptors in the appropriate descriptor table. The
are Intel486 OX Microprocessor-style descriptors. In RPL bits allow high speed testing of the selector's
particular, if the upper word of a descriptor is zero, privilege attributes.
then that descriptor is a 80286-style descriptor.
The only other differences between 80286-style de- 4.3.4.9 Segment Descriptor Cache
scriptors and Intel486 OX microprocessor-style de- In addition to the selector value, every segment reg-
scriptors is the interpretation of the word count field
ister has a segment descriptor cache register asso-
of call gates and the B bit. The word count field ciated with it. Whenever a segment register's con-
specifies the number of 16-bit quantities to copy for
tents are changed, the 8-byte descriptor associated
80286 call gates and 32-bit quantities for Intel486 with that selector is automatically loaded (cached)
OX microprocessor call gates. The B bit controls the
on the chip. Once loaded, a" references to that seg-
size of PUSHes when using a call gate; if B = 0
ment use the cached descriptor information instead
PUSHes are 16 bits, if B = 1 PUSHes are 32 bits. of reaccessing the descriptor. The contents of the
descriptor cache are not visible to the programmer.
4.3.4.8 Selector Fields Since descriptor caches only change when a seg-
ment register is changed, programs which modify
A selector in Protected Mode has three fields: Local the descriptor tables must reload the appropriate
or Global Descriptor Table Indicator (TI), Descriptor segment registers after changing a descriptor's val-
ue.
SELECTOR
15 4 3 2 1 0
SEGMENT
REGISTER I. I
0 0 ---- 0 I 0 1111~11 R~L
.
I
INDEX TABLE
INDICATOR
TI=l TI-O l
N N
DESCRIPTOR
NUMBER
6 6
5 5
4 4
~} ......... /:
DESCRiPTOR 3
2 2
1 1
0 0 NULL
LOCAL GLOBAL
DESCRIPTOR DESCRIPTOR
TABLE TABLE
241245-14
Figure 4.10. Example Descriptor Selection
4-8
intel® Intel486TM DX2 MICROPROCESSOR
4.3.4.10 Segment Descriptor Register Settings the 8086 architecture, the base is set to sixteen
times the current selector value, the limit is fixed at
The contents of the segment descriptor cache vary OOOOFFFFH, and the attributes are fixed so as to
depending on the mode the Intel486 OX microproc- indicate the segment is present and fully usable. In
essor is operating in. When operating in Real Ad- Real Address Mode, the internal "privilege level" is
dress Mode, the segment base, limit, and other attri- always fixed to the highest level, level 0, so 1/0 and
butes within the segment cache registers are de- other privileged opcodes may be executed.
fined as shown in Figure 4.11. For compatibility with
SEGMENT DESCRIPTOR CACHE REGISTER CONTENTS
32 - BIT BASE 32 - BIT LIMIT OTHER ATTRIBUTES

(UPDATED DURING SELECTOR (FIXED) (FIXED)
LOAD INTO SEGMENT REGISTER)
CONfORMING PRIVILEGE
STACK SIZE - - - - - - - - - - - - - - - - - - - - - - - - - - ,
EXECUTABLE - - - - - - - - - - - - - - - - - - - - - - - - ,
WRITEABLE - - - - - - - - - - - - - - - - - - - - - - - - ,
READABLE - - - - - - - - - - - - - - - - - - - - - - ,
EXPANSION DIRECTION
GRANULARITY
ACCESSED
PRIVILEGE LEVEL !1 1
~R~S_E~T________ ~A~E____________ :I~I~ ___ l_ ~ __ _ __
CS l6X CURRENT CS SELECTOR
. OOOOFFFFH Y 0 Y B U Y Y Y - N
SS l6X CURRENT SS SELECTOR OOOOFFFFH Y 0 Y B U Y Y N W -
OS l6X CURRENT OS SELECTOR OOOOFFFFH Y 0 Y B U Y Y N - -
ES l6X CURRENT ES SELECTOR OOOOFFFFH Y 0 Y B U Y Y N - -
FS l6X CURRENT FS SELECTOR OOOOFFFFH Y 0 Y B U Y Y N - -
GS l6X CURRENT GS SELECTOR OOOOFFFFH Y 0 Y B U Y Y N - -
241245-15
'Except the 32·bit CS base is initialized to FFFFFOOOH after reset until first intersegment control transfer (Le., intersegment CALL, or
intersegment JMP, or INT). (See Figure 4.13 Example.)
Key: Y = yes o = expand down
N = no B = byte granularity
o = privilege level 0 P = page granularity
1 = privilege level 1 W = push/pop 16·bit words
2 = privilege level 2 F = push/pop 32·bit dwords
3 = privilege level 3 - = does not apply to that segment cache register
U = expand up
Figure 4.11. Segment Descriptor Caches for Real Address Mode

(Segment Limit and Attributes are Fixed)
4-9
When operating in Protected Mode, the segment according to the contents of the segment descriptor
base, limit, and other attributes within the segment indexed by the selector value loaded into the seg-
cache registers are defined as shown in Figure 4.12. ment register.
In Protected Mode, each of these fields are defined
SEGMENT DESCRIPTOR CACHE REGISTER CONTENTS

32 - BIT BASE 32 - BIT LIMIT OTHER ATTRIBUTES
(UPDATED DURING (UPDATED DURING (UPDATED DURING
SELECTOR LOAD INTO SELECTOR LOAD INTO SELECTOR LOAD INTO
SEGMENT REGISTER) SEGMENT REGISTER) SEGMENT REGISTER)
CONFORMING PRIVILEGE
STACKSIZE------------------------------------------------,
EXECUTABLE - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ,
WRITEABLE
11
READABLE - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ,
EXPANSION DIRECTION
GRANULARITY
ACCESSED
PRIVILEGE LEVEL
~R~S~:T_____ ~~S: ___________ ~I~I~ ______

!
t t ____
CS BASE PER SEG DESCR LIMIT PER SEG DESCR P d d d d d N y - d
SS BASE PER SEG DESCR LIMIT PER SEG DESCR P d d d d r w N d
OS BASE PER SEG DESCR LIMIT PER SEG DESCR P d d d d d d N --
ES BASE PER SEG DESCR LIMIT PER SEG DESCR P d d d d d d N - -
FS BASE PER SEG DESCR LIMIT PER SEG DESCR P d d d d d d N - -
GS BASE PER SEG DESCR LIMIT PER SEG DESCR P d d d d d d N - -
241245-16
Key: Y ~ fixed yes

N ~ fixed no
d ~ per segment descriptor
p ~ per segment descriptor; descriptor must indicate "present" to avoid exception 11
(exception 12 in case of 55)
r ~ per segment descriptor, but descriptor must indicate "readable" to avoid exception 13
(special case for 55)
w = per segment descriptor, but descriptor must indicate "writable" to avoid exception 13
(special case for 55)
- ~ does not apply to that segment cache register
Figure 4.12. Segment Descriptor Caches for Protected Mode (Loaded per Descriptor)
4-10
in1et Intel486™ DX2 MICROPROCESSOR
When operating in a Virtual 8086 Mode within the OOOOFFFFH, and the attributes are fixed so as to
Protected Mode, the segment base, limit, and other indicate the segment is present and fully usable. The
attributes within the segment cache registers are de- virtual program executes at lowest privilege level,
fined as shown in Figure 4.13. For compatibility with level 3, to allow trapping of all IOPL-sensitive in-
the 8086 architecture, the base is set to sixteen structions and level-a-only instructions.
times the current selector value, the limit is fixed at
SEG~ENT DESCRIPTOR CACHE REGISTER CONTENTS
32 - BIT BASE 32 - BIT LI~IT OTHER ATTRIBUTES
(UPDATED DURING SELECTOR (FIXED) (FIXED)

LOAD INTO SEG~ENT REGISTER)
CONFOR~ING PRIVILEGE
STACK SIZE - - - - - - - - - - - - - - - - - - - - - - - - ,
EXECUTABLE - - - - - - - - - - - - - - - - - - - - - - - - - .
WRITEABLE - - - - - - - - - - - - - - - - - - - - - - ,
READABLE - - - - - - - - - - - - - - - - - - - - - - - - - .
EXPANSION DIRECTION
GRANULARITY
ACCESSED 1 1
~:~~_~~~~ ~~V:L B~~E ____ ____________ ~I~I~ ___ l_11 ____ _
CS 16X CURRENT CS SELECTOR OOOOFFFFH Y 3 Y B U Y Y Y - N
SS 16X CURRENT SS SELECTOR OOOOFFFFH Y 3 Y B U Y Y N W -
DS 16X CURRENT DS SELECTOR OOOOFFFFH Y 3 Y BUY Y N - -
ES 16X CURRENT ES SELECTOR OOOOFFFFH Y 3 Y B U Y Y N - -
FS 16X CURRENT FS SELECTOR OOOOFFFFH Y 3 Y B U Y Y N - -
GS 16X CURRENT GS SELECTOR OOOOFFFFH Y 3 Y B U Y Y N - -
241245-17
Key: Y ~ yes D ~ expand down

N ~ no B ~ byte granularity
o ~ privilege level 0 p ~ page granularity
1 ~ privilege level 1 W ~ push/pop 16·bil words
2 ~ privilege level 2 F ~ push/pop 32-bil dwords
3 ~ privilege level 3 - ~ does not apply to that segment cache register
U ~ expand up
Figure 4.13. Segment Descriptor Caches for Virtual 8086 Mode within Protected Mode
(Segment Limit and Attributes are Fixed)
4-11
intel" Intel486TM DX2 MICROPROCESSOR
4.4 Protection 4.4.3 PRIVILEGE LEVELS
4.4.1 PROTECTION CONCEPTS 4.4.3.1 Task Privilege

At any point in time, a task on the Intel486 OX Micro-
processor always executes at one of the four privi-
CPU
ENFORCED lege levels. The Current Privilege Level (CPL) speci-
SOFTWARE
INTERFACES fies the task's privilege level. A task's CPL may only
be changed by control transfers through gate de-
scriptors to a code segment with a different privilege
level. (See Section 4.4.4 Privilege Level Transfers)
Thus, an application program running at PL = 3 may
HIGH SPEED
OPERATING call an operating system routine at PL = 1 (via a
SYSTEM
INTERFACE gate) which would cause the task's CPL to be set to
1 until the operating system routine was finished.
4.4.3.2 Selector Privilege (RPL)

The privilege level of a selector is specified by the
241245-18
RPL field. The RPL is the two least significant bits of
Figure 4.14. Four-Level Hierarchical Protection the selector. The selector's RPL is only used to es-
tablish a less trusted privilege level than the current
The Intel486 OX Microprocessor has four levels of privilege level for the use of a segment. This level is
protection which are optimized to support the needs called the task's effective privilege level (EPL). The
of a multi-tasking operating system to isolate and EPL is defined as being the least privileged (Le. nu-
protect user programs from each other and the op- merically larger) level of a task's CPL and a selec-
erating system. The privilege levels control the use tor's RPL. Thus, if selector's RPL = 0 then the CPL
of privileged instructions, I/O instructions, and ac- always specifies the privilege level for making an ac-
cess to segments and segment descriptors. Unlike cess using the selector. On the other hand if RPL =
traditional microprocessor-based systems where 3 then a selector can only access segments at level
this protection is achieved only through the use of 3 regardless of the task's CPL. The RPL is most
complex external hardware and software the In- commonly used to verify that pointers passed to an
tel486 OX Microprocessor provides the protection operating system procedure do not access data that
as part of its integrated Memory Management Unit. is of higher privilege than the procedure that origi-
The Intel486 OX Microprocessor offers an additional nated the pointer. Since the originator of a selector
type of protection on a page basis, when paging is can specify any RPL value, the Adjust RPL (ARPL)
enabled (See Section 4.5.3 Page Level Protec- instruction is provided to force the RPL bits to the
tion). originator's CPL.
The four-level hierarchical privilege system is illus- 4.4.3.3 I/O Privilege and I/O Permission Bitmap
trated in Figure 4-14. It is an extension of the user/
supervisor privilege mode commonly used by mini- The I/O privilege level (IOPL, a 2-bit field in the
computers and, in fact, the user/supervisor mode is EFLAG register) defines the least privileged level at
fully supported by the Intel486 OX Microprocessor which I/O instructions can be unconditionally per-
paging mechanism. The privilege levels (PL) are formed. I/O instructions can be unconditionally per-
numbered 0 through 3. Level 0 is the most privileged formed when CPL ~ 10PL. (The I/O instructions are
or trusted level. IN, OUT, INS, OUTS, REP INS, and REP OUTS.)
When CPL > 10PL, and the current task is associat-
ed with a 286 TSS, attempted I/O instructions cause
4.4.2 RULES OF PRIVILEGE
an exception 13 fault. When CPL > 10PL, and the
The Intel486 OX Microprocessor controls access to current task is associated with an Intel486 OX Micro-
both data and procedures between levels of a task, processor TSS, the I/O Permission Bitmap (part of
according to the following rules. an Intel486 OX Microprocessor TSS) is consulted on
whether I/O to the port is allowed, or an exception
• Oata stored in a segment with privilege level p
13 fault is to be generated instead. For diagrams of
can be accessed only by code executing at a
the I/O Permission Bitmap, refer to Figures 4.15a
privilege level at least as privileged as p.
and 4.15b. For further information on how the I/O
• A code segment/procedure with privilege level p Permission Bitmap is used in Protected Mode or in
can only be called by a task executing at the Virtual 8086 Mode, refer to Section 4.6.4 Protection
same or a lesser privilege level than p. and I/O Permission Bitmap.
4-12
31
0000000000000000
16
I
15
BACK LINK
o0 .J TSS BASE
ESPO 4
0000000000000000 SSO 8
I
ESPI C
STACKS
10 FOR
0000000000000000 I SSI CPL 0,1,2
ESP2 14
0000000000000000 SS2 18
I
CR3 lC
EIP 20
EFLAGS 24
EAX 28
ECX 2C
EOX 30
EBX 34
ESP 38
EBP 3C
CURRENT
ESI 40
TASK
44 STATE
EOI
0000000000000000 ES 48
0000000000000000 CS 4C
0000000000000000 SS 50
0000000000000000 OS 54
0000000000000000 FS 58
0000000000000000 GS 5C
60
o
0000000000000000 LDT
BIT _MAP _OFFSET( 15:0) 0000000000000000 64
~
IT
NOTE:
BIT-MAP_OFFSET
must be ,;; DFFFH
AVAILABLE
---
SYSTEM STATUS, ETC.
IN Int.1486OX CPU TSS
DEBUG
TRAP BIT
31 24 23 16 15 8 7 0
63 56 55 48 47 40 39 32 I 'BILMAP .OFFSET
95 88 87 80 79 72 71 64
.-------------.
I
I
I
I
ACCESS
RIGHTS
I TSS
LIMIT
I
I
I
I
f-
96 OFFSET
OFFSET
+C
+ 10
I ~
I
I
I
BASE l, I
I/o PERMISSION BITMAP ~
65407 (ONE BIT PER BYTE I/o OFFSET + 1FEC

'31 PROGRAM 0 '
I I PORT. BITMAP MAY BE
I INVISIBLE I 65439 OFFSET + 1FFO
.... _ - - - - - _ _ _ _ - ... 01 TRUNCATED USING TSS LIMIT.)
TASK REGISTER 65471 I OFFSET + lFF4
I 65472 + 1FF8
t-
65503 OFFSET
TR SELECTOR
65535 I 65504 OFFSET + 1FFC
15 0 "FFH" OFFSET + 2000
t TSS LIIIIT = OFFSET + 2000H

31 Intol486 DX CPU TSS DESCRIPTOR (IN GDT) a
SEGMENT BASE 15 ... 0 SEGMENT LIMIT 15.. 0
BASE 31 .. 24IGI+101IL!~\~ pID~LH .TYrE • I

BASE
23 .. 16
241245-19
Type = 9: Available Intel486TM OX CPU TSS,
Type = B: Busy Intel486TM OX CPU TSS
Figure 4.15a.lntel486TM DX Microprocessor TSS and TSS Registers
4-13
31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
31 1 1 1 1 0 1 1 0 o 0 o 0 1 1 1 1 0 1 o 0 1 1 o 0 o 0 0 0 0 0 1 1
63 0 0 1 0 o 0 1 1 1 1 o 0 1 0 1 0 1 1 1 1 1 1 o 0 1 1 1 1 1 0 0 1
95 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1
127 0 0 0 0 o 0 o 0 o 0 o 0 000 o 0 o 0 o 0 000 o 0 0 0 0 0 o 0
1 1 1 1 1 1 1 1
't'. ole.
110 Ports Accessible: 2 ~ 9, 12, 13, 15, 20 ~ 24, 27, 33, 34, 40, 41, 48, 50, 52, 53, 58 ~ eo, 62, 63, 96 ~ 127 241245-20
Figure 4.15b. Sample 110 Permission Bit Map
Table 4.2. Pointer Test Instructions 4.4.3.4 Privilege Validation

Instruction Operands Function The Intel486 OX microprocessor provides several in-
ARPL Selector, Adjust Requested Privi- structions to speed pointer testing and help maintain
Register lege Level: adjusts the system integrity by verifying that the selector value
RPL of the selector to the refers to an appropriate segment. Table 4.2 summa-
numeric maximum of rizes the selector validation procedures available for
current selector RPL value the Intel486 OX microprocessor.
and the RPL value in the
register. Set zero flag if This pointer verification prevents the common prob-
selector RPL was lem of an application at PL = 3 calling a operating
changed. systems routine at PL = 0 and passing the operat-
ing system routine a "bad" pointer which corrupts a
VERR Selector VERify for Read: sets the data structure belonging to the operating system. If
zero flag if the segment the operating system routine uses the ARPL instruc-
referred to by the selector tion to ensure that the RPL of the selector has no
can be read. greater privilege than that of the caller, then this
VERW Selector VERify for Write: sets the problem can be avoided.
zero flag if the segment
referred to by the selector 4.4.3.5 Descriptor Access
can be written.
There are basically two types of segment accesses:
LSL Register, Load Segment Limit: reads
those involving code segments such as control
Selector the segment limit into the transfers, and those involving data accesses. Oeter-
register if privilege rules mining the ability of a task to access a segment in-
and descriptor type allow. volves the type of segment to be accessed, the in-
Set zero flag if successful. struction used, the type of descriptor used and CPL,
LAR Register, Load Access Rights: reads RPL, and OPL as described above.
Selector the descriptor access
rights byte into the register Any time an instruction loads data segment registers
if privilege rules allow. Set (OS, ES, FS, GS) the Intel486 DX microprocessor
zero flag if successful. makes protection validation checks. Selectors load-
ed in the OS, ES, FS, GS registers must refer only to
data segments or readable code segments. The
The 110 privilege level (IOPL) also affects whether data access rules are specified in Section 4.4.2
several other instructions can be executed or cause Rules of Privilege. The only exception to those
an exception 13 fault instead. These instructions are rules is readable conforming code segments which
called "IOPL-sensitive" instructions and they are can be accessed at any privilege level.
CLI and STI. (Note that the LOCK prefix is not 10PL-
sensitive on the Intel486 microprocessor.) Finally the privilege validation checks are performed.
The CPL is compared to the EPL and if the EPL is
The 10PL also affects whether the IF (interrupts en- more privileged than the CPL an exception 13 (gen-
able flag) bit can be changed by loading a value into eral protection fault) is generated.
the EFLAGS register. When CPL !S: 10PL, then the
IF bit can be changed by loading a new value into The rules regarding the stack segment are slightly
the EFLAGS register. When CPL > 10PL, the IF bit different than those involving data segments. In-
cannot be changed by a new value POP'ed into (or structions that load selectors into SS must refer to
otherWise loaded into) the EFLAGS register; the IF data segment descriptors for writeable data seg-
bit merely remains unchanged and no exceptIon is
generated.
4-14
infel~ Intel486™ DX2 MICROPROCESSOR
ments. The OPL and RPL must equal the CPL. All - CALLs can be made to a non-conforming code
other descriptor types or a privilege level violation segment with the same privilege or via a gate to a
will cause exception 13. A stack not present fault more privileged level.
causes exception 12. Note that an exception 11 is - Interrupts handled within the task obey the same
used for a not-present code or data segment. privilege rules as CALLs.
- Conforming Code segments are accessible by
4.4.4 PRIVILEGE LEVEL TRANSFERS privilege levels which are the same or less privi-
leged than the conforming-code segment's OPL.
Inter-segment control transfers occur when a selec-
- Both the requested privilege level (RPL) in the
tor is loaded in the CS register. For a typical system
most of these transfers are simply the result of a call selector pointing to the gate and the task's CPL
must be of equal or greater privilege than the
or a jump to another routine. There are five types of
gate's OPL.
control transfers which are summarized in Table 4.3.
Many of these transfers result in a privilege level - The code segment selected in the gate must be
transfer. Changing privilege levels is done only via the same or more privileged than the task's CPL.
control transfers, by using gates, task switches, and - Return instructions that do not switch tasks can
interrupt or trap gates. only return control to a code segment with same
or less privilege.
Control transfers can only occur if the operation
- Task switches can be performed by a CALL,
which loaded the selector references the correct de-
scriptor type. Any violation of these descriptor usage JMP, or INT which references either a task gate
or task state segment who's DPL is less privi-
rules will cause an exception 13 (e.g. JMP through a
call gate, or IRET from a normal subroutine call). leged or the same privilege as the old task's CPL.
Any control transfer that changes CPL within a task

In order to provide further system security, all control
causes a change of stacks as a result of the privi-
transfers are also subject to the privilege rules.
lege level change. The initial values of SS:ESP for
privilege levels 0, 1, and 2 are retained in the task
The privilege rules require that:
state segment (see Section 4.4.6 Task Switching).
- Privilege level transitions can only occur via During a JMP or CALL control transfer, the new
gates. stack pointer is loaded into the SS and ESP regis-
- JMPs can be made to a non-conforming code ters and the previous stack pointer is pushed onto
segment with the same privilege or to a conform- the new stack.
ing code segment with greater or equal privilege.
Table 4.3. Descriptor Types Used for Control Transfer

Descriptor Descriptor
Control Transfer Types Operation Types
Referenced Table
Intersegment within the same privilege level JMP, CALL, RET, IRET' Code Segment GOT/LOT
Intersegment to the same or higher privilege level CALL Call Gate GOT/LOT
Interrupt within task may change CPL
Interrupt Instruction, Trap or lOT
Exception, External Interrupt
Interrupt Gate
Intersegment to a lower privilege level RET,IRET' Code Segment GOT/LOT
(changes task CPL)
CALL,JMP Task State GDT
Segment
CALL,JMP Task Gate GDT/LOT
Task Switch
IRET" Task Gate lOT
Interrupt Instruction,
Exception, External
Interrupt
'NT (Nested Task bit of flag register) = 0
"NT (Nested Task bit of flag register) = 1
4-15
When RETurning to the original privilege level, use between tasks or processes. The Intel486 OX micro-
of the lower-privileged stack is restored as part of processor directly supports this operation by provid-
the RET or IRET instruction operation. For subrou- ing a task switch instruction in hardware. The In-
tine calls that pass parameters on the stack and tel486 OX microprocessor task switch operation
cross privilege levels, a fixed number of words (as saves the entire state of the machine (all of the reg-
specified in the gate's word count field) are copied isters, address space, and a link to the previous
from the previous stack to the current stack. The task), loads a new execution state, performs protec-
inter-segment RET instruction with a stack adjust- tion checks, and commences execution in the new
ment value will correctly restore the previous stack task, in about 10 microseconds. Like transfer of con-
pointer upon return. trol via gates, the task switch operation is invoked by
executing an inter-segment JMP or CALL instruction
which refers to a Task State Segment (TSS), or a
4.4.5 CALL GATES
task gate descriptor in the GOT or LOT. An INT n
Gates provide protected, indirect CALLs. One of the instruction, exception, trap, or external interrupt may
major uses of gates is to provide a secure method of also invoke the task switch operation if there is a
privilege transfers within a task. Since the operating task gate descriptor in the associated lOT descriptor
system defines all of the gates in a system, it can slot.
ensure that all gates only allow entry into a few trust-
ed procedures (such as those which allocate memo- The TSS descriptor points to a segment (see Figure
ry, or perform I/O). 4.15) containing the entire Intel486 OX microproces-
sor execution state while a task gate descriptor con-
Gate descriptors follow the data access rules of priv- tains a TSS selector. The Intel486 OX microproces-
ilege; that is, gates can be accessed by a task if the sor supports both 80286 and Intel486 OX microproc-
EPL, is equal to or more privileged than the gate essor style TSSs. Figure 4.16 shows a 80286 TSS.
descriptor's OPL. Gates follow the control transfer The limit of an Intel486 OX microprocessor TSS
rules of privilege and therefore may only transfer must be greater than 0064H (002BH for a 80286
control to a more privileged level. TSS), and can be as large as 4 Gigabytes. In the
additional TSS space, the operating system is free
Call Gates are accessed via a CALL instruction and to store additional information such as the reason
are syntactically identical to calling a normal subrou- the task is inactive, time the task has spent running,
tine. When an inter-level Intel486 OX call gate is ac- and open files belong to the task.
tivated, the following actions occur.
1. Load CS:EIP from gate check for validity Each task must have a TSS associated with it. The
2. SS is pushed zero-extended to 32 bits current TSS is identified by a special register in the
Intel486 OX microprocessor called the Task State
3. ESP is pushed Segment Register (TR). This register contains a se-
4. Copy Word Count 32-bit parameters from the lector referring to the task state segment descriptor
old stack to the new stack that defines the current TSS. A hidden base and limit
5. Push Return address on stack register associated with TR are loaded whenever TR
is loaded with a new selector. Returning from a task
The procedure is identical for 80286 Call gates, ex- is accomplished by the IRET instruction. When IRET
cept that 16-bit parameters are copied and 16-bit is executed, control is returned to the task which
registers are pushed. was interrupted. The current executing task's state
is saved in the TSS and the old task state is restored
Interrupt Gates and Trap gates work in a similar from its TSS.
fashion as the call gates, except there is no copying
of parameters. The only difference between Trap Several bits in the flag register and machine status
and Interrupt gates is that control transfers through word (CRO) give information about the state of a
an Interrupt gate disable further interrupts (i.e. the IF task which are useful to the operating system. The
bit is set to 0), and Trap gates leave the interrupt Nested Task (NT) (bit 14 in EFLAGS) controls the
status unchanged. function of the IRET instruction. If NT = 0, the IRET
instruction performs the regular return; when NT =
1, IRET performs a task switch operation back to the
4.4.6 TASK SWITCHING
previous task. The NT bit is set or reset in the follow-
A very important attribute of any multi-tasking/multi- ing fashion:
user operating systems is its ability to rapidly switch
4-16
15 0 croprocessor switches tasks, it sets the TS bit. The

BACK LINK SELECTOR TO TSS o Intel486 OX Microprocessor detects the first use of a
SP FOR CPL 0
processor extension instruction after a task switch
and causes the processor extension not available
SS FOR CPL 0 4
exception 7. The exception handler for exception 7
SP FOR CPL 1 6 INITIAL
STACKS
may then decide whether to save the state of the
SS FOR CPL 1
FOR CPL 0, 1,2 FPU. A processor extension not present exception
SP FOR CPL 2 A (7) will occur when attempting to execute a Floating
SS FOR CPL 2 C Point or WAIT instruction if the Task Switched and
IP (ENTRY POINT) Monitor coprocessor extension bits are both set (Le.
FLAGS 10 TS = 1 and MP = 1).
AX 12
CX 14
The T bit in the Intel486 OX Microprocessor TSS
indicates that the processor should generate a de-
OX 16
bug exception when switching to a task. If T = 1
ax 18
then upon entry to a new task a debug exception 1
CURRENT
SP 1A TASK will be generated.
BP IC STATE
SI IE
4.4.7 INITIALIZATION AND TRANSITION TO
01 20
PROTECTED MODE
ES SELECTOR 22
CS SELECTOR 24 Since the Intel486 OX Microprocessor begins exe-

SS SELECTOR 26 cuting in Real Mode immediately after RESET it is
OS SELECTOR 28 necessary to initialize the system tables and regis-
TASK'S LOT SELECTOR 2A
ters with the appropriate values.
AVAILABLE
The GOT and lOT registers must refer to a valid GOT
241245-21 and lOT. The lOT should be at least 256 bytes long,
and GOT must contain descriptors for the initial
Figure 4.16. 80286 TSS code, and data segments. Figure 4.17 shows the ta-
bles and Figure 4.18 the descriptors needed for a
When a CALL or INT instruction initiates a task simple Protected Mode Intel486 OX Microprocessor
switch, the new TSS will be marked busy and the system. It has a single code and single data/stack
back link field of the new TSS set to the old TSS segment each four gigabytes long and a single privi-
selector, The NT bit of the new task is set by CALL lege level PL = O.
or INT initiated task switches. An interrupt that does
not cause a task switch will clear NT. (The NT bit will The actual method of enabling Protected Mode is to
be restored after execution of the interrupt handler) load CRO with the PE bit set, via the MOV CRO, R/M
NT may also be set or cleared by POPF or IRET instruction. This puts the Intel486 OX Microproces-
instructions. sor in Protected Mode.
The Intel486 OX Microprocessor Task State Seg- After enabling Protected Mode, the next instruction
ment is marked busy by changing the descriptor type should execute an intersegment JMP to load the CS
field from TYPE 9H to TYPE BH. An 80286 TSS is register and flush the instruction decode queue. The
marked busy by changing the descriptor type field final step is to load all of the data segment registers
from TYPE 1 to TYPE 3. Use of a selector that refer- with the initial selector values.
ences a busy task state segment causes an excep-
tion 13. An alternate approach to entering Protected Mode
which is especially appropriate for multi-tasking op-
The Virtual Mode (VM) bit 17 is used to indicate if a erating systems, is to use the built in task-switch to
task, is a virtual 8086 task. If VM = 1, then the tasks load all of the registers. In this case the GOT would
will use the Real Mode addressing mechanism. The contain two TSS descriptors in addition to the code
virtual 8086 environment is only entered and exited and data descriptors needed for the first task. The
via a task switch (see Section 4.6 Virtual Mode). first JMP instruction in Protected Mode would jump
to the TSS causing a task switch and loading all of
The FPU's state is not automatically saved when a the registers with the values stored in the TSS. The
task switch occurs, because the incoming task may Task State Segment Register should be initialized to
not use the FPU. The Task Switched (TS) Bit (bit 3 in point to a valid TSS descriptor since a task switch
the CRO) helps deal with the FPU's state in a multi- saves the state of the current task in a task state
tasking environment. Whenever the Intel486 OX Mi- segment.
4-17
3••1-R-E-SE-T-R-0-UT-IN-E-S.....::0 FFFFFFFF
15 0
~';';;;;;~;;;;:':'::':':;;:""-I FFFFFFFO
ss~ INITIALIZATION
ROUTINES
GS~
CS
GDTR ~;,;.;.;~;;;;;;.:..,
00000118]
t--"';';';';";;;;;";"~-I 00000110
t-~"';';;;';;;';;';";';;;';"'-I 00000108 GOT
'\....o......~~;;;;;;.;.;.;;.;;...-I 00000100
IDTR
......---....,;...;;.;.., INTERRUPT +
lOT
DESCRIPTORS (32)
'-<0-'-_ _ _ _ _....
t
00000000
241245-22
Figure 4.17. Simple Protected System
LIMIT
2
BASE 31 ... 24 G D 0
0 19.16 1 001 o 0 1
o BASE 23 ... 16
00 (H) 1 1 00 (H)
F(H)
DATA SEGMENT BASE 15 ... 0 SEGMENT LIMIT 15 ... 0
DESCRIPTOR 0118 (H) FFFF(H)
LIMIT
1
BASE 31 ... 24 G D
0 0 19.16 1 o 0 1 1 o 1
o BASE23 ... 16
00 (H) 1 1 00 (H)
F(H)
CODE SEGMENT BASE 15 ... 0 SEGMENT LIMIT 15 ... 0
DESCRIPTOR 0118 (H) FFFF(H)
NULL DESCRIPTOR
0
31 24 16 15 8 0
Figure 4.18. GOT Descriptors for Simple System
4.4.8 TOOLS FOR BUILDING PROTECTED 4.5 Paging

SYSTEMS
In order to simplify the design of a protected multi- 4.5.1 PAGING CONCEPTS

tasking system, Intel provides a tool which allows
Paging is another type of memory management
the system designer an easy method of constructing
useful for virtual memory multitasking operating sys-
the data structures needed for a Protected Mode
tems. Unlike segmentation which modularizes pro-
Intel486 DX microprocessor system. This tool is the
wam~ ~nd data into vari.able length segments, pag-
builder BLD-386™. BLD-386 lets the operating sys-
tem writer specify all of the segment descriptors dis- Ing divides programs Into multiple uniform size
pages. Pages bear no direct relation to the logical
cussed in the previous sections (LDTs, IDTs, GDTs,
Gates, and TSSs) in a high-level language.
4-18
structure of a program. While segment selectors can 4.5.2.2 Page Descriptor Base Register
be considered the logical "name" of a program
module or data structure, a page most likely corre- CR2 is the Page Fault Linear Address register. It
sponds to only a portion of a module or data struc- holds the 32-bit linear address which caused the last
ture. page fault detected.
By taking advantage of the locality of reference dis- CR3 is the Page Directory Physical Base Address
played by most programs, only a small number of Register. It contains the physical starting address of
pages from each active task need be in memory at the Page Directory. The lower 12 bits of CR3 are
anyone moment. always zero to ensure that the Page Directory is al-
ways page aligned. Loading it via a MOV CR3, reg
instruction causes the Page Table Entry cache to be
4.5.2 PAGING ORGANIZATION flushed, as will a task switch through a TSS which
changes the value of CRO. (See 4.5.5 Translation
4.5.2.1 Page Mechanism Lookaside Buffer).
The Intel486 DX Microprocessor uses two levels of

tables to translate the linear address (from the seg- 4.5.2.3 Page Directory
mentation unit) into a physical address. There are
three components to the paging mechanism of the The Page Directory is 4 Kbytes long and allows up to
Intel486 DX Microprocessor: the page directory, the 1024 Page Directory Entries. Each Page Directory
Entry contains the address of the next level of ta-
page tables, and the page itself (page frame). All
memory-resident elements of the Intel486 DX Micro- bles, the Page Tables and information about the
page table. The contents of a Page Directory Entry
processor paging mechanism are the same size,
namely, 4 Kbytes. A uniform size for all of the ele- are shown in Figure 4.20. The upper 10 bits of the
ments simplifies memory allocation and reallocation linear address (A22-A31) are used as an index to
select the correct Page Directory Entry.
schemes, since there is no problem with memory
fragmentation. Figure 4.19 shows how the paging
mechanism works.
TWO LEVEL PAGING SCHEME

31 22 12 0
LINEAR
~ DIRECTORY I TABLE I OFFSET I USER
MEMORY
ADDRESS I 12
10 lot
CRO
31
Intel486 OX CPU
I
0
31
'f
31
'f ADDRESS
t f-+
CRl
PAGE TABLE
CR2
CR3 ROOT
DIRECTORY
CONTROL REGISTERS
241245-23
Figure 4.19. Paging Mechanism
31 12 11 10 9 8 7 6 5 4 3 2 1 0
OS P P U R
PAGE TABLE ADDRESS 31..12 RESERVED 0 0 D A C W - - P
D T S W
Figure 4.20. Page Directory Entry (Points to Page Table)
4-19
31 12 11 10 9 8 7 6 5 4 3 2 1 0
OS P P U R
PAGE FRAME ADDRESS 31 .. 12 RESERVED 0 0 0 A C W - - P
0 T S W
Figure 4.21. Page Table Entry (Points to Page)
4.5.2.4 Page Tables The (User/Supervisor) U/S bit 2 and the (Read/
Write) R/W bit 1 are used to provide protection attri-
Each Page Table is 4 Kbytes and holds up to 1024 butes for individual pages.
Page Table Entries. Page Table Entries contain the
starting address of the page frame and statistical
information about the page (see Figure 4.21). Ad- 4.5.3 PAGE LEVEL PROTECTION
dress bits A 12-A21 are used as an index to select (R/W, U/S BITS)
one of the 1024 Page Table Entries. The 20 upper-
The Intel486 OX microprocessor provides a set of
bit page frame address is concatenated with the
protection attributes for paging systems. The paging
lower 12 bits of the linear address to form the physi-
mechanism distinguishes between two levels of pro-
cal address. Page tables can be shared between
tection: User which corresponds to level 3 of the
tasks and swapped to disks.
segmentation based protection, and supervisor
which encompasses all of the other protection levels
4.5.2.5 Page Directory/Table Entries (0,1,2).
The lower 12 bits of the Page Table Entries and The R/W and U/S bits are used in conjunction with
Page Directory Entries contain statistical information the WP bit in the flags register (EFLAGS). The In-
about pages and page tables respectively. The P tel386 microprocessor does not contain the WP bit.
(Present) bit 0 indicates if a Page Directory or Page The WP bit has been added to the Intel486 OX mi-
Table entry can be used in address translation. If croprocessor to protect read-only pages from super-
P = 1 the entry can be used for address translation visor write accesses. The Intel386 microprocessor
if P = 0 the entry can not be used for translation, allows a read-only page to be written from protection
and all of the other bits are available for use by the levels 0, 1 or 2. WP = 0 is the Intel386 microproces-
software. For example the remaining 31 bits could sor compatible mode. When WP = 0 the supervisor
be used to indicate where on the disk the page is can write to a read-only page as defined by the U/S
stored. and R/W bits. When WP = 1 supervisor access to a
read-only page (R/W = 0) will cause a page fault (ex-
The A (Accessed) bit 5, is set by the Intel486 OX ception 14).
microprocessor for both types of entries before a
read or write access occurs to an address covered Table 4.4 shows the affect of the WP, UlS and R/W
by the entry. The D (Dirty) bit 6 is set to 1 before a bits on accessing memory. When WP = 0, the super-
write to an address covered by that page table entry visor can write to pages regardless of the state of
occurs. The 0 bit is undefined for Page Directory the R/W bit. When WP = 1 and R/W = 0 the supervi-
Entries. When the P, A and 0 bits are updated by the sor cannot write to a read-only page. A user attempt
Intel486 OX microprocessor, the processor gener- to access a supervisor only page (U/S = 0), or write
ates a Read-Modify-Write cycle which locks the bus to a read only page will cause a page fault (excep-
and prevents conflicts with other processors or per- tion 14).
pherials. Software which modifies these bits should
use the LOCK prefix to ensure the integrity of the The R/W and U/S bits provide protection from user
page tables in multi-master systems. access on a page by page basis since the bits are
contained in the Page Table Entry and the Page Di-
The 3 bits marked OS Reserved in Figure 4.20 and rectory Table. The U/S and R/W bits in the first level
Figure 4.21 (bits 9-11) are software definable. OSs Page Directory Table apply to all entries in the page
are free to use these bits for whatever purpose they table pointed to by that directory entry. The U/S and
wish. An example use of the OS Reserved bits R/W bits in the second level Page Table Entry apply
would be to store information about page aging. By only to the page described by that entry. The most
keeping track of how long a page has been in mem- restrictive of the U/S and R/W bits from the Page
ory since being accessed, an operating system can Directory Table and the Page Table Entry are used
implement a page replacement algorithm like Least to address a page.
Recently Used.
Example: If the UlS and R/W bits for the Page Di-
rectory entry were 10 (user read/execute) and the
4-20
U/S and R/W bits for the Page Table Entry were 01 When paging is enabled (PG = 1 in CRO), the bits
(no user access at all), the access rights for the from the page table entry are cached in the transla-
page would be 01, the numerically smaller of the tion lookaside buffer (TLB), and are driven any time
two. the page mapped by the TLB entry is referenced.
For normal memory cycles run with paging enabled,
Note that a given segment can be easily made read- the PWT and PCD bits are taken from the Page Ta-
only for level 0, 1 or 2 via use of segmented protec- ble Entry. During TLB refresh cycles when the Page
tion mechanisms. (Section 4.4 Protection). Directory and Page Table entries are read, the PWT
and PCD bits must be obtained elsewhere. The bits
are taken from CR3 when a Page Directory Entry is
4.5.4 PAGE CACHEABILITY being read. The bits are taken from the Page Direc-
(PWT AND PCD BITS) tory Entry when the Page Table Entry is being updat-
PWT (page write through) and PCD (page cache dis- ed.
able) are two new bits defined in entries in both lev-
The PCD or PWT bits in CR3 are initialized to zero at
els of the page table structure, the Page Directory
reset, but can be set to any value by level 0 soft-
Table and the Page Table Entry. PCD and PWT con-
ware.
trol page cacheability and write policy.
PWT controls write policy. PWT = 1 defines a write- 4.5.5 TRANSLATION LOOKASIDE BUFFER
through policy for the current page. PWT = 0 allows
the possibility of write~back. PWT is ignored internal- The Intel486 OX Microprocessor paging hardware is
ly because the Intel486 OX microprocessor has a designed to support demand paged virtual memory
write-through cache. PWT can be used to control systems. However, performance would degrade
the write policy of a second level cache. substantially if the processor was required to access
two levels of tables for every memory reference. To
PCD controls cacheability. PCD=O enables caching solve this problem, the Intel486 OX Microprocessor
in the on-chip cache. PCD alone does not enable keeps a cache of the most recently accessed pages,
caching, it must be conditioned by the KEN# (cache this cache is called the Translation Lookaside Buffer
enable) input signal and the state of the CD (cache (TLB). The TLBjs a four-way set associative 32-en-
disable bit) and NW (no write-through) bits in control try page table cache. It automatically keeps the most
register 0 (CRO). When PCD = 1, caching is disabled commonly used Page Table Entries in the proces-
regardless of the state of KEN#, CD and NW. (See sor. The 32-entry TLB coupled with a 4K page size,
Section 5.0, On-Chip Cache). results in coverage of 128 Kbytes of memory ad-
dresses. For many common multi-tasking systems,
The state of the PCD and PWT bits are driven out on the TLB will have a hit rate of about 98%. This
the PCD and PWT pins during a memory access. means that the processor will only have to access
the two-level page structure on 2% of all memory
The PWT and PCD bits for a bus cycle are obtained references. Figure 4.22 illustrates how the TLB com-
either from control register3 (CR3), the Page Direc- plements the Intel486 OX Microprocessor's paging
tory Entry or the Page Table Entry, depending on the mechanism.
type of cycle run. However, when paging is disabled
(PG = 0 in CRO) or for cycles which bypass paging Reading a new entry into the TlB (TLB refresh) is a
(i.e., I/O (input/output) references, INTR (interrupt two step process handled by the Inte1486>DX micro-
request) and HALT cycles), the PCD and PWT bits processor hardware. The sequence of data cycles to
of CR3 are ignored. The Intel486 OX CPU assumes perform a TLB refresh are:
PCD = 0 and PWT = 0 and drives these values on
the PCD and PWT pins.
Table 4.4. Page Level Protection Attributes

U/S R/W WP User Access Supervisor Access
0 0 0 None Read/Write/Execute
0 1 0 None Read/Write/Execute
1 0 0 Read/Execute Read/Write/Execute
1 1 0 Read/Write/Execute Read/Write/Execute
0 0 1. None Read/Execute
0 1 None Read/Write/Execute
0 Read/Execute Read/Execute
Read/Write/Execute Read/Write/Execute
4-21
1. Read the correct Page Directory Entry, as point- However, if the page table entry is not in the TLB,
ed to by the page base register and the upper the Intel486 OX Microprocessor will read the appro-
10 bits of the linear address. The page base priate Page Directory Entry. If P = 1 on the Page
register is in control register 3. Directory Entry indicating that the page table is in
1a. Optionally perform a locked read/write to set memory, then the Intel486 OX Microprocessor will
the accessed bit in the directory entry. The di- read the appropriate Page Table Entry and set the
rectory entry will actually get read twice if the Access bit. If P = 1 on the Page Table Entry indicat-
Intel486 OX microprocessor needs to set any of ing that the page is in memory, the Intel486 OX Mi-
the bits in the entry. If the page directory entry croprocessor will update the Access and Dirty bits
changes between the first and second reads, as needed and fetch the operand. The upper 20 bits
the data returned for the second read will be of the linear address, read from the page table, will
used. be stored in the TLB for future accesses. However, if
P = 0 for either the Page Directory Entry or the
2. Read the correct entry in the Page Table and Page Table Entry, then the processor will generate a
place the entry in the TLB. page fault, an Exception 14.
2a. Optionally perform a locked read/write to set
the accessed and/or dirty bit in the page table The processor will also generate an exception 14
entry. Again, note that the page table entry will page fault, if the memory reference violated the
actually get read twice if the Intel486 OX micro- page protection attributes (Le., U/S or R/W) (e.g.,
processor needs to set any of the bits in the trying to write to a read-only page). CR2 will hold the
entry. Like the directory entry, if the data chang- linear address which caused the page fault. If a sec-
es between the first and second read the data ond page fault occurs, while the processor is at-
returned for the second read will be used. tempting to enter the service routine for the first,
then the processor will invoke the page fault (excep-
Note that the directory entry must always be read tion 14) handler a second time, rather than the dou-
into the processor, since directory entries are never ble fault (exception 8) handler. Since Exception 14 is
placed in the paging TLB. Page faults can be sig- classified as a fault, CS: EIP will point to the instruc-
naled from either the page directory read or the tion causing the page fault. The 16-bit error code
page table read. Page directory and page table en- pushed as part of the page fault handler will contain
tries may be placed in the Intel486 OX on-chip status bits which indicate the cause of the page
cache just like normal data. fault.
4.5.6 PAGING OPERATION The 16-bit error code is used by the operating sys-
tem to determine how to handle the page fault. Fig-
32 ENTRIES
PHYSICAL ure 4.23a shows the format of the page-fault error
TRANSLATION
MEMORY code and the interpretation of the bits.
~I~~::SS-- LOOKASIDE
BUFFER HIT
NOTE:
MISS Even though the bits in the error code (U/S, W/R,
31 0
and P) have similar names as the bits in the Page
Directory/Table Entries, the interpretation of the er-
ror code bits is different. Figure 4.23b indicates
-
4 LJ what type of access caused the page fault.
15 3 2 1 0
PAGE
DIRECTORY
PAGE
TABLE
.98% HIT RATE
[u[u[u[u[u[u[u[u[u[u[u[u[u[u[~[~[p[
241245-24 Figure 4.23a. Page Fault Error Code Format
Figure 4.22. Translation Lookaside Buffer
U/S: The U/S bit indicates whether the access
The paging hardware operates in the following fash- causing the fault occurred when the processor was
ion. The paging unit hardware receives a 32-bit lin- executing in User Mode (U/S = 1) or in Supervisor
ear address from the segmentation unit. The upper mode (U/S = 0).
20 linear address bits are compared with all 32 en-
tries in the TLB to determine if there is a match. If W/R: The W/R bit indicates whether the access
there is a match (i.e., a TLB hit), then the 32-bit causing the fault was a Read (W/R = 0) or a Write
physical address is calculated and will be placed on (W/R = 1).
the address bus.
4-22
intel.. Intel486™ DX2 MICROPROCESSOR
P: The P bit indicates whether a page fault was anism. In particular, the Intel486 DX Microprocessor
caused by a not-present page (P = 0), or by a page allows the simultaneous execution of 8086 operating
level protection violation (P = 1). systems and its applications, and an Intel486 DX Mi-
croprocessor operating system and both 80286 and
U: UNDEFINED Intel486 DX Microprocessor applications. Thus, in a
multi-user Intel486 DX Microprocessor computer,
one person could be running an MS-DOS spread-
U/S W/R Access Type
sheet, another person using MS-DOS, and a third
0 0 Supervisor* Read person could be running multiple Unix utilities and
0 1 Supervisor Write applications. Each person in this scenario would be-
1 0 User Read lieve that he had the computer completely to him-
self. Figure 4.24 illustrates this con~ept.
. 1
Descnptor table access
is executing at level 3.
1
WIll
User Write
fault WIth U/S ~ 0, even if the program
4.6.2 VIRTUAL 8086 MODE ADDRESSING
Figure 4.23b. Type of Access MECHANISM
Causing Page Fault
One of the major differences between Intel486 DX
Microprocessor Real and Protected modes is how
4.5.7 OPERATING SYSTEM RESPONSIBILITIES the segment selectors are interpreted. When the
processor is executing in Virtual 8086 Mode the seg-
The Intel486 DX Microprocessor takes care of the
ment registers are used in an identical fashion to
page address translation process, relieving the bur-
Real Mode. The contents of the segment register is
den from an operating system in a demand-paged
shifted left 4 bits and added to the offset to form the
system. The operating system is responsible for set-
segment base linear address.
ting up the initial ~age tables, and handling any page
faults. The operating system also is required to inval-
!he Intel486 DX Microprocessor allows the operat-
idate (Le., flush) the TLB when any changes are
Ing system to specify which programs use the 8086
made to any of the page table entries. The operating
style address mechanism, and which programs use
system must reload eR3 to cause the TLB to be
Protected Mode addressing, on a per task basis.
flushed.
Through the use of paging, the one megabyte ad-
dress space of the Virtual Mode task can be mapped
Setting. up the tables is simply a matter of loading
to anywhere in the 4 gigabyte linear address space
eR3 ~Ith the address of the Page Directory, and
of the Intel486 DX Microprocessor. Like Real Mode
Virtual Mode effective addresses (Le., segment off~
allocating space for the Page Directory and the
Page Tables. The primary responsibility of the oper-
sets) that exceed 64 Kbyte will cause an exception
ating system is to implement a swapping policy and
13. However, these restrictions should not prove to
handle all of the page faults.
be important, because most tasks running in Virtual
8086 Mode will simply be existing 8086 application
A final concern of the operating system is to ensure
programs.
that the TLB cache matches the information in the
paging tables. In particular, any time the operating
system sets the P present bit of page table entry to 4.6.3 PAGING IN VIRTUAL MODE
zero, the TLB must be flushed. Operating systems
may want to take advantage of the fact that eR3 is The paging hardware allows the concurrent running
stored as part of a TSS, to give every task or group of multiple Virtual Mode tasks, and provides protec-
of tasks its own set of page tables. tion a~d operating system isolation. Although it is
not strictly necessary to have the paging hardware
enabled to run Virtual Mode tasks, it is needed in
4.6 Virtual 8086 Environment order to run multiple Virtual Mode tasks or to relo-
cate the address space of a Virtual Mode task to
physical address space greater than one megabyte.
4.6.1 EXECUTING 8086 PROGRAMS
The Intel486 DX Microprocessor allows the execu- The paging hardware allows the 20-bit linear ad-
tion of 8086 application programs in both Real Mode dress produced by a Virtual Mode program to be
and in the Virtual 8086 Mode (Virtual Mode). Of the divided into up to 256 pages. Each one of the pages
two. methods, Virtual 8086 Mode offers the system can be located anywhere within the maximum 4 gig-
designer the most flexibility. The Virtual 8086 Mode abyte physical address space of the Intel486 DX Mi-
allows the execution of 8086 applications, while still croprocessor. In addition, since eR3 (the Page Di-
allowing the system designer to take full advantage rectory Base Register) is loaded by a task switch
of the Intel486 DX Microprocessor protection mech- each Virtual Mode task can use a different mapping
scheme to map pages to different physical locations.
4-23
Finally, the paging hardware allows the sharing of LIDT; MOV DRn,reg; MOV reg,DRn;
the 8086 operating system code between multiple LGDT; MOV TRn, reg; MOV reg,TRn;
8086 applications. Figure 4.24 shows how the In- LMSW; MOV CRn,reg; MOV reg,CRn.
tel486 OX Microprocessor paging hardware enables CLTS;
multiple 8086 programs to run under a virtual memo- HLT;
ry demand paged system.
Several instructions, particularly those applying to
the multitasking model and protection model, are
4.6.4 PROTECTION AND 1/0 PERMISSION available only in Protected Mode. Therefore, at-
BITMAP tempting to execute the following instructions in
All Virtual 8086 Mode programs execute at privilege Real Mode or in Virtual 8086 Mode generates an
level 3, the level of least privilege. As such, Virtual exception 6 fault:
8086 Mode programs are subject to all of the protec- LTR; STR;
tion checks defined in Protected Mode. (This is dif- LLDT; SLDT;
ferent from Real Mode which implicitly is executing LAR; VERR;
at privilege level 0, the level of greatest privilege.) LSL; VERW;
Thus, an attempt to execute a privileged instruction ARPL.
when in Virtual 8086 Mode will cause an exception
13 fault. The instructions which are IOPL-sensitive in Protect-
ed Mode are:
The following are privileged instructions, which may
be executed only at Privilege Level o. Therefore, at- IN; STI;
tempting to execute these instructions in Virtual OUT; CLI
8086 Mode (or anytime CPL > 0) causes an excep- INS;
tion 13 fault: OUTS;
REP INS;
REP OUTS;
PHYSICAL
MEMORY
~~~~~ 02000000(H)
VIRTUAL MODE
8086 TASK
OOOOOOOO(H)
PAGE DIRECTORY TASK 1 PAGE TASK 1 • 8086 OS

ROOT TABLE •
MEMORY MEMORY
VIRTUAL MODE PAGE DIRECTORY I?77J TASK 2 ~ Int.,386TW CPU OS

8086 TASK TASK 1 f{ll;I MEMORY ~ MEMORY
241245-25
Figure 4.24. Virtual 8086 Environment Memory Management
4-24
In Virtual 8086 Mode, a slightly different set of in- required, while allowing the fully general case if de-
structions are made 10PL-sensitive. The following in- sired.
structions are 10PL-sensitive in Virtual 8086 Mode:
INT n; STI; EXAMPLE OF BITMAP FOR 110 PORTS 0-255:
PUSHF; eLI; Setting the TSS limit to {biLMap_Offset + 31
POPF; IRET + 1"l [*' see note below] will allow a 32-byte bit-
map for the 110 ports #0-255, plus a terminator
The PUSHF, POPF, and IRET instructions are 10PL- byte of all 1's [ •• see note below]. This allows the
sensitive in Virtual 8086 Mode only. This provision 110 bitmap to control 110 Permission to 110 port 0-
allows the IF flag (interrupt enable flag) to be virtual- 255 while causing an exception 13 fault on attempt-
ized to the Virtual 8086 Mode program. The INT n ed 110 to any 110 port 80256 through 65,565.
software interrupt instruction is also 10PL-sensitive
in Virtual 8086 Mode. Note, however, that the INT 3 "IMPORTANT IMPLEMENTATION NOTE: Beyond
(opcode OCCH), INTO, and BOUND instructions are the last byte of 110 mapping information in the 110
not 10PL-sensitive in Virtual 8086 mode (they aren't Permission Bitmap must be a byte containing all 1'so
10PL sensitive in Protected Mode either). The byte of all 1's must be within the limit of the
Intel486 microprocessor TSS segment (see Figure
Note that the JlO instructions (IN, OUT, INS, OUTS, 4.15a).
REP INS, and REP OUTS) are not 10PL-sensitive in
Virtual 8086 mode. Rather, the 110 instructions be- 4.6.5 INTERRUPT HANDLING
come automatically sensitive to the 1/0 Permission
Bitmap contained in the Intel486 DX Microproces- In order to fully support the emulation of an 8086
sor Task State Segment. The 110 Permission Bit- machine, interrupts in Virtual 8086 Mode are han-
map, automatically used by the Intel486 DX micro- dled in a unique fashion. When running in Virtual
processor in Virtual 8086 Mode, is illustrated by Fig- Mode all interrupts and exceptions involve a privi-
ures 4.15a and 4.15b. lege change back to the host Intel486 DX micro-
processor operating system. The Intel486 DX micro-
The 110 Permission Bitmap can be viewed as a 0- processor operating system determines if the inter-
64 Kbit bit string, which begins in memory at offset rupt comes from a Protected Mode application or
BiLMap_Offset in the current TSS. BiLMap_ from a Virtual Mode program by examining the VM
Offset must be :s:: DFFFH so the entire bit map and bit in the EFLAGS image stored on the stack.
the byte FFH which follows the bit map are all at
offsets :s:: FFFFH from the TSS base. The 16-bit When a Virtual Mode program is interrupted and ex-
pointer BiLMap_Offset (15:0) is found in the word ecution passes to the interrupt routine at level 0, the
beginning at offset 66H (102 decimal) from the TSS VM bit is cleared. However, the VM bit is still set in
base, as shown in Figure 4.15a. the EFLAG image on the stack.
Each bit in the 110 Permission Bitmap corresponds The Intel486 DX operating system in turn handles
to a single byte-wide 110 port, as illustrated in Figure the exception or interrupt and then returns control to
4.15a. If a bit is 0, 110 to the corresponding byte- the 8086 program. The Intel486 DX operating sys-
wide port can occur without generating an excep- tem may choose to let the 8086 operating system
tion. Otherwise the 110 instruction causes an excep- handle the interrupt or it may emUlate the function of
tion 13 fault. Since every byte~wide 110 port must be the interrupt handler. For example, many 8086 oper-
protectable, all bits corresponding to a word-wide or ating system calls are accessed by PUSHing param-
dword-wide port must be 0 for the word-wide or eters on the stack, and then executing an INT n in-
dword-wide 110 to be permitted. If all the referenced struction. If the 10PL is set to 0 then alllNT n instruc-
bits are 0, the 110 will be allowed. If any referenced tions will be intercepted by the Intel486 DX operat-
bits are 1, the attempted 110 will cause an exception ing system. The Intel486 DX operating system could
13 fault. emUlate the 8086 operating system's call. Figure
4.25 shows how the Intel486 DX operating system
Due to the use of a pointer to the base of the 110 could intercept an 8086 operating system's calJ to
Permission Bitmap, the bitmap may be located any- "Open a File".
where within the TSS, or may be ignored completely
by pointing the BiLMap_Offset (15:0) beyond the A Intel486 DX operating system can provide a Virtu-
limit of the TSS segment. In the same manner, only al 8086 Environment which is totally transparent to
a small portion of the 64K 110 space need have an the application software via intercepting and then
associated map bit, by adjusting the TSS limit to emulating 8086 operating system's calls, and inter-
truncate the bitmap. This eliminates the commitment cepting IN and OUT instructions.
of 8K of memory when a complete bitmap is not
4-25
4.6.6 ENTERING AND LEAVING VIRTUAL The segment registers in the TSS will contain 8086
8086 MODE segment base values rather than selectors.
Virtual 8086 mode is entered by executing an IRET A task switch into a task described by a Intel486 OX
instruction (at CPL = 0), or Task Switch (at any CPL) TSS will have an additional check to determine if the
to a Intel486 OX task whose Intel486 OX TSS has a incoming task should be resumed in virtual 8086
FLAGS image containing a 1 in the VM bit position mode. Tasks described by 80286 format TSSs can-
while the processor is executing in Protected Mode. not be resumed in virtual 8086 mode, so no check is
That is, one way to enter Virtual 8086 mode is to required there (the FLAGS image in 80286 format
switch to a task with a Intel486 OX TSS that has a 1 TSS has only the low order 16 FLAGS bits). Before
in the VM bit in the EFLAGS image. The other way is loading the segment register images from a Intel486
to execute a 32-bit IRET instruction at privilege level OX TSS, the FLAGS image is loaded, so that the
0, where the stack has a 1 in the VM bit in the segment registers are loaded from the TSS image
EFLAGS image. POPF does not affect the VM bit, as 8086 segment base values. The task is now
even if the processor is in Protected Mode or level 0, ready to resume in virtual 8086 execution mode.
and so cannot be used to enter Virtual 8086 Mode.
PUSHF always pushes a 0 in the VM bit, even if the
processor is in Virtual 8086 Mode, so that a program 4.6.6.2 Transitions Through Trap and Interrupt
cannot tell if it is executing in REAL mode, or in Vir- Gates, and IRET
tual 8086 mode. A task switch is one way to enter or exit virtual 8086
mode. The other method is to exit through a Trap or
The VM bit can be set by executing an IRET instruc- Interrupt gate, as part of handling an interrupt. and
tion only at privilege level 0, or by any instruction or to enter as part of executing an IRET instruction.
Interrupt which causes a task switch in Protected The transition out must use a Intel486 OX Micro-
Mode (with VM = 1 in the new FLAGS image), and processor Trap Gate (Type 14), or Intel486 OX Inter-
can be cleared only by an interrupt or exception in rupt Gate (Type 15), which must pOint to a non-con-
Virtual 8086 Mode. IRET and POPF instructions exe- forming level 0 segment (OPL = 0) in order to permit
cuted in REAL mode or Virtual 8086 mode will not the trap handler to IRET back to the Virtual 8086
change the value in the VM bit. program. The Gate must point to a non-conforming
level 0 segment to perform a level switch to level 0
The transition out of virtual 8086 mode to Intel486 so that the matching IRET can change the VM bit.
OX protected mode occurs only on receipt of an in- Intel486 OX gates must be used, since 80286 gates
terrupt or exception (such as due to a sensitive in- save only the low 16 bits of the FLAGS register, so
struction). In Virtual 8086 mode, all interrupts and that the VM bit will not be saved on transitions
exceptions vector through the protected mode lOT, through the 80286 gates. Also, the 16-bit IRET (pre-
and enter an interrupt handler in protected Intel486 sumably) used to terminate the 80286 interrupt han-
OX mode. That is, as part of interrupt processing, dier will pop only the lower 16 bits from FLAGS, and
the VM bit is cleared. will not affect the VM bit. The action taken for a
Intel486 OX Trap or Interrupt gate if an interrupt oc-
Because the matching IRET must occur from level 0, curs while the task is executing in virtual 8086 mode
if an Interrupt or Trap Gate is used to field an inter- is given by the following sequence.
rupt or exception out of Virtual 8086 mode, the Gate
must perform an inter-level interrupt only to level O. (1) Save the FLAGS register in a temp to push later.
Interrupt or Trap Gates through conforming seg- Turn off the VM and TF bits, and if the interrupt
ments, or through segments with OPL> 0, will raise a is serviced by an Interrupt Gate, turn off IF also.
GP fault with the CS selector as the error code. (2) Interrupt and Trap gates must perform a level
switch from 3 (where the VM86 program exe-
cutes) to level 0 (so IRET can return). This pro-
4.6.6.1 Task Switches To/From Virtual cess involves a stack switch to the stack given
8086 Mode in the TSS for privilege level O. Save the Virtual
Tasks which can execute in virtual 8086 mode must 8086 Mode SS and ESP registers to push in a
be described by a TSS with the Intel486 OX Micro- later step. The segment register load of SS will
processor format (TYPE 9 or 11 descriptor). be done as a Protected Mode segment load,
since the VM bit was turned off above.
A task switch out of virtual 8086 mode will operate
exactly the same as any other task switch out of a
task with an Intel486 OX TSS. All of the programmer
visible state, including the FLAGS register with the
VM bit set to 1, is stored in the TSS.
4-26
intet Intel486™ DX2 MICROPROCESSOR
241245-26
8086 Application makes "Open File Call" -> causes
General Protection Fault (Arrow # 1)
Virtual 8086 Monitor intercepts call. Calls Intel486TM OX as (Arrow # 2)
Intel486™ OX as opens file returns control to 8086as (Arrow # 3)
8086 as returns control to application. (Arrow #4)
Transparent to Application
Figure 4.25. Virtual 8086 Environment Interrupt and Call Handling
(3) Push the 8086 segment register values onto the with null (0) selectors before entering the interrupt
new stack, in the order: GS, FS, OS, ES. These handler. This will permit the handler to safely save
are pushed as 32-bit quantities, with undefined and restore the OS, ES, FS, and GS registers as
values in the upper 16 bits. Then load these 4 80286 selectors. This is needed so that interrupt
registers with null selectors (0). handlers which don't care about the mode of the
(4) Push the old 8086 stack pointer onto the new interrupted program can use the same prolog and
stack by pushing the SS register (as 32-bits, high epilog code for state saving (i.e., push all registers in
bits undefined), then pushing the 32-bit ESP reg- prolog, pop all in epilog) regardless of whether or not
ister saved above. a "native" mode or Virtual 8086 mode program was
interrupted. Restoring null selectors to these regis-
(5) Push the 32-bit FLAGS register saved in step 1. ters before executing the IRET will not cause a trap
(6) Push the old 8086 instruction pointer onto the in the interrupt handler. Interrupt routines which ex-
new stack by pushing the CS register (as 32-bits, pect values in the segment registers, or return val-
high bits undefined), then pushing the 32-bit EIP ues in segment registers will have to obtain/return
register. values from the 8086 register images pushed onto
(7) Load up the new CS:EIP value from the interrupt the new stack. They will need to know the mode of
gate, and begin execution of the interrupt routine the interrupted program in order to know where to
in protected Intel486 OX Microprocessor mode. find/return segment registers, and also to know how
to interpret segment register values.
The transition out of virtual 8086 mode performs a
level change and stack switch, in addition to chang- The IRET instruction will perform the inverse of the
ing back to protected mode. In addition, all of the above sequence. Only the extended Intel486 OX
8086 segment register images are stored on the IRET instruction (operand size=32) can be used,
stack (behind the SS:ESP image), and then loaded and must be executed at level 0 to change the VM
bit to 1.
4-27
intel" Intel486TM DX2 MICROPROCESSOR
(1) If the NT bit in the FLAGs register is on, an inter- (5) If VM = 1, load segment registers ES, OS, FS,
task return is performed. The current state is and GS from memory locations SS:[ESP+S],
stored in the current TSS, and the link field in the SS:[ESP+ 12], SS:[ESP+ 16], and
current TSS is used to locate the TSS for the SS:[ESP+ 20], respectively, where the new val-
interrupted task which is to be resumed. ue of ESP stored in step 4 is used. Since VM = 1,
Otherwise, continue with the following se- these are done as SOS6 segment register loads.
quence. Else if VM = 0, check that the selectors in ES,
(2) Read the FLAGS image from SS:S [ESP] into the OS, FS, and GS are valid in the interrupted rou-
FLAGS register. This will set VM to the value tine. Null out invalid selectors to trap if an at-
active in the interrupted routine. tempt is made to access through them.
(3) Pop off the instruction pointer CS:EIP. EIP is (6) If (RPL(CS) > CPL), pop the stack pointer
popped first, then a 32-bit word is popped which SS:ESP from the stack. The ESP register is
contains the CS value in the lower 16 bits. If popped first, followed by 32-bits containing SS in
VM=O, this CS load is done as a protected the lower 16 bits. If VM = 0, SS is loaded as a
mode segment load. If VM = 1, this will be done protected mode segment register load. If VM = 1,
as an SOS6 segment load. an SOS6 segment register load is used.
(4) Increment the ESP register by 4 to bypass the (7) Resume execution of the interrupted routine. The
FLAGS image which was "popped" in step 1. VM bit in the FLAGS register (restored from the
interrupt routine's stack image in step 1) deter-
mines whether the processor resumes the inter-
rupted routine in Protected mode of Virtual SOS6
mode.
4-2S
5.0 ON-CHIP CACHE

To meet its performance goals the Intel486 DX2 mi- 5.1 Cache Organization
croprocessor contains an eight Kbyte cache. The
cache is software transparent to maintain binary The on-chip cache is a unified code and data cache.
compatibility with previous generations of the In- The cache is used for both instruction and data ac-
tel386™ IIntel486™ architecture. cesses and acts on physical addresses.
The on-chip cache has been designed for maximum The cache organization is 4-way set associative and
flexibility and performance. The cache has several each line is 16 bytes wide. The eight Kbytes of
operating modes offering flexibility during program cache memory are logically organized as 128 sets,
execution and debugging. Memory areas can be de- each containing four lines.
fined as non-cacheable by software and external
hardware. Protocols for cache line invalidations and The cache memory is physically split into four
replacement are implemented in hardware, easing 2-Kbyte blocks each containing 128 lines (see Fig-
system design. ure 5.1). Associated with each 2-Kbyte block are
128 21-bit tags. There is a valid bit for each line in
the cache. Each line in the cache is either valid or
not valid. There are no provisions for partially valid
lines.
....J21 Bit k.. r- --l
,,·EO c=J Js
16-Byte Line Size
-I rag 1
k Bytes
Sets
o
o c=J
o c=J
r -3 LRU ~ 4 valid-j
Bits BitsI I
......._----_... IJ
Figure 5.1. On-Chip Cache Physical Organization
241245-27
5-1
intel" Intel486™ DX2 MICROPROCESSOR
The write strategy of on-chip cache is write-through. CD=1, NW=O

All writes will drive an external write bus cycle in Cache fills are disabled but write-throughs
addition to writing the information to the internal and invalidates are enabled. This mode is
cache if the write was a cache hit. A write to an the same as if the KEN # pin was strapped
address not contained in the internal cache will only HIGH disabling cache fills. Write-throughs
be written to external memory. Cache allocations and invalidates may still occur to keep the
are not made on write misses. cache valid. This mode is useful if the soft-
ware must disable the cache for a short pe-
riod of time, and then re-enable it without
5.2 Cache Control flushing the original contents.
Control of the cache is provided by the CD and NW CD=O, NW=1
bits in CRO. CD enables and disables the cache. NW INVALID. If CRO is loaded with this bit con-
controls memory write-through and invalidates. figuration, a General Protection fault with
error code of 0 is raised. Note that this
The CD and NW bits define four operating modes of mode would imply a non-transparent write-
the on-chip cache as given in Table 5.1. These back cache. A future processor may define
modes provide flexibility in how the on-chip cache is this combination of bits to implement a
used. write-back cache.
CD=O, NW=O
Table 5.1. Cache Operating Modes
This is the normal operating mode.
CD NW Operating Mode
1 1 Cache fills disabled, write-through and Completely disabling the cache is a two step pro-
invalidates disabled cess. First CD and NW must be set to 1 and then the
cache must be flushed. If the cache is not flushed,
1 0 Cache fills disabled, write-through and
cache hits on reads will still occur and data will be
invalidates enabled
read from the cache.
0 1 INVALID. IF CRO is loaded with this
configuration of bits, a GP fault with
error code of 0 is raised.
Cache fills enabled, write-through and
5.3 Cache Line Fills
0 0
invalidates enabled Any area of memory can be cached in the Intel486
OX microprocessor. Non-cacheable portions of
CD=1, NW=1 memory can be defined by the external system or by
software. The external system can inform the In-
The cache is completely disabled by setting
tel486 OX microprocessor that a memory address is
CD = 1 and NW = 1 and then flushing the
non-cacheable by returning the KEN # pin inactive
cache. This mode may be useful for debug-
during a memory access (refer to Section 7.2.3).
ging programs where it is important to see
Software can prevent certain pages from being
all memory cycles at the pins. Writes which
cached by setting the PCD bit in the page table en-
hit in the cache will not appear on the exter-
try.
nal bus.
It is possible to use the on-chip cache as A read request can be generated from program op-
fast static RAM by "pre-loading" certain eration or by an instruction pre-fetch. The data will
memory areas into the cache and then set- be supplied from the on-chip cache if a cache hit
ting CD = 1 and NW = 1. Pre-loading can be occurs on the read address. If the address is not in
done by careful choice of memory refer- the cache, a read request for the data is generated
ences with the cache turned on or by use of on the external bus.
the testability functions (see Section 8.2).
When the cache is turned off the memory If the read request is to a cacheable portion of mem-
mapped by the cache is "frozen" into the ory, the Intel486 OX microprocessor initiates a
cache since fills and invalidates are dis- cache line fill. During a line fill a 16-byte line is read
abled. into the Intel486 OX microprocessor.
Cache fills will only be generated for read misses.

Write misses will never cause a line in the internal
cache to be allocated. If a cache hit occurs on a
write, the line will be updated.
5-2
Cache line fills can be performed over 8- and 16-bit valid bits are checked to see if there is a non-valid
busses using the dynamic bus sizing feature. Refer line that can be replaced. If a non-valid line is found,
to Section 7.1.3 for a description of dynamic bus that line is marked for replacement.
sizing.
The four lines in the set are labeled 10, 11, 12, and 13.
Refer to Section 7.2.3 for further information on The order in which the valid bits are checked during
cacheable cycles. an invalidation is 10, 11, 12 and 13. All valid bits are
cleared when the processor is reset or when the
cache is flushed.
5.4 Cache Line Invalidations
Replacement in the cache is handled by a pseudo
The Intel486 OX microprocessor contains both a least recently used (LRU) mechanism when all four
hardware and software mechanism for invalidating lines in a set are valid. Three bits, BO, B1 and B2,
lines in its internal cache. Cache line invalidations are defined for each of the 128 sets in the cache.
are needed to keep the Intel486 OX microproces- These bits are called the LRU bits. The LRU bits are
sor's cache contents consistent with external mem- updated for every hit or replace in the cache.
ory.
If the most recent access to the set was to 10 or 11,
Refer to Section 7.2.8 for further information on BO is set to 1. BO is set to 0 if the most recent ac-
cache line invalidations. cess was to 12 or 13. If the most recent access to
10:11 was to 10, B1 is set to 1, else B1 is set to O. If
the most recent access to 12:13 was to 12, B2 is set to
5.5 Cache Replacement 1, else B2 is set to O.
When a line needs to be placed in its internal cache The pseudo LRU mechanism works in the following
the Intel486 OX microprocessor first checks to see if manner. When a line must be replaced, the cache
there is a non-valid line in the set that can be re- will first select which of 10:11 and 12:13 was least re-
placed. If all four lines in the set are valid, a pseudo cently used. Then the cache will determine which of
least-recently-used mechanism is used to determine the two lines was least recently used and mark it for
which line should be replaced. replacement. This decision tree is shown in Figure
5.2. When the processor is reset or when the cache
A valid bit is associated with each line in the cache. is flushed all 128 sets of three LRU bits are set to O.
When a line needs to be placed in a set, the four
All four lines in the set valid? ~ Replace non-valid line
80=0?
Ves: 10 or 11 least recently used No: 12 or 13 least recently used
B1 = O? B2=0?
~
Replace Replace
~
Replace Replace
10 11 12 13
241245-28
Figure 5.2. On-Chip Cache Replacement Strategy
5-3
5.6 Page Cacheability The PCD bit controls cacheability on a page by page
basis. The PCD bit is internally ANDed with the
Two bits for cache control, PWT and PCD, are de- KEN # signal to control cacheability on a cycle by
fined in the page table and page directory entries. cycle basis (see Figure 5.3). PCD=O enables cach-
The state of these bits are driven out on the PWT ing while PCD = 1 forbids it. Note that cache fills are
and PCD pins during memory access cycles. enabled when PCD=O AND KEN# =0. This logical
AND is implemented physically with a NOR gate.
The PWT bit controls write policy for second level
caches used with the Intel486 DX microprocessor. The state of the PCD bit in the page table entry is
Setting PWT= 1 defines a write-through policy for driven on the PCD pin when a page in external mem-
the current page while PWT = 0 allows the possibility ory is accessed. The state of the PCD pin informs
of write-back. The state of PWT is ignored internally the external system of the cacheability of the re-
by the Intel486 DX microprocessor since the on-chip quested information. The external system then re-
cache is write through. turns KEN # telling the Intel486 DX microprocessor
if the area is cacheable. The Intel486 DX microproc-
essor initiates a cache line fill if PCD and KEN #
indicate that the requested information is cacheable.
CRa
FLUSH#
CACHE CONTROL LOGIC
KEN#
CACHE MEMORY
31 22 12 a
DIRECTORY 1 TABLE -I aFFSET-1
LINEAR
ADDRESS 1aV
1t PCD
PWT
31 a 31 a
31 a
I CRa I
t
I
I C R1 PCD, PWT
I
IC R2
I
ICR3 PCD, PWT
<rI pca, PWT
CD
I PAGE TABLE
I (From CRO)
DIRECTORY
I CONTROL REGISTERS
I
241245-29
Figure 5.3. Page Cacheability
5-4
The PCD bit is masked with the CD (cache disable) 6.2.5 for the bus cycle definition pins and Section
bit in control register 0 to determine the state of the 7.2.11 for special bus cycles). Refer to the Intel486
PCD pin. If CD = 1 the Intel486 OX microprocessor OX microprocessor programmers reference manual
forces the PCD pin HIGH. If CD=O the PCD pin is for detailed instruction definitions.
driven with the value for the page table entry/direc-
tory. See Figure 5.3. The results of the INVD and WBINVD instructions
are identical for the operation of the Intel486 OX mi-
The PWT and PCD bits for a bus cycle are obtained croprocessor's on-chip cache since the cache is
from either CR3, the page directory or page table write-through. Note that the INVD and WBINVD in-
entry. These bits are assumed to be zero during real structions are machine dependent. Future members
mode, whenever paging is disabled, or for cycles of the Intel486 OX microprocessor family may
that bypass paging, (110 references, interrupt ac- change the definition of this instruction.
knowledge and Halt cycles), the PWT and PCD bits
are taken from CR3. These bits are initialized to 0 on
reset, but can be set to any value by level 0 soft- 5.8 Caching Translation Lookaside
ware. Buffer Entries
When paging is enabled, the bits from the page table The Intel486 OX microprocessor contains an inte-
entry are cached in the TLB, and are driven any time grated paging unit with a translation lookaside buffer
the page mapped by the TLB entry is referenced. (TLB). The TLB contains 32 entries. The TLB has
For normal memory cycles, PWT and PCD are taken been enhanced over the Intel386 microprocessor's
from the page table entry. During TLB refresh cycles TLB by upgrading the replacement strategy to a
where the page table and directory entries are read, pseudo-LRU (least recently used) algorithm. The
the PWT and PCD bits must be obtained elsewhere. pseudo-LRU replacement algorithm is the same as
During page table updates the bits are obtained from that used in the on-chip cache.
the page directory. When the page directory is up-
dated the bits are obtained from CR3. The paging TLB operation is automatic whenever
paging is enabled. The TLB contains the most re-
5_7 Cache Flushing cently used page table entries. A page table entry
translates the linear address pointing to a particular
The on-chip cache can be flushed by external hard- page to the physical address where the page is
ware or by software instructions. Flushing the cache stored in memory (refer to Section 4.5, Paging).
clears all valid bits for all lines in the cache. The
cache is flushed when external hardware asserts the The paging unit will look up the linear address in the
FLUSH# pin. TLB in response to an internal bus request. The cor-
responding physical address is passed on to the on-
The flush pin needs to be asserted for one clock if chip cache or the external bus (in the event of a
driven synchronously or for two clocks if driven cache miss) when the linear address is present in
asynchronously. The flush input is asynchronous but the TLB.
setup and hold times must be met. The flush pin
should be deasserted after the cache flush is com- The paging unit will access the page tables in exter-
plete. Failure to deassert the pin will cause execu- nal memory if the linear address is not in the TLB.
tion to stop as the processor will be repeatedly flush- The required page table entry will be read into the
ing the cache. If external hardware activates flush in TLB and'then the cache or bus cycle for the actual
response to an 1/0 write, flush must be asserted for data will take place. The process of reading a new
at least two clocks prior to ready being returned for page table entry into the TLB is called a TLB refresh.
the 1/0 write. This ensures that the flush completes
before the CPU begins execution of the instruction A TLB refresh is a two step process. The paging unit
following the OUT instruction, must first read the page directory entry which points
Flush is recognized during HOLD just like EADS#. to the appropriate page table. The page table entry
to be stored in the TLB is then read from the page
The instructions INVD and WBINVD cause the on- table. Control register 3 (CR3) points to the base of
cache to be flushed. External caches connected to the page directory table.
the Intel486 OX microprocessor are signalled to
flush their contents when these instructions are exe- The Intel486 OX microprocessor will allow page di-
cuted. rectory and page table entries (returned during TLB
refreshes) to be stored in the on-chip cache. Setting
WBINVD will cause an external write-back cache to the PCD bits in CR3 and the page directory entry to
write back dirty lines before flushing its contents. 1 will prevent the page directory and page table en-
The external cache is signalled using the bus cycle tries from being stored in the on-chip cache (see
definition pins and the byte enables (refer to Section Section 5.6, Page Cacheablllty).
5-5
6.0 HARDWARE INTERFACE

6.1 Introduction OX2 in a system that had already been designed for
the Inte1486. This performance is supplied because
The Intel486 OX2 microprocessor bus has been de- the bus interface is identical to that of an Intel486
signed to be identical with the Intel486 micropro- OX and all of the core is running at twice the speed
cessor bus. Several new features have been added of the comparable Intel486 OX. This speedup in-
to the Intel486 OX2 to increase performance and cludes the internal cache memory, the floating point
testability. New features include a speed doubler for unit, the instruction decode unit, the ALU and every-
the core logic, and IEEE 1149.1 boundary scan sup- thing except the bus interface.
port.
Like the Intel386 microprocessor, the Intel486 OX
The Intel486 OX2 is driven by what can be called a microprocessor has separate parallel busses for
%x clock, as opposed to the 1x clock in the Intel486 data and addresses. The bidirectonal data bus is
OX and the 2x clock in the Intel386 micropro- 32 bits in width. The address bus consists of two
cessors. Thus a 50 MHz Intel486 OX2 is driven by a components: 30 address lines (A2-A31) and 4 byte
25 MHz clock, in contrast with 25 MHz processors enable lines (BEO#-BE3#). The address bus ad-
like the Intel486 OX2 and the Intel386 requiring dresses external memory in the same manner as the
25 MHz and 50 MHz, respectively. Since the In- Intel386 microprocessor: The address lines form the
tel486 OX has a clock doubler driving its core, but upper 30 bits of the address and the byte enables
not its bus interface, it provides a simpler system select individual bytes within a 4 byte location. The
design for a given performance level than the In- address lines are bidirectional for use in cache line
tel486 OX. In reality, this permits dramatic increases invalidations.
in performance by just plugging in the Intel486
A
ClK
")
-y A2-A31 )
" 32-Bi\
Address
..
BE3#
Intel"S6DX2
)~
DATA BUS Bu.
t.ticroprocessor BE2#
Byt.
32-Bi\ {00-031
Data <A "
BEI#
BEO#
ADS#
Bu.
Control { ROY# M/IO#
D/c#
INTR W/R# Bu. Cycl.
Interrupt
Signals { RESET
NMI
lOCK#
PlOCK#
) Definition
AHOlD
HOLD
Cache { EADS#
Invalidation HlDA
Bu.
BOFF# ) Arbitration
KEN#
Cache
Control { FlUSH#
BREQ
PWT BRDY#
Page
Caching
Control { PCD BlAST#
Bur.\
} Control
FERR#
Numeric
Error
Reporting { IGNNE#
BS8#
BSI6#
Bu. Size
} C0ntrol
Address Bit A20M#

20 totask DP3
TCK DP2
Boundary
Scan
1 HAS
TOI
TDO
DPI
DPO
PCHK#
241245-30
Figure 6.1. Functional Signal Groupings

6-1
The Intel486 OX microprocessor's burst bus mecha- 6.2 Signal Descriptions

nism enables high-speed cache fills from external
memory. Burst cycles can strobe data into the proc-
essor at a rate of one item every clock. Non-burst 6.2.1 CLOCK (ClK)
cycles have a maximum rate of one item every two
clocks. Burst cycles are not limited to cache fills: all elK provides the fundamental timing and the inter-
bus cycles requiring more than a single data cycle nal operating frequency for the Intel486 DX2 micro-
can be bursted. processor. All external timing parameters are speci-
fied with respect to the rising edge of elK.
The Intel486 OX microprocessor has a bus hold fea-
ture similar to that of the Intel386 microprocessor. The Intel486 DX2 microprocessor can operate over
During bus hold, the Intel486 OX microprocessor re- a wide frequency range but elK's frequency cannot
linquishes control of the local bus by floating its ad- change rapidly while RESET is inactive. elK's fre-
dress, data and control busses. quency must be stable for proper chip operation
since a single edge of elK is used internally to gen-
The Intel486 OX microprocessor has an address erate four phases. elK only needs TTL levels for
hold feature in addition to bus hold. During address proper operation. Figure 6.2 illustrates the elK
hold only the address bus is floated, the data and waveform.
control busses can remain active. Address hold is
used for cache line invalidations. 6.2.2 Address Bus (A31-A2, BEO#-BE3#)
Ahead is a brief description of the Intel486 OX mi- A31-A2 and BEO#-BE3# form the address bus
croprocessor input and output signals arranged by and provide physical memory and 1/0 port address-
functional groups. Before beginning the signal de- es. The Intel486 OX microprocessor is capable of
scriptions a few terms need to be defined. The # addressing 4 gigabytes of physical memory space
symbol at the end of a signal name indicates the (OOOOOOOOH through FFFFFFFFHl, and 64 Kbytes
active, or asserted, state occurs when the signal is of 1/0 address space (OOOOOOOOH through
at a low voltage. When a # is not present after the OOOOFFFFH). A31-A2 identify addresses to a 4-byte
Signal name, the signal is active at the high voltage location. BEO#-BE3# identify which bytes within
level. The term "ready" is used to indicate that the the 4-byte location are involved in the current trans-
cycle is terminated with ROY # or BRDY # . fer.
Section 6 and 7 will discuss bus cycles and data Addresses are driven back into the Intel486 OX mi-
cycles. A bus cycle is at least two clocks long and croprocessor over A31-A4 during cache line invali-
begins with ADS # active in the first clock and ready dations. The address lines are active HIGH. When
active in the last clock. Data is transferred to or from used as inputs into the processor, A31-A4 must
the Intel486 OX microprocessor during a data cycle. meet the setup and hold times, t22 and t23. A31-A2
A bus cycle contains one or more data cycles. are not driven during bus or address hold.
t)( = input setup times 241245-31

ty = input hold times, output float, valid and hold times
Figure 6.2. ClK waveform
6-2
The byte enable outputs, BEO#-BE3#, determine end of the previous clock. Parity is checked during
which bytes must be driven valid for read and write code reads, memory reads and 1/0 reads. Parity is
cycles to external memory. not checked during interrupt acknowledge cycles.
PCHK # only checks the parity status for enabled
BE3# applies to 024-031 bytes as indicated by the byte enable and bus size
BE2# applies to 016-023 signals. It is valid only in the clock immediately after
read data is returned to the Intel486 OX microproc-
BE1 # applies to 08-015 essor. At all other times it is inactive (HIGH).
BEO# applies to 00-07 PCHK# is never floated.
BEO#-BE3# can be decoded to generate AO, A1 Driving PCHK # is the only effect that bad input pari-
and BHE# signals used in 8- and 16-bit systems ty has on the Intel486 OX microprocessor. The In-
(see Table 7.5). BEO#-BE3# are active LOW and tel486 OX microprocessor will not vector to a bus
are not driven during bus hold. error interrupt when bad data parity is returned. In
systems that will not employ parity, PCHK# can be
ignored. In systems not using parity, OPO-OP3
6_2.3 DATA LINES (D31-DO) should be connected to Vee through a pullup resis-
The bidirectional lines, 031-00, form the data bus tor.
for the Intel486 OX microprocessor. 00-07 define
the least significant byte and 024-031 the most sig- 6.2.5 BUS CYCLE DEFINITION
nificant byte. Oata transfers to 8- or 16-bit devices is
possible using the data bus sizing feature controlled M/IO#, D/C#, W/R# Outputs
by the BS8# or BS16# input pins.
MIIO#, O/C# and W/R# are the primary bus cycle
031-00 are active HIGH. For reads, 031-00 must definition signals. They are driven valid as the AOS#
meet the setup and hold times, t22 and t23. 031-00 signal is asserted. M/IO# distinguishes between
are not driven during read cycles and bus hold. memory and 1/0 cycles, O/C# distinguishes be-
tween data and control cycles and W/R# distin-
guishes between write and read cycles.
6.2.4 PARITY
Data Parity Input/Outputs (DPO-DP3) Bus cycle definitions as a function of MilO #, O/C #
and W/R# are given in Table 6.1. Note there is a
OPO-OP3 are the data parity pins for the processor. difference between the Intel486 OX microprocessor
There is one pin for each byte of the data bus. Even and Intel386 microprocessor bus cycle definitions.
parity is generated or checked by the parity genera- The halt bus cycle type has been moved to location
torsi checkers. Even parity means that there are an 001 in the Intel486 OX microprocessor from location
even number of HIGH inputs on the eight corre- 101 in the Intel386 microprocessor. Location 101 is
sponding data bus pins and parity pin. now reserved and will never be generated by the
Intel486 OX microprocessor.
Oata parity is generated on all write data cycles with
the same timing as the data driven by the Intel486 Table 6.1. ADS# Initiated Bus Cycle Definitions
OX microprocessor. Even parity information must be M/IO# D/C# W/R# Bus Cycle Initiated
driven back to the Intel486 OX microprocessor on
these pins with the same timing as read information 0 0 0 Interrupt Acknowledge
to insure that the correct parity check status is indi- 0 0 1 Halt/Special Cycle
cated by the Intel486 OX microprocessor. 0 0 1/0 Read
0 1 1 I/O Write
The values read on these pins do not affect program 0 0 Code Read
execution. It is the responsibility of the system to 0 1 Reserved
take appropriate actions if a parity error occurs. 0 Memory Read
Memory Write
Input signals on OPO-OP3 must meet setup and
hold times t22 and t23 for proper operation.
Special bus cycles are discussed in Section 7.2.11.
Parity Status Output (PCHK#)
Bus Lock Output (LOCK #)
Parity status is driven on the PCHK# pin, and a pari-
ty error is indicated by this pin being LOW. PCHK# LOCK # indicates that the Intel486 OX microproces-
is driven the clock after ready for read operations to sor is running a read-modify-write cycle where the
indicate the parity status for the data sampled at the external bus must not be relinquished between the
6-3
read and write cycles. Read-modify-write cycles are 6.2.6 BUS CONTROL
used to implement memory-based semaphores.
Multiple reads or writes can be locked. The bus control Signals allow the processor to indi-
cate when a bus cycle has begun, and allow other
When LOCK # is asserted, the current bus cycle is system hardware to control burst cycles, data bus
locked and the Intel486 DX microprocessor should width and bus cycle termination.
be allowed exclusive access to the system bus.
LOCK # goes active in the first clock of the first Address Status Output (ADS#)
locked bus cycle and goes inactive after ready is
returned indicating the last locked bus cycle. The ADS # output indicates that the address and
bus cycle definition signals are valid. This signal will
The Intel486 DX microprocessor will not acknowl- go active in the first clock of a bus cycle and go
edge bus hold when LOCK # is asserted (though it inactive in the second and subsequent clocks of the
will allow an address hold). LOCK# is active LOW cycle. ADS# is also inactive when the bus is idle.
and is floated during bus hold. Locked read cycles
will not be transformed into cache fill cycles if KEN # ADS# is used by external bus circuitry as the indica-
is returned active. Refer to Section 7.2.6 for a de- tion that the processor has started a bus cycle. The
tailed discussion of Locked bus cycles. external circuit must sample the bus cycle definition
pins on the next riSing edge of the clock after ADS #
Pseudo-Lock Output (PLOCK #) is driven active.
The pseudo-lock feature allows atomic reads and ADS# is active LOW and is not driven during bus
writes of memory operands greater than 32 bits. hold.
These operands require more than one cycle to
transfer. The Intel486 DX microprocessor asserts Non-burst Ready Input (RDY #)
PLOCK # during floating point long reads and writes
(64 bits), segment table descriptor reads (64 bits) RDY # indicates that the current bus cycle is com-
and cache line fills (128 bits). plete. In response to a read, RDY # indicates that
the external system has presented valid data on the
When PLOCK # is asserted no other master will be data pins. In response to a write request, RDY # indi-
given control of the bus between cycles. A bus hold cates that the external system has accepted the In-
request (HOLD) is not acknowledged during pseudo- tel486 DX microprocessor data. RDY # is ignored
locked reads and writes, with one exception. During when the bus is idle and at the end of the first clock
non-cacheable non-bursted code prefetches, HOLD of the bus cycle. Since RDY # is sampled during ad-
is recognized on memory cycle boundaries even dress hold, data can be returned to the processor
though PLOCK# is asserted. The Intel486 DX mi- when AHOLD is active.
croprocessor will drive PLOCK # active until the ad-
dresses for the last bus cycle of the transaction RDY # is active LOW, and is not provided with an
have been driven regardless of whether BRDY # or internal pullup resistor. This input must satisfy setup
RDY # are returned. and hold times t16 and t17 for proper chip operation.
A pseudo-locked transfer is meaningful only if the

memory operand is aligned and if its completely con- 6.2.7 BURST CONTROL
tained within a single cache line. A 64-bit floating
Burst Ready Input (BRDY #)
point number must be aligned to an 8-byte boundary
to guarantee an atomic access. BRDY # performs the same function during a burst
cycle that RDY # performs during a non-burst cycle.
Normally PLOCK# and BLAST# are inverse of
BRDY # indicates that the external system has pre-
each other. However during the first cycle of a 64-bit
sented valid data on the data pins in response to a
floating point write, both PLOCK # and BLAST # will
read or that the external system has accepted the
be asserted.
Intel486 DX microprocessor data in response to a
write. BRDY # is ignored when the bus is idle and at
Since PLOCK # is a function of the bus size and
the end of the first clock in a bus cycle.
KEN # inputs, PLOCK # should be sampled only in
the clock ready is returned. This pin is active LOW
During a burst cycle, BRDY # will be sampled each
and is not driven during bus hold. Refer to Section
clock, and if active, the data presented on the data
7.2.7 for a detailed discussion of pseudo-locked bus
bus pins will be strobed into the Intel486 DX micro-
cycles.
processor. ADS # is negated during the second
through last data cycles in the burst, but address
6-4
int:el.. Intel486™ DX2 MICROPROCESSOR
lines A2-A3 and byte enables will change to reflect sure program interruption. Refer to Section 7.2.10
the next data item expected by the Intel486 DX mi- for a detailed discussion of interrupt acknowledge
croprocessor. cycles.
If RDY # is returned simultaneously with BRDY #, The INTR pin is active HIGH and is not provided with
BRDY # is ignored and the burst cycle is premature- an internal pulldown resistor. INTR is asynchronous,
ly aborted. An additional complete bus cycle will be but the INTR setup and hold times, t20 and t21, must
initiated after an aborted burst cycle if the cache line be met to assure recognition on any specific clock.
fill was not complete. BRDY # is treated as a normal
ready for the last data cycle in a burst transfer or for Non-maskable Interrupt Request Input (NMI)
non-burstable cycles. Refer to Section 7.2.2 for
burst cycle timing. NMI is the non-maskable interrupt request signal.
Asserting NMI causes an interrupt with an internally
BRDY # is active lOW and is provided with a small supplied vector value of 2. External interrupt ac-
internal pullup resistor. BRDY # must satisfy the set- knowledge cycles are not generated since the NMI
up and hold times t16 and t17. interrupt vector is internally generated. When NMI
processing begins, the NMI signal will be masked
Burst Last Output (BLAST #) internally until the IRET instruction is executed.
BLAST # indicates that the next time BRDY # is re-
NMI is rising edge sensitive after internal synchroni-
turned it will be treated as a normal RDY #, terminat- zation. NMI must be held lOW for at least four elK
ing the line fill or other multiple-data-cycle transfer. periods before this rising edge for proper operation.
BLAST # is active for all bus cycles regardless of NMI is not provided with an internal pulldown resis-
whether they are cacheable or not. This pin is active tor. NMI is asynchronous but setup and hold times,
lOW and is not driven during bus hold. t20 and t21 must be met to assure recognition on any
specific clock.
6.2.8 INTERRUPT SIGNALS (RESET, INTR,
NMI)
6.2.9 BUS ARBITRATION SIGNALS
The interrupt signals can interrupt or suspend exe-
This section describes the mechanism by which the
cution of the processor's current instruction stream.
processor relinquishes control of its local bus when
Reset Input (RESET) requested by another bus master.
RESET forces the Intel486 DX2 microprocessor to Bus Request Output (BREQ)
begin execution at a known state. For a power-up
(cold start) reset, Vee and ClK must reach their The Intel486 DX microprocessor asserts BREa
proper DC and AC specifications for at least whenever a bus cycle is pending internally. Thus,
1 ms before the Intel486 DX2 microprocessor be- BREa is always asserted in the first clock of a bus
gins instruction execution. The RESET pin should cycle, along with ADS#. Furthermore, if the Intel486
remain active during this time to ensure proper In- DX microprocessor is currently not driving the bus
tel486 DX2 microprocessor operation. However, for (due to HOLD, AHOlD, or 80FF#), BREa is assert-
a warm boot-up case, RESET is required to re- ed in the same clock that ADS# would have been
main active for a minimum of 15 clocks. The test- asserted if the processor were driving the bus. After
ability operating modes are programmed by the fail- the first clock of the bus cycle, 8REa may change
ing (inactive going) edge of RESET. (Refer to Sec- state. It will be asserted if additional cycles are nec-
tion 8.0 for a description of the test modes during essary to complete a transfer (via 8S8 #, 8S 16 # ,
reset.) KEN#), or if more cycles are pending internally.
However, if no additional cycles are necessary to
Maskable Interrupt Request Input (INTR) complete the current transfer, 8REa can be negat-
ed before ready comes back for the current cycle.
INTR indicates that an external interrupt has been External logic can use the 8REa signal to arbitrate
generated. Interrupt processing is initiated if the IF among multiple processors. This pin is driven re-
flag is active in the EFLAGS register. gardless of the state of bus hold or address hold.
BREa is active HIGH and is never floated. During a
The Intel486 DX microprocessor will generate two hold state, internal events may cause 8REa to be
locked interrupt acknowledge bus cycles in re- deasserted prior to any bus cycles.
sponse to asserting the INTR pin. An 8-bit interrupt
number will be latched from an external interrupt Bus Hold Request Input (HOLD)
controller at the end of the second interrupt ac-
knowledge cycle. INTR must remain active until the HOLD allows another bus master complete control
interrupt acknowledges have been performed to as- of the Intel486 DX microprocessor bus. The Intel486
6-5
intel. Intel486TM DX2 MICROPROCESSOR
OX microprocessor will respond to an active HOLD Any data returned to the processor while BOFF # is
signal by asserting HLDA and placing most of its asserted is ignored. BOFF # has higher priority than
output and input/output pins in a high impedance ROY # or BRDY #. If both BOFF # and ready are
state (floated) after completing its current bus cycle, returned in the same clock, BOFF # takes effect. If
burst cycle, or sequence of locked cycles. In addi- BOFF# is asserted while the bus is idle, the Intel486
tion, if the Intel486 OX CPU receives a HOLD re- OX microprocessor will float its bus in the next bus
quest while performing a non-cacheable, non-burst- clock. BOFF # is active LOW and must meet setup
ed code prefetch and that cycle is backed off and hold times t18 and t19 for proper chip operation.
(BOFF #), the Intel486 OX CPU will recognize HOLD
before restarting the cycle. The BREQ, HLDA, 6.2.10 CACHE INVALIDATION
PCHK # and FERR # pins are not floated during bus
hold. The Intel486 OX microprocessor will maintain The AHOLD and EADS# inputs are used during
its bus in this state until the HOLD is deasserted. cache invalidation cycles. AHOLD conditions the In-
Refer to Section 7.2.9 for timing diagrams for a bus tel486 OX microprocessors address lines, A4-A31,
hold cycle. to accept an address input. EADS# indicates that
an external address is actually valid on the address
Unlike the Intel386 microprocessor, the Intel486 DX inputs. Activating EADS# will cause the Intel486 OX
microprocessor will recognize HOLD during re- microprocessor to read the external address bus
set. Pullup resistors are not provided for the outputs and perform an internal cache invalidation cycle to
that are floated in response to HOLD. HOLD is ac- the address indicated. Refer to Section 7.2.8 for
tive HIGH and is not provided with an internal pull- cache invalidation cycle timing.
down resistor. HOLD must satisfy setup and hold
times t18 and t19 for proper chip operation. Address Hold Request Input (AHOLD)
Bus Hold Acknowledge Output (HLDA) AHOLD is the address hold request. It allows anoth-
er bus master access to the Intel486 OX microproc-
HLDA indicates that the Intel486 OX microprocessor essor address bus for performing an internal cache
has given the bus to another local bus master. HLDA invalidation cycle. Asserting AHOLD will force the
goes active in response to a hold request presented Intel486 OX microprocessor to stop driving its ad-
on the HOLD pin. HLDA is driven active in the same dress bus in the next clock. While AHOLD is active
bus clock cycle that the Intel486 OX microprocessor only the address bus will be floated, the remainder
floats its bus. of the bus can remain active. For example, data can
be returned for a previously specified bus cycle
HLDA will be driven inactive when leaving bus hold when AHOLD is active. The Intel486 OX microproc-
and the Intel486 OX microprocessor will resume essor will not initiate another bus cycle during ad-
driving the bus. The Intel486 OX microprocessor will dress hold. Since the Intel486 OX microprocessor
not cease internal activity during bus hold since the floats its bus immediately in response to AHOLD, an
internal cache will satisfy the majority of bus re- address hold acknowledge is not required. If AHOLD
quests. HLDA is active HIGH and remains driven is asserted while a bus cycle is in progress, and no
during bus hold. readies are returned during the time AHOLD is as-
serted, the Intel486 OX will redrive the same ad-
Backoff Input (BOFF #) dress (that it originally sent out) once AHOLD is neg-
ated.
Asserting the BOFF# input forces the Intel486 OX
microprocessor to release control of its bus in the AHOLD is recognized during reset. Since the entire
next clock. The pins floated are exactly the same as cache is invalidated by reset, any invalidation cycles
in response to HOLD. The response to BOFF # dif- run during reset will be unnecessary. AHOLD is ac-
fers from the response to HOLD in two ways: First, tive HIGH and is provided with a small internal pull-
the bus is floated immediately in response to down resistor. It must satisfy the setup and hold
BOFF # while the Intel486 OX microprocessor com- times t18 and t19 for proper chip operation. This pin
pletes the current bus cycle before floating its bus in determines whether or not the built in self test fea-
response to HOLD. Second the Intel486 OX does tures of the Intel486 OX microprocessor will be exer-
not assert HLDA in response to BOFF#. cised on assertion of RESET.
The processor remains in bus hold until BOFF # is External Address Valid Input (EADS#)
negated. Upon negation, the Intel486 OX microproc-
essor restarts the bus cycle aborted when BOFF # EADS# indicates that a valid external address has
was asserted. To the internal execution engine the been. driven onto the Intel486 OX address pins. This
effect of BOFF # is the same as inserting a few wait address will be used to perform an internal cache
states to the original cycle. Refer to Section 7.2.12 invalidation cycle. The external address will be
for a description of bus cycle restart. checked with the current cache contents. If the ad-
6-6
dress specified matches any areas in the cache, that PCD is masked by the CD (cache disable) bit in con-
area will immediately be invalidated. trol register 0 (CRO). When CD = 1 (cache line fills
disabled) the Intel486 OX microprocessor forces
An invalidation cycle may be run by asserting PCD HIGH. When CD = 0, PCD is driven with the
EADS# regardless of the state of AHOLD, HOLD value of the page table entry/directory.
and BOFF#. EADS# is active LOW and is provided
with an internal pullup resistor. EADS# must satisfy The purpose of PCD is to provide a cacheable/non-
the setup and hold times t12 and t13 for proper chip cacheable indication on a page by page basis. The
operation. Intel486 OX will not perform a cache fill to any page
in which bit 4 of the page table entry is set. PWT
corresponds to the write-back bit and can be used
6.2.11 CACHE CONTROL
by an external cache to provide this functionality.
Cache Enable Input (KEN#) PCD and PWT bits are assigned to be zero during
real mode or whenever paging is disabled. Refer to
KEN # is the cache enable pin. KEN # is used to Sections 4.5.4 and 5.6 for a discussion of non-
determine whether the data being returned by the cacheable pages.
current cycle is cacheable. When KEN # is active
and the Intel486 OX microprocessor generates a cy- PCD and PWT have the same timing as the cycle
cle that can be cached (most any memory read cy- definition pins (M/IO#, D/C#, W/R#). PCD and
cle), the cycle will be transformed into a cache line PWT are active HIGH and are not driven during bus
fill cycle. hold.
A cache line is 16 bytes long. During the first cycle of

a cache line fill the byte-enable pins should be ig- 6.2.13 NUMERIC ERROR REPORTING
nored and data should be returned as if all four byte (FERR#,IGNNE#)
enables were asserted. The Intel486 OX microproc-
essor will run between 4 and 16 contiguous bus cy- To allow PC-type floating point error reporting, the
cles to fill the line depending on the bus data width Intel486 OX microprocessor provides two pins,
selected by BS8# and BS16#. Refer to Section FERR# and IGNNE#.
7.2.3 for a description of cache line fill cycles.
Floating Point Error Output (FERR #)
The KEN # input is active LOW and is provided with
a small internal pullup resistor. It must satisfy the The Intel486 OX microprocessor asserts FERR #
setup and hold times t14 and t15 for proper chip op- whenever an unmasked floating point error is en-
eration. countered. FERR # is similar to the ERROR # pin on
the Intel387 math coprocessor. FERR # can be
Cache Flush Input (FLUSH#) used by external logic for PC-type floating point error
reporting in Intel486 OX microprocessor systems.
The FLUSH # input forces the Intel486 OX micro- FERR # is active LOW, and is not floated during bus
processor to flush its entire internal cache. FLUSH # hold.
is active LOW and need only be asserted for one
clock. FLUSH # is asynchronous but setup and hold In some cases, FERR # is asserted when the next
times t20 and t21 must be met for recognition on any floating point instruction is encountered and in other
specific clock. cases it is asserted before the next floating point
instruction is encountered depending upon the exe-
FLUSH # also determines whether or not the 3-state cution state of the instruction causing the exception.
test mode of the Intel486 OX microprocessor will be
invoked on assertion of RESET. The following class of floating point exceptions drive
FERR # at the time the exception occurs (Le., before
encountering the next floating point instruction).
6.2.12 PAGE CACHEABILITY (PWT, PCD)
1. The stack fault, invalid operation, and denormal
The PWT and PCD output signals correspond to two exceptions on all transcendental instructions, in-
user attribute bits in the page table entry. When pag- teger arithmetic instructions, FSQRT, FSCALE,
ing is enabled, PWT and PCD correspond to bits 3 FPREM(1), FXTRACT, FBLD, and FBSTP.
and 4 of the page table entry respectively. For cy- 2. Any exceptions on store instructions (including
cles that are not paged when paging is enabled (for integer store instructions).
example 110 cycles) PWT and PCD correspond to
bits 3 and 4 in control register 3. When paging is The following class of floating point exceptions drive
disabled, the Intel486 OX CPU ignores the PCD and FERR # only after encountering the next floating
PWT bits and assumes they are zero for the purpose point instruction.
of caching and driving PCD and PWT.
fi-7
1. Exceptions other than on all transcendental in- tion in any specific clock. For correct operation of
structions, integer arithmetic instructions, the chip, A20M # should be sampled high 2 clocks
FSQRT, FSCALE, FPREM(1), FXTRACT, F8LO. before and 2 clocks after RESET goes low.
and F8STP.
2. Any exception on all basic arithmetic, load, com- 6.2.16 BOUNDARY SCAN TEST SIGNALS
pare, and control instructions (i.e., all other in-
structions).
Test Clock (TCK)
Ignore Numeric Error Input (IGNNE#) TCK is an input to the Intel486 OX2 CPU and pro-
vides the clocking function required by the JTAG
The Intel486 OX microprocessor will ignore a numer-
boundary scan feature. TCK is used to clock state
ic error and continue executing non-control floating information and data into and out of the component.
point instructions when IGNNE # is asserted, but State select information and data are clocked into
FERR # will still be activated. When deasserted, the
the component on the rising edge of TCK on TMS
Intel486 OX microprocessor will freeze on a non- and TOI, respectively. Oata is clocked out of the part
control floating point instruction if a previous instruc- on the falling edge of TCK on TOO.
tion caused an error. IGNNE# has no effect when
the NE bit in control register 0 is set. In addition to using TCK as a free running clock, it
may be stopped in a low, 0, state, indefinitely as
The IGNNE# input is active LOW and is provided described in IEEE 1149.1. While TCK is stopped in
with a small internal pullup resistor. This input is the low state, the boundary scan latches retain their
asynchronous, but must meet setup and hold times state.
t20 and t21 to insure recognition on any specific
clock. When boundary scan is not used, TCK should be
tied high or left as a NC (This is important during
6.2.14 BUS SIZE CONTROL (BS16#, BS8#) power up to avoid the possibility of glitches on the
TCK which could prematurely initiate boundary scan
The 8S16# and 8S8# inputs allow external 16- and operations). TCK is supplied with an internal pullup
8-bit busses to be supported with a small number of resistor.
external components. The Intel486 OX CPU sam-
ples these pins every clock. The value sampled in TCK is a clock signal and is used as a reference for
the clock before ready determines the bus size. sampling other JTAG signals. On the riSing edge of
When asserting 8S16# or 8S8# only 16 or 8 bits of TCK, TMS and TOI are sampled. On the falling edge
the data bus need be valid. If both 8S16# and of TCK, TOO is driven.
BS8 # are asserted, an 8-bit bus width is selected.
When 8S16# or 8S8# are asserted the Intel486 OX Test Mode Select (TMS)
microprocessor will convert a larger data request to TMS is decoded by the JTAG TAP (Tap Access
the appropriate number of smaller transfers. The Port) to select the operation of the test logic, as de-
byte enables will also be modified appropriately for scribed in Section 8.5.4.
the bus size selected.
To guarantee deterministic behavior of the TAP con-
BS16# and 8S8# are active LOW and are provided troller, TMS is provided with an internal pull-up resis-
with small internal pullup resistors. 8S16# and tor. If boundary scan is not used, TMS may be tied
BS8# must satisfy the setup and hold times t14 and high or left unconnected. TMS is sampled on the
t15 for proper chip operation. rising edge of TCK. TMS is used to select the inter-
nal TAP states required to load boundary scan in-
6.2.15 ADDRESS BIT 20 MASK (A20M#) structions to data on TOI. For proper initialization of
the JTAG logiC, TMS should be driven high, "1", for
Asserting the A20M# input causes the Intel486 OX at least four TCK cycles following the riSing edge of
microprocessor to mask physical address bit 20 be- RESET.
fore performing a lookup in the internal cache and
before driving a memory cycle to the outside world.
When A20M # is asserted, the Intel486 OX micro- Test Data Input (TDI)
processor emulates the 1 Mbyte address wrap- TOI is the serial input used to shift JTAG instructions
around that occurs on the 8086. A20M # is active and data into the component. The shifting of instruc-
LOW and must be asserted only when the processor tions and data occurs during the SHIFT-IR and
is in real mode. The A20M # is not defined in Pro- SHIFT-OR controller states, respectively. These
tected Mode. A20M # is asynchronous but should states are selected using the TMS signal as de-
meet setup and hold times t20 and t21 for recogni- scribed in Section 8.5.4.
6-8
int'eL Intel486TM DX2 MICROPROCESSOR
An internal pull-up resistor is provided on TOI to en- Reordering of a read with the writes pending in the
sure a known logic state if an open circuit occurs on buffers can only occur once before all the buffers
the TOI path. Note that when "1" is continuously are emptied. Reordering read once only maintains
shifted into the instruction register, the BYPASS cache consistency. Consider the following example:
instruction is selected. TOI is sampled on the The CPU writes to location X. Location X is in the
rising edge of TCK, during the SHIFT-IR and the internal cache, so it is updated there immediately.
SHIFT-OR states. Ouring all other TAP controller However, the bus is busy so the write out to main
states, TOI is a "don't care". memory is buffered (see Figure 6.3(a)). At this point,
any reads to location X would be cache hits and
most up-to-date data would be read.
Test Data Output (TOO)
TOO is the serial output used to shift JTAG instruc-

Intel486 DX2
tions and data out of the component. The shifting of
cpu Cache Write Buffer Main Memory
instructions and data occurs during the SHIFT-IR
'I-~"I '1--' 1
and SHIFT-OR TAP controller states, respectively. w
These states are selected using the TMS signal as X data x
described in Section 8.5.4. When not in SHIFT-IR or y data y
SHIFT-OR state, TOO is driven to a high impedance Z
state to allow connecting TOO of different devices in
parallel. Figure 6.3(a)
TOO is driven on the falling edge of TCK during the The next instruction causes a read to location Y.
SHIFT-IR and SHIFT-OR TAP controller states. At Location Y is not in the cache (a cache miss). Since
all other times TOO is driven to the high impedance the write in the write buffer is a cache hit, the read is
state. reordered. When location Y is read, it is put into the
cache. The possibility exists that location Y will re-
place location X in the cache. If this is true, location
6.3 Write Buffers X would no longer be cached (see Figure 6.3(b)).
The Intel486 OX2 microprocessor contains four

write buffers to enhance the performance of consec- Intel486 DX2
utive writes to memory. The buffers can be filled at a CPU Cache Write Buffer Main Memory
rate of one write per clock until all four buffers are
filled.
When all four buffers are empty and the bus is idle, a
write request will propagate directly to the external
bus bypassing the write buffers. If the bus is not
available at the time the write is generated internally, Figure 6.3(b)
the write will be placed in the write buffers and prop-
agate to the bus as soon as the bus becomes avail- Cache consistency has been maintained up to this
able. The write is stored in the on-chip cache imme- point. If a subsequent read is to location X (now a
diately if the write is a cache hit. cache miss) and it was reordered in front of the buff-
ered write to location X, stale data would be read.
Writes will be driven onto the external bus in the This is why only 1 read is allowed to be reordered.
same order in which they are received by the write Once a read is reordered, all the writes in the write
buffers. Under certain conditions a memory read will buffer are flagged as cache misses to ensure that no
go onto the external bus before the memory writes more reads are reordered. Since one of the condi-
pending in the buffer even though the writes oc- tions to reorder a read is that all writes in the write
curred earlier in the program execution. buffer must be cache hits, no more reordering is al-
lowed until all of those flagged writes propogate to
A memory read will only be reordered in front of all the bus. Similarly, if an invalidation cycle is run all
writes in the buffers under the following conditions: If entries in the write buffer are flagged as cache
all writes pending in the buffers are cache hits and misses.
the read is a cache miss. Under these conditions the
Intel486 OX microprocessor will not read from an For multiple processor systems and/or systems us-
external memory location that needs to be updated ing OMA techniques, such as bus snooping, locked
by one of the pending writes. semaphores should be used to maintain cache con-
sistency.
6-9
6.3.1 WRITE BUFFERS AND 1/0 CYCLES The Intel486 OX microprocessor will assert the
LOCK # pin after the write buffers are emptied dur-
Input/Output (1/0) cycles must be handled in a dif- ing a locked bus cycle. With the LOCK# pin assert-
ferent manner by the write buffers. ed, the microprocessor will read the data, operate
on the data and place the results in a write buffer.
110 reads are never reordered in front of buffered The contents of the write buffer will then be written
memory writes. This insures that the Intel486 OX mi- to external memory. LOCK # will become inactive
croprocessor will update all memory locations be- after the write part of the locked cycle.
fore reading status from an 1/0 device.
The Intel486 OX microprocessor never buffers sin-

gle 110 writes. When processing an OUT instruction,
6.4 Interrupt and Non-Maskable
internal execution stops until the 1/0 write actually Interrupt Interface
completes on the external bus. This allows time for The Intel486 OX microprocessor provides two asyn-
the external system to drive an invalidate into the chronous interrupt inputs, INTR (interrupt request)
Intel486 OX microprocessor or to mask interrupts and NMI (non-maskable interrupt input). This section
before the processor progresses to the instruction describes the hardware interface between the in-
following OUT. REP OUTS instructions will be buff- struction execution unit and the pins. For a descrip-
ered. tion of the algorithmic response to interrupts refer to
Section 2.7. For interrupt timings refer to Section
1/0 device recovery time must be handled slightly
7.2.10.
differently by the Intel486 OX microprocessor than
with the Intel386 microprocessor. 1/0 device back-
to-back write recovery times could be guaranteed by 6.4.1 INTERRUPT LOGIC
the Intel386 microprocessor by inserting a jump to
the next instruction in the code that writes to the The Intel486 OX microprocessor contains a two-
device. The jump forces the Intel386 microprocessor clock synchronizer on the interrupt line. An interrupt
to generate a prefetch bus cycle which can't begin request will reach the internal instruction execution
until the 1/0 write completes. unit two clocks after the INTR pin is asserted, if
proper setup is provided to the first stage of the syn-
Inserting a jump to the next write will not work with chronizer.
the Intel486 OX microprocessor because the pre-
fetch could be satisfied by the on-chip cache. A read There is no special logic in the interrupt path other
cycle must be explicitly generated to a non-cache- than the synchronizer. The INTR signal is level sen-
able location in memory to guarantee that a read sitive and must remain active for the instruction exe-
bus cycle is performed. This read will not be allowed cution unit to recognize it. The interrupt will not be
to proceed to the bus until after the 1/0 write has serviced by the Intel486 OX microprocessor if the
completed because 1/0 writes are not buffered. The INTR signal does not remain active.
1/0 device will have time to recover to accept anoth-
er write during the read cycle. The instruction execution unit will look at the state of
the synchronized interrupt signal at specific clocks
6.3.2 WRITE BUFFERS IMPLICATIONS ON during the execution of instructions (if interrupts are
LOCKED BUS CYCLES enabled). These specific clocks are at instruction
boundaries, or iteration boundaries in the case of
Locked bus cycles are used for read-modify-write string move instructions. Interrupts will only be ac-
accesses to memory. During a read-modify-write accepted at these boundaries.
cess, a memory base variable is read, modified and
then written back to the same memory location. It is An interrupt must be presented to the Intel486 OX
important that no other bus cycles, generated by microprocessor INTR pin three clocks before the
other bus masters or by the Intel486 OX microproc- end of an instruction for the interrupt to be acknowl-
essor itself, be allowed on the external bus between edged. Presenting the interrupt 3 clocks before the
the read and write portion of the locked sequence. end of an instruction allows the interrupt to pass
through the two clock synchronizer leaving one
During a locked read cycle the Intel486 OX micro- clock to prevent the initiation of the next sequential
processor will always access external memory, it will instruction and to begin interrupt service. If the inter-
never look for the location in the on-chip cache, but rupt is not received in time to prevent the next in-
for write cycles, data is written in the internal cache struction, it will be accepted at the end of next in-
(if cache hit) and in the external memory. All data struction, assuming INTR is still held active. The in-
pending in the Intel486 OX microprocessor's write terrupt service microcode will start after two dead
buffers will be written to memory before a locked clocks.
cycle is allowed to proceed to the external bus.
6-10
infel· Intel486™ DX2 MICROPROCESSOR
The longest latency between when an interrupt re- Table 6.2. Register Values after Reset
quest is presented on the INTR.pin and when the
interrupt service begins is: longest instruction used Initial Value Initial Value
Register
+ the two clocks for synchronization + one clock (BIST) (NoBlst)
required to vector into the interrupt service micro- EAX Zero (Pass) Undefined
code.
ECX Undefined Undefined
EOX 0400+ Revision 10 0400+ Revision 10
6.4.2 NMI LOGIC EBX Undefined Undefined
The NMI pin has a synchronizer like that used on the ESP Undefined Undefined
INTR line. Other than the synchronizer, the NMllog- EBP Undefined Undefined
ic is different from that of the maskable interrupt. ESI Undefined Undefined
EOI Undefined Undefined
NMI is edge triggered as opposed to the level trig- EFLAGS 00000OO2h 00000002h
gered INTR signal. The rising edge of the NMI signal EIP OFFFOh OFFFOh
is used to generate the interrupt request. The NMI
ES OOOOh OOOOh
input need not remain active until the interrupt is ac-
CS FOOOh· FOOOh·
tually serviced •. The NMI pin only needs to remain
active for a single clock if the required setup and SS OOOOh OOOOh
hold times are met. NMI will operate properly if it is OS OOOOh OOOOh
held active for an arbitrary number of clocks. FS OOOOh OOOOh
GS OOOOh OOOOh
The NMI input must be held inactive for at least four 10TR Base = 0, Limit=3FFh Base=O, Limit=3FFh
clocks after it is asserted to reset the edge triggered CRO 60000010h 60000010h
logic. A subsequent NMI may not be generated if the
OR7 OOOOOOOOh OOOOOOOOh
NMI is not held inactive for at least two clocks after
being asserted.
CW 037Fh Unchanged
The NMI input is internally masked whenever the SW OOOOh Unchanged
NMI routine is entered. The NMI input will remain TW FFFFh Unchanged
masked until an IRET (return from interrupt) instruc- FIP OOOOOOOOh Unchanged
tion is executed. Masking the NMI signal prevents FEA OOOOOOOOh Unchanged
recursive NMI calls. If another NMI occurs while the FCS OOOOh Unchanged
NMI is masked off, the pending NMI will be executed
FOS OOOOh Unchanged
after the current NMI is done. Only one NMI can be
pending while NMI is masked. FOP OOOh Unchanged
FSTACK Undefined Unchanged
6.5 Reset and Initialization Table 6.3. Component and Revision ID

The Intel486 OX microprocessor has a built in self Intel486 DX2 CPU Component Revision
test (BIST) that can be run during reset. The BIST is Stepping Name ID ID
invoked if the AHOLO pin is asserted for 2 clocks
before and 2 clocks after RESET is deasserted. RE- A 04h 32h
SET must be active for 15 clocks with or with no 8 04h 33h
BIST being enabled. Refer to Section 8.0 for infor-
mation on Intel486 OX microprocessor testability.
The Intel486 OX microprocessor will start executing
The Intel486 OX microprocessor registers have the instructions at location FFFFFFFOH after RESET.
values shown in Table 1.5 after RESET is per- When the first InterSegment Jump or Call is execut-
formed. The EAX register contains information on ed, address lines A20-A31 will drop LOW for CS-rel-
the success or failure of the BIST if the self test is ative memory cycles, and the Intel486 OX micro-
executed. The OX register always contains a compo- processor will only execute instructions in the lower
nent identifier at the conclusion of RESET. The up- one Mbyte of physical memory. This allows the sys-
per byte of OX (OH) will contain 04 and the lower tem designer to use a ROM at the top of physical
byte (OL) will contain a stepping identifier (see Table memory to initialize the system and take care of
1.5). The floating point registers are initialized as if RESETs.
the FINITIFNINIT (initialize processor) instruction
was executed if the BIST was performed. If the BIST
is not executed, the floating point registers are un-
changed.
6-11
intal.. Intel486TM DX2 MICROPROCESSOR
RESET forces the Intel486 OX microprocessor to After the first FINIT or FNINIT instruction, FERR#
terminate all execution and local bus activity. No in- pin and the FPU status word register bits (0-7) will
struction or bus activity will occur as long as RESET be inactive irrespective of the Built-In Self-Test
is active. (BIST).
All entries in the cache are invalidated by RESET.

Power Down Mode (Upgrade Processor
Support)
6.5.1 PIN STATE DURING RESET
The Power Down Mode on the Intel486 DX2 micro-
The Intel486 DX2 microprocessor recognizes and processor, when initiated by the upgrade processor,
can respond to HOLD, AHOLD, and BOFF # re- reduces the power consumption of the Intel486 DX2
quests regardless of the state of RESET. Thus, even CPU (seeTable 14-2 D.C. Specifications), as well as
though the processor is in reset, it can still float its forces all of its output signals to be 3-stated. The
bus in response to any of these requests. UP# pin on the Intel486 DX2 microprocessor is
used for enabling the Power Down Mode.
While in reset, the Intel486 OX microprocessor bus
is in the state shown in Figure 6.4 if the HOLD, Once the UP# pin is driven active by the upgrade
AHOLD and BOFF # requests are inactive. Note that processor upon power-up, the Intel486 .DX2 micro-
the address (A31-A2, BE3#-BEO#) and cycle defi- processor's bus is floated immediately. The Intel486
nition (M/IO#, D/C#, W/R#) pins are undefined DX2 CPU enters the Power Down Mode when the
from the time reset is asserted up to the start of the UP# pin is sampled asserted in the clock before the
first bus cycle. All undefined pins (except FERR#) falling edge of RESET. The UP# pin has no effect
assume known values at the beginning of the first on the power down status, except during this edge.
bus cycle. The first bus cycle is always a code fetch The Intel486 DX2 CPU then remains in the Power
to address FFFFFFFOH. FERR# reflects the state Down Mode until the next time the RESET signal is
of the ES (error summary status) bit in the floating activated. For warm resets, with the upgrade proces-
point unit status word. The ES bit is initialized when- sor in the system, the Intel486 DX2 CPU will remain
ever the floating point unit state is initialized. The 3-stated and re-enter the Power Down Mode once
floating point unit's status word register can be ini- RESET is de-asserted. Similarly for power-up resets,
tialized by BIST or by executing FINITIFNINIT in- if the upgrade processor is not taken out of the sys-
struction. Thus, after reset and before executing the tem, the Intel486 DX2 CPU will 3-state its outputs
first FINIT or FNINIT instruction, the values of the upon sensing the UP# pin active and enter the Pow-
FERR# and the numeric status word register bits er Down Mode after the falling edge of RESET.
0-7 depends on whether or not BIST is performed.
Table 6-4 shows the state of FERR# signal after
reset and before the execution of the FINITIFNINIT
instruction.
Table&-4
FPU Status
BIST FERR#
Word Register
Performed Pin
Bits 0-7
Inactive Inactive
YES
(High) (Low)
Undefined Undefined
NO
(Low or High) (Low or High)
6-12
ClK
RESET 1 - - - -..... 219 elKs if .."-test ----+I
AHOlD
FlUSH#
(aync)
FlUSH#
(urnc)
A20M"
(sync)
A20N"
(oyne)
:!!
CD
...
c:
CD
ADS"
!» BREQ
~
"3"
fn
A31 -A.. , MIO#, BLAST
BED-BE3". PWT. PCD

UNDEFINED ..,
!
~
~
A3 , A21 PLOCK# UNDEFINED
(,.) D/c_. W/R"
1/1 PCHK".
a.
c: lOCK#
7777
:l-
:::I D3,-Do· ________....>:.,{,)""')(.J)}-------------------------------:---------------------
CD DPO-3
:II
m
fn
HlDA ® 241245-32
m
-I
NOTES:
1. RESET is an asynchronous input. t20 must be met only to guarantee recognition on a specific clock edge.
2a. When A20M# is driven synchronously. it must be driven high (inactive) for the CLK edge prior to the falling edge of RESET to ensure proper operation. A20M#
setup and hold times must be met. -
2b. When A20M# is driven asynchronously. it must be driven high (inactive) for two CLKs prior to and two CLKs after the falling edge of RESET to ensure proper
operation.
3a. When FLUSH# is driven synchronously. it should be driven low (active) for the CLK edge prior to the falling edge of RESET to invoke the 3-state Output Test
Mode. All outputs are guaranteed 3-stated within 10 CLKs of RESET being deasserted. FLUSH# setup and hold times must be met.
3b. When FLUSH# is driven asynchronously, it must be driven low (active) for two CLKs prior to and two CLKs after the falling edge of RESET to invoke the 3-state
Output Test Mode. All outputs are guaranteed 3-stated within 10 CLKs of RESET being deasserted.
4. AHOLD should be driven high (active) for the CLK edge prior to the falling edge of RESET to invoke the Built-In-Self-Test (BISn. AHOLD setup and hold times
must be met.
5. Hold is recognized normally during RESET. On power-up HLDA is indeterminate until RESET is recognized by the CPU.
6. 15 CLKs RESET pulse width for warm resets. Power-up resets require RESET to be asserted for at least 1 ms after Vee and CLK are stable.
int:el.. Intel486TM DX2 MICROPROCESSOR
7.0 BUS OPERATION

7.1 Data Transfer Mechanism Address bits AO and A 1 of the physical operand's
base address can be created when necessary. Use
All data transfers occur as a result of one or more of the byte enables to create AO and A 1 is shown in
bus cycles. Logical data operands of byte, word and Table 7.2. The byte enables can also be decoded to
dword lengths may be transferred without restric- generate BLE# (byte low enable) and BHE# (byte
tions on physical address alignment. Oata may be high enable). These signals are needed to address
accessed at any byte boundary but two or three cy- 16-bit memory systems (see Section 7.1.4 Inter-
cles may be required for unaligned data transfers. facing with 8- and 16-bit memories).
See Section 7.1.3 Oynamic Bus Sizing and 7.1.6 Op-
erand Alignment. Table 7.2. Generating AO-A31 from
BEO#-BE3# and A2-A31
The Intel486 OX microprocessor address signals are
Intel486TM OX CPU Address Signals
split into two components. High-order address bits
are provided by the address lines, A2-A31. The byte A31 ......... A2 BE3# BE2# BE1# BEO#
enables, BEO#-BE3#, form the low-order address
and provide linear selects for the four bytes of the Physical Base
32-bit address bus. Address
A31 ......... A2 A1 AO
The byte enable outputs are asserted when their as-
sociated data bus bytes are involved with the pres- A31 ......... A2 0 0 X X X Low
ent bus cycle, as listed in Table 7.1. Byte enable
patterns which have a negated byte enable separat-
A31 ......... A2 0 1 X X Low High
ing two or three asserted byte enables will never A31 ......... A2 1 0 X Low High High
occur (see Table 7.5). All other byte enable patterns
are possible.
A31 ......... A2 1 1 Low High High High
Table 7.1. Byte Enables and Associated

7.1.1 MEMORY AND 1/0 SPACES
Data and Operand Bytes
Byte Bus cycles may access physical memory space or
Enable Associated Data Bus Signals I/O space. Peripheral devices in the system may ei-
ther be memory-mapped, or I/O-mapped, or both.
Signal
Physical memory addresses range from OOOOOOOOH
BEO# 00-07 (byte O-Ieast significant) to FFFFFFFFH (4 gigabytes). I/O addresses range
from OOOOOOOOH to OOOOFFFFH (64 Kbytes) for pro-
BE1# 08-015 (byte 1) grammed I/O. See Figure 7.1.
BE2# 016-023 (byte 2)
BE3# 024-031 (byte 3-most significant)
7-1
FFFFFFFFH
~
I/(~~
PHYSICAL
MEMORY
4GBYTE
I~/NOT I).
OOOOFFFFH
~
:W1
B} ACCESSIBLE
64 kBYTE PROGRAMMED
OOOOOOOOH L.._ _--' OOOOOOOOH I/o SPACE 241245-33
Physical Memory Space 1/0 Space
Figure 7.1. Physical Memory and 1/0 Spaces
7.1.2 MEMORY AND 1/0 SPACE.
I I I I r~'~
32-Bit Wide Organization
ORGANIZATION
The Intel486 OX microprocessor data path to memo-
ry and input/output (110) spaces can be 32-, 16- or m"'~
8-bits wide. The byte enable signals, BEO#-BE3#,
00000003H '-. • • • • • ~ oOOOOOOOH
allow byte granularity when addressing any memory
OJ
or 110 structure whether 8, 16 or 32 bits wide. BE3# BE2# BE1# 9EO#
241245-34
The Intel486 OX microprocessor includes bus con-
trol pins, BS16 # and BS8 #, which allow direct con- 16-Blt Wide Organization
nection to 16- and 8-bit memories and 110 devices. FFFFFFFFH FFFFFFFEH
Cycles to 32-, 16- and 8-bit may occur in any se-
quence, since the 8S8# and 8S16# signals are
sampled during each bus cycle.
32-bit wide memory and 110 spaces are organized

as arrays of physical 4-byte words. Each memory or OOOOOOOlH oOOOOOOOH
L........w • ,....-J
110 4-byte word has four individually addressable 9HE# 9LE#
bytes at consecutive byte addresses (see Figure 241245-35
7.2). The lowest addressed byte is associated with
data signals 00-07; the highest-addressed byte Figure 7.2. Physical Memory
with 024-031. Physical 4-byte words begin at ad- and 1/0 Space Organization
dresses divisible by four.
7-2
intel@ Intel486TM DX2 MICROPROCESSOR
16-bit memories are organized as arrays of physical The Intel486 OX microprocessor will drive the byte
2-byte words. Physical 2-byte words begin at ad- enables appropriately during extra cycles forced by
dresses divisible by two. The byte enables 8EO#- 888# and 8816#. A2-A31 will not change if ac-
8E3#, must be decoded to A1, 8LE# and 8HE# to cesses are to a 32-bit aligned area. Table 7.3 shows
address 16-bit memories (see 8ection 7.1.4). the set of byte enables that will be generated on the
next cycle for each of the valid possibilities of the
To address 8-bit memories, the two low order ad- byte enables on the current cycle.
dress bits AO and A1, must be decoded from 8EO #-
8E3 #. The same logic can be used for 8- and 16-bit The dynamic bus sizing feature of the Intel486 OX
memories since the decoding logic for 8LE# and AO microprocessor is significantly different than that of
are the same (see 8ection 7.1.4). the Intel386 microprocessor. Unlike the Intel386 mi-
croprocessor, the Intel486 OX microprocessor re-
quires that data bytes be driven on the addressed
7.1.3 DYNAMIC DATA BUS SIZING data pins. The simplest example of this function is a
32-bit aligned, 8816# read. When the Intel486 OX
Oynamic data bus sizing is a feature allowing proc-
essor connection to 32-, 16- or 8-bit buses for mem- microprocessor reads the two high order bytes, they
ory or liD. A processor may connect to all three bus must be driven on the data bus pins 016-031. The
sizes. Transfers to or from 32-, 16- or 8-bit devices Intel486 OX microprocessor expects the two low or-
are supported by dynamically determining the bus der bytes on 00-015. The Intel386 microprocessor
width during each bus cycle. Address decoding cir- expects both the high and low order bytes on 00-
cuitry may assert 8816# for 16-bit devices, or 015. The Intel386 microprocessor always reads or
888# for 8-bit devices during each bus cycle. 888# writes data on the lower 16 bits of the data bus when
and 8816# must be negated when addressing 32- 8816# is asserted.
bit devices. An 8-bit bus width is selected if both
8816# and 888# are asserted. The external system must contain buffers to enable
the Intel486 OX microprocessor to read and write
data on the appropriate data bus pins. Table 7.4
8816#.and 888# force the Intel486 OX microproc-
essor to run additional bus cycles to complete re- shows the data bus lines where the Intel486 OX mi-
croprocessor expects data to be returned for each
quests larger than 16- or 8 bits. A 32-bit transfer will
be converted into two 16-bit transfers (or 3 transfers valid combination of byte enables and bus sizing op-
if the data is misaligned) when 8816# is asserted. tions.
Asserting 888# will convert a 32-bit transfer into
four 8-bit transfers. Valid data will only be driven onto data bus pins cor-
responding to active byte enables during write cy-
Extra cycles forced by 8816# or 888# should be cles. Other pins in the data bus will be driven but
viewed as independent bus cycles. 8816# or 888# they will not contain valid data. Unlike the Intel386
microprocessor, the Intel486 OX microprocessor will
must be driven active during each of the extra cycles
unless the addressed device has the ability to not duplicate write data onto parts of the data bus
change the number of bytes it can return between for which the corresponding byte enable is negated.
cycles.
Table 7.3. Next Byte Enable Values for BSn# Cycles

Current Next with BS8 # Next with BS16#
BE3# BE2# BE1# BEO# BE3# BE2# BE 1# BEO# BE3# BE2# BE 1# BEO#
1 1 1 0 n n n n n n n n
1 1 0 0 1 1 0 1 n n n n
1 0 0 0 1 0 0 1 1 0 1 1
0 0 0 0 0 0 0 1 0 0 1 1
1 1 0 1 n n n n n n n n
1 0 0 1 1 0 1 1 1 0 1 1
0 0 0 1 0 0 1 1 0 0 1 1
1 0 1 1 n n n n n n n n
0 0 1 1 0 1 1 1 n n n n
0 1 1 1 n n n n n n n n
"n" means that another bus cycle Will not be reqUired to satisfy the request.
7-3
Table 7.4. Data Pins Read with Different Bus Sizes

BE3# BE2# BE1# BEO# wlo BS8# IBS16# wBS8# WBS16#
1 1 1 0 07-00 07-00 07-00
1 1 0 0 015-00 07-00 015-00
1 0 0 0 023-00 07-00 015-00
0 0 0 0 031-00 07-00 015-00
1 1 0 1 015-08 015-08 015-08
1 0 0 1 023-08 015-08 015-08
0 0 0 1 031-08 015-08 015-08
1 0 1 1 023-016 023-016 023-016
0 0 1 1 031-016 023-016 031-016
0 1 1 1 031-024 031-024 031-024
7.1.4 INTERFACING WITH 8-,16- AND 32-BIT 16- and 8-bit memories require external byte swap-
MEMORIES ping logic for routing data to the appropriate data
lines and logic for generating BHE #, BLE # and A 1.
In 32-bit physical memories such as Figure 7.3, each In systems where mixed memory widths are used,
4-byte word begins at a byte address that is a multi- extra address decoding logic is necessary to assert
ple of four. A2-A31 are used as a 4-byte word se- B816# or B88#.
lect. BEO#-BE3# select individual bytes within the
4-byte word. B88# and B816# are negated for all Figure 7.4 shows the Intel486 OX microprocessor
bus cycles involving the 32-bit array. address bus interface to 32-, 16- and 8-bit memo-
ries. To address 16-bit memories the byte enables
must be decoded to produce A1, BHE# and BLE#
32 DATA BUS (00-031) (AO). For 8-bit wide memories the byte enables must
be decoded to produce AO and A1. The same byte
ADDRESS BUS (BEO#-BE3#,A2-A31)
select logic can be used in 16- and 8-bit systems
since BLE# is exactly the same as AO (see Table
7.5).
"HIGH" "HIGH"
241245-36 BEO#-BE3# can be decoded as shown in Table
7.5 to generate A1, BHE# and BLE#. The byte se-
Figure 7.3. Intel486™ DX Microprocessor lect logic necessary to generate BHE# and BLE# is
with 32-Bit Memory shown in Figure 7.5.
Intel486 ox Addre•• Bu. (A31-A2 BEO#-BE3#) 32-Bit

~ icroprocessor Uemory
B58# 1 1 BS16#
A31-A2
Addre•• 16-8it
Decode ~ BHE#, BLE#, A 1
Memory
8EO#-8E3# Byte
Select Logic
AO(BLE#), A 1
a-Bit
A31-A2 Memory
241245-37
Figure 7.4. Addressing 16- and 8-Bit Memories
7-4
Table 7.5. Generating A1, BHE# and BLE# for Addressing 16·Bit Devices
Intel486TM DX CPU Signals 8, 16·Bit Bus Signals
Comments
BE3# BE2# BE1# BEO# A1 BHE# BLE# (AO)
H* H* H* H* x x x x-no active bytes
H H H L L H L
H H L H L L H
H H L L L L L
H L H H H H L
H* L* H* L* x x x x-not contiguous bytes
H L L H L L H
H L L L L L L
L H H H H L H
L* H* H* L* x x x x-not contiguous bytes
L* H* L* H* x x x x-not contiguous bytes
L* H* L* L* x x x x-not contiguous bytes
L L H H H L L
L* L* H* L* x x x x-not contiguous bytes
L L L H L L H
L L L L L L L
BLE# asserted when 00-07 of 16-bit bus is active.
BHE # asserted when 08-015 of 16-bit bus is active.
A 1 low for all even words; A 1 high for all odd words.
Key:
x = don't care
H = high voltage level
L = low voltage level
• = a non-occurring pattern of Byte Enables; either none are asserted,
or the pattern has Byte Enables asserted for non-contiguous bytes
BEO# BE1#
_BE_1_#-a..[_~ _BE_3_#-a..[_~
241245-38 241245-39
BLE# (OR AO)
241245-40
Figure 7.5. Logic to Generate A1, BHE# and BLE# for 16·Bit Busses
Combinations of BEO#-BE3# which never occur Figure 7.6 shows a Intel486 OX microprocessor data
are those in which two or three asserted byte en- bus interface to 16- and 8-bit wide memories. Exter-
ables are separated by one or more negated byte nal byte swapping logic is needed on the data lines
enables. These combinations are "don't care" con- so that data is supplied to, and received from the
ditions in the decoder. A decoder can use the non- Intel486 OX microprocessor on the correct data pins
occurring BEO # - BE3 # combinations to its best ad- (see Table 7.4).
vantage.
7-5
00-07 4
08-015 4
Inlol486 OX 32-Bil
Microprocessor 016-023 4 Memory
024-031 4
BSS #
BS16# (A2-A31, BEO#-BE3#)
Bylo
I
16-Bil
Swap
logic • )
, 16
·1
Memory
I
Bylo 8-Bit
Address
,,
Decode Swap
Logic
• 8
·1
Memory
241245-41
Figure 7.6. Data Bus Interface to 16- and 8-bit Memories
7.1.5 DYNAMIC BUS SIZING DURING CACHE 7.1.6 OPERAND ALIGNMENT

LINE FILLS
Physical 4-byte words begin at addresses that are
BS8# and BS16# can be driven during cache line multiples of four. It is possible to transfer a logical
fills. The Intel486 OX microprocessor will generate operand that spans more than one physical 4-byte
enough 8- or 16-bit cycles to fill the cache line. This word of memory or liD at the expense of extra cy-
can be up to 16 8-bit cycles. cles. Examples are 4-byte operands beginning at ad-
dresses that are not evenly divisible by 4, or 2-byte
The external system should assume that all byte en- words split between two physical 4-byte words.
ables are active for the first cycle of a cache line fill. These are referred to as unaligned transfers.
The Intel486 OX microprocessor will generate prop-
er byte enables for subsequent cycles in the line fill. Operand alignment and data bus size dictate when
Table 7.6 shows the appropriate AO (BLE#), A1 and multiple bus cycles are required. Table 7.7 describes
BHE # for the various combinations of the Intel486 the transfer cycles generated for all combinations of
OX microprocessor byte enables on both the first logical operand lengths, alignment, and data bus siz-
and subsequent cycles of the cache line fill. The ... " ing. When multiple cycles are required to transfer a
marks all combinations of byte enables that will be multi-byte logical operand, the highest-order bytes
generated by the Intel486 OX microprocessor during are transferred first. For example, when the proces-
a cache line fill. sor does a 4-byte unaligned read beginning at loca-
tion x11 in the 4-byte aligned space, the three high
order bytes are read in the first bus cycle. The low
byte is read in a subsequent bus cycle.
Table 7.6. Generating AD, A1 and BHE# from the Intel486™ OX Microprocessor Byte Enables
First Cache Fill Cycle Any Other Cycle
BE3# BE2# BE1# BED#
AD A1 BHE# AD A1 BHE#
1 1 1 0 0 0 0 0 0 1
1 1 0 0 0 0 0 0 0 0
1 0 0 0 0 0 0 0 0 0
'0 0 0 0 0 0 0 0 0 0
1 1 0 1 0 0 0 1 0 0
1 0 0 1 0 0 0 1 0 0
'0 0 0 1 0 0 0 1 0 0
1 0 1 1 0 0 0 0 1 1
'0 0 1 1 0 0 0 0 1 0
'0 1 1 1 0 0 0 1 1 0
7-6
Table 7.7. Transfer Bus Cycles for Bytes, Words and Dwords
Physical Byte Address in

xx 00 01 10 11
Memory (Low Order Bits)
Transfer Cycles
b w w
over 32-Bit Bus
Transfer Cycles over
16-Bit Data Bus
b w
II= BS16# Asserted
Transfer Cycles over

8-Bit Data Bus
b
\1 = BS8 # Asserted
KEY:
b = byte transfer
w = 2-byte transfer
3 = 3-byte transfer
h = high-order portion
I = low-order portion
m = mid-order portion
4-Byte Operand Ib mlb I I
mhb hb
d = 4-byte transfer i i
byte with byte with
lowest highest
address address
The function of unaligned transfers with dynamic This section begins with basic non-cacheable non-
bus sizing is not obvious. When the external systems burst single cycle transfers. It moves on to multiple
asserts BS16# or BS8# forcing extra cycles, law- cycle transfers and introduces the burst mode.
order bytes or words are transferred first (opposite Cacheability is introduced in Section 7.2:3. The re-
to the example above). When the Intel486 OX micro- maining sections describe locked, pseudo-locked,
processor requests a 4-byte read and the external invalidate, bus hold and interrupt cycles.
system asserts BS16#, the lower 2 bytes are read
first followed by the upper 2 bytes. Bus cycles and data cycles are discussed in this
section. A bus cycle is at least two clocks long and
In the unaligned transfer described above, the proc- begins with ADS# active in the first clock and ready
essor requested three bytes on the first cycle. If the active in the last clock. Data is transferred to or from
external system asserted B$16# during this 3-byte the Intel486 OX microprocessor during a data cycle.
transfer, the lower word is transferred first followed A bus cycle contains one or more data cycles.
by the upper byte. In the final cycle the lower byte of
the 4-byte operand is transferred as in the 32-bit ex- Refer to Section 7.2.13 for a description of the bus
ample above. states shown in the timing diagrams.
7.2 Bus Functional Description 7.2.1 NON-CACHEABLE NON-BURST SINGLE

CYCLE
The Intel486 OX microprocessor supports a wide va-
riety of bus transfers to meet the needs of high per- 7.2.1.1 No Walt States
formance systems. Bus transfers G;an be single cycle
or multiple cycle, burst or non-burst, cacheable or The fastest non-burst bus cycle that the Intel486 OX
non-cacheable, 8-, 16- or 32-bit, and pseudo~locked. microprocessor supports is two clocks long. These
To support multiprocessing systems there are cache cycles are called 2-2 cycles because reads and
invalidation CYcles and locked cycles. writes take two cycles each. The first 2 refers. to
7-7
reads and the second to writes. For example, if a 7.2.2 MULTIPLE AND BURST CYCLE BUS
wait state needs to be added to a write, the cycle TRANSFERS
would be called 2-3.
Multiple cycle bus transfers can be caused by inter-
Basic two clock read and write cycles are shown in nal requests from the Intel486 DX microprocessor or
Figure 7.7. The Intel486 DX microprocessor initiates by the external memory system. An internal request
a cycle by asserting the address status signal for a 64-bit floating point load or a 128-bit pre-fetch
(ADS#) at the rising edge of the first clock. The must take more than one cycle. Internal requests for
AOS# output indicates that a valid bus cycle defini- unaligned data may also require multiple bus cycles.
tion and address is available on the cycle definition A cache line fill requires multiple cycles to complete.
lines and address bus. The external system can cause a multiple cycle
transfer when it can only supply 8 or 16 bits per
The non-burst ready input (RDY #) is returned by the cycle.
external system in the second clock. RDY # indi-
cates that the external system has presented valid Only multiple cycle transfers caused by internal re-
data on the data pins in response to a read or the quests are considered in this section. Cacheable cy-
external system has accepted data in response to a cles and 8- and 16-bit transfers are covered in Sec-
write. tions 7.2.3 and 7.2.5.
The Intel486 OX microprocessor samples ROY # at 7.2.2.1 Burst Cycles

the end of the second clock. The cycle is complete if
ROY # is active (LOW) when sampled. Note that The Intel486 DX microprocessor can accept burst
ROY # is ignored at the end of the first clock of the cycles for any bus requests that require more than a
bus cycle. single data cycle. During burst cycles, a new data
item is strobed into the Intel486 OX microprocessor
every clock rather than every other clock as in non-
The burst last signal (BLAST #) is asserted (LOW)
by the Intel486 OX microprocessor during the sec- burst cycles. The fastest burst cycle requires 2
ond clock of the first cycle in all bus transfers illus- clocks for the first data item with subsequent data
items returned every clock.
trated in Figure 7.7. This indicates that each transfer
is complete after a single cycle. The Intel486 DX The Intel486 DX microprocessor is capable of burst-
microprocessor asserts BLAST# in the last cycle of ing a maximum of 32 bits during a write. Burst writes
a bus transfer. can only occur if BS8# or BS16# is asserted. For
example, the Intel486 DX microprocessor can burst
The timing of the parity check output (PCHK#) is write four 8-bit operands or two 16-bit operands in a
shown in Figure 7.7. The Intel486 DX microproces- single burst cycle. But the Intel486 OX microproces-
sor drives the PCHK# output one clock after ready sor cannot burst multiple 32-bit writes in a single
terminates a read cycle. PCHK # indicates the parity burst cycle.
status for the data sampled at the end of the previ-
ous clock. The PCHK# signal can be used by the Burst cycles begin with the Intel486 OX microproc-
external system. The Intel486 OX microprocessor essor driving out an address and asserting ADS# in
does nothing in response to the PCHK # output. the same manner as non-burst cycles. The Intel486
OX microprocessor indicates that it is willing to per-
form a burst cycle by holding the burst last signal
7.2.1.2 Inserting Wait States (BLAST #) inactive in the second clock of the cycle.
The external system can insert wait states into the The external system indicates its willingness to do a
basic 2-2 cycle by driving ROY # inactive at the end burst cycle by returning the burst ready Signal
of the second clock. RDY # must be driven inactive (BRDY #) active.
to insert a wait state. Figure 7.8 illustrates a simple The addresses of the data items in a burst cycle will
non-burst, non-cacheable signal with one wait state all fall within the same 16-byte aligned area (corre-
added. Any number of wait states can be added to sponding to an internal Intel486 DX microprocesSor
an Intel486 DX microprocessor bus cycle by main- cache line). A 16-byte aligned area begins at loca-
taining ROY # inactive. tion XXXXXXXO and ends at location XXXXXXXF.
During a burst cycle, only BEO-3#, A2, and A3 may
The burst ready input (BRDY #) must be driven inac- change. ~-A31, MIIO#, D/C#, and W/R# will re-
tive on all clock edges where ROY# is driven inac- main stable throughout a burst. Given the first ad-
tive for proper operation of these simple non-burst dress in a burst, external hardware can easily calcu-
cycles. late the address of subsequent transfers in advance.
An external memory system can be designed to
quickly fill the Intel486 DX microprocessor internal
cache lines.
7-8
intel., Intel486TM DX2 MICROPROCESSOR
Ti T1 T2 T1 T2 11 12 T1 T2 Ti
ClK
ADS#
\ / \ / \ / \ /
A2-A31
M/IO#
D/C# X X X X
BEO-3#
W/R#
\ / \ /
RDY#
BlAST#
X \ / ~ / \ / ~ C
DATA FROM CPU TO FROM CPU
CPU
I
PCHK#
0) OJ
READ WRITE READ WRITE
241245-42
Figure 7.7. Basic 2-2 Bus Cycle
Ti 11 T2 T2 11 T2 T2 Ti
ClK
ADS#
\ / \ /
A2-A31
M/IO#
D/C#
BEO-3#
X X
W/R#
\ /
RDY#
BLAST#
X \ / \ I
I
C
I
DATA
READ
®CPU (
WRITE
: FROM CPU
I
)-
241245-43
Figure 7.8. Basic 3-3 Bus Cycle
7-9
inial. li1te1486TM DX2 MICROPROCESSOR
Burst cycles are not limited to cache line fills. Any the external system returns KEN#, BS8# and
multiple cycle read request by the Intel486 OX mi- BS16#. BLAST# should only be sampled in the
croprocessor can be converted into a burst cycle. second and subsequent clocks of a cycle when the
The Intel486 OX microprocessor will only burst the external system returns ROY # or BROY #.
number of bytes needed to complete a transfer. For
example, eight bytes will be bursted in for a 64-bit The system may terminate a burst cycle by returning
floating point non-cacheable read. ROY # instead of BROY #. BLAST # will remain
deasserted until the last transfer. However, any
The external system converts a multiple cycle re- transfers required to complete a cache line fill will
quest into a burst cycle by returning BROY # active follow the burst order, e.g., if burst order was 4, 0, C,
rather than ROY # (non-burst ready) in the first cycle 8 and ROY # was returned at after 0, the next trans-
of a transfer. For cycles that cannot be bursted such fers will be from C and 8.
as interrupt acknowledge and halt, BROY # has the
same effect as ROY #. BROY"" is ignored if both
BROY # and ROY # are returned in the same clock. 7.2.2.3 Non-Cacheable, Non-Burst, Multiple
Memory areas and peripheral devices that cannot Cycle Transfers
perform bursting must terminate cycles with ROY"". Figure 7.9 illustrates a 2 cycle non-burst, non-cache-
able multiple cycle read. This transfer is simply a
7.2.2.2 Terminating Multiple and sequence of two single cycle transfers. The Intel486
Burst Cycle Transfers OX microprocessor indicates to the external system
that this is a multiple cycle transfer by driving
The Intel486 OX microprocessor drives BLAST# in- BLAST # inactive during the second clock of the first
active for all but the last cycle in a multiple cycle cycle. The external system returns ROY # active in-
transfer. BLAST# is driven inactive in the first cycle dicating that it will not burst the data. The external
to inform the external system that the transfer could system also indicates that the data is not cacheable
take additional cycles. BLAST# is driven active in by returning KEN # inactive one clock before it re-
the last cycle of the transfer indicating that the next turns ROY # active. When the Intel486 OX micro-
time BROY # or ROY"" is returned the transfer is processor samples ROY # active it ignores BROY #.
complete.
Each cycle in the transfer begins when AOS# is
BLAST # is not valid in the first clock of a bus cycle. driven active and the cycle is complete when the
It should be sampled only in the second and subse- external system returns ROY # active.
quent clocks when ROY # or BROY # is returned.
The Intel486 OX microprocessor indicates the last
The number of cycles in a transfer is a function of cycle of the transfer by driving BLAST# active. The
several factors including the number of bytes the mi- next ROY # returned by the external system termi-
croprocessor needs to complete an internal request nates the transfer.
(1, 2, 4, 8, or 16), the state of the bus size inputs
(BS8# and BS16#), the state of the cache enable
input (KEN #) and alignment of the data to be trans- 7.2.2.4 Non-Cacheable Burst Cycles
ferred. The external system converts a multiple cycle re-
quest into a burst cycle by returning BROY # active
When the Intel486 OX microprocessor initiates a re- rather than ROY # in the first cycle of the transfer.
quest it knows how many bytes will be transferred This is illustrated in Figure 7.10.
and if the data is aligned. The external system must
tell the microprocessor whether the data is cache- There are several features to note in the burst read.
able (if the transfer is a read) and the width of the AOS# is only driven active during the first cycle of
bus by returning the state of the KEN#, BS8# and the transfer. ROY"" must be driven inactive when
BS16# inputs one clock before ROY# or BROY# is BROY # is returned active.
returned. The Intel486 OX microprocessor deter-
mines how many cycles a transfer will take based on BLAST # behaves exactly as it does in the non-burst
its internal information and inputs from the external read. BLAST# is driven inactive in the second clock
system. of the first cycle of the transfer indicating more cy-
cles to follow. In the last cycle, BLAST# is driven
BLAST # is not valid in the first clock of a bus cycle active telling the external memory system to end the
because the Intel486 OX microprocessor cannot de- burst after returning the next BROY #.
termine the number of cycles a transfer will take until
7-10
Ti Tl T2 Tl T2 Ti
ClK
ADS#
\ / \ /
A2-A31
M/IO#
D/C#
W/R#
X X
BEO-3#
RDY#
BRDY#
KEN#
BlAST#
X 7 ~ ~ I
I I
DATA
® CPU
I
®--
CPU
I
1st DATA 2nd DATA

241245-44
Figure 7.9. Non-Cacheable, Non-Burst, Multiple Cycle Transfers
Ti Tl T2 T2 Ti Ti
ClK
ADS#
A2-A31
\ /
M/IO#
D/C#
W/R#
X X
BEO-3#
RDY#
BRDY#
KEN#
BlAST#
X 7 \ L
I
DATA
~ CPU CPU
241245-45
Figure 7.10. Non-Cacheable Burst Cycle
7-11
7.2.3 CACHEABLE CYCLES 7.2.3.1 Byte Enables during a Cache Line Fill
Any memory read can become a cache fill operation. For the first cycle in the line fill, the state of the byte
The external memory system can allow a read re- enables should be ignored. In a non-cacheable
quest to fill a cache line by returning KEN # active memory read, the byte enables indicate the bytes
one clock before ROY # or BROY # during the first actually required by the memory or code fetch.
cycle of the transfer on the external bus. Once
KEN # is asserted and the remaining three require- The Intel486 OX microprocessor expects to receive
ments described below are met, the Intel486 OX mi- valid data on its entire bus (32 bits) in the first cycle
croprocessor will fetch an entire cache line regard- of a cache line fill. Oata should be returned with the
less of the state of KEN #. KEN # must be returned assumption that all the byte enable pins are driven
active in the last cycle of the transfer for the data to active. However if BS8 # is asserted only one byte
be written into the internal cache. The Intel486 OX need be returned on data lines 00-07. Similarly if
microprocessor will only convert memory reads or BS16# is asserted two bytes should be returned on
prefetches into a cache fill. 00-015.
KEN # is ignored during write or 1/0 cycles. Memory The Intel486 OX microprocessor will generate the
writes will only be stored in the on·chip cache if addresses and byte enables for all subsequent cy-
there is a cache hit. 1/0 space is never cached in cles in the line fill. The order in which data is read
the internal cache. during a line fill depends on the address of the first
item read. Byte ordering is discussed in Section
To transform a read or a prefetch into a cache line 7.2.4.
fill the following conditions must be met:
1. The KEN # pin must be asserted one clock pri- 7.2.3.2 Non-Burst Cacheable Cycles
or to ROY # or BROY # being returned for the
first data cycle. Figure 7.11 shows a non-burst cacheable cycle. The
2. The cycle must be of the type that can be inter- cycle becomes a cache fill when the Intel486 OX
nally cached. (Locked reads, 1/0 reads, and microprocessor samples KEN # active at the end of
interrupt acknowledge cycles are never cach- the first clock. The Intel486 OX microprocessor
ed). drives BLAST # inactive in the second clock in re-
sponse to KEN #. BLAST # is driven inactive be-
3. The page table entry must have the page cause a cache fill requires 3 additional cycles to
cache disable bit (PCO) set to o. To cache a complete. BLAST # remains inactive until the last
page table entry, the page directory must have transfer in the cache line fill. KEN # must be re-
PCO=O. To cache reads or prefetches when turned active in the last cycle of the transfer for the
paging is disabled, or to cache the page direc- data to be written into the internal cache.
tory entry, control register 3 (CR3) must have
PCO=O. Note that this cycle would be a single bus cycle if
4. The cache disable (CO) bit in control register 0 KEN # was not sampled active at the end of the first
(CRO) must be clear. clock. The subsequent three reads would not have
happened since a cache fill was not requested.
External hardware can determine when the Intel486
OX microprocessor has transformed a read or pre- The BLAST # output is invalid in the first clock of a
fetch into a cache fill by examining the KEN # , cycle. BLAST # may be active during the first clock
M/IO#, O/C#, W/R#, LOCK#, and PCO pins. due to earlier inputs. Ignore BLAST # until the sec-
These pins convey to the system the outcome of ond clock.
conditions 1-3 in the above list. In addition, the In-
tel486 OX drives PCO high whenever the CO bit in Ouring the first cycle of the cache line fill the exter-
CRO is set, so that external hardware can evaluate nal system should treat the byte enables as if they
condition 4. are all active. In subsequent cycles in the burst, the
Intel486 OX microprocessor drives the address lines
Cacheable cycles can be burst or non-burst. and byte enables (see Section 7.2.4.2 for Burst and
Cache Line Fill Order).
7-12
Ti Tl T2 Tl T2 T1 T2 T1 T2 Ti
elK
ADS#
A2-A31
''---!--If ''-----L.......If
1.4/10#
D/C#
W/R#
BEO-3#
____~X~_r----~X~~----~X~_r----~XL_r-------
RDY#
BRDY#
w
I
KEN#
W
BlAST#
____~x'--. . . . . . . /. \'--.....J....-'.l...-.-_C,---
DATA ------~------~----~~~----~----~~~----~----~~~----~----~
241245-46
Figure 7.11. Non-Burst, Cacheable Cycles
7.2.3.3 Burst Cacheable Cycles The external system informs the Intel486 OX micro-
processor that it will burst the line in by driving
Figure 7.12 illustrates a burst mode cache fill. As in BROY # active at the end of the first cycle in the
Figure 7.11, the transfer becomes a cache line fill transfer.
when the external system returns KEN # active at
the end of the first clock in the cycle. Note that during a burst cycle ADS# is only driven
with the first address.
7-13
Ti T1 T2 T2 T2 T2 Ti
ClK
ADS#
\\.-....J........I!
A4-A31,
1.1/10#,
O/C#,
W/R# ____~x~~--~----~--~--~----
A2-A3,
BEO-3#
RDY#
BRDY#
I
I
KEN#
\J) I
BlAST#
_~x i /
DATA
PCHK#
241245-47
Figure 7.12. Burst Cacheable Cycle
7.2.3.4 Effect of Changing KEN# during a would be a cache line fill. Similarly, it uses the value
Cache Line Fill of KEN # in the last cycle, before early ROY # to
load the line just retrieved from the memory into the
KEN# can change multiple times as long as it ar· cache. KEN # is sampled every clock, it must satisfy
rives at its final value in the clock before ROY # or setup and hold time.
BROY# is returned. This is illustrated in Figure 7.13.
Note that the timing of BLAST# follows that of KEN # can also change multiple times before a burst
KEN# by one clock. The Intel486 OX samples cycle as long as it arrives at its final value one clock
KEN # every clock and uses the value returned in before ready is returned active.
the clock before ready to determine if a bus cycle
7·14
Ti T1 T2 T2 T2 T1 T2
ClK
ADS#
\ / \ /
A4-A31,
~
1.4/10#,
D/C#,
W/R#
~ ~
A2-A3,
BEO-3#
RDY#
KEN#
W W
BlAST#
X / \ / \ /
DATA
@
CPU @-
CPU
241245-48
Figure 7.13. Effect of Changing KEN#
7.2.4 BURST MODE DETAILS data into the chip when either ROY # or BRDY # are
active. Driving BRDY # and ROY # inactive adds a
wait state to the transfer. A burst cycle where two
7.2.4.1 Adding Wait States to Burst Cycles clocks are required for every burst item is shown in
Figure 7.14.
Burst cycles need not return data on every clock.
The Intel486 OX microprocessor will only strobe
7-15
Ti Tl T2 T2 T2 T2 T2 T2 T2
CLK
ADS#
\ I
A4-A31,
t.l/IO#,
D/C#,
W/R#
X
A2-A3,
BEO-3# X X X X
RDY#
BRDY#
KEN#
\JJ
BLAST#
I I I
DATA ffi ffi ffi fTo\

-----1'----!--~~)----7---<~~---!----<~)----!---~
241245-49
Figure 7.14. Slow Burst Cycle
7.2.4.2 Burst and Cache Line Fill Order Table 7.7. Burst Order
The burst order used by the Intel486 DX microproc- First Second Third Fourth
essor is shown in Table 7.7. This burst order is fol- Addr. Addr. Addr. Addr.
lowed by any burst cycle (cache or not), cache line 0 4 8 C
fill (burst or not) or code prefetch.
4 0 C 8
This burst order is optimized for a two-way inter- 8 C 0 4
leaved memory architecture. This means that if the C 8 4 0
memory is built as 64-bit (versus 32-bit) words which
are multiplexed into the 32-bit data bus, the Intel486 An example of burst address sequencing is shown in
CPU will read all 64 bits before accessing the next Figure 7.15.
location.
The microprocessor presents each request for data

in an order determined by the first address in the
transfer. For example, if the first address was 104
the next three addresses in the burst will be 100,
10C and 108.
7-16
If>OO~I!..O~OOO~OOW
Ti Tl T2 T2 T2 T2 Ti
ClK
ADS#
\ /
A2-A31
X
104
X100 i X10C i X108:
RDY#
BRDY#
KEN#
W W
BlAST#
X / \ r=
DATA
241245-50
Figure 7.15. Burst Cycle Showing Order of Addresses
The sequences shown in Table 7.7 accommodate any time. The Intel486 OX microprocessor will auto-
systems with 64-bit busses as well as systems with matically generate another normal bus cycle after
32-bit data busses. The sequence applies to all being interrupted to complete the data transfer. This
bursts, regardless of whether the purpose of the is called an interrupted burst cycle. The external sys-
burst is to fill a cache line, do a 64-bit read, or do a tem can respond to an interrupted burst cycle with
pre-fetch. If either BS8# or BS16# is returned ac- another burst cycle.
tive, the Intel486 OX microprocessor completes the
transfer of the current 32-bit word before progress- The external system can interrupt a burst cycle by
ing to the next 32-bit word. For example, a BS16# returning ROY # instead of BROY #. ROY # can be
burst to address 4 has the following order: 4-6-0-2- returned after any number of data cycles terminated
C-E-8-A. with BROY#.
An example of an interrupted burst cycle is shown in

7.2.4.3 Interrupted Burst Cycles Figure 7.16. The Intel486 OX microprocessor imme-
diately drives ADS # active to initiate a new bus cy-
Some memory systems may not be able to respond
cle after ROY # is returned active. BLAST # is driven
with burst cycles in the order defined in Table 7.7.
inactive one clock after ADS # begins the second
To support these systems the Intel486 OX micro-
bus cycle indicating that the transfer is not complete.
processor allows a burst cycle to be interrupted at
7-17
Ti T1 T2 T2 T1 T2 T2 Ti
ClK
ADS#
\L....---!---If
A2-A31 ___ ..L.-..JX~_i-_1_04_-i-..JX 100 : X~_i-_1_0C_-i-....IX~1_08-+-:_ __
RDY#
BRDY#
KEN#
w
BlAST#
'\...-......1........1 \,--_LL.....-
DATA
241245-51
Figure 7.16. Interrupted Burst Cycle
KEN # need not be returned active in the first data An example of the order in which the Intel486 OX
cycle of the second part of the transfer in Figure microprocessor requests operands during a cycle in
7.16. The cycle had been converted to a cache fill in which the external system mixes ROY # and
the first part of the transfer and the Intel486 OX mi- BROY# is shown in Figure 7.17. The Intel486 OX
croprocessor expects the cache fill to be completed. microprocessor initially requests a transfer begin-
Note that the first half and second half of the trans- ning at location 104. The transfer becomes a cache
fer in Figure 7.16 are each two cycle burst transfers. line fill when the external system returns KEN # ac-
tive. The first cycle of the cache fill transfers the
The order in which the Intel486 OX microprocessor contents of location 104 and is terminated with
requests operands during an interrupted burst trans- ROY #. The Intel486 OX microprocessor drives out a
fer is determined by Table 7.7. Mixing ROY# and new request (by asserting AOS#) to address 100. If
BROY # does not change the order in which oper- the external system terminates the second cycle
and addresses are requested by the Intel486 OX mi- with BROY #, the Intel486 OX microprocessor will
croprocessor. next request/expect address 10C. The correct order
is determined by the first cycle in the transfer, which
may not be the first cycle in the burst if the system
mixes ROY # with BROY #.
7-18
Ti Tl T2 T1 T2 T2 T2 Ti
ClK
ADS#
\ / \ /
A2-A31
X
104
X
100 X10C i X108:
RDY#
BRDY#
KEN#
W W
BlAST#
X / \ / \ C
TO
DATA CPU
241245-52
Figure 7.17. Interrupted Burst Cycle with Unobvious Order of Addresses
7.2.5 8- AND 16-BIT CYCLES Driving the B816# and B88# active can force the
Intel486 DX microprocessor to run additional cycles
The Intel486 DX microprocessor supports both 16- to complete what would have been only a single
and 8-bit external busses through the 8816# and 32-bit cycle. B88# and B816# may change the
888# inputs. 8816# and 888# allow the external state of BLA8T # when they force subsequent cy-
system to specify, on a cycle by cycle basis, whether cles from the transfer.
the addressed component can supply 8, 16 or 32
bits. 8816# and 888# can be used in burst cycles Figure 7.18 shows an example in which B88#
as well as non-burst cycles. If both 8816# and forces the Intel486 DX microprocessor to run two
888 # are returned active for any bus cycle, the In- extra cycles to complete a transfer. The Intel486 DX
tel486 DX microprocessor will respond as if only microprocessor issues a request for 24 bits of infor-
8S8 # were active. mation. The external system drives B88# active in-
dicating that only eight bits of data can be supplied
The timing of 8816# and 888# is the same as that per cycle. The Intel486 DX microprocessor issues
of KEN#. B816# and B88# must be driven active two extra cycles to complete the transfer.
before the first RDY # or BRDY # is driven active.
7-19
Ti T1 T2 T1 T2 T1 T2 Ti
ClK
ADS#
L
\'------!---II \'------!---II
A2-A31
M/IO#
D/C#
W/R#
__~~X~~____~~____~____C=
BEO-3# __-+~X~~__~X~~__~X~~____c=
RDY#
BS8#
\JJ \JJ I
\JJ
BlAST#
cb ,'----I--\J..-...+--'-c_
DATA rrt\
----T----'----(Y:!:V>----'--~Y:!:V>---~----;~
rrt\ ~
241245-53
Figure 7.18. 8-Bit Bus Size Cycle
Extra cycles forced by the BS 16 # and BS8 # should BS8# and BS16# operate during burst cycles in ex-
be viewed as independent bus cycles. BS16# and actly the same manner as non-burst cycles. For ex-
BS8# should be driven active for each additional ample, a single non-cacheable read could be trans-
cycle unless the addressed device has the ability to ferred by the Intel486 DX microprocessor as four
change the number of bytes it can return between 8-bit burst data cycles. Similarly, a single 32-bit write
cycles. The Intel486 DX microprocessor will drive could be written as four 8-bit burst data cycles. An
BLAST # inactive until the last cycle before the example of a burst write is shown in Figure 7.19.
transfer is complete. Burst writes can only occur if BS8# or BS16# is
asserted.
Refer to Section 7.1.3 for the sequencing of ad-
dresses while BS8# or BS16# are active.
7-20
intel., Intel486TM DX2 MICROPROCESSOR
Ti T1 T2 T2 T2 T2 Ti
ClK
ADS#
ADDR
SPEC -J.........Jx'----...;.....---i----i-------r-----+---':
I
C
BEO-3#
RDY#
BRDY#
8S8#
\'--_ _-_--.J/
BlAST#
_---T""--IX'---+--',
DATA -----r---...J..--« :FROM CPU )-
~~:--~--~----~
241245-54
Figure 7.19. Burst Write as a Result of BS8# or BS16#
7.2.6 LOCKED CYCLES Locked cycles are implemented in hardware with the
LOCK # pin. When LOCK # is active, the processor
Locked cycles are generated in software for any in- is performing a read-modify-write operation and the
struction that performs a read-modify-write opera- external bus should not be relinquished until the cy-
tion. During a read-modify-write operation the proc- cle is complete. Multiple reads or writes can be
essor can read and modify a variable in external locked. A locked cycle is shown in Figure 7.20.
memory and be assured that the variable is not ac- LOCK # goes active with the address and bus defini-
cessed between the read and write. tion pins at the beginning of the first read cycle and
remains active until RDY # is returned for the last
Locked cycles are automatically generated during write cycle. For unaligned 32 bits read-modify-write
certain bus transfers. The xchg (exchange) instruc- operation, the LOCK # remains active for the entire
tion generates a locked cycle when one of its oper- duration of the multiple cycle. It will go inactive when
ands is memory based. Locked cycles are generat- RDY # is returned for the last write cycle.
ed when a segment or page table entry is updated
and during interrupt acknowledge cycles. Locked cy-
cles are also generated when the LOCK instruction
prefix is used with selected instructions.
7-21
Ti Tl T2 Tl T2 Ti
CLK
ADS#
\ / \ /
A2-A31
1.1/10#
D/C#
8EO-3#
X X
W/R#
\ I
RDY#
I I
I
DATA @
CPU
I
( FROM PPU )-
LOCK#
\ f
READ WRITE
241245-55
Figure 7.20. Locked Bus Cycle
When LOCK# is active, the Intel486 OX microproc- PLOCK# is asserted during the first write to indicate
essor will recognize address hold and backoff but that another write follows. This behavior is shown in
will not recognize bus hold. It is left to the external Figure 7.21.
system to properly arbitrate a central bus when the
Intel486 OX microprocessor generates LOCK#. The first cycle of a 64-bit floating point write is the
only case in which both PLOCK# and BLAST# are
asserted. Normally PLOCK# and BLAST# are the
7.2.7 PSEUDO-LOCKED CYCLES inverse of each other.
Pseudo-locked cycles assure that no other master
will be given control of the bus during operand trans- During all of the cycles where PLOCK# is asserted,
fers which take more than one bus cycle. Examples HOLD is not acknowledged until the cycle com-
include 64-bit floating point read and writes, 64-bit pletes. This results in a large HOLD latency, espe-
descriptor loads and cache line fills. cially when BS8# or BS16# is asserted. To reduce
the HOLD latency during these cycles, windows are
available between transfers to allow HOLD to be ac-
Pseudo-locked transfers are indicated by the
PLOCK # pin. The memory operands must be knowledged during non-cacheable, non-bursted
aligned for correct operation of a pseudo-locked cy- code prefetches. PLOCK # will be asserted since
cle. BLAST # is negated, but it is ignored and HOLD is
recognized during the prefetch.
PLOCK# need not be examined during burst reads.
A 64-bit aligned operand can be retrieved in one PLOCK # can change several times during a cycle
settling to its final value in the clock ready is re-
burst (note: this is only valid in systems that do not
interrupt bursts). turned.
The system must examine PLOCK # during 64-bit 7.2.8 INVALIDATE CYCLES
writes since the Intel486 OX microprocessor cannot
burst write more than 32 bits. However, burst can be Invalidate cycles are needed to keep the Intel486
used within each 32-bit write cycle if BS8 # or OX microprocessor's internal cache contents con-
B816# is asserted. BLAST will be deasserted in re- sistent with external memory. The Intel486 OX mi-
sponse to BS8 # or BS 16 #. A 64-bit write will be croprocessor contains a mechanism for listening to
driven out as two non-burst bus cycles. BLAST # is writes by other devices to external memory. When
asserted during both writes since a burst is not pos- the processor finds a write to a Section of external
sible.
7-22
inlet Intel486TM DX2 MICROPROCESSOR
Ti T1 T2 Tl T2 Ti
ClK
ADS#
\L..--+--" \L..--+--"
A2-A31
t.t/IO#
D/C#
BEO-3#
W/R#
PlOCK#
L
RDY#
, I
BlAST#
X ~ I
l ~ C
I
DATA ~ fROM CPU ) ~ fROM CPU )-

WRITE WRITE
241245-56
Figure 7.21. Pseudo Lock Timing
memory contained in its internal cache, the proces- float its address bus before ready is returned termi-
sor's internal copy is invalidated. nating the bus cycle.
Invalidations use two pins, address hold request When AHOlD is asserted only the address bus is
(AHOlD) and valid external address (EADS#). floated, the data bus can remain active. Data can be
There are two steps in an invalidation cycle. First, returned for a previously specified bus cycle during
the external system asserts the AHOlD input forcing address hold (see Figures 7.22, 7.23).
the Intel486 DX microprocessor to immediately relin-
quish its address bus. Next, the external system as- EADS# is normally asserted when an external mas-
serts EADS# indicating that a valid address is on ter drives an address onto the bus. AHOlD need not
the Intel486 DX microprocessor's address bus. be driven for EADS# to generate an internal invali-
EADS# and the invalidation address, Figure 7-22 date. If EADS# alone is asserted while the Intel486
shows the fastest possible invalidation cycle. The DX microprocessor is driving the address bus, it is
Intel486 DX CPU recognizes AHOlD on one ClK possible that the invalidation address will come from
edge and floats the address bus in response. To the Intel486 DX microprocessor itself.
allow the address bus to float and avoid contention,
EADS # and the invalidation address should not be Note that it is also possible to run an invalidation
driven until the following ClK edge. The microproc- cycle by asserting EADS# when HOLD or BOFF#
essor reads the address over its address lines. If the is asserted.
microprocessor finds this address in its internal
cache, the cache entry is invalidated. Note that the Running an invalidate cycle prevents the Intel486
Intel486 DX microprocessor's address bus is input! DX microprocessor cache from satisfying other inter-
output unlike the Intel386 microprocessor's bus, nal requests, so invalidations should be run only
which is output only. when necessary. The fastest possible invalidate cy-
cle is shown in Figure 7.22, while a more realistic
The Intel486 DX microprocessor immediately relin- invalidation cycle is shown in 7.23. Both of the ex-
quishes its address bus in the next clock upon as- amples take one clock of cache access from the
sertion of AHOlD. For example, the bus could be 3 rest of the Intel486 DX microprocessor.
wait states into a read cycle. If AHOlD is activated,
the Intel486 DX microprocessor· will immediately
7-23
infel~ Intel486TM DX2 MICROPROCESSOR
Ti T1 T2 Ti Ti Tl T2 Ti
ClK
ADS#
\ / ,,
\ /
AD DR
X ) ®CPu ( i C
AHOlD
/' ,
\
EADS#
\JJ,,
RDY#
,,
DATA @ CPU
~
,
CPU I
BREQ
/ \ \
241245-57
Figure 7.22. Fast Internal Cache Invalidation Cycle
Ti Tl T2 Ti Ti Ti T1 T2
ClK
ADS#
\ / ,
\ I
ADDR
X ) ®
CPu (
AHOlD
/' \
EADS#
\JJ,
RDY#
DATA @
I CPU J
BREQ
/ \ \ /
241245-58
Figure 7.23. Typical Internal Cache Invalidation Cycle
7-24
7.2.8.1 Rate of Invalidate Cycles
The Intel486 OX microprocessor can accept one in- Intel486 ox

validate per clock except in the last clock of a line Microprocessor
fill. One invalidate per clock is possible as long as
EAOS# is negated in ONE or BOTH of the following
cases:
1. In the clock ROY # or BROY # is returned for
the last time. Address, Data &: Control Bus
2. In the clock following ROY # or BROY # being
returned for the last time. Second
Level
This definition allows two system designs. Simple Cache
designs can restrict invalidates to one every other
clock. The simple design need not track bus activity.
Alternatively, systems can request one invalidate
per clock provided that the bus is monitored.
7.2.8.2 Running Invalidate Cycles Concurrently

with Line Fills
Precautions are necessary to avoid caching stale

241245-59
data in the Intel486 OX microprocessor's cache in a
system with a second level cache. An example of a Figure 7.24. System with Second Level Cache
system with a second level cache is shown in Figure
7.24. An external device can be writing to main A potential problem exists if the external device is
memory over the system bus while the Intel486 OX writing to an address in external memory, and at the
microprocessor is retrieving data from the second same time the Intel486 OX microprocessor is read-
level cache. The Intel486 OX microprocessor will ing data from the same address in the second level
need to invalidate a line in its internal cache if the cache. The system must force an invalidation cycle
external device is writing to a main memory address to invalidate the data that the Intel486 OX micro-
also contained in the Intel486 OX microprocessor's processor has requested during the line fill.
cache.
If the system asserts EAOS# before the first data in
the line fill is returned to the Intel486 OX microproc-
essor, the system must return data consistent with
the new data in the external memory upon resump-
tion of the line fill after the invalidation cycle. This is
illustrated by the asserted EAOS# signal labeled 1
in Figure 7.25.
Ti T1 T2 T2 T2 T2 T2 T2 Ti
ClK
ADS#
U.-J I I
I
I
I I I
ADDR
____~~X i )~~---~----~----7-~(~~_____
AHOlD
_--;----11 I
\ I
I I
EADS#
\:Jf\2J
I I
RDY#
BRDY#
KEN#
UJ I
I
DATA
241245-60
NOTES:
1. Data returned must be consistent if its address equals the invalidation address in this clock
2. Data returned will not be cached if its address equals the invalidation address in this clock
Figure 7.25. Cache Invalidation Cycle Concurrent with Line Fill
If the system asserts EAOS # at the same time or processor, the Intel486 OX microprocessor can re-
after the first data in the line fill is returned (in the spond to HOLD by floating its bus and asserting
same clock that the first ROY # or BROY # is re- HLOA while RESET is asserted.
turned or any subsequent clock in the line fill) the
data will be read into the Intel486 OX microproces- Note that HOLD will be recognized during un-aligned
sors input buffers but it will not be stored in the on- writes (less than or equal to 32-bits) with BLAST #
chip cache. This is illustrated by asserted EAOS# being active for each write. For greater than 32-bit or
signal labeled 2 in Figure 7.25. The stale data will be un-aligned write, HOLO# recognition is prevented
used to satisfy the request that initiated the cache fill by PLOCK # getting asserted.
cycle.
The pins floated during bus hold are: BEO#-BE3#,
PCO, PWT, W/R#, O/C#, MIIO#, LOCK#,
7.2.9 BUS HOLD PLOCK#, AOS#, BLAST # , 00-031, A2-A31,
OPO-OP3.
The Intel486 OX microprocessor provides a bus
hold, hold acknowledge protocol using the bus hold
request (HOLD) and bus hold acknowledge (HLOA) 7.2.10 INTERRUPT ACKNOWLEDGE
pins. Asserting the HOLD input indicates that anoth-
er bus master desires control of the Intel486 OX mi- The Intel486 OX microprocessor generates interrupt
croprocessor's bus. The processor will respond by acknowledge cycles in response to maskable inter-
floating its bus and driving HLOA active when the rupt requests generated on the interrupt request in-
current bus cycle, or sequence of locked cycles is put (INTR) pin. Interrupt acknowledge cycles have a
complete. An example of a HOLO/HLOA transaction unique cycle type generated on the cycle type pins.
is shown in Figure 7.26. Unlike the Intel386 micro-
7-26
Ti Ti Tl T2 Ti Ti T1
ClK
ADS# \~--~----~~U~____
A2-A31
M/IO#
D/C#
W/R#
8EO-3#
RDY#
DATA ---......----+-----i---« FROM :CPU )>--......----+----
HOLD _ - - - - - I ._ _ ~I
HlDA
241245-61
Figure 7.26. HOLD/HLDA Cycles
An example interrupt acknowledge transaction is The state of A2 distinguishes the first and second
shown in Figure 7.27. Interrupt acknowledge cycles interrupt acknowledge cycles. The byte address
are generated in locked pairs. Data returned during driven during the first interrupt acknowledge cycle is
the first cycle is ignored. The interrupt vector is re- 4 (A31-A3 low, A2 high, BE3#-BE1 # high, and
turned during the second cycle on the lower 8 bits of BEO# low). The address driven during the second
the data bus. The Intel486 DX microprocessor has interrupt acknowledge cycle is 0 (A31-A2 low,
256 possible interrupt vectors. BE3#-BE1 # high, BEO# low).
Ti Tl T2 Ti Ti Tl T2 Ti
ClK
ADS#
\ / I.
4 CLOCKS I
.: \ /
ADDR
X X
RDY#
DATA ~
----r-------<~
lOCK#
\'---i-------i ;-------;---+---11
241245-62
Figure 7.27. Interrupt Acknowledge Cycles
7-27
Each of the interrupt acknowledge cycles are termi- The external hardware must acknowledge these
nated when the external system returns ROY # or special bus cycles by returning ROY # or BROY #.
BROY #. Wait states can be added by withholding
ROY # or BROY #. The Intel486 OX microprocessor Table 7.8. Special Bus Cycle Encoding
automatically generates four idle clocks between the
Special
first and second cycles to allow for 8259A recovery BE3# BE2# BE1# BEO#
time. Bus Cycle
1 1 1 0 Shutdown
7.2.11 SPECIAL BUS CYCLES 1 1 0 1 Flush
1 0 1 1 Halt
The Intel486 OX microprocessor provides four spe- 0 1 1 1 Write Back
cial bus cycles to indicate that certain instructions
have been executed, or certain conditions have oc-
curred internally. The special bus cycles in Table 7.8 7.2.11.1 Halt Indication Cycle
are defined when the bus cycle definition pins are in
the following state: MIIO#=O, OfC#=O and The Intel486 OX microprocessor halts as a result of
WfR # = 1. During these cycles the address bus is executing a HALT instruction. Signaling its entrance
driven low while the data bus is undefined. into the halt state, a halt indication cycle is per-
formed. The halt indication cycle is identified by the
Two of the special cycles indicate halt or shutdown. bus definition signals in special bus cycle state and a
Another special cycle is generated when the In- byte address of 2. BEO# and BE2# are the only
tel486 OX microprocessor executes an INVO (invali- signals distinguishing halt indication from shutdown
date data cache) instruction and could be used to indication, which drives an address of o. During the
flush an external cache. The Write Back cycle is halt cycle undefined data is driven on 00-031. The
generated when the Intel486 OX microprocessor ex- halt indication cycle must be acknowledged by
ecutes the WBINVO (write-back invalidate data ROY # or BROY # asserted.
cache) instruction and could be used to synchronize
an external write-back cache.
Ti Tl T2 Tb Tb Tlb T2 T2 T2 T2
ClK
I I I
ADS#
I
I
I
I
LlJ I
I
A2-A31
M/IO#
D/C#
BEO-3#
RDY#
BRDY#
I I I
un
I I I
KEN#
BOFF#
W
I
I
, I
I
I
W
I
BlAST#
'LlJ I
I
\
CD I
I
U I
I
I
DATA
241245-63
Figure 7.28. Restarted Read Cycle
7-28
Asserting BOFF# during a burst, BS8# or BS16# There are two possible solutions to this problem.
cycle will force the Intel486 DX microprocessor to The first is to have all devices recognize this condi-
ignore data returned for that cycle only. Data from tion and ignore ADS# until ready comes back. The
previous cycles will still be valid. For example, if second approach is to use a "two clock" backoff: in
BOFF # is asserted on the third BRDY # of a burst, the first clock AHOLD is asserted, and in the second
the Intel486 DX microprocessor assumes the data· clock BOFF # is asserted. This guarantees that
returned with the first and second BRDY # 's is cor- ADS# will not be floating low. This is only necessary
rect and restarts the burst beginning with the third in systems where BOFF # may be asserted in the
item. The same rule applies to transfers broken into same clock as ADS#.
multiple cycle by BS8# or BS16#.
Asserting BOFF # in the same clock as ADS # will 7.2.13 BUS STATES
cause the Intel486 DX microprocessor to float its
A bus state diagram is shown in Figure 7.30. A de-
bus in the next clock and leave ADS# floating low.
scription of the signals used in the diagram is given
Since ADS# is floating low, a peripheral may think
in Table 7.9.
that a new bus cycle has begun even though the
cycle was aborted.
(RDY# ASSERTED + (BRDY# • BLAST#)ASSERTED) •

(HOLD + AHOLD + NO REQUEST) •
BOFF# NEGATED
REQUEST PENDING •
(RDY# ASSERTED + (BRDY# • BLAST#)ASSERTED) •
HOLD NEGATED •
AHOLD NEGATED •
BOFF# NEGATED •
REQUEST PENDING •
HOLD NEGATED •
AHOLD NEGATED . -
BOFF# NEGATED BOFF# NEGATE/
BOFF # ~~~'*' "~

~v:<''' BOFF#
ASSERTED / ".c,c,~~ NEGATED
/BOFF# ASSERTED
AHOLD NEGATED •
BOFF# NEGATED •
(HOLD NEGATED 0)
• HOLD is only factored into this stote transition if Tb was entered while a
non-cacheable, non-bursted, code prefetch was in progress.
Otherwise, ignore HOLD.
241245-65
Figure 7.30. Bus State Diagram
Table 7.9. Bus State Description

State Means
Ti Bus is idle. Address and status signals may be driven to undefined values, or the bus may be
floated to a high impedance state.
T1 First clock cycle of a bus cycle. Valid address and status are driven and ADS# is asserted.
T2 Second and subsequent clock cycles of a bus cycle. Data is driven if the cycle is a write, or data is
expected if the cycle is a read. RDY # and BRDY # are sampled.
T1b First clock cycle of a restarted bus cycle. Valid address and status are driven and ADS# is
asserted.
Tb Second and subsequent clock cycles of an aborted bus cycle.
7-30
intel@ Intel486™ DX2 MICROPROCESSOR
7.2.14 FLOATING POINT ERROR HANDLING The following class of floating point exceptions drive
FERR # only after encountering the next floating
The Intel486 DX microprocessor provides two op- point instruction.
tions for reporting floating point errors. The simplest 1. Exceptions other than on all transcendental in-
method is to raise interrupt 16 whenever an un- structions, integer arithmetic instructions,
masked floating point error occurs. This option may FSQRT, FSCALE, FPREM(1), FXTRACT, FBLD,
be enabled by setting the NE bit in control register 0 and FBSTP.
(CRO).
2. Any exception on all basic arithmetic, load, com-
The Intel486 DX microprocessor also provides the pare, and control instructions (Le., all other in-
option of allowing external hardware to determine structions).
how floating point errors are reported. This option is
necessary for compatibility with the error reporting For both sets of exceptions above, the Intel387
scheme used in DOS based systems. The NE bit Math Coprocessor asserts ERROR # when the error
must be cleared in CRO to enable user-defined error occurs and does not wait for the next floating point
reporting. User-defined error reporting is the default instruction to be encountered.
condition because the NE bit is cleared on reset.
IGNNE # is an input to the Intel486 DX microproces-
Two pins, floating point error (FERR#) and ignore sor.
numeric error (IGNNE#), are provided to direct the
actions of hardware if user-defined error reporting is When the NE bit in CRO is cleared, and IGNNE# is
used. The Intel486 DX microprocessor asserts the asserted, the Intel486 DX microprocessor will ignore
FERR # output to indicate that a floating point error a user floating point error and continue executing
has occurred. FERR # corresponds to the ERROR # floating point instructions. When IGNNE# is negat-
pin on the Intel387 math coprocessor. However, ed, the Intel486 DX microprocessor will freeze on
there is a difference in the behavior of the two. floating point instructions which get errors (except
for the control instructions FNCLEX, FNINIT,
In some cases FERR# is asserted when the next FNSAVE, FNSTENV, FNSTCW, FNSTSW, FNSTSW
floating point instruction is encountered and in other AX, FNENI, FNDISI and FNSETPM). IGNNE# may
cases it is asserted before the next floating point be asynchronous to the Intel486 DX clock.
instruction is encountered depending upon the exe-
cution state of the instruction causing the exception. In systems with user-defined error reporting, the
FERR # pin is connected to the interrupt controller.
The following class of floating point exceptions drive When an unmasked floating point error occurs, an
FERR # at the time the exception occurs (Le., before interrupt is raised. If IGNNE# is high at the time of
encountering the next floating point instruction). this interrupt, the Intel486 DX microprocessor will
freeze (disallowing execution of a subsequent float-
1. The stack fault, invalid operation, and denormal ing point instruction) until the interrupt handler is in-
exceptions on all transcendental instructions, invoked. By driving the IGNNE# pin low (when clear-
teger arithmetic instructions, FSQRT, FSEALE, ing the interrupt request), the interrupt handler can
FPREM(1), FXTRACT, FBLD, and FBSTP. allow execution of a floating point instruction, within
2. Any exceptions on store instructions (including the interrupt handler, before the error condition is
integer store instructions). cleared (by FNCLEX, FNINIT, FNSAVE or
FNSTENV). If execution of a non-control floating
point instruction, within the floating point interrupt
handler, is not needed, the IGNNE# pin can be tied
HIGH.
7-31
int:eL Intel486™ DX2 MICROPROCESSOR
RESET
I/O PORT FO
Address decoder
I
Processor Bus
I)
I
Q
CLR
olI
0 -- FERR#
PR
Y.... 5V
Intel487™ sx
! Math
CoProcessor
Q
CLR
oLI
~
r0- O
PR
8259A
Programmable
L 5V
Interrupt IGNNE#
IRQ13 Controller
INTR
241245-96
Figure 7-31. DOS Compatible Numerics Error Circuit
7-32
intel® Intel486™ DX2 MICROPROCESSOR
Ti Tl T2 Tb Tb Tlb T2 Ti
ClK
\
ADS#
\ I \ I
ADDR
SPEC X
100 ) ( 100
C
RDY#
BRDY#
BOFF#
DATA -------7-~( FROM ~PU )~--:------+-----7"--1( FROM :CPU )-
241245-64
Figure 7.29. Restarted Write Cycle
A halted Intel486 OX microprocessor resumes exe- asserted is aborted and any data returned to the
cution when INTR (if interrupts are enabled) or NMI processor is ignored. The same pins are floated in
or RESET is asserted. response to BOFF # as are floated in response to
HOLD. HLOA is not generated in response to
BOFF #. BOFF # has higher priority than ROY # or
7.2.11.2 Shutdown Indication Cycle BROY #. If either ROY # or BROY # are returned in
The Intel486 OX microprocessor shuts down as a the same clock as BOFF #, BOFF # takes effect.
result of a protection fault while attempting to pro-
The device asserting BOFF # is free to run any cy-
cess a double fault. Signaling its entrance into the
shutdown state, a shutdown indication cycle is per- cles it wants while the Intel486 OX microprocessor
bus is in its high impedance state. If backoff is re-
formed. The shutdown indication cycle is identified
by the bus definition signals in special bus cycle quested after the Intel486 OX microprocessor has
started a cycle, the new master should wait for
state and a byte address of O.
memory to return ROY # or BROY # before assum-
ing control of the bus. Waiting for ready provides a
7.2.12 BUS CYCLE RESTART handshake to insure that the memory system is
ready to accept a new cycle. If the bus is idle when
In a mUlti-master system another bus master may BOFF # is asserted, the new master can start its
require the use of the bus to enable the Intel486 OX cycle two clocks after issuing BOFF # .
microprocessor to complete its current bus request.
In this situation the Intel486 OX microprocessor will The external memory can view BOFF # in the same
need to restart its bus cycle after the other bus mas- manner as BLAST #. Asserting BOFF # tells the ex-
ter has completed its bus transaction. ternal memory system that the current cycle is the
last cycle in a transfer.
A bus cycle may be restarted if the external system
asserts the backoff (BOFF#) input. The Intel486 OX The bus remains in the high impedance state until
microprocessor samples the BOFF # pin every BOFF# is negated. Upon negation, the Intel486 OX
clock. The Intel486 OX microprocessor will immedi- microprocessor restarts its bus cycle by driving out
ately (in the next clock) float its address, data and the address and status and asserting ADS #. The
status pins when BOFF # is asserted (see Figure bus cycle then continues as usual.
7.28). Any bus cycle in progress when BOFF # is
7-29
8.0 Intel486 DX2 CPU TESTABILITY

Testing the Intel486 DX2 microprocessor can be di- 8.2 On-Chip Cache Testing
vided into three categories: Built-In Self Test (BIST),
Boundary Scan, and external testing. BIST performs The on-chip cache testability hooks are designed to
basic device testing on the Intel486 DX2 CPU, in- be accessible during the BIST and for assembly lan-
cluding the non-random logic, control ROM (CROM), guage testing of the cache.
translation lookaside buffer (TLB), and on-chip
cache memory. Boundary Scan provides additional The Intel486 DX2 microprocessor contains a cache
test hooks that conform to the IEEE Standard Test fill buffer and a cache read buffer. For testability
Access Port and Boundary Scan Architecture (IEEE writes, data must be written to the cache fill buffer
Std.1149.1). The Intel486 DX2 microprocessor also before it can be written to a location in the cache.
has a test mode in which all of its outputs are 3-stat- Data must be read from a cache location into the
ed. Additional testing can be performed by using the cache read buffer before the microprocessor can
test registers within the Intel486 DX2 CPU. access the data. The cache fill and cache read buff-
er are both 128 bits wide.
8.1 Built-In Self Test (BIST)

8.2.1 CACHE TESTING REGISTERS TR3, TR4
The BIST is initiated by holding the AHOLD (address AND TR5
hold) pin HIGH for 2 CLKs before and 2 CLKs after
RESET going from HIGH to LOW as shown in Figure Figure 8.1 shows the three cache testing registers:
6.4. The BIST takes approximately 600 thousand the Cache Data Test Register (TR3), the Cache
clocks, or approximately 24 milliseconds with a Status Test Register (TR4) and the Cache Control
50 MHz Intel486 DX2 microprocessor. No bus cy- Test Register (TR5). External access to these regis-
cles will be run by the Intel486 DX2 microprocessor ters is provided through MOV reg,TREG and MOV
until the BIST is concluded. Note that for the In- TREG, reg instructions.
tel486 DX2 microprocessor the RESET must be ac-
tive for 15 clocks with or without BIST being enabled Cache Data Test Register: TR3
for warm resets.
The cache fill buffer and the cache read buffer can
The results of BIST is stored in the EAX register. only be accessed through TR3. Data to be written to
The Intel486 DX2 microprocessor has successfully the cache fill buffer must first be written to TR3. Data
passed the BIST if the contents of the EAX register read from the cache read buffer must be loaded into
are zero. If the results in EAX are not zero then the TR3.
BIST has detected a flaw in the microprocessor. The
microprocessor performs reset and begins normal TR3 is 32 bits wide while the cache fill and read
operation at the completion of the BIST. buffers are 128 bits wide. 32 bits of data must be
written to TR3 four times to fill the cache fill buffer.
The non-random logic, control ROM, on-chip cache 32 bits of data must be read from TR3 four times to
and translation lookaside buffer (TLB) are tested empty the cache read buffer. The entry select bits in
during the BIST. TR5 determine which 32 bits of data TR3 will access
in the buffers.
The cache portion of the BIST verifies that the
cache is functional and that it is possible to read and Cache Status Test Register: TR4
write to the cache. The BIST manipulates test regis-
ters TR3, TR4 and TR5 while testing the cache. TR4 handles tag, LRU and valid bit information dur-
These test registers are described in Section 8.2. ing cache tests. TR4 must be loaded with a tag and
a valid bit before a write to the cache. After a read
The cache testing algorithm writes a value to each from a cache entry, TR4 contains the tag and valid
cache entry, reads the value back, and checks that bit from that entry, and the LRU bits and four valid
the correct value was read back. The algorithm may bits from the accessed set.
be repeated more than once for each of the 512
cache entries using different constants. Cache Control Test Register: TR5
The TLB portion of the BIST verifies that the TLB is TR5 specifies which testability operation will be per-
functional and that it is possible to read and write to formed and the set and entry within the set which
the TLB. The BIST manipulates test registers TR6 will be accessed.
and TR? while testing the TLB. TR6 and TR? are
described in Section 8.3.
8-1
The seven bit set select field determines which of Table 8.1 shows the encoding of the two control bits
the 128 sets will be accessed. in TR5 for the cache testability functions. Table 8.1
also shows the functionality of the entry and set se-
The functionality of the two entry select bits depend lect bits for each control operation.
on the state of the control bits. When the fill or read
buffers are being accessed, the entry select bits The cache tests attempt to use as much of the nor-
point to the 32-bit location in the buffer being ac- mal operating circuitry as possible. Therefore when
cessed. When a cache location is specified, the en- cache tests are being performed, the cache must be
try select bits point to one of the four entries in a set. disabled (the CD and NW bits in control register
Refer to Table 8.1. must be set to 1 to disable the cache. See Section
5).
Five testability functions can be performed on the
cache. The two control bits in TR5 specify the oper-
ation to be executed. The five operations are: 8_2.2 CACHE TESTABILITY WRITE
1. Write cache fill buffer A testability write to the cache is a two step process.
2. Perform a cache testability write First the cache fill buffer must be loaded with 128
bits of data and TR4 loaded with the tag and valid
3. Perform a cache testability read
bit. Next the contents of the fill buffer are written to a
4. Read the cache read buffer cache location. Sample assembly code to do a write
5. Perform a cache flush is given in Figure 8.2.
3t o
TR3
DATA Cache Data
'--_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _---'TestReglster
I
2
TR4
Cache Status
Test Register
4 3 2 t 0
TR5
Set Select
Test Register
i0 = unused
Figure 8.1. Cache Test Registers
Table 8.1. Cache Control Bit Encoding and Effect of

Control Bits on Entry Select and Set Select Functionality
Control Bits Entry Select Bits
Operation Set Select Bits
Function
Bit 1 Bit 0
0 0 { Fill Buffer Write Select 32-bit location in fill/read
Enable
Read Buffer Read buffer
-
0 1 Perform Cache Write Select an entry in set. Select a set to write to
1 0 Perform Cache Read Select an entry in set. Select a set to read from
1 1 Perform Flush Cache - -
8-2
Sample Assembly Code
An example assembly language sequence to perform a cache write is:
eax. ebx. ecx. edx contain the cache line to write

edi contains the tag information to load
CRO already says to enable reads/write to TR5
fill the cache buffer
mov eSi,O set up command
mov tr5,esi load to TR5
mov tr3,eax load data into cache fill buffer
mov esi,4
mov tr5,esi
mov tr3,ebx
mov esi,8
mov tr5,esi
mov tr3,ecx
mov esi,Och
mov tr5,esi
mov tr3,edx
load the Cache Status Register
mov tr4,edi ; load 21-bit tag and valid bit
perform the cache write
mov eSi,l
mov tr5,esi ; write the cache (set 0, entry 0)
An example assembly language sequence to perform a cache read is:
data into eax, ebx, eox, edx; status into edi

read the cache line back
mov esi,2
mov tr5,esi ; do cache testability read (set 0, entry 0)
read the data from the read buffer

mov esi,O
mov tr5,esi
mov eax,tr3
mov eSi,4
mov tr5,esi
mov ebx,tr3
mov esi,8
mov tr5,esi
mov ecx,tr3
mov esi,Och
mov tr5,esi
mov edx,tr3
read the status from TR4
mov edi,tr4
Figure 8.2 Sample Assembly Code for Cache Testing
8-3
Loading the fill buffer is accomplished by first writing transfer into TR3 and the control bits in TRS must be
to the entry select bits in TRS and setting the control loaded with 00. The register read of TR3 will initiate
bits in TRS to 00. The entry select bits identify one of the transfer of the 32-bit value from the read buffer
four 32-bit locations in the cache fill buffer to put 32 to the specified general purpose register.
bits of data. Following the write to TRS, TR3 is writ-
ten with 32 bits of data which are immediately Note that it is very important that the entire 128-bit
placed in the cache fill buffer. Writing to TR3 initiates quantity from the read buffer and also the informa-
the write to the cache fill buffer. The cache fill buffer tion from TR4 be read before any memory refer-
is loaded with 128 bits of data by writing to TRS and ences are allowed to occur. If memory operations
TR3 four times using a different entry select location are allowed to happen, the contents of the read buff-
each time. er will be corrupted. This is because the testability
operations use hardware that is used in normal
TR4 must be loaded with the 21-bit tag and valid bit memory accesses for the Intel486 DX2 microproc-
(bit 10 in TR4) before the contents of the fill buffer essor whether the cache is enabled or not.
are written to a cache location.
The contents of the cache fill buffer are written to a 8.2.4 FLUSH CACHE
cache location by writing TRS with a control field of The control bits in TRS must be written with 11 to
01 along with the set select and entry select fields. flush the cache. None of the other bits in TRS have
The set select and entry select field indicate the lo- any meaning when 11 is written to the control bits.
cation in the cache to be written. The normal cache Flushing the cache will reset the LRU bits and the
LRU update circuitry updates the internal LRU bits valid bits to 0, but will not change the cache tag or
for the selected set. data arrays.
Note that a cache testability write can only be done When the cache is flushed by writing to TRS the
when the cache is disabled for replaces (the CD bit special bus cycle indicating a cache flush to the ex-
is control register 0 is reset to 1). Also note that care ternal system is not run (see Section 7.2.11, Special
must be taken when directly writing to entries in the Bus Cycles). The cache should be flushed with the
cache. If the entry is set to overlap an area of mem- instruction INVD (Invalidate Data Cache) instruction
ory that is being used in external memory, that or the WBINVD (Write-back and Invalidate Data
cache entry could inadvertently be used instead of Cache) instruction.
the external memory. Of course, this is exactly the
type of operation that one would desire if the cache
were to be used as a high speed RAM.
8.3 Translation Lookaside Buffer
(TLB) Testing
8.2.3 CACHE TESTABILITY READ
The Intel486 DX2 microprocessor TLB testability
A cache testability read is a two step process. First hooks are similar to those in the Intel386 microproc-
the contents of the cache location are read into the essor. The testability hooks have been enhanced to
cache read buffer. Next the data is examined by provide added test features and to include new fea-
reading it out of the read buffer. Sample assembly tures in the Intel486 DX2 microprocessor. The TLB
code to do a testability read is given in Figure 8.2. testability hooks are designed to be accessible dur-
ing the BIST and for assembly language testing of
Reading the contents of a cache location into the the TLB.
cache read buffer is initiated by writing TRS with the
control bits set to 10 and the desired seven-bit set
select and two-bit entry select. In response to the 8.3.1 TRANSLATION LOOKASIDE BUFFER
write to TRS, TR4 is loaded with the 21-bit tag field ORGANIZATION
and the single valid bit from the cache entry read. The Intel486 DX2 microprocessors TLB is 4-way set
TR4 is also loaded with the three LRU bits and four associative and has space for 32 .entries. The TLB is
valid bits corresponding to the cache set that was logically split into three blocks shown in Figure 8.3.
accessed. The cache read buffer is filled with the
128-bit value which was found in the data array at The data block is physically split into four arrays,
the specified location. each with space for eight entries. An entry in the
data block is 22 bits wide containing a 20-bit physi-
The contents of the read buffer are examined by cal address and two bits for the page attributes. The
performing four reads of TR3. Before reading TR3 page attributes are the PCD (page cache disable) bit
the entry select bits in TRS must loaded to indicate and the PWT (page write-through) bit. Refer to Sec-
which of the four 32-bit words in the read buffer to tion 4.S.4 for a discussion of the PCD and PWT bits.
8-4
.--
I
Tag
17 Bits
Page
Protection
Physical
Address
Page
Attributes
+1
~i_~_itS_
20 Bits 2 Bits 8 Entries
8 TS L -_ _ _ _...... .....
L---_"'----....I~
1,-------III'--- ----I
1,-------III~______
I~------II~______
[J :rt
RU
Bits 8
241245-66
Figure 8.3. TLB Organization
The tag block is also split into four arrays, one for TLB is the same as used by the on-chip cache. For a
each of the data arrays. A tag entry is 21 bits wide description of this algorithm refer to Section 5.5.
containing a 17-bit linear address and four protec-
tion bits. The protection bits are valid (V), user/su-
pervisor (U/S), read/write (R/W) and dirty (D). 8.3.2 TLB TEST REGISTERS TR6 AND TR7
The two TLB test registers are shown in Figure 8.4.
The third block contains eight three bit quantities
TR6 is the command test register and TR7 is the
used in the pseudo least recently used (LRU) re-
data test register. External access to these registers
placement algorithm. These bits are called the LRU
is provided through MOV reg,TREG and MOV
bits. The LRU replacement algorithm used in the
TREG,reg instructions.
31 12 11 10 9 8 7 6 5 4 o
Linear Address
.I
v
. . . . . . 1 ' ' ," " :~
1 D ID#I u lu#1 wlw) : ""~:1 p
Option I~~: Command
.Test Register
31 12 11 10 9 8 7 6 5 4 3 2 1 o
TR7
Physical Address TLB Data " c
'--_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _-'-_'---'-_ _--'=.."""""'-..L.-'-_-'-.......~_''''' Test Register

t
Replacement Pointer Select (Writes) Replacement Pointer (Writes)
Hit Indication (Lookup) Hit Location (Lookup)
Figure 8.4. TLB Test Registers
8-5
Command Test Register: TR6 test write, TR7 contains the physical address and
the page attribute bits to be stored in the entry. After
TR6 contains the tag information and control infor- a TLB test lookup hit, TR7 contains the physical ad-
mation used in a TLB test. Loading TR6 with tag and dress, page attributes, LRU bits and entry location
control information initiates a TLB write or lookup from the access.
test.
TR7 contains a 20-bit physical address (bits 12-31),
TR6 contains three bit fields, a 20-bit linear address two bits for PCD (bit 11) and PWT (bit 10) and three
(bits 12-31), seven bits for the TLB tag protection bits for the LRU bits (bits 7-9). The LRU bits in TR7
bits (bits 5-11) and one bit (bit 0) to define the type are only used during a TLB lookup test. The func-
of operation to be performed on the TLB. tionality of TR7 bit 4 differs for TLB writes and look-
ups. The encoding of bit 4 is defined in Tables 8.4
The 20-bit linear address forms the tag information and 8.5. Finally TR7 contains two bits (bits 2-3) to
used in the TLB access. The lower three bits of the specify a TLB replacement pointer or the location of
linear address select which of the eight sets are ac- a TLB hit.
cessed. The upper 17 bits of the linear address form
the tag stored in the tag array. Table 8.4. Encoding of Bit 4 of TR7 on Writes
TR7 Replacement Pointer
The seven TLB tag protection bits are described be-
low. Bit 4 Used on TLB Write
V: The valid bit for this TLB entry 0 Pseudo-LRU Replacement Pointer
D,D#: The dirty bit for/from the TLB entry 1 Data Test Register Bits 3:2
U,U#: The user/supervisor bit for/from the TLB
entry Table 8.5. Encoding of Bit 4 of TR7 on Lookups
W,W#: The read/write bit for/from the TLB entry TR7 Meaning after TLB
Bit4 Lookup Operation
Two bits are used to represent the D, U/S and R/W
bits in the TLB tag to permit the option of a forced 0 TLB Lookup Resulted in a Miss
miss or hit during a TLB lookup operation. The 1 TLB Lookup Resulted in a Hit
forced miss or hit will occur regardless of the state
of the actual bit in the TLB. The meaning of these A replacement pointer is used during a TLB write.
pairs of bits is given in Table 8.2. The pointer indicates which of the four entries in an
accessed set is to be written. The replacement
The operation bit in TR6 determines if the TLB test pointer can be specified to be the internal LRU bits
operation will be a write or a lookup. The function of or bits 2-3 in TR7. The source of the replacement
the operation bit is given in Table 8.3. pointer is specified by TR7 bit 4. The encoding of bit
4 during a write is given by Table 8.4.
Table 8.3. TR6 Operation Bit Encoding
TR6 TLB Operation Note that both testability writes and lookups affect
the state of the internal LRU bits regardless of the
BitO to Be Performed
replacement pointer used. All TLB write operations
0 TLB Write (testability or normal operation) cause the written
1 TLB Lookup entry to become the most recently used. For exam-
ple, during a testability write with the replacement
pointer specified by TR7 bits 2-3, the indicated en-
Data Test Register: TR7 try is written and that entry becomes the most re-
cently used as specified by the internal LRU bits.
TR7 contains the information stored or read from the
data block during a TLB test operation. Before a TLB
Table 8.2. Meaning of a Pair of TR6 Protection Bits

TR6 Protection Bit TR6 Protection Bit# Meaning on Meaning on
(B) (B#) TLB Write Operation TLB Lookup Operation
0 0 Undefined Miss any TLB TAG Bit B
0 1 Write 0 to TLB TAG Bit B Match TLB TAG Bit B if 0
1 0 Write 1 to TLB TAG Bit B Match TLB TAG Bit B if 1
1 1 Undefined Match any TLB TAG Bit B
8-6
There are two TLB testing operations: write entries Bits 9-7 will contain the LRU bits associated with
into the TLB, and perform TLB lookups. One major the accessed set. The state of the LRU bits is previ-
enhancement over TLB testing in the Intel386 micro- ous to their being updated for the current lookup.
processor is that paging need not be disabled while
executing testability writes or lookups. If bit 4 in TR7 indicated that the lookup test resulted
in a miss the remaining bits in TR7 are undefined.
Note that any time one TLB set contains the same
linear address in more than one of its entries, look- Again it should be noted that a TLB testability lookup
ing up that linear address will not result in a hit. operation affects the state of the LRU bits. The LRU
Therefore a single linear address should not be writ- bits will be updated if a hit occurred. The entry which
ten to one TLB set more than once. was hit will become the most recently used.
8.3.3 TLB WRITE TEST 8.4 3-State Output Test Mode

To perform a TLB write TR7 must be loaded fol- The Intel486 DX2 microprocessor provides the abili-
lowed by a TR6 load. The register operations must ty to float all its outputs and bidirectional pins. This
be performed in this order since the TLB operation is
includes all pins floated during bus hold as well as
triggered by the write to TR6.
pins which are never floated in normal operation of
the chip (HLDA, BREQ, FERR# and PCHK#).
TR7 is loaded with a 20-bit physical address and
When the Intel486 DX2 microprocessor is in the 3-
values for PCD and PWT to be written to the data state output test mode external testing can be used
portion of the TLB. In addition, bit 4 of TR7 must be
to test board connections.
loaded to indicate whether to use TR7 bits 3-2 or the
internal LRU bits as the replacement pointer on the
The 3-state test mode is invoked by driving
TLB write operation. Note that the LRU bits in TR7
FLUSH # low for 2 clocks before and 2 clocks after
are not used in a write test. RESET going low. The outputs are guaranteed to 3-
state no later than 10 clocks after RESET goes low
TR6 must be written to initiate the TLB write opera- (see Figure 6.4). The Intel486 DX2 microprocessor
tion. Bit 0 in TR6 must be reset to zero to indicate a
remains in the 3-state test mode until the next
TLB write. The 20-bit linear address and the seven
RESET.
page protection bits must also be written in TR6 to
specify the tag portion of the TLB entry. Note that
the three least significant bits of the linear address
specify which of the eight sets in the data block will 8.5 Intel486™ DX2 Microprocessor
be loaded with the physical address data. Thus only Boundary Scan (JTAG)
17 of the linear address bits are stored in the tag
The Intel486 DX2 microprocessor provides testabili-
array.
ty features compatible with the IEEE Standard Test
Access Port and Boundary Scan Architecture (IEEE
8.3.4 TLB LOOKUP TEST Std.1149.1). The test logic provided allows for test-
ing to insure that components function correctly, that
To perform a TLB lookup it is only necessary to write interconnections between various components are
the proper tags and control information into TR6. Bit correct, and that various components interact cor-
o in TR6 must be set to 1 to indicate a TLB lookup. rectly on the printed circuit board.
TR6 must be loaded with a 20-bit linear address and
the seven protection bits. To force misses and The boundary scan test logic consists of a boundary
matches of the individual protection bits on TLB scan register and support logic that are accessed
lookups, set the seven protection bits as specified in through a test access port (TAP). The TAP provides
Table 8.2. a simple serial interface that makes it possible to
test all signal traces with only a few probes.
A TLB lookup operation is initiated by the write to
TR6. TR7 will indicate the result of the lookup opera- The TAP can be controlled via a bus master. The
tion following the write to TR6. The hit/miss indica- bus master can be either automatic test equipment
tion can be found in TR7 bit 4 (see Table 8.5). or a component (PLD) that interfaces to the four-pin
test bus.
TR7 will contain the following information if bit 4 indi-
cated that the lookup test resulted in a hit. Bits 2-3
will indicate in which set the match occurred. The 22
most significant bits in TR7 will contain the physical
address and page attributes contained in the entry.
8-7
8.5.1 BOUNDARY SCAN ARCHITECTURE Each test data register is serially connected to TOI
and TOO, with TOI connected to the most significant
The boundary scan test logic contains the following bit and TOO connected to the least significant bit of
elements: the test data register. Data is shifted one stage (bit
- Test access port (TAP), consisting of input pins position within the register) on each riSing edge of
TMS, TCK, and TOI; and output pin TOO. the test clock (TCK).
- TAP controller, which interprets the inputs on the In addition the Intel486 OX2 CPU contains a runbist
test mode select (TMS) line and performs the register to support the RUNBIST boundary scan in-
corresponding operation. The operations per- struction.
formed by the TAP include controlling the in-
struction and data registers within the compo-
nent. 8.5.2.1 Bypass Register
- Instruction register (IR), which accepts instruc- The Bypass Register is a one-bit shift register that
tion codes shifted into the test logic on the test provides the minimal length path between TOI and
data input (TOI) pin. The instruction codes are TOO. This path can be selected when no test opera-
used to select the specific test operation to be tion is being performed by the component to allow
performed or the test data register to be ac- rapid movement of test data to and from other com-
cessed. ponents on the board. While the bypass register is
- Test data registers: The Intel486 OX2 microproc- selected, data is transferred from TOI to TOO with-
essor contains three test data registers: Bypass out inversion.
register (BPR), Device Identification register
(DID), and Boundary Scan register (BSR). 8.5.2.2 Boundary Scan Register
The instruction and test data registers are separate The Boundary Scan Register is a single shift register
shift-register paths connected in parallel and have a path containing the boundary scan cells that are
common serial data input and a common serial data connected to all input and output pins of the Intel486
output connected to the TAP signals, TOI and TOO, OX2 CPU. Figure 8.1 shows the logical structure of
respectively. the boundary scan register. While output cells deter-
mine the value of the signal driven on the corre-
8.5.2 DATA REGISTERS sponding pin, input cells only capture data; they do
not affect the normal operation of the device. Data is
The Intel486 OX2 CPU contains the two required transferred without inversion from TOI to TOO
test data registers; bypass register and boundary through the boundary scan register during scanning.
scan register. In addition, they also have a device The boundary scan register can be operated by the
identification register. EXTEST and SAMPLE instructions. The boundary
scan register order is described in Section 8.5.5 .
.--------------------------------------------------. I
I
BOUNDARY SCAN REGISTER I
I
I
I
I
I
I
I SYSTEM
BIDIRECTIONAL
I PIN
I
I
I
I
SYSTEM I
LOGICI---.,-i SYSTEM I
I
INPUT I LOGIC I
I SYSTEM
I
3-STATE
TCK
I OUTPUT
I
I I
I I
I I
I I
I I
._-------
I I
TDI TOO
241245-67
Figure 8.1. Logical Structure of Boundary Scan Register

8-8
8.5.2.3 Device Identification Register tion register is four (4) bits wide. The most significant
bit is connected to TDI and the least significant bit is
The Device Identification Register contains the man- connected to TOO. There are no parity bits associat-
ufacturer's identification code, part number code, ed with the Instruction register. Upon entering the
and version code in the format shown in Figure 8.2. Capture-IR TAP controller state, the Instruction reg-
Table 8.1 lists the codes corresponding to the In- ister is loaded with the default instruction "0001 ",
tel486 DX2 CPU. SAMPLE/PRELOAD. Instructions are shifted into
the instruction register on the rising edge of TCK
while the TAP controller is in the Shift-IR state.
8.5.2.4 Runbist Register
The Runbist Register is a one bit register used to 8.5.3.1 Intel486 DX2 CPU Boundary Scan
report the results of the Intel486 DX2 CPU BIST Instruction Set
when it is initiated by the RUNBIST instruction. This
register is loaded with a "1" prior to invoking the The Intel486 DX2 CPU supports all three mandatory
BIST and is loaded with "0" upon successful com- boundary scan instructions (BYPASS, SAMPLE/
pletion. PRELOAD, and EXTEST) along with two optional in-
structions (IDCODE and RUNBIST). Table 8.2 lists
the Intel486 DX2 CPU boundary scan instruction
8.5.3 INSTRUCTION REGISTER codes. The instructions listed as PRIVATE cause
TOO to become enabled in the Shift-DR state and
The Instruction Register (IR) allows instructions to
be serially shifted into the device. The instruction cause "0" to be shifted out of TOO on the rising
selects the particular test to be performed, the test edge of TCK. Execution of the PRIVATE instructions
data register to be accessed, or both. The instruc- will not cause hazardous operation of the Intel486
DX2 CPU.
/31302926/27262524232221201918171615141312/11109676543 21/0/
MANUfACTURER
VERSION PART NUMBER 1
IDENTITY
/
241245-66
Figure 8.2. Format of Device Identification Register
Table 8.1
Component Code Version Code Part Number Code Manufacturer Identity
Intel486 DX2 CPU (Ax) OOh 0432h 09h
Intel486 DX2 CPU (Bx) OOh 0433h 09h
8-9
Table 8.2 the component without interfering with

that normal operation. The instruction
Instruction Code Instruction Name causes boundary scan register cells as·
0000 EXTEST sociated with outputs to sample the val·
ue being driven by the Intel486 DX2
0001 SAMPLE CPU. It causes the cells associated with
0010 IDCODE inputs to sample the value being driven
into the Intel486 DX2 CPU. On both out-
0011 PRIVATE puts and inputs the sampling occurs on
the rising edge of TCK. When the TAP
0100 PRIVATE
controller is in the Update-DR state, the
0101 PRIVATE SAMPLE/PRELOAD instruction pre-
loads data to the device pins to be driv-
0110 PRIVATE en to the board by executing the
0111 PRIVATE EXTEST instruction. Data is preloaded
to the pins from the boundary scan reg-
1000 RUNBIST ister on the falling edge of TCK.
1001 PRIVATE IDCODE The instruction code is "0010". The ID-
CODE instruction selects the device
1010 PRIVATE
identification register to be connected
1011 PRIVATE to TDI and TDO, allowing the device
identification code to be shifted out of
1100 PRIVATE the device on TDO. Note that the de-
1101 PRIVATE vice identification register is not altered
by data being shifted in on TDI.
1110 PRIVATE
BYPASS The instruction code is "1111". The
1111 BYPASS BYPASS instruction selects the bypass
register to be connected to TDI or TDO,
EXT EST The instruction code is "0000". The EX- effectively bypassing the test logic on
TEST instruction allows testing of cir- the Intel486 DX2 microprocessor by re-
cuitry external to the component pack- ducing the shift length of the device to
age, typically board interconnects. It one bit. Note than an open circuit fault
does so by driving the values loaded in the board level test data path will
into the Intel486 DX2 CPU's boundary cause the bypass register to be select-
scan register out on the output pins cor- ed following an instruction scan cycle
responding to each boundary scan cell due to the pull-up resistor on the TDI
and capturing the values on Intel486 input. This has been done to prevent
DX2 CPU input pins to be loaded into any unwanted interference with the
their corresponding boundary scan reg- proper operation of the system logic.
ister locations. I/O pins are selected as RUNBIST The instruction code is "1000". The
input or output, depending on the value RUNBIST instruction selects the one (1)
loaded into their control setting loca- bit runbist register, loads a value of "1"
tions in the boundary scan register. Val- into the runbist register, and connects it
ues shifted into input latches in the to TDO. It also initiates the built-in self
boundary scan register are never used test (BISn feature of the Intel486 DX2
by the internal logic of the Intel486 DX2 CPU, which is able to detect approxi-
CPU. mately 60% of the stuck-at faults on the
NOTE: Intel486 DX2 CPU. The Intel486 DX2
CPU AC/DC Specifications for Vee and
After using the EXTEST instruction, the ClK must be met and reset must have
Intel486 DX2 CPU must be reset before been asserted at least once prior to ex-
normal (non-boundary scan) use. ecuting the RUNBIST boundary scan in-
struction. After loading the RUNBIST in-
SAMPlE/ The instruction code is "0001". The struction code in the instruction register,
PRELOAD SAMPLE/PRELOAD has two functions the TAP controller must be placed in
that it performs. When the TAP control- the Run-Test/Idle state. BIST begins on
ler is in the Capture-DR state, the SAM- the first rising edge of TCK after enter-
PLE/PRELOAD instruction allows a ing the Run-Test/Idle state. The TAP
"snap-shot" of the normal operation of
8-10
controller must remain in the Run-Test! The value of the test mode state (TMS) input signal
Idle state until BIST is completed. It re- at a rising edge of TCK controls the sequence of the
quires 1.2 million clock (ClK) cycles to state changes. The state diagram for the TAP con-
complete BIST and report the result to troller is shown in Figure 8.3. Test designers must
the runbist register. After completing consider the operation of the state machine in order
the 1.2 million clock (ClK) cycles, the to design the correct sequence of values to drive on
value in the runbist register should be TMS.
shifted out on TOO during the Shift-OR
state. A value of "0" being shifted out
on TOO indicates BIST successfully 8.5.4.1 Test-Logic-Reset State
completed. A value of "1" indicates a
In this state, the test logic is disabled so that normal
failure occurred. After executing the
operation of the device can continue unhindered.
RUNBIST instruction, the Intel486 OX2
This is achieved by initializing the instruction register
CPU must be reset prior to normal oper-
such that the IOCOOE instruction is loaded. No mat-
ation.
ter what the original state of the controller, the con-
troller enters Test-logic-Reset state when the TMS
8.5.4 TEST ACCESS PORT (TAP) input is held high (1) for at least five rising edges of
CONTROLLER TCK. The controller remains in this state while TMS
is high. The TAP controller is also forced to enter
The TAP controller is a synchronous, finite state ma- this state at power-up.
chine. It controls the sequence of operations of the
test logic. The TAP controller changes state only in
response to the following events: 8.5.4.2 Run-Test/Idle State
1. a rising edge of TCK A controller state between scan operations. Once in
2. power-up. this state, the controller remains in this state as long
Figure 8.3. TAP Controller State Diagram

8-11
as TMS is held low. In devices supporting the nates the scanning process. If TMS is held low and a
RUNBIST instruction, the BIST is performed during rising edge is applied to TCK, the controller enters
this state and the result is reported in the runbist the Pause-DR state.
register. For instruction not causing functions to exe-
cute during this state, no activity occurs in the test The test data register selected by the current in-
logic. The instruction register and all test data regis- struction retains its previous value during this state.
ters retain their previous state. When TMS is high The instruction does not change in this state.
and a rising edge is applied to TCK, the controller
moves to the Select-DR state.
8.5.4.7 Pause-Dr State
8.5.4.3 Select-OR-Scan State The pause state allows the test controller to tempo-
rarily halt the shifting of data through the test data
This is a temporary controller state. The test data register in the serial path between TDI and TOO. An
register selected by the current instruction retains its example of using this state could be to allow a tester
previous state. If TMS is held low and a rising edge to reload its pin memory from disk during application
is applied to TCK when in this state, the controller of a long test sequence.
moves into the Capture-DR state, and a scan se-
quence for the selected test data register is initiated. The test data register selected by the current in-
If TMS is held high and a rising edge is applied to struction retains its previous value during this state.
TCK, the controller moves to the Select-IR-Scan The instruction does not change in this state.
state.
The controller remains in this state as long as TMS
The instruction does not change in this state. is low. When TMS goes high and a rising edge is
applied to TCK, the controller moves to the Exit2-DR
state.
8.5.4.4 Capture-DR State
In this state, the boundary scan register captures 8.5.4.8 Exit2-0R State
input pin data if the current instruction is EXT EST or
SAMPLE/PRELOAD. The other test data registers, This is a temporary state. While in this state, if TMS
which do not have parallel input, are not changed. is held high, a rising edge applied to TCK causes the
controller to enter the Update-DR state, which termi-
The instruction does not change in this state. nates the scanning process. If TMS is held low and a
rising edge is applied to TCK, the controller enters
When the TAP controller is in this state and a rising the Shift-DR state.
edge is applied to TCK, the controller enters the
Exit1-DR state if TMS is high or the Shift-DR state if The test data register selected by the current in-
TMS is low. struction retains its previous value during this state.
The instruction does not change in this state.
8.5.4.5 Shift-DR State
8.5.4.9 Update-DR State
In this controller state, the test data register con-
nected between TDI and TOO as a result of the cur- The boundary scan register is provided with a
rent instruction, shifts data one stage toward its seri- latched parallel output to prevent changes at the
al output on each rising edge of TCK. parallel output while data is shifted in response to
the EXT EST and SAMPLE/PRELOAD instructions.
The instruction does not change in this state. When the TAP controller is in this state and the
boundary scan register is selected, data is latched
When the TAP controller is in this state and a rising onto the parallel output of this register from the shift-
edge is applied to TCK, the controller enters the register path on the falling edge of TCK. The data
Exit1-DR state if TMS is high or remains in the Shift- held at the latched parallel output does not change
DR state if TMS is low. other than in this state.
All shift-register stages in test data register selected

8.5.4.6 Exit1-0R State by the current instruction retains its previous value
This is a temporary state. While in this state, if TMS during this state. The instruction does not change in
is held high, a rising edge applied to TCK causes the this state.
controller to enter the Update-DR state, which termi-
8-12
8.5.4.10 Select-IR-Scan State controller to enter the Update-IR state, which termi-
nates the scanning process. If TMS is held low and a
This is a temporary controller state. The test data rising edge is applied to TCK, the controller enters
register selected by the current instruction retains its the Pause-IR state.
previous state. If TMS is held low and a rising edge
is applied to TCK when in this state, the controller The test data register selected by the current in-
moves into the Capture-IR state, and a scan se- struction retains its previous value during this state.
quence for the instruction register is initiated. If TMS The instruction does not change in this state.
is held high and a rising edge is applied to TCK, the
controller moves to the Test-Logic-Reset state.
8.5.4.14 Pause-IR State
The instruction does not change in this state. The pause state allows the test controller to tempo-
rarily halt the shifting of data through the instruction
8.5.4.11 Capture-IR State register.
In this controller state the shift register contained in The test data register selected by the current in-
the instruction register loads the fixed value "0001" struction retains its previous value during this state.
on the riSing edge of TCK. The instruction does not change in this state.
The test data register selected by the current in- The controller remains in this state as long as TMS
struction retains it previous value during this state. is low. When TMS goes high and a rising edge is
The instruction does not change in this state. applied to TCK, the controller moves to the Exit2-IR
state.
When the controller is in this state and a rising edge
is applied to TCK, the controller enters the Exit1-IR
state if TMS is held high, or the Shift-IR state if TMS 8.5.4.15 Exit2-IR State
is held low. This is a temporary state. While in this state, if TMS
is held high, a rising edge applied to TCK causes the
8.5.4.12 Shift-IR State controller to enter the Update-IR state, which termi-
nates the scanning process. If TMS is held low and a
In this state the shift register contained in the in- rising edge is applied to TCK, the controller enters
struction register is connected between TDI and the Shift-IR state.
TDO and shifts data one stage towards its serial out-
put on each rising edge of TCK. The test data register selected by the current in-
struction retains its previous value during this state.
The test data register selected by the current in- The instruction does not change in this state.
struction retains its previous value during this state.
The instruction does not change in this state.
8.5.4.16 Update-IR State
When the controller is in this state and a rising edge
The instruction shifted into the instruction register is
is applied to TCK, the controller enters the Exit1-IR
latched onto the parallel output from the shift-regis-
state if TMS is held high, or remains in the Shift-IR
ter path on the falling edge of TCK. Once the new
state if TMS is held low. instruction has been latched, it becomes the current
instruction.
8.5.4.13 Exit1-IR State
Test data registers selected by the current instruc-
This is a temporary state. While in this state, if TMS tion retain the previous value.
is held high, a rising edge applied to TCK causes the
8-13
8.5.5 BOUNDARY SCAN REGISTER CELL "RESERVED" corresponds to no connect "NC" sig-
nals on the Intel486 DX2 CPU.
The boundary scan register contains a cell for each
pin, as well as cells for control of 1/0 and 3-state All the 'CTL cells are control cells that are used to
pins. select the direction of bidirectional pins or 3-state
output pins. If "1" is loaded into the control cell
The following is the bit order of the Intel486 DX2 (*CTL), the associated pin(s} are 3-stated or select-
CPU boundary scan register: (from left to right and ed as input. The following lists the control cells and
top to bottom). their corresponding pins.
1. WRCTL controls the D31-0 and DP3-0 pins.
TOI - WRCTL ABUSCTL BUSCTL MISCCTL
ADS# BLAST# PLOCK# LOCK# PCHK# 2. ABUSCTL controls the A31-A2 pins.
BRDY# BOFF# BS16# BS8# RDY# KEN# 3. BUSCTL controls the ADS#, BLAST#,
HOLD AHOLD CLK HLDA WR# BREQ BEO# PLOCK#, LOCK#, WR#, BEO#, BE1#, BE2#,
BE1 # BE2# BE3# MIO# DC# PWT PCD BE3#, MIO#, DC#, PWT, and PCD pins.
EADS# A20M# RESET FLUSH# INTR NMI 4. MISCCTL controls the PCHK#, HLDA, BREQ,
UP# FERR# IGNNE# D31 D30 D29 D28 D27 and FERR # pins.
D26 D25 D24 DP3 D23 D22 D21 020 019 D18
D17 D16 DP2 D15 D14 D13 D12 D11 D10 D9
D8 DP1 D7 D6 05 D4 D3 D2 D1 DO DPO A31 8.5.6 TAP CONTROLLER INITIALIZATION
A30 A29 A28 A27 A26 A25 A24 A23 A22 A21
A20 A19 A18 A17 A16 A15 A14 A13 A12 A11 The TAP controller is automatically initialized when a
A10 A9 A8 A7 A6 RESERVED A5 A4 A3 device is powered up. In addition, the TAP controller
A2-TDO can be initialized by applying a high signal level on
the TMS input for five TCK periods.
8-14
8.5.7 BOUNDARY SCAN DESCRIPTION LANGUAGE (BSDL)
Intel i486(tm)DX2 CPU BSDL description
entity Intel486TM_DX2 is
generic(PHYSICAL_PIN_MAP : string .- 'PGA_17xI7');
port (A20M in bit;

ABUS2 out bit;
ABUS3 out bit;
ABUS inout bit_vector (4 to 31); -- Address bus (words)
ADS out bit;
AHOLD in bit;
BE out bit_vector(O to 3) ;
BLAST out bit;
BOFF in bit;
BRDY in bit;
BREQ out bit;
BS8 in bit;
BS16 in bit;
CLK in bit;
DBUS inout bit _vector (
DC out bit;
DP inout bit_vect
EADS in bit;
FERR out bit;
FLUSH in bit·
HLDA out bit
HOLD in
IGNNE
INTR
KEN
LOCK
MIO
NC to 12); -- No Connects
Ncl
NMI
PCD
PCHK
PLOCK
PWT bit;
RDY bit;
RESE bit;
TC in bit; Scan Port inputs
T out bit; Scan Port output
UP in bit;
VCC linkage bit_vector(1 to 24); VCC
VSS linkage bit_vector(1 to 28); VSS
WR out bit);
attribute PIN_MAP of Intel486TM_DX2 : entity is PHYSICAL_PIN_MAP;
constant PGA_17x17 : PIN_MAP_STRING .- -- Define Pin Out of PGA

'A20M DIS,' &
'ABUS2 Q14, , &
'ABUS3 R15. ' &
'ABUS (SI6, Q12, SIS, Q13, R13, Qll, S13, R12,' &.
S7, QI0, S5, R7, Q9, Q3, R5, Q4, Q8, Q5,' &
Q7, S3, Q6, R2, 82, SI, Rl, P2, P3, Q1),' I<
'ADS S17, , I<
'AHOLD A17, , &
'BE (KI5, J16, J15, FI7), , I<
241245-97
Intel486™ DX2 CPU BSDL Model for Boundary Scan

8-15
'BLAST R16, &

'BOFF D17, &
'BRDY HIS, &
'BREQ Q1S, &
'BS8 D16, &
'BS16 C17, &
'CLK C3, &
'DBUS (P1, N2, N1, H2, M3, J2, L2, L3, F2, 01, E3, &
C1, G3, D2, K3, F3, J3, D3, C2, B1, AI, B2, , &
A2, A4, A6, B6, C7, C6, C8, A8, C9, B8), ' &
'DC MIS, &
'DP (N3, F1, H3, AS) , &
'EADS B17, &
'FERR C14, &
'FLUSH C15, , &
'HLDA P15, &
'HOLD E15, &
'IGNNE A15, &
'INTR A16, &
'KEN F15, &
'LOCK N15, &
'MID N16, &
'NC (RI7, G15, C10, C12,
A10, A12, A13), ' &
'NC1 S4, &
'NMI B1S, &
'PCD J17, &
'PCHK Q17, &
'PLOCK Q16, &
'PWT L1S, &
'RDY F16 t &
'RESET C16, &
'TCK A3, &
'TDI A14, &
'TDO B16, &
'TMS B14, &
'UP Cll, &
'VCC (R8, R9, K2, K16, , &
J1, H16, B9, Bll, &
R3, R6
'VSS (S6, Q2, P17, M1, &
M17, G17, E!. E17, &
B3,*, B
'WR N17' ;
attribute Tap_Scan_In of true;
attribute Tap_Scan_Mode of true;
attribute Tap_Sca~Out of is true;
attribute Tap_Scan_Clock 0 is (25.0e6, BOTH);
attribute th of Inte1486TM_DX2: entity is 4;
attribute Instruc code of Inte1486TM_DX2: entity is
'BYPASS (1 &
'EXTEST (0 &
'SAMPLE ( 0 0 , &
'IDCODE (0010),' &
'RUNBIST (1000),' &
'PRIVATE (0011,0100,0101,0110,0111,1001,1010,1011,1100,1101,1110)';
attribute Instruction_Capture of Inte1486TM_DX2: entity is '0001';
-- there is no Instruction_Disable attribute for Inte1486TM_DX2
attribute Instruction_Private of Inte1486TM_DX2: entity is 'private';
attribute Instruction_Usage of Inte1486TM_DX2: entity is
'RUNBIST (registers BIST; , &
'result 0;' &
'clock CLK in Run_Test_Idle;'&
'length 1200000)';
attribute Idcode_Register of Inte1486TM_DX2: entity is
'0000' & --version
'0000010000010001' & --new part number
'00000001001' & --manufacturers identity
'1'; --requi red by the standard
attribute Register_Access of Inte1486TM_DX2: entity is
'BIST!l] (RUNBIST)' ;
241245-98
Intel486TM DX2 CPU BSDL Model for Boundary Scan (Continued)
8-16
--(*******************************************************************}
--( The first cell is closest to TDO )
--{++*****************************************************************}
attribut.e Boundat-y_Length of Inte1486TM_DX2: entity is 105;

atLtibut.e Boundary_Cells oE Inte1486TM_DX2 : entity is 'BC_2, BC_l, BC_6' ;
attrIbute Boundary_Register of InteI486TM_DX2: entity is

'0 IRC_2, ABUS2, output3, X, 102, 1, Z), ' &
'I IBC_2, ABUS3, output3, X, 102, 1, Z), ' &
'2 IBC_6, ABUS(4), bidi r, X, 102, 1, Z), ' &
'3 IBC_6, ABUS 15), bidir, X, 102, 1, Z), ' &
'4 I BC_1- NC1, input, X), ' &
'5 IBC_6, ABUS (6), bidir, X, 102, &
'6 IBC_6, ABUS (7), bidir, X, 102, &
'7 IBC6, ABUS(8) , bidir, X, 102, &
'8 IBC_6, ABUS(9), bidir, X, 102, &
,9 IBC_6, ABUS(10) , bidir, X, 102, &
'10 (BC_6, ABUS(ll), bidir, X, 102,
'11 IBC _6, ABUS (12) , bidir, X, 102,
'12 (BC_6, ABUS(13) , bidi r, X, 102,
'13 IRC_6, ABUS(14), bidir, X, 102,
'14 (BC_6, ABUS(IS) , bidir, X, 102,
'15 IRC_6, ABUS(16) , bidir, X, 102,
'16 (BC6, ABUS(17) , bidir, X, 102,
'17 (BC_6, ABUS (18), bidir, X, 102,
'18 IRC_6, ABUS(19) , bidir, X, 102,
'19 (BC_6, ABUS(20) , bidir, X, 1
'20 (BC_6, ABUS (21), bidi r, X,
'21 IBC_6, ABUS(22) , bidi r, X,
'/.7. I R(·_.G , ABlIS(23) , bidi r,
'23 (BC_6, ABUS(24) , bidir,
'24 (BC6, ABUS(2S) , bidir
'25 (BC6, ABUS (26) , bidi
'26 (BC_6, ABUS(27) , bi
'27 (BC6, ABUS(28) ,
'28 (BC_6, ABUS (29),
'29 (BC_6, ABUS(30) ,
'30 (BC_6, ABUS (31) &
'31 (BC6, DP(O) , ),' &
'32 (BC6, DBUS( Z), ' &
'33 (BC_6, DBUS( Z), ' &
'34 (BC_6, D~(2), 1, Z), ' &
'35 (BC_6, DBUS(3) , 1, Z), ' &
'36 (BC_6, DBUS(4) , 1, Z), ' &
'37 (BC_6, [lBUS(S) 103 : 1, Z), ' &
'38 (BC6, DBUS(6) 103, 1, Z), ' &
'39 (BC_6, DBUS(?) , 103, 1, Z), ' &
'40 (BC_6, DP( 103, 1, Z), ' &
'41 (BC_6, D bidi r, 103, 1, Z), ' &
'42 (BC6, bidir, 103, L Z), ' &
'43 (BC_6, ), bidi r, X, 103, 1, Z), ' &
'44 (BC 6 (11) , bidir, X, 103, 1, Z), ' &
'45 (BC S( 12), bidir, X, 103, 1, Z), ' &
'46 (BC_ BUS(13) , bidi r, X, 103, 1, Z), ' &
'47 (BC_6, DBUS(14) , bidir, X, 103, 1. Z), ' &
'48 (BC_6, DBUS(lS) , bidi r, X, 103, 1, Z), ' &
'49 (BC_6, DP(2) , bidir, X, 103, 1, Z), ' &
'50 (BC_6, DBUS(16) , bidir, X, 103, 1, Z), ' &
'51 (RC6, DBUS(17) , bidi r, X, 103, 1, Z), ' &
'52 (BC6, DBUS(18) , bidir, X, 103, 1, Z), ' &
'53 (BC_6, DBUS(19), bidir, X, 103, 1, Z), ' &
'54 (BC_6, DBUS(20) , bidir, X, 103, 1, Z), ' &
'55 (BC_6, DBUS(211 , bidi r, X, 103, 1, Z), ' &
'56 (Bc_6, DBUS(22) , bidir, X, 103, L Z), ' &
'57 (BC_6, DBUS(23) , bidi r, X, 103, 1, Z), ' &
'58 (BC_6, DP(3) , bidir, X, 103, 1- Z), ' &
'59 (BC_6, DBUS(24) , bidi r, X, 103, 1, Z), ' &
'60 (BC_6, DBUS (25) , bidir, X, 103, 1, Z), ' &
'61 (BC6, DBUS(26) , bidir, X, 103, 1, Z), ' &
'62 (BC_6, DBUS(27) , bidir, X, 103, 1. Z), ' &
'63 (BC6, DBUS(28) , bidir, X, 103, 1, Z), ' &
'64 (BC_6, DBUS (29), bidir, X, 103, 1, Z), ' &
'65 (BC_6, DBUS(30) , bidir, X, 103, 1, Z), ' &
'66 (BC_6, DBUS(31) , bidir, X, 103, 1, Z), ' &
'67 (BC_1- IGNNE, input, X), ' &
'68 (BC2, FERR, output3, X, 100, L Z), ' &
'69 (BC_1- UP, input, X), ' &
'70 (BCl, NMI, input, X), ' &
'71 (BC1, INTR, input, X), ' &
241245-99
Intel486TM DX2 CPU BSDL Model for Boundary Scan (Continued)

8-17
'72 (BC_l. FLUSH. input. X). ' &

'73 (BC_l. RESET. input. X). ' &
'74 (BC_l. A20M. input. X). ' &
'75 (BC_l. EADS. input. X). ' &
'76 (BC_2. PCD. output3. X. 101. 1. Z) • ' &
'77 (BC_2. PWT. output3. X. 101. 1. Z) • ' [.
'78 (BC_2. DC. output3. X. 101. 1. Z) • ' &
'79 (BC_2. MIO. output3. X. 101. 1. Z) • ' &
'80 (BC2. BE(3) • output3. X. 101. 1. Z) • ' &
'81 (BC_2. BE(2) • output3 • x. 101. 1. Z). ' &
'82 (BC_2. BE(l) • output3. X. 101. 1. Z). ' &
'83 (BC2. BE(O) • output3. X. 101. 1. Z). ' &
'84 (BC2. BREQ. output3. X. 100. 1. Z), ' &
'85 (BC2. WR. output3. X. 101. 1. Z). ' &
'86 (BC_2. HLDA. output3. X. 100. 1. Zl. '
'87 (BC_l. CLK. input. X). ' &
'88 (BC_l. AHOLD. input. Xl. '
'89 (BC_l. HOLD. input. X). '
'90 (BC_l. KEN. input. Xl. '
'91 (BC_l. ROY. input. Xl. '
'92 (BC_l. BS8. input. Xl
'93 (BC_t. BS16. input. X)
'94 (BC_I. BOFF. input.
'95 (BC_1. BRDY. inpu
'96 (BC_2. PCHK. ou &
, 97 (BC_2. LOCK. &
'98 (BC_2. PLOCK. &
'99 (BC_2. BLAST. &
'100 (BC_2. ADS, &
'101
"102
"103
(BC_2.
(BC_2.
(BC_2.
*
*. DISMISC
DISBUS
DISABUS
"104 (BC_2. DISWR
end Inte1486TM_DX2;
241245-A1
8-18
9.0 DEBUGGING SUPPORT

The Intel486 microprocessor family provides several single-step exception occurs. The single-step ex-
features which simplify the debugging process. The ception is auto vectored to exception number 1. Pre-
three categories of on-chip debugging aids are: cisely, exception 1 occurs as a trap after the instruc-
1) the code execution breakpoint opcode (OCCH), tion following the instruction which set TF. In typical
practice, a debugger sets the TF bit of a flag register
2) the single-step capability provided by the TF bit image on the debugger's stack. It then typically
in the flag register, and transfers control to the user program and loads the
3) the code and data breakpoint capability provided flag image with a signal instruction, the IRET instruc-
by the Debug Registers DRO-3, DR6, and DR7. tion. The single-step trap occurs after executing one
instruction of the user program.
9.1 Breakpoint Instruction Since the exception 1 occurs as a trap (that is, it
occurs after the instruction has already executed),
A single-byte-opcode breakpoint instruction is avail- the CS:EIP pushed onto the debugger's stack points
able for use by software de buggers. The breakpoint to the next unexecuted instruction of the program
opcode is OCCH, and generates an exception 3 trap being debugged. An exception 1 handler, merely by
when executed. In typical use, a debugger program ending with an IRET instruction, can therefore effi-
can "plant" the breakpoint instruction at all desired ciently support single-stepping through a user pro-
code execution breakpoints. The single-byte break- gram.
point opcode is an alias for the two-byte general
software interrupt instruction, INT n, where n=3.
The only difference between INT 3 (OCCh) and INT n 9.3 Debug Registers
is that INT 3 is never IOPL-sensitive but INT n is
IOPL-sensitive in Protected Mode and Virtual 8086 The Debug Registers are an advanced debugging
Mode. feature of the Intel486 microprocessor family. They
allow data access breakpoints as well as code exe-
cution breakpoints. Since the breakpoints are indi-
9.2 Single-Step Trap cated by on-chip registers, an instruction execution
break-point can be placed in ROM code or in code
If the single-step flag (TF, bit 8) in the EFLAG regis- shared by several tasks, neither of which can be
ter is found to be set at the end of an instruction, a supported by the INT3 breakpoint opcode.
9-1
The Intel486 microprocessor contains six Debug equals the physical address. If paging is enabled,
Registers, providing the ability to specify up to four the linear address is translated to a physical 32-bit
distinct breakpoints addresses, breakpoint control address by the on-chip paging unit. Regardless of
options, and read breakpoint status. Initially after re- whether paging is enabled or not, however, the
set, breakpoints are in the disabled state. Therefore, breakpoint registers hold linear addresses.
no breakpoints will occur unless the debug registers
are programmed. Breakpoints set up in the Debug
Registers are autovectored to exception number 1. 9.3.2 DEBUG CONTROL REGISTER (DR7)
A Debug Control Register, DR? shown in Figure 9.1,
9.3.1 LINEAR ADDRESS BREAKPOINT allows several debug control functions such as en-
REGISTERS (DRO-DR3) abling the breakpoints and setting up other control
options for the breakpoints. The fields within the De-
Up to four breakpoint addresses can be specified by bug Control Register, DR?, are as follows:
writing into Debug Registers DRO-DR3, shown in
Figure 9.1. The breakpoint addresses specified are LENi (breakpoint length specification bits)
32-bit linear addresses. Intel486 microprocessor
hardware continuously compares the linear break- A 2-bit LEN field exists for each of the four break-
point addresses in DRO-DR3 with the linear ad- points. LEN specifies the length of the associated
dresses generated by executing software (a linear breakpoint field. The choices for data breakpoints
address is the result of computing the effective ad- are: 1 byte, 2 bytes, and 4 bytes. Instruction execu-
dress and adding the 32-bit segment base address). tion breakpoints must have a length of 1 (LENi =
Note that if paging is not enabled the linear address 00). Encoding of the LENi field is as follows:
31 16 15 o
BREAKPOINT 0 LINEAR ADDRESS ORO
BREAKPOINT 1 LINEAR ADDRESS DR1
Intel reserved. Do not define. DR4
Intel reserved. Do not define. DR5
DR6
DR?
31 16 15 o
NOTE:
!indicates Intel reserved: Do not define; SEE SECTION 2.3.10
Figure 9.1. Debug Registers
9-2
Usage of Least DR2 = 00000005H; LEN2 = OOB

LENi Breakpoint Significant Bits in
Encoding Field Width Breakpoint Address
Register i, (i = 0 - 3)
00
01
1 byte
2 bytes
All 32-bits used to
specify a single-byte
breakpoint field.
I"I Ibk.tfl'21 1:::=: 0
A1-A31 used to specify

a two-byte, word- DR2=00000005H; LEN2 = 01B
aligned breakpoint field.
AO in Breakpoint
31 1 0
Address Register is not
used.
r---~-----+----~----~
I 00000008H
10 Undefined- +- bkpt fld2 -- 00000004H

do not use
this encoding
L -_ _ _ _ ~ ____ ~ ______I ~ ____ ~
OOOOOOOOH
11 4 bytes A2-A31 used to specify

a four-byte, dword- DR2=00000005H; LEN2 = 11B
aligned breakpoint field.
AO and A1 in
31 I I 1 0
Breakpoint Address
Register are not used.
I I 00000008H
+- bkpt fld2 -- 00000004H
r-----~-----r----_,r-----,
The LENi field controls the size of breakpoint field i
by controlling whether all low-order linear address
I I OOOOOOOOH
bits in the breakpoint address register are used to

detect the breakpoint event. Therefore, all break-
point fields are aligned; 2-byte breakpoint fields be- RWi (memory access qualifier bits)
gin on Word boundaries, and 4-byte breakpoint
fields begin on Dword boundaries. A 2-bit RW field exists for each of the four break-
points. The 2-bit RW field specifies the type of usage
The following is an example of various size break- which must occur in order to activate the associated
point fields. Assume the breakpoint linear address in breakpoint.
DR2 is OOOOOOOSH. In that situation, the following
illustration indicates the region of the breakpoint
field for lengths of 1, 2, or 4 bytes.
9-3
int"eL Intel486TM DX2 MICROPROCESSOR
bug Register resources when required. The GD bit,

RW Usage
when set, causes an exception 1 fault if an instruc-
Encoding Causing Breakpoint tion attempts to read or write any Debug Register.
00 Instruction execution only The GD bit is then automatically cleared when the
01 Data writes only exception 1 handler is invoked, allowing the excep-
10 Undefined-do not use this encoding tion 1 handler free access to the debug registers.
11 Data reads and writes only GE and LE (Exact data breakpoint match, global and
local)
RW encoding 00 is used to set up an instruction
execution breakpoint. RW encodings 01 or 11 are The breakpoint mechanism of the Intel486 micro-
used to set up write-only or read/write data break- processor family differs from that of the Inte1386.
points. The Intel486 microprocessor always does exact
data breakpoint matching, regardless of GE/LE bit
Note that instruction execution breakpoints are settings. Any data breakpoint trap will be reported
taken as faults (Le., before the instruction exe- exactly after completion of the instruction that
cutes), but data breakpoints are taken as traps caused the operand transfer. Exact reporting is pro-
(Le., after the data transfer takes place). vided by forcing the Intel486 microprocessor execu-
tion unit to wait for completion of data operand
Using LENi and RWi to Set Data Breakpoint i transfers before beginning execution of the next in-
struction.
A data breakpoint can be set up by writing the linear
address into DRi (i = 0-3). For data breakpoints, When the Intel486 microprocessor performs a task
RWi can = 01 (write-only) or 11 (write/read). LEN switch, the LE bit is cleared. Thus, the LE bit sup-
can = 00,01, or 11. ports fast task switching out of tasks, that have
enabled the exact data breakpoint match for their
If a data access entirely or partly falls within the data task-local breakpoints. The LE bit is cleared by the
breakpoint field, the data breakpoint condition has processor during a task switch, to avoid having ex-
occurred, and if the breakpoint is enabled, an excep- act data breakpoint match enabled in the new task.
tion 1 trap will occur. Note that exact data breakpoint match must be re-
enabled under software control.
Using LENi and RWi to Set Instruction Execution
Breakpoint i The Intel486 microprocessor GE bit is unaffected
during a task switch. The GE bit supports exact data
An instruction execution breakpoint can be set up by breakpoint match that is to remain enabled during all
writing address of the beginning of the instruction tasks executing in the system.
(including prefixes if any) into DRi (i = 0-3). RWi
must = 00 and LEN must = 00 for instruction exe- Note that instruction execution breakpoints are al-
cution breakpoints. ways reported exactly.
If the instruction beginning at the breakpoint address Gi and Li (breakpoint enable, global and local)
is about to be executed, the instruction execution
breakpoint condition has occurred, and if the break- If either Gi or Li is set then the associated breakpoint
point is enabled, an exception 1 fault will occur be- (as defined by the linear address in DRi, the length
fore the instruction is executed. in LENi and the usage criteria in RWi) is enabled. If
either Gi or Li is set, and the Intel486 microproces-
Note that an instruction execution breakpoint ad- sor detects the ith breakpoint condition, then the ex-
dress must be equal to the beginning byte address ception 1 handler is invoked.
of an instruction (including prefixes) in order for the
instruction execution breakpoint to occur. When the Intel486 microprocessor performs a task
switch to a new Task State Segment (TSS), all Li
GD (Global Debug Register access detect) bits are cleared. Thus, the Li bits support fast task
switching out of tasks that use some task-local
The Debug Registers can only be accessed in Real breakpoint registers. The Li bits are cleared by the
Mode or at privilege level 0 in Protected Mode. The processor during a task switch, to avoid spurious ex-
GD bit, when set, provides extra protection against ceptions in the new task. Note that the breakpoints
any Debug Register access even in Real Mode or at must be re-enabled under software control.
privilege level 0 in Protected Mode. This additional
protection feature is provided to guarantee that a All Intel486 microprocessor Gi bits are unaffected
software debugger can have full control over the De- during a task switch. The Gi bits support breakpoints
that are active in all tasks executing in the system.
9-4
9.3.3 DEBUG STATUS REGISTER (DR6) IMPORTANT NOTE: A flag Bi is set whenever the
hardware detects a match condition on enabled
A Debug Status Register, DR6 shown in Figure 9.1, breakpoint i. Whenever a match is detected on at
allows the exception 1 handler to easily determine least one enabled breakpoint i, the hardware imme-
why it was invoked. Note the exception 1 handler diately sets all Bi bits corresponding to breakpoint
can be invoked as a result of one of several events: conditions matching at that instant, whether enabled
1) ORO Breakpoint fault/trap. or not. Therefore, the exception 1 handler may see
that multiple Bi bits are set, but only set Bi bits corre-
2) DR1 Breakpoint fault/trap. sponding to enabled breakpoints (Li or Gi set) are
3) DR2 Breakpoint fault/trap. true indications of why the exception 1 handler was
4) DR3 Breakpoint fault/trap. invoked.
5) Single-step (TF) trap. BD (debug fault due to attempted register access
6) Task switch trap. when GO bit set)
7) Fault due to attempted debug register access
when GD=1. This bit is set if the exception 1 handler was invoked
due to an instruction attempting to read or write to
The Debug Status Register contains single-bit flags the debug registers when GO bit was set. If such an
for each of the possible events invoking exception 1. event occurs, then the GO bit is automatically
Note below that some of these events are faults (ex- cleared when the exception 1 handler is invoked,
ception taken before the instruction is executed), allowing handler access to the debug registers.
while other events are traps (exception taken after
the debug events occurred). BS (debug trap due to single-step)
The flags in DR6 are set by the hardware but never This bit is set if the exception 1 handler was invoked
cleared by hardware. Exception 1 handler software due to the TF bit in the flag register being set (for
should clear DR6 before returning to the user pro- single-stepping).
gram to avoid future confusion in identifying the
source of exception 1. BT (debug trap due to task switch)
The fields within the Debug Status Register, DR6, This bit is set if the exception 1 handler was invoked
are as follows: due to a task switch occurring to a task having a
Intel486 microprocessor TSS with the T bit set. Note
Bi (debug fault/trap due to breakpoint 0-3) the task switch into the new task occurs normally,
but before the first instruction of the task is execut-
Four breakpoint indicator flags, BO-B3, correspond ed, the exception 1 handler is invoked. With respect
one-to-one with the breakpoint registers in DRO- to the task switch operation, the operation is consid-
DR3. A flag Bi is set when the condition described ered to be a trap.
by DRi, LENi, and RWi occurs.
9.3.4 USE OF RESUME FLAG (RF) IN FLAG
If Gi or Li is set, and if the ith breakpoint is detected, REGISTER
the processor will invoke the exception 1 handler.
The exception is handled as a fault if an instruction The Resume Flag (RF) in the flag word can sup-
execution breakpoint occurred, or as a trap if a data press an instruction execution breakpoint when the
breakpoint occurred. exception 1 handler returns to a user program at a
user address which is also an instruction execution
breakpoint.
9-5
10.0 INSTRUCTION SET SUMMARY

This section describes the Intel486 DX2 microproc- 2. Accesses are aligned. Add three core clocks to
essor instruction set. Tables 10.1 through 10.3 list all each misaligned access.
instructions along with instruction encoding dia- 3. Cache fills complete before subsequent access-
grams and clock counts. Further details of the in- es to the same line. If a read misses the cache
struction encoding are then provided in Section during a cache fill due to a previous read or pre-
10.2, which completely describes the encoding fetch, the read must wait for the cache fill to
structure and the definition of all fields occurring complete. If a read or write accesses a cache
within the Intel486 DX2 microprocessor instructions. line still being filled, it must wait for the fill to
complete.
10.1 Intel486™ DX2 Microprocessor 4. If an effective address is calculated, the base
register is not the destination register of the pre-
Instruction Encoding and Clock
ceding instruction. If the base register is the
Count Summary destination register of the preceding instruction
To calculate elapsed time for an instruction, multiply add 1 to the core clock counts shown. Back-to-
the instruction clock count, as listed in Tables 10.1 back PUSH and POP instructions are not affect-
through 10.3 by the processor core clock period ed by this rule.
(e.g., 20 ns for a 50 MHz Intel486 DX2 microproces- 5. An effective address calculation uses one base
sor). register and does not use an index register.
However, if the effective address calculation
For more detailed information on the encodings of uses an index register, 1 core clock may be
instructions, refer to Section 10.2 Instruction Encod- added to the clock count shown.
ings. Section 10.2 explains the general structure of
6. The target of a jump is in the cache. If not, add r
instruction encodings, and defines exactly the en-
clocks for accessing the destination instruction
codings of all fields contained within the instruction.
of a jump. If the destination instruction is not
INSTRUCTION CLOCK COUNT ASSUMPTIONS completely contained in the first dword read,
add a maximum of 3b bus clocks. If the destina-
The Intel486 DX2 microprocessor instruction core tion instruction is not completely contained in
clock count tables give clock counts assuming data the first 16 byte burst, add a maximum of anoth-
and instruction accesses hit in the cache. The com- er r + 3b bus clocks.
bined instruction and data cache hit rate is over 7. If no write buffer delay, w bus clocks are added
90%. only in the case in which all write buffers are full.
A cache miss will force the Intel486 DX2 microproc- 8. Displacement and immediate not used together.
essor to run an external bus cycle. The Intel486 DX2 If displacement and immediate used together, 1
microprocessor 32-bit burst bus is defined as core clock may be added to the core clock
r-b-w. count shown.
9. No invalidate cycles. Add a delay of 1 bus clock
Where: for each invalidate cycle if the invalidate cycle
r = The number of bus clocks in the first cycle of a contends for the internal cache/external bus
burst read or the number of clocks per data when the Intel486 DX2 CPU needs to use it.
cycle in a non-burst read. 10. Page translation hits in TLB. A TLB miss will add
b = The number of bus clocks for the second and 13, 21 or 28 bus clocks + 1 possible core clock
subsequent cycles in a burst read. to the instruction depending on whether the Ac-
cessed and/or Dirty bit in neither, one or both of
w = The number of bus clocks for a write. the page entries needs to be set in memory.
The fastest bus the Intel486 DX2 microprocessor This assumes that neither page entry is in the
can support is 2 -1 - 2 assuming 0 wait states. The data cache and a page fault does not occur on
clock counts in the cache miss penalty column as- the address translation.
sume a 2-1-2 bus. For slower busses add r-2 11. No exceptions are detected during instruction
clocks to the cache miss penalty for the first dword execution. Refer to Interrupt core Clock Counts
accessed. Other factors also affect instruction clock Table for extra clocks if an interrupt is detected.
counts. 12. Instructions that read multiple consecutive data
items (i.e. task switch, paPA, etc.) and miss the
Instruction Clock Count Assumptions cache are assumed to start the first access on a
1. The external bus is available for reads or writes 16-byte boundary. If not, an extra cache line fill
at all times. Else add bus clocks to reads until may be necessary which may add up to (r + 3b)
the bus is available. bus clocks to the cache miss penalty.
10-1
Table 10.1. Intel486™ DX2 Microprocessor Integer Core Clock Count Summary
INSTRUCTION FORMAT Cache Hit Notes
INTEGER OPERATIONS
MOV ~ Move:
reg1 to reg2 I 1000100W 11 reg1 reg21 1
reg2 to reg1 I 1000101w 11 reg1 reg21 1
memory to reg I 1000101w mod reg rim I 1
reg to memory I 1000100w mod reg rim 1 1
Immediate to reg I 1100011 w 11000 I

reg immediate data 1
or I 1011w reg immediate data 1
Immediate to Memory I 1100011 w mod 000

I Idisplacement 1
r m immediate
Memory to Accumulator I 1010000w full displacement 1
Accumulator to Memory I 1010001w full displacement 1
MOVSX/MOVZX ~ Move with Sign/Zero Extension
re92 to re91 I 00001111 1 1011 z11 w 111 re9 1 re92 1 3
memory to reg I 00001111 1 1011 z11 w 1 mod reg rim 1 3
z instruction
0 MOVZX
1 MOVSX
PUSH ~ Push
reg I 11111111 111 110 reg 1 4
or 101010 reg 1 1
memory I 11111111 1 mod 110 rim 1 4
immediate 1 01101080 1 immediate data 1
PUSHA ~ Push All I 01100000 1 11
POP ~ Pop
reg 1 10001111 111 000 reg 1 4
or 101011 reg 1 1
memory I 10001111 1 mod 000 rim 1 5
POPA ~ PopAIl
1 01100001 1 9
XCHG ~ Exchange
reg1 with r9g2 1000011w 111 re9 1 reg21 3
Accumulator with reg 10010 reg 1 3
Memory with reg 1000011w 1 mod reg rim 1 5
NOP ~ No Operation 10010000 1 1
LEA ~ Load EA to Register 10001101 1 mod reg r/ml

no index register 1
with index register 2
10-2
Table 10.1.lnteI486™ DX2 Microprocessor Integer Core Clock Count Summary (Continued)
INTEGER OPERATIONS (Continued)
Instruction TIT
ADD ~ Add 000
ADC ~ Add with Carry 010
AND ~ Logical AND 100
OR ~ Logical OR 001
SUB ~ Subtract 101
SSB = Subtract with Borrow 011
XOR ~ Logical Exclusive OR 110
regl toreg2 I OOTTTOOw 11 regl reg21 1
reg2to regl I OOTTTOlw 11 regl reg21 1
memory to register I OOTTTOlw mod reg rim I 2
register to memory I OOTTTOOw mod reg rim I 3 U/L
immediate to register I 100000sw 11 TTT I

reg immediate register 1
immediate to accumulator I 00TTT10w immediate data 1
immediate to memory I 100000sw I

mod TTT rim immediate data 3 U/L
Instruction TIT
INC = Increment 000
DEC = Decrement 001
reg I l l l l l l l w 111 TTT reg I 1
or 101TTT reg I 1
memory
I lllllllw I mod TTT rim I 3 U/L
Instruction TIT
NOT ~ Logical Complement 010
NEG ~ Negate 011
reg I 1111011 w 111 TTT reg I 1
memory I 1111011 w I
mod TTT rim I 3 U/L
CMP ~ Compare
re91 with re92 0011100w 111 regl reg21 1
re92 with reg1 0011101 w 111 re91 re92 1 1
memory with register 0011100w I

mod reg rlml 2
register with memory 0011101 w I

mod reg rlml 2
immediate with register 100000sw 111 111 reg I immediate data 1
immediate with acc. 0011110w I immediate data 1
immediate with memory I 100000sw I

mod 111 I
rim immediate data 2
TEST ~ Logical Compare

re91 and re92 1000010w 111 regl r9g21 1
memory and register 1000010w I

mod reg rlml 2
immediate and register 1111011 w 111 000 I

reg immediate data 1
immediate and acc. 1010100w I immediate data 1
immediate and memory 1111011 w I I

mod 000 rIm immediate data 2
10·3
intel" Intel486™ DX2 MICROPROCESSOR
Table 10.1.lnteI486™ DX2 Microprocessor Integer Core Clock Count Summary (Continued)
MUL ~ Multiply (unsigned)
ace. with register I 1111011 w 111 100 reg 1
Multiplier-Byte 13/18 MN/MX,3
Word 13/26 MN/MX,3
Dword 13/42 MN/MX,3
acc. with memory I 1111011w Imod 100 rIm 1

Word 13/26 MN/MX,3
Dword 13/42 MN/MX,3
IMUL ~ Integer Multiply (signed)

ace. with register I 1111011 w 111 101 reg 1
Word 13/26 MN/MX,3
Dword 13/42 MN/MX,3
acc. with memory 1 1111011 w 1mod 101 rIm 1

Word 13/26 MN/MX,3
Dword 13/42 MN/MX,3
regl with reg2 I 00001111 1 10101111 111 regl reg21

Word 13/26 MN/MX,3
Dword 13/42 MN/MX,3
register with memory I 00001111

1 10101111 1mod reg rIm 1
Word 13/26 MN/MX,3
Dword 13/42 MN/MX,3
reg1 with imm. to re92 1 01101 Os 1 111 regl reg21 immediate data
Word 13/26 MN/MX,3
Dword 13/42 MN/MX,3
memo with imm. to reg. I 01101 Os 1 1mod reg rIm 1 immediate data
Word 13/26 MN/MX,3
Dword 13/42 MN/MX,3
DIV ~ Divide (unsigned)
acc. by register I 1111011 w 111 110 reg 1
Divisor-Byte 16
Word 24
Dword 40
acc. by memory I 1111011w 1mod 110 rIm 1

Divisor-Byte 16
Word 24
Dword 40
IDIV ~ Integer Divide (signed)

acc. by register 1 1111011 w 111 111 reg 1
Divisor-Byte 19
Word 27
Dword 43
10-4
intaL Intel486TM DX2 MICROPROCESSOR
Table 10.1. Intel486™ DX2 Microprocessor Integer Core Clock Count Summary (Continued)
INSTRUCTION FORMAT CacheHil Notes
acc. by memory 11111011wlmodlll rlml

Divisor~Byte 20
Word 28
Dword 44
CBW/CWOE ~ Convert Byte to Wordl
Convert Word 10 Oword 1100110001 3
CWO/COO ~ Convert Word to Dwordl
Convert Dword to
Ouadword
110011001 I 3
Instruction TTT
ROL ~ Rotate Left 000
ROR ~ Rotate Right 001
RCL ~ Rotate through Carry Left 010
RCR ~ Rotate through Carry Right 011
SHL/SAL ~ Shift Logical! Artthmetic Left 100
SHR ~ Shift Logical Right 101
SAR ~ Shift Arithmetic Right 111
Nol Through Carry (ROL, ROR, SAL, SAR, SHL, and SHR)
reg by 1 1 1101000w 11 TTT reg 3
memorybyl I 1101000w mod TTT rim 4
reg byCL I 1101001 w 11 TTT reg 3
memorybyCL 1 1101001 w mod TTT rim 4
reg by immediate count 1 1100000w 11 TTT reg immediate 8-bit data 2
mem by immediate count 1 1100000w mod TTT r/m·1 immediate a-bit data 4
Through Carry (RCL and RCR)

reg by 1 1101000w 11 TTT reg I 3
memory by 1 1101000w mod TTT rlml 4
reg byCL 1101001 w 11 TTT reg I 8/30 MN/MX,4
memory by CL 1101001 w mod TTT rlml 9/31 MN/MX,5
reg by immediate count 1100000w 11 TTT reg I immediate a-bit data 8/30 MN/MX,4
mam by immediate count 1100000w mod TTT rim Iimmediate B-bit data 9/31 MN/MX,5
Instruction TTT
SHLD ~ Shift Left Double 100
SHRD ~ Shift Right Double 101
register with immediate 00001111 10TTT100 111 reg2 regl Iimm a·bit data 2
memory by immediate 00001111 10TTT100 Imod reg I

rim imm 8-bit data 3
register by CL 00001111 10TTT10l 111 reg2 regll 3
memorybyCL 00001111 10TTT10l Imod reg rim I 4
BSWAP ~ Byte Swap 00001111 11001 reg I 1
XADD ~ Exchange and Add

regl, reg2 1 00001111 11100000W 111 reg2 regll 3
memory, reg I 00001111 11100000w Imod reg r/mi 4 U/L
CMPXCHG ~ Compare and Exchange

regl,reg2 1 00001111 11011000W 111 reg2 regll 6
memory, reg 1 00001111 11011000W Imod reg rIm I 7/10 6
10-5
Table 10.1.lnteI486lM DX2 Microprocessor Integer Core Clock Count Summary (Continued)
INSTRUCTION FORMAT cache Hit Notea
CONTROL TRANSFER (within ""IImant)
NOTE: Times are jump takenlnot taken
Jccc = Jump on ccc
S·blt displacement I 0111111n I 8·bitdisp. I 3/1 TINT, 23
full displacement I 00001111 I 10001lin I lull displacement 3/1 TINT, 23
NOTE: Times are jump takenlnot taken

SETcccc = Set Byte on cccc (TIm.. are cccc true/false)
reg I 00001111 I 1001111n 111 000 regI 4/3
memory
I 00001111 I 1001111n I mod 000 rIm I 3/4
Mnemonic
CondlUon mn
eccc
0 Overflow 0000
NO NoOVerilow 0001
B/NAE Below/Not Above or Equal 0010
NB/AE Not BelowlAbove or Equal 0011
EIZ EquallZero 0100
NEINZ Nol Equal/Nol Zero 0101
BEINA Below or EquallNot Above 0110
NBE/A Nol Below or EquallAbove 0111
S Sign 1000
NS NolSign 1001
PIPE ParitylParity Even 1010
NP/PO Not ParitylParity Odd 1011
LlNGE Less ThanlNol Grealer or Equal 1100
NL/GE Nol Less ThanlGreater or Equal 1101
LEING Less Than or EquallGreater Than 1110
NLE/G Not Less Than or Equal/Grealer Than 1111
LOOP = LOOP CX Tim.. 11100010 8·bitdisp. 716 LINL,23
LOOPZ/LOOPE = Loop with 11100001 8-bitdisp. 9/6 LINL,23

Zero/Equal
LOOPNVLOOPNE = Loop while 11100000 8-bildlsp. 9/8 LINL,23

Not Zero
JCXZ = Jump on CX Zero 11100011 8-bildlsp. 8/5 TINT, 23
JECXZ = Jump on ECX Zero 11100011 8-bil disp. 8/5 TINT, 23

(Address Size Prefix OHIerentiates JC Z lor JECXZ)
JMP = UncondlUonal Jump (within ""IIment)
Short I 11101011 I 8-bil disp. I 3 7,23
Direct I 11101001 I full displacement 3 7,23
Register Indirect I 11111111 111 100 I

reg 5 7,23
Memory Indirect I 11111111 Imedl00 rIm I 5 7
CALL = can (within ugment)

Direct I 11101000 I full displacement 3 7,23
Register Indirect I 11111111 111 010 reg I 5 7,23
Memory Indirect I 11111111 Imedolo rIm I 5 7
RET = Return from CALL (within ""IImant)

I 11000011 I 5
Adding Immediate to SP I 11000010 I 16-b~ disp. I 5
10-6
CONTROL TRANSFER (within aegment) (Continued)
ENTER - Enter Procedure I 11001000 116-bitdisp., 6-bit level

Level- 0 14
Level- 1 17
LeveI(L) > 1 17+3L 8
LEAVE - Leave Procedure I 11001001 1 5
MULTIPLE-sEGMENT INSTRUCTIONS
MOV- Move
reg. to segment reg. I 10001110 111 sreg3 reg I 3/9 RVlP, 9
memory to segment reg. I 10001110 Imod sreg3 rIm 1 3/9 RVlP,9
segment reg. to reg. I 10001100 111 .reg3 reg 1 3
segment reg. to memory 1 10001100 1 mod .reg3 rIm 1 3
PUSH - Push
segment reg. 1000sreg21101 3
(ES, CS, SS, or OS)
segment reg. (FS or GS) 1 00001111 110 .reg3000 1 3
POP - Pop
segment reg. 1000sreg2111 3/9 RV/P,9
(ES, SS, or OS)
segment reg. (FS or GS) 1 00001111 10 sreg30011 3/9 RV/P,9
LDS - Load Pointer to DS I 11000101 mod reg rIm 1 6/12 RVlP, 9
LES - Load Pointer to ES I 11000100 mod reg rIm 1 6/12 RVlP, 9
LFS - Load Pointer to FS I 00001111 10110100 1 mod reg rIm 1 6/12 RVlP, 9
LGS - Load PoInter to GS I 00001111 10110101 1 mod reg rIm 1 6112 RVlP, 9
LSS - Load Pointer to SS I 00001111 10110010 1 mod reg rIm 1 6/12 RVlP, 9
CALL - Call
Direct intersegment I 10011010 1 unsigned full offset, selector 18 R,7,22
to same level 20 P,9
thru Gate to same level 35 P,9
to inner level, no parameters 69 P,9
to inner level, x parameter (d) words n+4X P,11,9
toTSS 37+TS P,10,9
thru Task Gete 38+TS P,10,9
Indirect intersegment 1 11111111 1 mod 011 rIm 1 17 R,7
thru Gate to same level 35 P,9
to inner level, no parameters 89 P,9
to inner level, x parameter (d) words 77+4X+n P,11,9
toTSS 37+TS P,10,9
thru Task Gate 38+TS P,10,9
RET - Retum from CALL
Intersegment I 11001011 1 13 R,7
to outer level 35 P,9
intersegment adding
Imm.to SP
I 11001010 1 16-bitdisp. 1
14 R,7
to outer level 36 P,9
10·7
Table 10.1. Intel486TM DX2 Microprocessor Integer Core Clock Count Summary (Continued)
INSTRUCTION FORMAT CacheHl1 Notes
MULTIPLE-8EGMENT INSTRUCTIONS (Continued)
JMP ~ Unconditional Jump
Direct intersegment I 11101010 Iunsigned full offset, selector 17 A,7,22
thru Call Gate to same level 32 P,9
thruTSS 42+TS P, 10,9
Indirect intersegment I 11111111 Imod 101 r/ml 13 A,7,9
thru Call Gate to same level 31 P,9
thruTSS 41+TS P,10,9
BIT MANIPULATION
BT ~ Test bit
register, immediate I 00001111 I 10111010 111 100 reg I imm. 8-bit data 3
memory, immediate I 00001111 I 10111010 I I

mod 100 rim imm. 8-bit data 3
regl, reg2 I 00001111 110100011 111 reg2 regll 3
memory, reg
I 00001111 I 10100011 I mod reg rim I 8
Instruction TTT
BTS ~ Test Bit and Set 101

BTA ~ Test Bit and Aeset 110
BTC ~ Test Bit and Compliment 111
register. immediate I 00001111 I 10111010 111 TTT reg I imm. 8-bit data 6
memory. immediate I 00001111 I 10111010 I mod TTT rIm I imm. a-bit data 8 U/L
regl, reg2 100001111 I 10TTTOIl 111 reg2 regll 6
memory, reg I 00001111 I 10TTTOIl I mod reg rim 1 13 U/L
BSF ~ Scan Bil Forward

regl, reg2 I 00001111 I 10111100 111 reg2 regll 6/42 MN/MX,12
memory, reg I 00001111 I 10111100 I mod reg rim 1 7/43 MN/MX,13
BSR ~ Scan Bit Reverse

regl, reg2 I 00001111 I 10111101 111 reg2 regll 6/103 MN/MX,14
memory,reg 1 00001111 I 10111101 I mod reg rim I 7/104 MN/MX,15
STRING INSTRUCTIONS
CMPS ~ Compare Byte Word I 1010011 w I 8 16
LODS ~ Load Byte/Word

to ALiAX/EAX
I 1010110w I 5
MOYS ~ Move Byte/Word I 1010010w I 7 16
SCAS ~ Scan Byte/Word I 1010111 w I 6
STOS ~ Store Byte/Word

from AL/ AX/EX
1 1010101w I 5
XLAT ~ Translate Siring I 11010111 I 4
10·8
REPEATED STRING INSTRUCTIONS
Repeated by Count in CX or ECX (C ~ Count in CX or ECX)
REPE CMPS ~ Compare string

(Find Non-Match)
I 11110011 I 1010011 w I
C~O
5
C>O 7+7c 16,17
REPNE CMPS ~ Compare String

(Find Match)
I 11110010 I 1010011 w I
C~O
5
C>O 7+7c 16,17
REP LODS
C~O
~ Load SIring I 11110011 I 1010110w I
5
C>O 7+4C 16,18
REP MOVS
C~O
~ Move String I 11110011 I 1010010w
I
5
C~1
13 16
C>1 12+3c 16,19
REPE SCAS ~ Scan String
(Find Non-ALI AX/EAX)
I 1111 oq 11 I 1010111 w I
C~O
5
C>O 7+5c 20
REPNE SCAS ~ Scan string
(Find ALI AX/EAX)
I 11110010 I 1010111 w
I
C~O
5
C>O 7+5c 20
REP STOS
C~O
~ Store String I 11110011 I 1010101w I
5
C>O 7+4c
FLAG CONTROL
CLC ~ Clear Carry Flag 11111000 I 2
STC ~ Set Carry Flag 11111001 I 2
CMC ~ Complement Carry Flag 11110101 I 2
CLD ~ Clear Direction Flag 11111100 I 2
STD ~ Set Direction Flag 11111101 I 2
CLI ~ Clear Interrupt

Enable Flag
I 11111010 I 5
STI ~ Set Interrupt

Enable Flag
I 11111011 I 5
LAHF ~ Load AH Into Flag I 10011111 I 3
SAHF ~ store AH Into Flags I 10011110 I 2
PUSHF ~ Push Flags I 10011100 I 4/3 RV/P
POPF ~ Pop Flags I 10011101 I 9/6 RV/P
DECIMAL ARITHMETIC
AAA ~ ASCII Adjust lor Add I 00110111 I 3
AAS ~ ASCII Adjust lor

Subtract
I 00111111 I 3
AAM ~ ASCII Adjust lor

Multiply
I 11010100 I 00001010 I 15
10-9
Table 10.1. Intel486TM DX2 Microprocessor Integer Core Clock Count Summary (Continued)
INSTRUCTION FORMAT ClIChe Hit Nole8
DECIMAL ARITHMETIC (Continued)
AAD ~ ASCII AdJUst for
Divide
I 11010101 I 00001010 I 14
DAA ~ Declmal AdJust for Add

I 00100111 I 2
DAS ~ DecImal AdJust for SUbtract I 00101111 I 2
PROCESSOR CONTROL INSTRUCTIONS
HLT ~ Halt
I 11110100 I 4
MOV ~ Move To and From Control/DebuglTast Registers
CRO from register 00001111 00100010 11 000 reg I 17
CR2/CR3 from register 00001111 00100010 11 eee reg I 4
Reg from CRO-3 00001111 00100000 11 eee reg I 4
DRO-3 from register 00001111 00100011 11 eee reg I 10
OR6-7 from register 00001111 00100011 11 eee reg I 10
Register from DR6-7 00001111 00100001 11 eee reg I 9
Register from DRO-3 00001111 00100001 11 eee reg 9
TR3 from register 00001111 00100110 11 011 reg 4
TR4-7 from register 00001111 00100110 11 eee reg 4
Register from TR3 00001111 00100100 11 011 reg 3
Register from TR4-7 00001111 00100100 11 eee reg 4
CL18 ~ Clear Task SWitched Flag 00001111 00000110 7
INVD ~ Invalidate Date cache 00001111 00001000 4
WBINVD ~ Wrlte-_ and Invalidate I 00001111 00001001 5

Date Cache
INVLPG ~ Invall_ TLB Entry
INVLPG memory I 00001111 I 00000001 I mod 111 rIm I 12/11 HINH
PREFIX BYTES
Add. . . SIze PreIIx I 01100111 I 1
LOCK ~ Bus Lock Prellx I 11110000 I 1
Operand Size Prefix I 01100110 I 1
Segment OVerrIde Prefix

cs: 00101110 1
OS: 00111110 1
ES: 00100110 1
FS: 01100100 1
GS: 01100101 1
88: 00110110 ,
10-10
PROTECTION CONTROL
ARPL ~ Adjust Requested Privilege Level
From register I 01100011 111 reg1 reg21 9
From memory
I 01100011 1 mod reg rIm 1 9
LAR ~ Load Access Rights

From register I 00001111 1 00000010 111 reg1 reg21 11
From memory
I 00001111 1 00000010 1 mod reg rIm 1 11
LGDT ~ Load Global Descriptor

Table register I 00001111 I 00000001 Imod010 rIm 1 12
LlDT ~ Load Interrupt Descriptor

Table register I 00001111 1 00000001 I mod 011 rIm 1 12
LLDT ~ Load Local Descriptor

Table register from reg. I 00001111 1 00000000 111 010 reg 1 11
Table register from memo I 00001111 1 00000000 Imod010 rIm I 11
LMSW ~ Load Machine Status Word

From register I 00001111 1 00000001 111 110 reg 1 13
From memory I 00001111 1 00000001 1 mod 110 rIm 1 13
LSL ~ Load Segment Limit

From register I 00001111 1 00000011 111 reg1 reg21 10
From memory I 00001111 1 00000011 1 mod reg rIm 1 10
LTR ~ Load Task Register

From Register I 00001111 1 00000000 111 011 reg 1 20
From Memory I 00001111 1 00000000 1 mod 011 rIm 1 20
SGDT ~ Store Global Descriptor Table
I 00001111 1 00000001 1 mod 000 rIm 1 10
SIDT ~ Store Interrupt Descriptor Table
I 00001111 I 00000001 1 mod 001 rIm 1 10
SLDT ~ Store Local Descriptor Table

To register I 00001111 1 00000000 111 000 reg I 2
To memory I 00001111 1 00000000 1 mod 000 rIm 1 3
SMSW ~ Store Machine Status Word

Teregister I 00001111 1 00000001 111 100 reg 1 2
To memory I 00001111 1 00000001 1 mod 100 rIm I 3
STR ~ Store Task Register

To register I 00001111 1 00000000 111 001 reg 1 2
VERR ~ Verify Read Access

Register I 00001111 1 00000000 111 100 r/ml 11
Memory I 00001111 1 00000000 1 mod 100 r/ml 11
VERW ~ Verify Write Access

To register I 00001111 1 00000000 111 101 reg 1 11
10-11
intel.. Intel486TM DX2 MICROPROCESSOR
Table 10.1. Inte1486TM DX2 Microprocessor Integer Core Clock Count Summary (Continued)
INSTRUCTION FORIIAT C8ch_HIt Notes
INTERRUPT INSTRUCTIONS
INT n = Intanupt Type n I 11001101 I type I INT+4/0 RVlP,21
INT 3 = Interrupt Type 3 I 11001100 I INT+O 21
INTO = Interrupt 41f

Overflow Flag Set
I 11001110 I
Taken INT+2 21
NoITaken 3 21
BOUND = Interrupt 511 Detect

Value Out Range
I 01100010 I
mod reg rIm I
If in range 7 21
If out of range INT+24 21
IRET = Intanupt Return

I 11001111 I
Real ModelVirtual Mode 15
Protected Mode
To same level 20 9
To outer level 36 9
To nested task (EFLAGS.NT =' 1) " TS+32 9, 10
Extemellnterrupt INT+ll 21
NIII = Non-lleskable Interrupt INT+3 21
Peg_Fault INT+24 21
VM86 Exceptions
eLi INT+8 21
STI INT+8 21
INTn INT+9
PUSHF INT+9 21
POPF INT+8 21
IRET INT+9
IN
Fixed Port INT+50 21
Variable Port INT+51 21
OUT
Fixed Port INT+50 21
Variable Port INT+51 21
INS INT+50 21
OUTS INT+50 21
REP INS INT+51 21
REP OUTS INT+51 21
Task SWitch Clock Counts Table

Value.orTS
Method
Cache Hit
VM/intel486 DX2 CPU/286 TSS To Intel486 DX2 CPU TSS 162
VM/intel486 DX2 CPU/286 TSS To 286 TSS 143
VMllntel486 DX2 CPU/286 TSS To VM TSS 140
10-12
Interrupt Clock Counts Table

Value for INT
Method
Cache Hit Notes
Real Mode 26
Protected Mode
Interrupt/Trap gate, same level 44 9
Interrupt/Trap gate, different level 71 9
Task Gate 37 + T5 9, 10
Virtual Mode
Interrupt/Trap gate, different level 82
Task gate 37 + T5 10
AbbrevlaUons Definition
16/32 16/32 bit modes
U/L unlocked/locked
MN/MX minimum/maximum
LlNL loop/no loop
RVIP real and virtual mode/protected mode
R real mode
P protected mode
T/NT taken/not taken
H/NH hitlno hit
NOTES:
1. Assuming that the operand address and stack address fall in different cache sets.
2. Always locked, no cache hit case.
3. Clocks = 10 + max(log2(lml),n)
m = multiplier value (min clocks for m = 0)
n = 3/5 for ±m
4. Clocks = /quotient(countloperand length)J*7+9
= 8 if count s; operand length (8/16/32)
5. Clocks = {quotient(count/operand length)}*7+9
= 9 if count s; operand length (8/16/32)
6. Equal/not equal cases (penalty is the same regardless of lock).
7. Assuming that addresses for memory read (for indirection), stack push/pop, and branch fall in different cache sets.
8. Penalty for cache miss: add 6 clocks for every 16 bytes copied to new stack frame.
9. Add 11 clocks for each unaccessed deSCriptor load.
10. Refer to task switch clock counts table for value of TS.
11. Add 4 extra clocks to the cache miss penalty for each 16 bytes.
For notes 12-13: (b = 0-3, non-zero byte number);
(i = 0-1, non-zero nibble number);
(n = 0-3, non bit number in nibble);
12. Clocks = 8+4 (b+1) + 3(i+1) + 3(n+1)
= 6 if second operand = 0
13. Clocks = 9+4(b+1) + 3(i+1) + 3(n+1)
= 7 if second operand = 0
For notes 14-15: (n = bit position 0-31)
14. Clocks = 7 + 3(32 - n)
6 if second operand = 0
15. Clocks = 8 + 3(32-n)
7 if second operand = 0
16. Assuming that the two string addresses fall in different cache sets.
17. Cache miss penalty: add 6 clocks for every 16 bytes compared. Entire penalty on first compare.
18. Cache miss penalty: add 2 clocks for every 16 bytes of data. Entire penalty on first load.
19. Cache miss penalty: add 4 clocks for every 16 bytes moved.
(1 clock for the first operation and 3 for the second)
20. Cache miss penalty: add 4 clocks for every 16 bytes scanned.
(2 clocks each for first and second operations)
21. Refer to interrupt clock counts table for value of INT
22. Clock count includes one clock for using both displacement and immediate.
23. Refer to assumption 6 in the case of a cache miss.
10-13
Table 10.2.lnteI486TM DX2 Microprocessor 1/0 Instructions Core Clock Count Summary
Protected Protected
Real Virtual Ie
INSTRUCTION FORMAT Mode Mode Notes
Mode Mode
(CPL':IOPL) (CPL>IOPL)
1/0 INSTRUCTIONS
IN = Input from:
Fixed Port 1111001 Ow 1 port number I 17 12 32 30
Variable Port 1111011 Ow 1 17 11 31 30
OUT = Output to:

Fixed Port 11110011 wi port number 1 19 14 34 32
Variable Port 11110111W 1 19 13 33 32
INS = Input BytalWord 0110110w 20 13 35 33

trom DX Port
OUTS = Output BytelWord 0110111 w 20 13 35 33 1

toDXPort
REP INS = Input Siring 111110011 1011011 Ow 1 19+11c 13+11c 33+11c 32+11c 2
REP OUTS = Output SIrIng 111110011 1 0110111w I 2O+8c 14+8c 34+8c 33+8c 3
NOTES:
1. Two clock cache miss penalty in all cases.
2. c = count in CX or ECX.
3. Cache miss penalty in all modes: Add 2 clocks for every 16 bytes. Entire penalty on second operation.
10·14
infel~ Intel486TM DX2 MICROPROCESSOR
Table 10.3. Intel486TM DX2 Microprocessor Floating Point Core Clock Count Summary
Cache Hit
INSTRUCTION FORMAT Avg(Lower Notes
Range •••
Upper Range)
DATA TRANSFER
FLO ~ Real Load to ST(O)
32·Mmemory 111011 0011 mod 000 rIm I s-i·b/disp. I 3
64-bilmemory 111011 1011mod 000 rIm I s-i·b/disp. I 3
8().bilmemory 111011 0111modl0l rIm I s-i·b/disp. I 6
ST(i) 111011 001111000 STO) I 4
FILD ~ Integer Load to ST(O)

16-b~ memory 111011 1111 mod 000 rIm I s·i·b/dlsp. I 14.5(13-16)
32-1>il memory 111011 0111mod 000 rIm I S-;'b/disp. I 11.5(9-12)
64-1>il memory 111011 1111 mod 101 rIm I s-i·b/disp. I 16.8(10-18)
FBLD ~ BCD Load to ST(O) 111011 l111modloo rIm I s-i·b/disp. I 75(70-103)
FST ~ Store Real from ST(O)

32-bit memory 111011 0011 mod 010 rIm I s-i·b/disp. I 7 1
64-Mmemory 111011 1011 mod 010 rIm I s·i·b/disp. I 8 2
ST(ij 111011 101111010 STO) I 3
FSTP ~ Store Real from ST(O) and Pop

32·bilmemory 111011 oOllmod all rIm I s~-I>/disp.
I 7 1
64-bilmemory 111011 1011mod all rIm I s-i·b/disp. I 8 2
80·bilmemory 111011 0111 mod 111 rIm I s-I·b/disp. I 6
ST(i) 111011 101111001 STO) I 3
FIST ~ Store Integer from ST(O)

16-1>il memory 111011 l111mod 010 rIm I s-;'b/disp. I 33.4(Z9-34)
32·Mmemory 111011 0111mod 010 rIm I s·;'b/disp. I 32.4(28-34)
FISTP ~ Store Integer from ST(O) and Pop

16-b~ memory 111011 111 mod all rIm I s-i·b/disp. I 33.4(29-34)
32·bilmemory 111011 all mod all rIm I s-i·b/disp. I 33.4(29-34)
64-Mmemory 111011 111 mod 111 rIm I s-i·b/disp. I 33.4(29-34)
FBSTP ~ Store BCD from 111011 111 mod 110 rIm I s-i·b/disp. I 175(172-176)
ST(O) and Pop
FXCH ~ Exchange ST(O) and ST(I) 111011 001 11001 STool 4
COMPARISON INSTRUCTIONS
FCOM ~ Compare ST(O) with Real
32·b~ memory 111011 ooolmodolo rIm I s-i·b/disp. I 4
64-bilmemory 111011 100lmodol0 rIm I s-i-l>/disp. I 4
ST(ij 111011 000111010 STool 4
FCOMP ~ Compare ST(O) with Real and Pop

32-1>~ memory 111011 oooimod all rIm I s-;'b/disp. I 4
64-1>il memory 111011 100lmod all rIm I s-;'b/disp. I 4
STO) 111011 000 111 all ST(I) I 4
10·15
intel .. Intel486TM DX2 MICROPROCESSOR
Table 10.3. Intel486™ DX2 Microprocessor Floating Point Core Clock Count Summary (Continued)
Cache Hit
Range ...
Upper Range)
COMPARISON INSTRUCTIONS (Continued)
FCOMPP = Compare ST(O) wllh 111011 11011101 10011 5

ST(I) and Pop Twice
FICOM = Compare ST(O) with Integer
16~bit memory 111011 110lmod 010 rim I s-i-b/disp. I 18(16-20)
32-bitmemory 111011 ololmod 010 rim I s-i-bldisp. I 16.5(15-17)
FICOMP = Compare ST(O) with Integer

16-bit memory 111011 110 mod 011 rim s-i-b/disp. I 18(16-20)
32-bitmemory 111011 010 mod 011 rim s-i-b/disp. I 16.5(15-17)
FTST = Compare ST(O) with 0.0 111011 001 1110 0100 4
FUCOM = Unordered compare 111011 101 11100 STeil 4

ST(O) with ST(I)
FUCOMP = Unordered compare 111011 101 11101 STeil 4

ST(O) wllh ST(I) and Pop
FUCOMPP = Unordered compare 111011 010 1110 1001 5

ST(O) wtth ST(I) and Pop Twice
FXAM = Examine ST(O) 111011 001 1110 0101 I 8
CONSTANTS
FLOZ = Load + 0.0 Into ST(O) 111011 001 1110 1110 4
FLOI = Load + 1.0 Inlo ST(O) 111011 001 1110 1000 4
FLOPI = Load 'IT Inl0 ST(O) 111011 001 1110 1011 8
FLOL2T = Load 1092110) Inlo ST(O) 111011 001 1110 1001 8
FLDL2E = Load Iog2le) Into ST(O) 111011 001 1110 1010 8
FLOLG2 = Load 109,0(2) Into ST(O) 111011 001 1110 1100 8
FLOLN2 = Load 1090(2) Inl0 ST(O) 111011 001 1110 1101 I 8
ARITHMETIC
FADD = Add Real with ST(O)
ST(O) ..... ST(O) + 32-bit memory 111011 000 I
mod 000 rim I s-i-bl disp. I 10(8-20)
ST(O) ..... ST(O) + 64-bit memory 111011 100lmodOOO rim I s-i-bl disp. I 10(8-20)
ST(d) ..... ST(O) + STeil 111011 doolll000 STeilI 10(8-20)
FADDP = Add real with ST(O) and

Pop (ST(I) ..... ST(O) + ST(i»
111011 110111000 STeilI 10(8-20)
FSUB = Subtract reallrom ST(O)

ST(O) ..... ST(O) - 32-bit memory 111011 ooolmod 100 rim I s-i-bl disp. I 10(8-20)
ST(O) ..... ST(O) - 64-bit memory 111011 100lmod 100 rim I s-i-b/disp. I 10(8-20)
ST(d) ..... ST(O) - STeil 111011 doollll0d STeil I 10(8-20)
FSUBP = Subtract reallrom ST(O) 111011

and Pop (ST(I) ..... ST(O) - ST(i»
110111101 STeil I 10(8-20)
10-16
Table 10.3.lnteI486™ DX2 Microprocessor Floating Point Core Clock Count Summary (Continued)
Cache Hit
Range .•.
Upper Range)
ARITHMETIC (Conlinued)
FSUBR ~ Subtract real reversed (Subtract ST(O) from real)
ST(O) +- 32-bit memory - ST(O) 111011 oooimod 101 rim I s-i-b/disp. I 10(8-20)
ST(O) +- 64-bil memory - ST(O) 111011 100lmod 101 r/ml s-i-b/disp. I 10(8-20)
ST(d) +- ST(i) - ST(O) 111011 doollll0d STeil I 10(8-20)
FSUBRP ~ Subtract real reversed 111011 110111100 ST<il1 10(8-20)

and Pop (ST(I) +- ST(I) - ST(O»
FMUL ~ Multiply real with ST(O)
ST(O) +- ST(O) x 32-bit memory 111011 oooimod 001 rim I s-i-b/disp_
I 11
ST(O) +- ST(O) x 64-bil memory 111011 100lmod 001 rim I s-i-b/ disp. I 14
ST(d) +- ST(O) x ST(i) 111011 dooll1001 STeil I 16
FMULP ~ Multiply ST(O) with ST(I) 111011

and Pop (ST(I) +- ST(O) x ST(I»
110111001 STeil I 16
FDIV ~ Divide ST(O) by Real

ST(O) +- ST(0)/32-bij memory 111011 oooimod 110 rim I s-i-b/disp. I 73 3
ST(O) +- ST(0)/64-bit memory 111011 100lmod 110 rim I .-i-b/ disp. I 73 3
ST(d) +- ST(O)/ST(i) 111011 dOO 11111 d ST(i) I 73 3
FDIVP ~ Divide ST(O) by ST(I) and

Pop (ST(I) +- ST(O)/ST(i»
111011 110111111 STO) I 73 3
FDIVR.~ Divide real reversed (Real/ST(O»

ST(O) +- 32-bit memory/ST(O) 111011 oooimod 111 rim I 8-i-b/disp. I 73 3
ST(O) +- 64-bij memory/ST(O) 111011 tOol mod 111 r/ml s-i-b/disp. I 73 3
ST(d) +- ST(i)/ST(O) 111011 dOO 11111 d STeil I 73 3
FDIVRP ~ Divide real reversed and 111011 110111110 ST(i) I 73 3

Pop (ST(I) +- ST(i)/ST(O»
FIADD ~ Add Integer to ST(O)
ST(O) +- ST(O) + 16-bij memory 111011 1101 mod 000 rim I .-i-b/disp. I 24(20-35)
ST(O) +- ST(O) + 32-bil memory 111011 ololmod 000 r/ml s-i-b/disp. I 22.5(19-32)
FISUB ~ SUbtract Integer from ST(O)

ST(O) +- ST(O) - 16-bit memory 111011 1101 mod 100 r/ml s-i-b/disp. I 24(20-35)
ST(O) +- ST(O) - 32-bit memory 111011 ololmod 100 rim I s-i-b/disp. I 22.5(19-32)
FISUBR ~ Integer Subtract Reversed

ST(O) +- 16-bit memory - ST(O) 111011 1101 mod 101 r/ml s-i-bl disp.
I 24(20-35)
ST(O) +- 32-bit memory - ST(O) 111011 ololmod 101 r/ml s-i-b/disp. I 22.5(19-32)
FIMUL ~ MuHiply Integer with ST(O)

ST(O) +- ST(O) x 16-bit memory 111011 1101 mod 001 rim I s-i-b/disp. I 25(23-27)
ST(O) +- ST(O) x 32-bit memory 111011 0101 mod 001 r/ml s-i-b/disp. I 23.5(22-24)
FIDIV ~ Integer Divide

ST(O) +- ST(0)/16-bij memory 111011 1101 mod 110 rim I s-i-b/disp. I, 87(85-89) 3
ST(O) +- ST(0)/32-bit memory 111011 0101 mod 110 r/ml s-i-b/disp. I 85.5(84-86) 3
10-17
Table 10.3. Intel486TM DX2 Microprocessor Floating Point Core Clock Count Summary (Continued)
Cache Hit
Range .••
Upper Range)
ARITHMETIC (Continued)
FIDIVR ~ Integer Divide Reversed
ST(O) <-16-bit memoryIST(O) 111011 110 mod 111 rIm s-i-bl disp. I 87(85-89) 3
ST(O) <- 32-bit memoryIST(O) 111011 010 mod 111 rIm s-i-bl disp. I 85.5(84-86) 3
FSORT ~ Square Root 111011 001 1111 1010 85.5(83-87)
FSCALE ~ Scale ST(O) by ST(I) 111011 001 1111 1101 31(30-32)
FXTRACT ~ Extract components 111011 001 1111 0100 19(16-20)

ofST(O)
FPREM ~ Partial Reminder 111011 001 1111 1000 84(70-138)
FPREMI ~ Partial Reminder (IEEE) 111011 001 1111 0101 94.5(72-167)
FRNDINT ~ Round ST(O) to integer 111011 001 1111 1100 29.1 (21-30)
FABS ~ Absolute value of ST(O) 111011 001 1110 0001 3
FCHS ~ Change sign of ST(O) 111011 001 1110 0000 6
TRANSCENDENTAL
FCOS ~ Cosine of ST(O) 11011 001 1111 11111 241(193-279) 6,7
FPTAN ~ Partial tangent of ST(O) 11011 001 1111 00101 244(200-273) 6,7
FPATAN ~ Partial arctangent 11011 001 1111 0011 289(218-303) 6
FSIN ~ Sine of ST(O) 11011 001 1111 1110 241(193-279) 6,7
FSINCOS ~ Sine and cosine of ST(O) 11011 001 1111 1011 291 (243-329) 6,7
F2XMl ~ t1T(O) - 1 11011 001 1111 0000 242(140-279) 6
FYL2X ~ ST(I) x log2(ST(0» 11011 001 1111 0001 311(196-329) 6
FYL2XPI ~ ST(I) x 10g2CST(0) + 1.0) 11011 001 1111 10011 313(171-326) 6
PROCESSOR CONTROL
FINIT ~ Initialize FPU 111011 01111110 0011 I 17 4
FSTSW AX ~ Store status word 111011 11111110 00001 3 5

into AX
FSTSW ~ Store status word

Into memory
111011 1011 mod 111 rIm s-i-b/disp. I 3 5
FLDCW ~ Load control word 111011 oOllmod 101 rIm s-i-b/disp. I 4
FSTCW = Store control word 111011 001 I

mod 111 rIm s-i-b/disp. I 3 5
FCLEX ~ Clear exceptions 111011 01111110 0010 7 4
FSTENV ~ Store environment 111011

Real and Virtual modes 16-bit Address
oOllmod 110 rIm s-i-b/disp. I
67 4
Real and Virtual modes 32-bit Address 67 4
Protected mode 16-bit Address 56 4
FLDENV ~ Load environment 111011 oOllmod 100 rIm I sMi-b/disp. I
Real and Virtual modes 16-bit Address 44
Protected mode 16-bit Address 34
Protected mode 32-bit Address 34
10-18
Table 10.3. Intel486™ DX2 Microprocessor Floating Point Core Clock Count Summary (Continued)
Cache Hit
Range ...
Upper Range)
PROCESSOR CONTROL (Continued)
FSAVE ~ Save state 111011

Real and Virtual modes 16-bit Mdress
1011 mod 110 rIm I s-i-b/disp. I
154 4
Real and Virtual modes 32-bit Address 154 4
FRSTOR ~ Restore state 111011
Real and Virtual modes 16-bit Address
1011 mod 100 rIm I s-i-bl I
131
Protected mode IS-bit Address 120
Protected mode 32-bH Address 120
FINCSTP ~ Increment Stack Pointer 11011 00111111 0111 I 3
FDECSTP ~ Decrement Stack Pointer 11011 00111111 01101 3
FFREE ~ Free ST(I) 11011 101111000 ST(i) I 3
FNOP ~ No operations 11011 00111101 00001 3
WAIT ~ Wait until FPU ready

(Minimum/Maximum)
10011011
I 113
NOTES:
1. If operand is 0 clock counts = 27_
2. If operand is 0 clock counts = 28.
3. If CW_PC indicates 24 bit precision then subtract 38 clocks.
If CW_PC indicates 53 bit precision then subtract 11 clocks.
4. If there is a numeric error pending from a previous instruction add 17 clocks_
5. If there is a numeric error pending from a previous instruction add 18 clocks.
6. The INT pin is polled several times while this instruction is executing to assure short interrupt latency.
7. If ABS(operand) is greater than '11"14 then add n clocks_ Where n = (operand/('11"14)).
10-19
10.2 Instruction Encoding addressing byte, the scale-index-base byte, follows

the mod rim byte to fully specify the addressing
mode.
10.2.1 OVERVIEW
Addressing modes can include a displacement im-
All instruction encodings are subsets of the general
mediately following the mod rim byte, or scaled in-
instruction format shown in Figure 10.1. Instructions
dex byte. If a displacement is present, the possible
consist of one or two primary opcode bytes, possibly
sizes are S, 16 or 32 bits.
an address specifier consisting of the "mod rim"
byte and "scaled index" byte, a displacement if re-
If the instruction specifies an immediate operand,
quired, and an immediate data field if required.
the immediate operand follows any displacement
bytes. The immediate operand, if specified, is always
Within the primary opcode or opcodes, smaller en-
the last field of the. instruction.
coding fields-,may be defined. These fields vary. ac-
cording to the class of operation. The fields define
Figure 10.1 illustrates several of the fields that can
such information as direction of the operation, size
appear in an instruction, such as the mod field and
of the displacements. register encoding, or sign ex- the rim field, but the Figure does not show all fields.
tension.
Several smaller fields also appear in certain instruc-
tions, sometimes within the opcode bytes them-
Almost all instructions referring to an operand in
selves. Table 10.4 is a complete list of all fields ap-
memory have an addressing mode byte following
pearing in the Intel4S6 DX2 microprocessor instruc-
the primary opcode byte(s). This byte, the mod rim
tion set. Further ahead, following Table 10.4, are de-
byte, specifies the address mode to be used. Certain
tailed tables for each field.
encodings of the mod rim byte indicate a second
ITTTTTTTTI TTTTTTTTI modTTTr/m I ssindexbase Id321161s1 nonedata32 161s1 none I

:z 07 0/\.765320/\.765320J\.. I\, /
~------~~------~ ¥ ¥ ~--~---- ~----~----
opcode "mod rim" "s-i-b" address immediate
(one or two bytes) byte byte displacement data
\. /
(T represents an (4, 2, 1 bytes (4, 2, 1 bytes
opcode bit.) register and address or none) or none)
mode specifier
Figure 10.1. General Instruction Format
Table 10.4_ Fields within Intel486TM DX2 Microprocessor Instructions

Field Name Description Number of Bits
w Specifies if Data is Byte or Full Size (Full Size is either 16 or 32 Bits) 1
d Specifies Direction of Data Operation 1
s Specifies if an Immediate Data Field Must be Sign-Extended 1
reg General Register Specifier 3
mod rim Address Mode Specifier (Effective Address can be a General Register) 2 for mod;
3 for rim
ss Scale Factor for Scaled Index Address Mode 2
index General Register to be used as Index Register 3
base General Register to be used as Base Register 3
sreg2 Segment Register Specifier for CS, SS, OS, ES 2
sreg3 Segment Register Specifier for CS, SS, OS, ES, FS, GS 3
mn For Conditional Instructions, Specifies a Condition Asserted
or a Condition Negated 4
NOTE:
Tables 10.1-10.3 show encoding of individual instructions.
10-20
int'et Intel486TM DX2MICROPROCESSOR
10.2.2 32-BIT EXTENSIONS OF THE Unless specified otherwise, instructions with 8-bit
INSTRUCTION SET and 16·bit operands do not affect the contents of
the high·order bits of the extended registers.
The Intel486 DX2 supports all Intel486 extensions to
the 8086/80186/80286 instruction set.
10.2.3 ENCODING OF INTEGER
With the Intel486 microprocessor, the 8086/801861 INSTRUCTION FIELDS
80286 instruction set was extended in two orthogo·
Within the instruction are several fields indicating
nal directions: 32·bit forms of all 16·bit instructions
register selection, addressing mode and so on. The
are added to support the 32-bit data types, and
exact encodings of these fields are defined immedi-
32·bit addressing modes are made available for all
ately ahead.
instructions referencing memory. This orthogonal in·
struction set extension is accomplished having a De-
fault (D) bit in the code segment descriptor, and by 10.2.3.1 Encoding of Operand Length (w) Field
having 2 prefixes to the instruction set.
For any given instruction performing a data opera-
Whether the instruction defaults to operations of 16 tion, the instruction is executing as a 32-bit operation
bits or 32 bits depends on the setting of the 0 bit in or a 16·bit operation. Within the constraints of the
the code segment descriptor, which gives the de· operation size, the w field encodes the operand size
fault length (either 32 bits or 16 bits) for both oper· as either one byte or the full operation size, as
ands and effective addresses when executing that shown in the table below.
code segment. In the Real Address Mode or Virtual
8086 Mode, no code segment descriptors are used, Operand Size Operand Size
but a 0 value of 0 is assumed internally by the In-
wField During 16-Blt During 32-Blt
tel486 DX2 microprocessor when operating in those
modes (for 16·bit default sizes compatible -with the Data Operations Data Operations
8086/80186/80286). 0 8 Bits 8 Bits
1 16 Bits 32 Bits
Two prefixes, the Operand Size Prefix and the Effec-
tive Address Size Prefix, allow overriding individually
the Default selection of operand size and effective 10.2.3.2 Encoding of the General
address size. These prefixes may precede any op- Register (reg) Field
code bytes and affect only the instruction they pre-
cede. If necessary, one or both of the prefixes may The general register is specified by the reg field,
be placed before the opcode bytes. The presence of which may appear in the primary opcode bytes, or as
the Operand Size Prefix and the Effective Address the reg field of the "mod rim" byte, or as the rim
Prefix will toggle the operand size or the effective field of the "mod rim" byte.
address size, respectively, to the value "opposite"
from the Default setting. For example, if the default Encoding of reg Field When w Field
operand size is for 32-bit data operations, then pres- Is not Present In Instruction
ence of the Operand Size Prefix toggles the instruc-
tion to 16-bit data operation. As another example, if Register Selected Register Selected
the default effective address size is 16 bits, pres- reg Field During 16-Blt During 32-Blt
ence of the Effective Address Size prefix toggles the Data Operations Data Operations
instruction to use 32·bit effective address computa·
tions. 000 AX EAX
001 CX ECX
These 32-bit extensions are available in all Intel486 010 OX EDX
microprocessor modes, including the Real Address 011 BX EBX
Mode or the Virtual 8086 Mode. In these modes the 100 SP ESP
default is always 16 bits, so prefixes are needed to 101 BP EBP
specify 32·bit operands or addresses. For instruc· 110 SI ESI
tions with more than one prefix, the order of prefixes 111 01 EDI
is unimportant.
10·21
Encoding of reg Field When w Field 3-Bit sreg3 Field

Is Present In Instruction
Segment
3-Bit
Register Specified by reg Field Register
sreg3Fieid
During 16~Blt Data Operations: Selected
Function of w Field 000 ES
reg
(whenw = 0) (whenw = 1) 001 CS
010 SS
000 AL AX 011 OS
001 CL CX 100 FS
010 OL OX 101 GS
011 BL BX 110 do not use
100 AH SP 111 do not use
101 CH BP
110 OH SI
111 BH 01 10.2.3.4 Encoding of Address Mode
Except for special instructions, such as PUSH or

Register Specified by reg Field POP, where the addressing mode is pre-determined,
During 32-Blt Data Operations the addressing mode for the current instruction is
specified by addressing bytes following the primary
Function of w Field opcode. The primary addressing byte is the "mod
reg
(whenw = 0) (whenw = 1) rIm" byte, and a second byte of addressing informa-
tion, the "s-i-b" (scale-index-base) byte, can be
000 AL EAX specified.
001 CL ECX
010 OL EOX The s-i-b byte (scale-index-base byte) is specified
011 BL EBX when using 32-bit addressing mode and the "mod
100 AH ESP rIm" byte has rIm = 100 and mod = 00,01 or 10.
When the sib byte is present, the 32-bit addressing
101 CH EBP
mode is a function of the mod, ss, index, and base
110 OH ESI
fields.
111 BH EOI
The primary addressing byte, the "mod rIm" byte,
also contains three bits (shown as TTl in Figure
10.2.3.3 Encoding of the Segment 10.1) sometimes used as an extension of the pri-
Register (sreg) Field mary opcode. The three bits, however, may also be
used as a register field (reg).
The sreg field in certain instructions is a 2-bit field
allowing one of the four 80286 segment registers to
When calculating an effective address, either 16-bit
be specified. The sreg field in other instructions is a
addressing or 32-bit addressing is used. 16-bit ad-
3-bit field, allowing the Intel486 OX2 Microprocessor
dressing uses 16-bit address components to calcu-
FS and GS segment registers to be specified.
late the effective address while 32-bit addressing
uses 32-bit address components to calculate the ef-
2-Blt sreg2 Field
fective address. When 16-bit addressing is used, the
Segment "mod rIm" byte is interpreted as a 16-bit addressing
2-Blt mode specifier. When 32-bit addressing is used, the
Register
sreg2Fleid "mod rIm" byte is interpreted as a 32-bit addressing
Selected
mode specifier.
00 ES
01 CS Tables on the following three pages define all en-
10 SS codings of all 16-bit addressing modes and 32-bit
11 OS addressing modes.
10-22
Encoding of 16-bit Address Mode with "mod rIm" Byte
mod rIm Effective Address mod rIm Effective Address

00000 OS:[BX+SI] 10000 OS:[BX+SI+d16]
00001 OS:[BX+OI] 10001 OS:[BX+01+d16]
00010 SS:[BP+SI] 10010 SS:[BP+ SI + d16]
00011 SS:[BP+OI] 10011 SS:[BP+01+d16]
00100 OS: [SI] 10100 OS: [SI + d16]
00101 OS: [01] 10101 OS: [01 + d16]
00110 OS:d16 10110 SS:[BP+d16]
00111 OS: [BX] 10111 OS:[BX+d16]
01000 OS: [BX + SI + d8] 11 000 register-see below

01001 OS: [BX + 01 + d8] 11001 register-see below
01010 SS:[BP+SI+d8] 11010 register-see below
01011 SS:[BP+ 01 + d8] 11 011 register-see below
01100 OS:[SI+d8] 11 100 register-see below
01101 OS:[01+d8] 11 101 register-see below
01110 SS:[BP+d8] 11 110 register-see below
01 111 OS:[BX+d8] 11 111 register-see below
Register Specified by rIm Register Specified by rIm

During 16-Bit Data Operations During 32-Bit Data Operations
Function of w Field Function of w Field
mod rIm mod rIm
(when w=O) (whenw =1) (whenw=O) (whenw = 1)
11000 AL AX 11000 AL EAX
11001 CL CX 11001 CL ECX
11010 OL OX 11010 OL EOX
11 011 BL BX 11 011 BL EBX
11100 AH SP 11100 AH ESP
11 101 CH BP 11 101 CH EBP
11 110 OH SI 11 110 OH ESI
11 111 BH 01 11 111 BH EOI
10-23
Encoding of 32-bit Address Mode with "mod rim" byte (no "s-I-b" byte present)
mod rim Effective Address mod rim Effective Address

00000 DS:[EAX] 10000 DS:[EAX + d32]
00001 DS:[ECX] 10001 DS:[ECX + d32]
00010 DS:[EDX] 10010 DS:[EDX + d32]
00011 DS:[EBX] 10011 DS:[EBX+d32]
00100 s-i-b is present 10100 s-i-b is present
00101 DS:d32 10101 SS: [EBP + d32]
00110 DS:[ESI] 10110 DS: [ESI + d32]
00111 DS:[EDI] 10111 DS: [EDI + d32]
01000 DS:[EAX+d8] 11000 register-see below

01001 DS:[ECX+d8] 11001 register-see below
01010 DS: [EDX + d8] 11010 register-see below
01011 DS: [EBX + d8] 11 011 register-see below
01100 s-i-b is present 11100 register-see below
01101 SS: [EBP + d8] 11 101 register-see below
01110 DS: [ESI + d8] 11 110 register-see below
01 111 DS:[EDI+d8] 11 111 register-see below
Register Specified by reg or rim Register Specified by reg or rim

during 16-Bit Data Operations: during 32-Blt Data Operations:
Function of w field Function of w field
mod rim mod rim
(whenw=O) (whenw=1) (whenw=O) (whenw=1)
11000 AL AX 11000 AL EAX
11001 CL CX 11001 CL ECX
11010 DL DX 11010 DL EDX
11 011 BL BX 11 011 BL EBX
11100 AH SP 11100 AH ESP
11 101 CH BP 11101 CH EBP
11 110 DH SI 11110 DH ESI
11 111 BH DI 11 111 BH EDI
10-24
Encoding of 32-bit Address Mode ("mod rIm" byte and "s-i-b" byte present)
mod base Effective Address ss Scale Factor

00000 DS: [EAX + (scaled index)] 00 x1
00001 DS: [ECX + (scaled index)] 01 x2
00010 DS: [EDX + (scaled index)] 10 x4
00011 DS: [EBX + (scaled index)] 11 x8
00100 SS: [ESP + (scaled index)]
00101 DS: [d32 + (scaled index)]
00110 DS: [ESI + (scaled index)] index Index Register
00111 DS: [EDI + (scaled index)] 000 EAX
001 ECX
01000 DS: [EAX + (scaled index) + d8] 010 EDX
01001 DS: [ECX + (scaled index) + d8] 011 EBX
01010 DS: [EDX + (scaled index) + d8] 100 no index reg"
01011 DS: [EBX + (scaled index) + d8] 101 EBP
01100 SS: [ESP + (scaled index) + d8] 110 ESI
01101 SS: [EBP + (scaled index) + d8] 111 EDI
01 110 DS: [ESI + (scaled index) + d8]
01 111 DS: [EDI + (scaled index) + d8] ""IMPORTANT NOTE:
When index field is 100, indicating "no index register," then
ss field MUST equal 00. If index is 100 and ss does not
10000 DS: [EAX + (scaled index) + d32] equal 00, the effective address is undefined.
10001 DS: [ECX + (scaled index) + d32]
10010 DS: [EDX + (scaled index) + d32]
10011 DS: [EBX + (scaled index) + d32]
10100 SS: [ESP + (scaled index) + d32]
10101 5S: [EBP + (scaled index) + d32]
10110 DS: [ESI + (scaled index) + d32]
10111 DS: [EDI + (scaled index) + d32]
NOTE:
Mod field in "mod rim" byte; ss, index, base fields in
"s-i-b" byte.
10-25
10.2.3.5 Encoding of Operation Mnemonic Condition mn

Direction (d) Field
0 Overflow 0000
In many two-operand instructions the d field is pres- NO No Overflow 0001
ent to indicate which operand is considered the BINAE BelowlNot Above or Equal 0010
source and which is the destination. Not Below/Above or Equal 0011
NB/AE
E/Z Equal/Zero 0100
d Direction of Operation NE/NZ Not Equal/Not Zero 0101
0 Register/Memory <- - Register BE/NA Below or Equal/Not Above 0110
"reg" Field Indicates Source Operand; NBE/A Not Below or Equal/Above 0111
"mod r/m" or "mod ss index base" Indicates S Sign 1000
Destination Operand NS Not Sign 1001
PIPE Parity/Parity Even 1010
1 Register <- - Register/Memory NP/PO Not Parity/Parity Odd 1011
"reg" Field Indicates Destination Operand; Less Than/Not Greater or Equal 1100
LlNGE
"mod r/m" or "mod ss index base" Indicates NL/GE Not Less Than/Greater or Equal 1101
Source Operand LEING Less Than or Equal/Greater Than 1110
NLE/G Not Less or Equal/Greater Than 1111
10.2.3.6 Encoding of Sign-Extend (s) Field
The s field occurs primarily to instructions with im- 10.2.3.& Encoding of Control or Debug
mediate data fields. The s field has an effect only if or Test Register (eee) Field
the size of the immediate data is 8 bits and is being
For the loading and storing of the Control. Debug
placed in a 16-bit or 32-bit destination.
and Test registers.
Effect on Effect on When Interpreted as Control Register Field

s Immediate Immediate Reg Name
eeeCode
Data& Data 16132
000 CRO
0 None None 010 CR2
011 CR3
1 Sign-Extend Data8 to Fill None
Do not use any other encoding
16-Bit or 32-Bit Destination
When Interpreted as Debug Register Field

10.2.3.7 Encoding of Conditional eeeCode Reg Name
Test (tttn) Field
000 ORO
For the conditional instructions (conditional jumps 001 DR1
and set on condition). mn is encoded with n indicat- 010 DR2
ing to use the condition (n = 0) or its negation (n = 1). 011 DR3
and m giving the condition to test. 110 DR6
111 DR?
When Interpreted as Test Register Field

eeeCode Reg Name
011 TR3
100 TR4
101 TR5
110 TR6
111 TR?
10-26
Instruction Optional
First Byte Second Byte Fields
11011 OPA 1 mod 1 I OPS rim s-i-b 1 disp

2 11011 MF OPA mod OPS rim s-i-b I disp
3 11011 d P OPA 1 1 OPS ST(i)
4 11011 0 0 1 1 1 1 I OP
5 11011 0 1 1 1 1 1 I OP
15-11 10 9 8 7 6 5 43210
10.2.4 ENCODING OF FLOATING POINT R XOR d = O-Destination (op) Source

INSTRUCTION FIELDS R XOR d = 1-Source (op) Destination
Instructions for the FPU assume one of the five ST(i) = Register stack element i
forms shown in the following table. In all cases, in- 000 = Stack top
structions are at least two bytes long and begin with 001 = Second stack element
the bit pattern 11011 S. •
•
OP = Instruction opcode, possible split into two •
fields OPA and OPS 111 = Eighth stack element
MF = Memory Format mod (Mode field) and rim (Register/Memory specifi-

00-32-bit real er) have the same interpretation as the correspond-
01-32-bit integer ing fields of the integer instructions.
10-64-bit real
11-16-bit integer s-i-b (Scale Index Sase) byte and disp (displace-
ment) are optionally present in instructions that have
P = Pop mod and rim fields. Their presence depends on the
O-Do not pop stack values of mod and rim, as for integer instructions.
1-Pop stack after operation
d = Destination
O-Destination is ST(O)
1-Destination is ST(i)
10-27
11.0 DIFFERENCES BETWEEN THE INTEL486™ DX2

MICROPROCESSOR AND THE INTEL386™
MICROPROCESSOR PLUS THE INTEL387™ MATH
COPROCESSOR EXTENSION
The differences between the Intel486 DX2 micro- essor asserts ERROR # when the error occurs
processor and the Intel386 microprocessor are due and does not wait for the next floating point in-
to performance enhancements. The differences be- struction to be encountered.
tween the microprocessors are listed below. 7. Six new instructions have been added:
1. Instruction clock counts have been reduced to Byte Swap (BSWAP)
achieve higher performance. See Section 10.
Exchange-and-Add (XADD)
2. The Intel486 DX2 microprocessor bus is signifi-
cantly faster than the Intel386 microprocessor Compare and Exchange (CMPXCHG)
bus. Differences include an internally doubled Invalidate Data Cache (INVD)
clock, parity support, burst cycles, cacheable cy- Write-back and Invalidate Data Cache
cles, cache invalidate cycles and 8-bit bus sup- (WBINVD)
port. The Hardware Interface and Bus Operation
Sections (Sections 6 and 7) of the data sheet Invalidate TLB Entry (INVLPG)
should be carefully read to understand the In- 8. There are two new bits defined in control regis-
tel486 DX2 microprocessor bus functionality. ter 3, the page table entries and page directory
3. To support the on-chip cache new bits have been entries (PCD and PWT) (Section 4.5.2.5).
added to control register 0 (CD and NW) (Section 9. A new page protection feature has been added.
2.1.2.1), new pins have been added to the bus This feature required a new bit in control register
(Section 6) and new bus cycle types have been o (WP) (Section 2.1.2.1 and 4.5.3).
added (Section 7). The on-chip cache needs to 10. A new Alignment Check feature has been add-
be enabled after reset by clearing the CD and ed. This feature required a new bit in the flags
NW bit in CRO. register (AC) (Section 2.1.1.3) and a new bit in
4. The complete Intel387 math coprocessor instruc- control register 0 (AM) (Section 2.1.2.1).
tion set and register set have been added. No 11. The replacement algorithm for the translation
1/0 cycles are performed during Floating Point lookaside buffer has been changed from a ran-
instructions. The instruction and data pointers are dom algorithm to a pseudo least recently used
set to 0 after FINIT/FSAVE. Interrupt 9 can no algorithm like that used by the on-chip cache.
longer occur, interrupt 13 occurs instead. See Section 5.5 for a description of the algo-
5. The Intel486 DX2 microprocessor supports new rithm.
floating point error reporting modes to guarantee 12. Three new testability registers, TR3, TR4 and
DOS compatibility. These new modes required a TR5, have been added for testing the on-chip
new bit in control register 0 (NE) (Section 2.1.2.1) cache. TLB testability has been enhanced. See
and new pins (FERR# and IGNNE#) (Section Section 8.
6.2.13 and 7.2.14).
13. The prefetch queue has been increased from 16
6. In some cases FERR # is asserted when the next bytes to 32 bytes. A jump always needs to exe-
floating point instruction is encountered and in cute after modifying code to guarantee correct
other cases it is asserted before the next floating execution of the new instruction.
point instruction is encountered, depending upon
the execution state the instruction causing ex- 14. After reset, the 10 in the upper byte of the OX
ception (see Sections 6.2.13 and 7.2.14). For register is 04. The contents of the base regis-
both of these cases, the Intel387 Math Coproc- ters including the floating point registers may be
different after reset.
11-1
12.0 UPGRADE SOCKET

This chapter contains the specifications for the Up- the amount of training and technical expertise re-
grade Socket for systems based on the Intel486 quired to install the Upgrade Processors be mini-
DX2 Microprocessor. All of the specifications de- mized. Upgrade installation instructions should be
scribed herein are based on the specifications of the clearly described in the system user's manual. In ad-
Intel486 DX2 Microprocessor. dition, by making installation simple and foolproof,
PC manufacturers can reduce the risk of system
One of the most important features of the Intel486 damage, warranty claims and service calls. Feed-
family architecture, compared with previous X86 ar- back from Intel's Math CoProcessor upgrade cus-
chitectures, is its "end user easy" upgradability via tomers highlights three main characteristics of end
the Upgrade Socket. Inclusion of the Upgrade Sock- user easy designs: accessible Upgrade Socket loca-
et in systems based on the Intel486 family of micro- tion, clear indication of upgrade component orienta-
processors provides the end user with an easy and tion, and minimization of insertion force.
cost-effective way to increase system performance.
The paradigm of simply installing an additional com- Upgrade Socket Location: The Upgrade Socket for
ponent into an empty Upgrade Socket to achieve Intel486 DX2 Microprocessor based systems is an
enhanced system performance is familiar to the mil- empty socket which can be located on either the
lions of end users and dealers who have purchased motherboard or modular CPU card. The Upgrade
Intel Math CoProcessor upgrades to boost system Socket should be easily accessible for installation
floating point performance. The first Upgrade Proc- and readily visible when the PC case is removed.
essor for Intel486 DX2 CPU based systems will pro- The Upgrade Socket should not be located in a posi-
vide up to 50% integer performance improvement tion that requires removal of any other hardware
and up to 150% floating point performance improve- (such as hard disk drives) in order to install the Up-
ment over the base system performance. This Up- grade Processor. Since Math CoProcessor sockets
grade Processor will take advantage of Intel's next are typically found near CPU socket on the mother-
generation processor technology to provide this per- board, similarly locating the Upgrade Socket near
formance improvement. the CPU further adds to the ease of installation.
The Upgrade Processor will implement a superset of Component Orientation: The most common mis-
the Intel486 DX2 Microprocessor signals. The new take made by end users and resellers when install-
signals for the Upgrade Socket, in addition to the ing Math CoProcessor upgrades is incorrect orienta-
Intel486 DX2 CPU signals, support a writeback pro- tion of the chip. This can result in irreversible dam-
tocol for the on-chip cache in Intel's next generation age to the chip and/or the PC. To solve this prob-
processors. Implementation of the cache writeback lem, Intel has designed the Upgrade Socket and the
capability for the Upgrade Socket is optional. Imple- Upgrade Processor with a keying mechanism to en-
mentation of the Level 1 writeback protocol enables sure proper orientation of the upgrade component
maximum performance gain for the Upgrade Proces- by the PC user. The keying mechanism for the Up-
sor over the base Intel486 DX2 system. The signals grade Processor is three missing pins on one corner
required to implement this writeback are detailed in of the device. To be effective as a keying mecha-
a separate document and are marked reserved in nism the corresponding locations in the socket must
this databook. be plugged. The Upgrade Socket for Intel486 DX2
CPU-based systems is designed to be backward
As a new system architecture feature, the provision compatible with the 169-pin Upgrade Socket of In-
of the Upgrade Socket as a means for PC users to tel486 SX and Intel486 DX systems. In order to
take advantage of the ever more rapid advances in maintain compatibility, the Upgrade Socket for In-
software and hardware technology will help to main- tel486 DX2 Microprocessor systems should include
tain the competitiveness of X86 PC-compatible sys- the Key Pin at location E5. In addition, the location
tems over other architectures into the future. of the key corner should be clearly marked on the
motherboard or CPU card, for example by silk
The majority of upgrade installations which take ad- screening.
vantage of the Upgrade Socket will be performed by
end users and resellers. Therefore, it is important Insertion Force: The third major concern voiced by
that the deSign be "end user easy", and that end users refers to how much pressure should be
exerted on the upgrade chip and PC board for prop-
12-1
er installation without damage. This becomes even tion specifications must be implemented. Section
more of a concern with the larger components which 12.3 shows the Upgrade Processor heat dissipation
require up to 200 pounds of pressure for insertion requirements for a hypothetical system design at 25
into a standard screw machine socket. This level of MHz and 33 MHz. Because the system must operate
pressure can easily result in cracked traces and correctly with any Upgrade Processor without a
stress to solder joints. To minimize the risk of sys- BIOS change, BIOS and software restrictions and
tem damage, it is recommended that a Zero Inser- recommendations are provided in Section 12.4. Sec-
tion Force (ZIF) socket be used for the Upgrade tion 12.5 discusses Upgrade Socket test require-
Socket. Designing with a ZIF socket eliminates the ments. Finally, Sections 12.6 and 12.7 specify the
need to design in additional structural support to pinout and electrical characteristics of the Upgrade
prevent flexing of the PC board during installation, Processor, respectively.
and results in improved end user and reseller prod-
uct satisfaction due to easy "drop-in" installation.
12.1 Upgrade Circuit Design
12.0.1 UPGRADE SOCKET OVERVIEW The Upgrade Socket for Intel486 DX2 Microproces-
sor-based systems is designed to reside on the
The Upgrade Socket for Intel486 DX2 CPU-based
same processor bus as the Intel486 DX2 CPU. This
systems is deSigned such that when an Upgrade Upgrade Socket specifies a UP# output (Upgrade
Processor is, installed in the Upgrade Socket, the Present) pin which should be connected directly to
original CPU relinquishes control of the system to the UP# input pin of the Intel486 DX2 Microproces-
the Upgrade Processor by backing off the bus. The
sor. When the Upgrade Processor occupies the Up-
circuit design requirements for the Upgrade Socket grade Socket, the UP# signal (active low) forces the
are discussed in Section 12.1. In addition to the Up-
Intel486 DX2 Microprocessor to 3-state all outputs
grade Socket circuits, there are layout considera- and reduce power consumption. When the Upgrade
tions for the Upgrade Socket and Upgrade Proces- Processor is not in the Upgrade Socket, a pullup re-
sor spatial requirements. These issues are dis-
sistor, internal to the Intel486 DX2 Microprocessor,
cussed in Section 12.2. Because future high-per- drives UP# inactive and allows the Intel486 DX2 Mi-
formance Upgrade Processors must function in the croprocessor to control the processor bus.
Upgrade Socket, the Upgrade Socket heat dissipa-
CTRl
ADDR
DATA
DATA ADDR CTRl DATA ADDR CTRl
7, RESERVED UP# UP#
UPGRADE Int.1486 DX2

SOCKET CPU
r>ClK I>ClK
-
ClK
241245-83
Figure 12·1. Upgrade Socket Circuit Diagram
12-2
12.2 Socket Layout moved for orientation purposes. The Upgrade Proc-
essor will be provided with a heat sink attached (see
This section discusses four aspects for the Upgrade Section 12.3), to dissipate heat.
Socket: compatibility, size, upgradability, and ven-
dors. The maximum and minimum dimensions of the Up-
grade Processor package with the heat sink are
shown in Table 12-1.
12.2.1 BACKWARD COMPATIBILITY
Table 12-1. Upgrade Processor, 237-Pin, PGA
The Upgrade Socket for Intel486 OX2 Microproces-
Package Dimensions with Heat Sink Attached
sor-based systems is designed to be compatible
with the Upgrade Processor for Intel486 OX2 CPU- Dimension (Inches) Minimum Maximum
based systems as well as the Upgrade Processor for
Intel486 SX CPU- and Intel486 OX CPU-based sys- A. Heat Sink Width 1.772 1.790
tems. B. PGA Package 1.950 1.975
Width
The Upgrade Socket for Intel486 OX2 microproces-
sor-based systems has a fourth row of contacts C. Heat Sink Edge 0.037 0.138
around the outside of the 169 contacts defined for Gap
the Intel486 SX CPU- and Intel486 OX CPU-based O. Heat Sink Height 0.312 0.360
Upgrade Processor sockets. The three inner rows,
with inner key pin, are 100% compatible with the E. Adhesive 0.008 0.012
169-pin PGA Upgrade Processor, for Intel486-based Thickness
systems. For backward compatibility, the inner row 0.140 0.180
F. Package Height
key pin location (E5) must be included in the Up- from Stand-Ofts
grade Socket for Intel486 OX2 CPU-based systems.
G. Total Height from 0.460 0.552
Stand-Ofts to Top
12.2.2 PHYSICAL DIMENSIONS of Heat Sink
The Upgrade Socket for Intel486 OX2 microproces-
sor-based systems is equivalent to a standard
240-lead PGA package with three corner pins re-
I· A =:j ,1=
UPGRADE PROCESSOR f f
OMNI-DIRECTIONAL HEAT SINK D G
/ADHESIVE
"""----
LL
UPGRADE PROCESSOR, 237 PIN, PGA PACKAGE 11
. I
i
241245-84
Figure 12-2. Upgrade Processor, 237-Pin, PGA Package with Heat Sink Attached
12-3
12.2.3 "END USER EASY" stallation in the Upgrade Socket simple and fool-
proof for the end user and reseller by implementing
PC buyers value easy and safe upgrade installation. the suggestions listed in Table 12-2.
PC manufacturers can make upgrade component in-
Table 12-2. Upgrade Socket and Layout Considerations

"End User Easy"
Implementation
Feature
Visible Upgrade Socket The Upgrade Socket should be easily visible when the PC's cover is
removed. Label the Upgrade Socket and the location of Pin 1 by silk
screening this information on the PC board.
Accessible Upgrade Socket Make the Upgrade Socket easily accessible to the end user (Le., do not
place the Upgrade Socket under a disk drive). If a Low Insertion Force (LlF)
or screw machine socket is used, position the Upgrade Socket on the PC
board such that there is enough clearance around the socket to use a chip
removal tool.
Foolproof Chip Orientation This Upgrade Socket must insure proper orientation of the Upgrade
Processor for Intel486 DX2 CPU-based systems and also the Upgrade
Processor for Intel486 SX/intel486 DX CPU-based systems. The 237-pin,
PGA package of the Upgrade Processor for Intel486 DX2 CPU-based
systems is oriented by the three corner pins that have been removed from
the "Pin 1" corner. These three contacts (A1, A2, and 81) should be
plugged, such that PGA pins cannot be inserted, in order to assure correct
orientation. The 169-pin PGA package of the Upgrade Processor for
Intel486 SXllntel486 DX CPU-based systems is oriented by the "key" pin
located in the inside corner of the "Pin 1" corner. All inside contacts (11
innermost rows) should be plugged, except the "key" pin (ES), to ensure
correct orientation and alignment. The total number of contacts for the
Upgrade Socket is therefore 238; a standard 240-pin socket plus the inside
"key" pin and less the three outside corner pins. Supplying a 238-pin
socket as the Upgrade Socket eliminates the possibility of end users or
resellers damaging the PC board or Upgrade Processor by powering up the
system with the Upgrade Processor in an incorrect orientation.
Zero Insertion Force The high pin count of the Upgrade Processor makes the insertion force
Upgrade Socket required for installation in a screw machine PGA socket excessive by end
users or resellers. Even most Low Insertion Force (LlF) sockets often
require more than 60 Ibs. of insertion force. A Zero Insertion Force (ZIF)
socket ensures that the chip insertion force does not damage the PC board.
If the ZIF socket has a handle, be sure to allow enough clearance for the
socket handle. If a LlF or screw machine socket is used, additional PC
board support is recommended.
"Plug and Play" Jumper or switch changes should not be needed to electrically configure
the system for the Upgrade Processor.
Thorough Documentation Describe the Upgrade Socket and the installation procedure for the
Upgrade Processor in the PC's User Manual.
12-4
12.2.4 LlF AND ZIF SOCKET VENDORS 12.3 Thermal Management

The following lists provide socket vendor information The Upgrade Socket must be designed to dissipate
based on products offered for the Upgrade Socket the heat generated by the Upgrade Processor. In the
for Intel486 OX and Intel486 SX CPU Systems following Sections the airflow required over the Up-
grade Socket is calculated for a hypothetical system
NOTE: design where there is a maximum ambient tempera-
This is not a comprehensive list. Intel has not test- ture of 45DC inside the system box.
ed the sockets listed below and cannot guarantee
that these sockets will meet every PC manufactur-
er's specific requirements. 12.3.1 THERMAL CALCULATIONS FOR
HYPOTHETICAL SYSTEM
Zero Insertion Force Upgrade Sockets and The maximum temperature specification for the Up-
Vendors: grade Processor is 80DC (with heat sink attached).
Therefore, the temperature of the heat sink surface
1. AMP Inc. (TS) cannot exceed BODC under the worst case spec-
P.O. Box 3608 ified operating conditions for the system. The vari-
Harrisburg, PA 17105-3608 ables which affect the heat sink temperature include
Tel: (800) 522-6752 ambient temperature inside the system box (TA)'
Part Number: TBD Vee, and Icc. An equation for the approximate Up-
Contact: Rick Simonic, New Product Manager grade Processor temperature (TS) is:
(717) 561-6143
2. Aries Electronics TS = TA + Power' (JSA where Power = Vcc' Icc
P.O. Box 130
Frenchtown, NJ 08825 In the above equation, the variables under worst
Tel: (908) 996-6841 case conditions are specified as follows:
Part Number: TBD TS: Specified as 80DC for the Upgrade Processor.
Contact: Frank Folmsbee, Marketing Manager TA: Specified by the PC manufacturer for the
(908) 996-6841 worst case system operating conditions.
3. JAE Vee: Specified for the Upgrade Processor as 5V.
599 N. Mathilda Ave., Suite 8
Sunnyvale, CA 94086 Icc: Specified for the Upgrade Processor and relat-
Tel: (408) 733-0493 ed to clock frequency.
Part Number: TBD (}SA: (}SA = (}JA - (}JS·
Contact: Bob Gerleman, Western Sales (}JA and (}JS are specified in Table 12-4.
Manager (408) 733-0493
4. Thomas and Betts ICC is dependent upon the system's Vee, bus load-
200 Executive Center Drive ing, software code sequences, and silicon process
P.O. Box 24901 variations. For the Upgrade Socket specifications,
Greenville, SC 29616-2401 the typical Icc value will be derived by testing a sam-
Tel: (803) 676-2900 ple of components under the following worst case
Part Number: TBD conditions: Vee = 5.3V, full D.C. current loads on all
Contact: Scott Roland, Product Marketing output pins, and running a file with the predicted
Manager (803) 676-2910 worst case software code sequences at the speci-
fied frequency. Icc typical is not a guaranteed speci-
5. Yamaichi Electronics fication.
1420 Koll Circle, Suite B
San Jose, CA 95112 The Icc maximum values in Table 12-3 is the best
Tel: (408) 452-0797 known design estimate and should be used as a
Part Number: TBD guaranteed maximum specification.
Contact: Jim Bennett, Sales Manager
(408) 452-0797
12-5
intel.. Intel486TM DX2 MICROPROCESSOR
Table 12-3. Upgrade Processor 12.3.2 HEAT SINKS

Typical and Maximum Icc Values
The Upgrade Processor will be shipped with a heat
Upgrade Upgrade sink attached. Because of the heat sink attached to
System
Processor Processor the Upgrade Processor, it is vital that vertical clear-
Frequency
Typical Maximum ance is provided for the Upgrade Socket. The height
(MHz) of the package and the heat sink is shown in Table
ICC (mA) ICC (mA)
12-1 in Section 12.2.2.
25 TBD 1600
33 TBD 1900
12.3.3 AIRFLOW
The Upgrade Processor for Intel486 DX2 CPU- The Upgrade Socket for Intel486 DX2 Microproces-
based systems will be provided with a heat sink. The sor-based systems must be positioned such that the
OJS and OJA values for the Upgrade Processor with a airflow over the socket has the velocity, volume, and
heat sink are shown in Table 12-4. The maximum TA ambient temperature to satisfy the thermal calcula-
values for the 25 MHz and 33 MHz Upgrade Proces- tions in Section 12.3.1. Because the heatsink at-
sor are shown in Table 12-5. The maximum TA val- tached to the Upgrade Processor is omni-directional,
ues shown in Table 12-5 were calculated using Ts the specified airflow may come from any direction.
= 80·C, Vcc = 5V, the maximum Icc value shown However, because the Upgrade Processor will gen-
in Table 12-3, and the OJC and OJS values shown in erate more power than the Intel486 DX2 Microproc-
Table 2-4. essor, it is recommended that the airflow reach the
Upgrade Socket before or at the same time that it
Table 12-4. Thermal Resistance reaches the Intel486 DX2 CPU.
eC/W) OJS and OJA
Upgrade CPU OJS l Airflow (ftlmin, LFM) NOTE:
An airflow of at least 400 linear feet per minute
with Heat Sink 12.ooC/W o J20014001600 Isoo (LFM) will be required to cool the Upgrade Proces-
OJA ("C/W) 10.41 6.8 1 4.9 J 4.1 1 3.7 sor at 33 MHz. It is essential that care be taken to
ensure sufficient airflow over the Upgrade Socket.
Table 12-5. Maximum TA for 25 MHz and

33 MHz Upgrade Processor
Upgrade Linear Airflow (ft/mln)
Processor
with Heat fCLK
Sink (MHz)
0 200 400 600 SOO
TA 25 9.44 39.68 55.64 62.36 65.72

("C) 33 -3.8 32.12 51.07 59.05 63.04
12-6
12.4 BIOS and Software As an example, a timing loop may be implemented

as follows: The software performs a dummy I/O in-
The following should be considered when designing struction to an unused 110 port. The hardware for
the Upgrade Socket for a Intel486 OX2 microproces- the bus controller logic recognizes this I/O instruc-
sor-based system. tion and delays the termination of the I/O cycle by
keeping ROY # or BROY # deasserted for the appro-
priate amount of time.
12.4.1 UPGRADE PROCESSOR DETECTION
The component identifier and stepping/revision

identifier for the Upgrade Processor for Intel486 OX2 12_5 Test Requirements
CPU-based systems is readable in the OH and OL The Upgrade Socket's electrical functionality can be
registers respectively, immediately after RESET, verified by fully testing the PC with a populated Up-
where grade Socket. We recommend that the system is
tested with all available Upgrade Processors to en-
DH = 15h
sure that there are no BIOS issues. This Upgrade
DL = 30h-3Fh Socket can be electrically tested with the Upgrade
Processor for Intel486 SXllntel486 OX CPU-based
As with the Intel486 OX2 microprocessor specifica- systems. The Upgrade Processor for Intel486 OX2
tion, it is recommended that the BIOS save the con- CPU-based systems should also be used to test the
tents of the OX register, immediately after RESET, hardware and software when it is available. The
so that this information can be used later, if required. BIOS requirements to maintain compatibility with all
Upgrade Processors are discussed in Section 12.4
of this document. All Upgrade Processors undergo
12.4.2. TIMING DEPENDENT LOOPS
thorough application software compatibility testing
The Upgrade Processor for Intel486 OX2 microproc- prior to their introduction.
essor-based systems executes instructions at twice
the frequency of the input clock. This Upgrade Proc-
essor also will use advanced design techniques to 12.6 Upgrade Socket Pinout
decrease the number of clocks per instruction (cpi)
from that of the Intel486 OX2 microprocessor. Thus The Upgrade Socket for Intel486 OX2 Microproces-
software, such as instruction-based timing loops, will sor-based systems specifies 238 contacts. The 238
execute faster on this Upgrade Processor than on contacts correspond to a standard 240-pin socket
either the Intel486 OX CPU or the Intel486 OX2 mi- with one "KEY" contact inside and three "orienta-
croprocessor at the same input clock frequency. In- tion" contacts plugged on the outside corner. The
structions such as Nap, LOOP, and JMP $+2 are "KEY" contact provides backward compatibility for
frequently used by the BIOS to implement timing the Intel487 SX Math CoProcessor and the Upgrade
loops that are required, for example, to enforce re- Processor for Intel486 SX/lntel486 OX CPU-based
covery time between consecutive accesses for I/O systems. The three contacts plugged on the outside
device~. These instruction-based, timing-loop imple-
corner ensure proper orientation for the Upgrade
mentations may require modification to be compati- Processor for Intel486 OX2 CPU-based systems.
ble with this Upgrade Socket. Additionally, all 120 inner contacts of a standard
240-pin socket (the inner 11 rows minus the "KEY"
pin) should be plugged to ensure proper alignment
In order to avoid any incompatibilities, timing loops
must be implemented in hardware rather than in of the 169-pin PGA Intel487 SX Math CoProcessor
software. This provides transparency and also does and Upgrade Processor.
not require any change in BIOS or 110 device drivers
in the future when moving to higher processor clock
speeds.
12-7
12.6.1 PINOUT
u T s R Q P N M L K J H G F E o C B A •
o o
Ne
o o
vee
o o
Ne
o o
vss
o o
vee
o o
vss
o oNe o o
vee
o
Ne vss vss Ne vee vee Ne vss vss
2 o 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2
Ne
A27
A28
A31 D2
vss
vss vee vss vss D11 D20
DO vss vss DPI D9 D19
3 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 3
A26 A25 vss Dl D6 D5 vee vee 013 D18 D22
vss A29 vee vee D3 D8 D21 vss
4 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 4
A23 vee A17 DPO 07 D16 D12 D15 Dl0 017 elK VSS Ne
vee A30 04 014 OP2 vee
5 o 0
NC
0 0
A19
o 0 0 0 5
vee vss 023
VSS VSS VSS
6 o 0 0 0 00006
Ne AU A18 A21 vee vss OP3 Ne
7 o 0 0 0 o 0 0 0 7
Ne VSS vee A24 027 025 024 RES 1
8 o 000 o 0 0 0 8
A12 A15 A22 026 vee VSS
VSS VSS
9 o 0 0 0 o 0 0 0 9
VSS vee A20 D28 029
vee D31 vce
10 o 000 o 0 0 0 10
VSS vee A16 D30 vee VSS
vee vec
11 o 000 o 0 0 0 11
VSS vee A13 Ne Ne
vee Ne vee
12 o 0 0 0 o 0 0 0 12
VSS A9 NC VSS
VSS vee VCC VSS
13 000 0 o 0 0 0 13
VSS AS Ne Ne
Ne Al1 Ne Ne
14 o 000 o 0 0 0 14
RES7 AID A7 Ne Ne FERR# RES2
A8
15 o 0 0 0 o 0 0 0 15
VSS A2 Ne Ne
VSS vee UP# VSS
16 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 16
vee
A6 u~~~~-_~~~~~_~~-=
17 o o o 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 17
VSS A4 BLAST# PLOCK# vee M/IO# vee vee vee BE 1# vee vee ROY# vee BS8# RESET Ne INTR VSS
18 o o 0 0 0 0 0 o 0 o
PCD
o o 0 0 0 0 0 0 0 18
Ne ADS# Ne PCHK# vss W/R# vss VSS VSS VSS VSS 8E3# VSS fA)FF# 8516# EADS# AHOlD NC
19 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 19
Ne Ne vss vee vss RES6 RESS vss vee vee vee vss RES4 RES3 vss vee vss Ne NC
u T s R Q P N M L K J H G F E o C B A
241245-85
Figure 12-3. Upgrade Socket Pinout for Intel486 DX2 Microprocessor System (Top Side View)
12-8
A B c D E F G H J K L M N p Q R S T u
o 0
vee
0 0
HC
0 000
vss VCC
0 0
vss
0 0
NC
0 0
vee
0 0 0
HC
vss vss NC VCC VCC HC vss vss HC
2 o o o o o o o o o o o o o o o o o o 2
020
019
011
09
vss OPl
vss vss vee vss vss vss 02
DO
A31
A28
A27
HC
3 0 0 0 0 0 0 000 0 0 0 0 0 0 0 0 003
vss 022
021 018 013 VCC
08
VCC
03
05
vee 06
VCC
01
A29
vss A25 A26 vss
4 0 0 0 0 0 0 000 000 0 0 0 0 0 .0 0 4
HC 012 016 014 07 OPO A17
VCC vss ClK 017 010 015 OP2 0< A30 vee A23 VCC
5 o 0 0 0 o 0 0 0 5
023 VCC A19 HC
vss vss vss vss
6 o 0 0 0 o 0 0 0 6
OP3 VCC A21
NC vss A18 A14 NC
7 o 0 0 0 o 0 007
RES 1 024 025 027 A24 vcc VSS NC
8 0 0 0 0 o 0 008
VSS vss VCC 026 A22
A15 A12 VSS
9 o .0 0 0 o 0 0 0 9
029 028 A20 vec vss vce
vee 031
10 o o o o o 000 10
vee vss vee 030 A16 VCC vss VCC
11 o o o o o 0 0 0 11
NC HC A13 vcc vss vee
VCC HC
12 o 0 0 0 o 0 0 0 12
vss vss VCC
HC A9 VCC vss vss
13 o o o o o 000 13
HC NC A5 All VSS HC
NC NC
14 o o o o o 000 14
RES2 FERR# HC NC A7 A8 Al0 RES7
15 o 000 o 0 0 0 15
HC NC A2 vss vss
vss UP# VCC
16 o o o o o o o o o o o o o o o o 000 16
vee IGNNE# NWI FLU5H# A20t.t# HOLD KEN# Ne BROY# BE2# B[O# PWT o/c# lOCK# HlOA BREQ A3 A6
VCC
17 o 0 0 .0 0 0 000 0 0 o 000 0 0 o o 17
VSS INTR NC RESET BS8# vee ROY# VCC VCC BE1# vee vee vcc M/IO# VCC PLOCK#BLAST# A4 vss
18 o 0 0 0 0 0 000 o
PCO
o 000 0 0 0 o 0 18
HC AHOLD EADS# BS16# BOFF# VSS BE3# VSS VSS VSS VSS VSS W/R# VSS PCHK# HC ADS# Ne
19 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 19
Ne Ne vss vee vss RES3 RES4 vss vee vee vee vss RESS RES6 vss vee vss Ne Ne
A B c D E F G H J K L N p Q R S T u
241245-86
Figure 12-4. Upgrade Socket Pinout for Intel486 DX2 Microprocessor System (Bottom Side View)
12-9
Table 12-6. Upgrade Socket Pin Cross Reference

Address Data Control Control N/C Vee Vss
A2 R15 00 02 A20M# E16 PLOCK# R17 A6 A4 C8 A3 B8
Aa 816 01 P3 A08# T18 ROY# G17 A18 A9 C10 A5 B10
AJ. T17 02 P2 AHOLO B18 RE8ET 017 A19 A10 C12 A8 B12
A5 R13 Oa J3 BEO# L16 W/R# P18 B4 A11 05 A12 C4
Ae T16 04 N4 BE1# K17 UP# C15 B11 A16 06 A15 C5
A7 R14 05 K3 BE2# K16 B13 01 F3 A17 C6
Reserved
As 814 06 M3 BE3# G18 B15 019 F17 C1 F2
Ag R12 07 M4 BLA8T# 817 RE81 A7 B19 J1 H3 C19 F18
AlO T14 Os G3 BOFF# E18 RE82 A14 C11 J19 H17 E1 H2
A11 813 09 E2 BROY# J16 RE83 F19 C13 K1 J17 E19 H18
A12 T8 010 F4 BREO# R16 RE84 G19 C14 K19 K2 H1 J2
A13 R11 011 02 B88# E17 RE85 N19 C17 L1 L3 H19 J18
A14 T6 012 H4 B816# 018 RE86 P19 011 L19 L17 M1 L2
A15 88 013 E3 CLK 04 RE87 U14 012 R1 M17- M19 L18
A16 R10 014 L4 O/C# N16 Position 013 R19 N3 01 M2
A17 R4 015 G4 OPO P4 014 U4 N17 019 M18
86 KEY E5
A1S 016 K4 OP1 G2 015 U9 017 81 N2
R5 E4 OP2 J4 PLUG A1 F1 U10 84 819 N18
A19 017
R9 03 OP3 B6 PLUG A2 G1 U11
A20 018 87 U3 018
R6 C2 EA08# PLUG B1
A21 019 C18 H16 U16 89 U5 R3
A22 R8 020 B2 FERR# B14 N1 810 U8 85
A23 T4 021 C3 FLU8H# 016 P1 811 U12 T7
A24 R7 022 B3 HLOA 016 818 812 U15 T9
A25 83 023 B5 HOLO F16 T1 815 U17 T10
A26 T3 024 B7 IGNNE# 816 T5 T11
A27 T2 025 C7 INTR B17 T19 T12
A28 82 026 08 KEN# G16 U1 T13
A29 03 027 07 LOCK# P16 U2 T15
A30 04 028 09 M/IO# P17 U6
A31 R2 029 B9 NMI C16 U7
030 010 PCO K18 U13
031 C9 PCHK# R18 U18
PWT M16 U19
NOTE:
The Upgrade Socket for Intel486 DX2 Microprocessor-based systems provides orientation guides for Upgrade Processors
via one "KEY" pin and three c~rner plugs.
12.6.2 PIN DESCRIPTION 12.6.3 RESERVED PIN SPECIFICATION
The signal pin descriptions for the Upgrade- Proces- 8even pins in the Upgrade 80cket are defined as
sor are identical to the pin descriptions for the In- reserved. The function of these pins is documented
tel486 OX2 Microprocessor except for the Upgrade separately. These signals will be used to implement
Present pin (UP#) and KEY pin. The pin descrip- a Write Back level 1 (on-chip) cache protocol. These
tions for these two signals are shown in Table 12-7. signals must not be connected unless they are used
to implement a level 1 Write Back solution using the
information available separately.
12-10
Table 12-7. Upgrade Socket Pin Description

Intel486 DX2 CPU INTERFACE
UP# 0 The Upgrade Present pin is used to signal the Intel486 DX2 microprocessor to float its
outputs and get-off the bus. It is active low and is never floated. UP# is driven low at
power-up and remains active for the entire duration of the Upgrade Processor
operation.
KEY PIN
KEY The Key pin is an electrically non-functional pin which provides backward compatibility
to the Upgrade Processor for Intel486 SX/lntel486 OX CPU-based systems and is
used to ensure correct orientation for 169-pin upgrade products. Proper orientation of
the Upgrade Processor for Intel486 DX2 Microprocessor systems (237-pin PGA) is
insured by the three socket contacts which must be plugged (A 1, A2, and B 1); the
Upgrade Processor will not have pins in these locations.
12.7 D.C'!A.C. Specifications Upgrade Processor will be compatible to the maxi-

mum ratings and A.C. Specifications of the Intel486
The electrical specifications in this section represent DX2 Microprocessor. Table 12-8 provides the D.C.
the electrical interface of the Upgrade Processor for Operating Conditions for the Upgrade Processor.
a Intel486 DX2 microprocessor-based system. The
Table 12-8. Upgrade Socket D.C. Parametric Values(1)

Symbol Parameter Min Max Unit Notes
VIL Input low Voltage -0.3 +0.8 V
VIH Input High Voltage 2.0 VCC + 0.3 V
VOL Output low Voltage 0.45 V (Note 2)
VOH Output High Voltage 2.4 V (Note 3)
Icc Power Supply Current
ClK = 25 MHz 1600 mA
ClK = 33 MHz 1900
III Input leakage Current ±15 p.A (Note 4)
IIH Input leakage Current 200 p.A (Note 5)
IlL Input leakage Current -400 p.A (Note 6)
ILO Output leakage Current ±15 p.A
CIN Input Capacitance 13 pF FC = 1 MHz(7)
Co I/O or Output Capacitance 17 pF FC = 1 MHz(7)
CCLK ClK Capacitance 15 pF Fc = 1 MHz(7)
NOTES:
1. Functional operating range: Vee = 5V; Ts = O"C to +80"C.
2. This parameter is measured at:
....;. Address, Data, BEn 4.0 mA
- Definition, Control 5.0 mA
- Address, Data, BEn -1.0 mA
- Definition, Control -0.9 mA
4. This parameter is for inputs without pullups or pulldowns and 0 ,;;; VIN ,;;; Vee.
5. This parameter is for inputs with pulldowns and VIH = 2.4V.
6. This parameter is for inputs with pullups and VIL = 0.45V.
7. Not 100% tested.
12-11
intel· Intel486™ DX2 MICROPROCESSOR
13.0 CONVERTING AN EXISTING

Intel486™ DX CPU DESIGN
Converting an Intel486 OX CPU system design to an The system checks mentioned above are common
Intel486 OX2 CPU design provides more perform- to all conversions from an Intel486 OX CPU to an
ance for a small difference in cost. Three conversion Intel486 OX2 CPU regardless of the speed of the
possibilities are available as shown in Table 13.1. processor or system.
Migrating from a 33 MHz Intel486 OX CPU to a 50
MHz Intel486 OX2 CPU could increase performance A few system implications exist for converting from
by 35%, and migrating from a 25 MHz Intel486 OX one frequency to another as shown in Figure 13.1.
CPU to a 50 MHz Intel486 OX2 CPU could increase The first case is migrating from a 25 MHz Intel486
performance by an average of 70%. See the In- OX CPU to a 50 MHz Intel486 DX2 CPU (the bus
te1486f M DX2 Microprocessor Performance Brief runs at the same speed for both parts). System
(Order # 241254) for more details on performance. hardware modifications need not be made to plug in
Conversion can be as easy as replacing one or two the 50 MHz Intel486 OX2 CPU and achieve the de-
devices. sired performance. When all instructions are running
out of the on-chip cache, performance increases by
Table 13.1. Converting Intel486™ DX CPU a maximum of 100%.
Designs to Intel486™ DX2 CPU Designs
The second case is migrating from a 33 MHz In-
Initial Converted Typical tel486 OX CPU to a 50 MHz Intel486 OX2 CPU. This
Design Design Performance conversion is a two step process. The first step is to
(Intel486 OX CPU) (Intel486 DX2 CPU) Gain change the frequency source for the CPU from 33
25 MHz 50 MHz 70% MHz to 25 MHz. The Intel486 OX2 CPU can then be
inserted into the system. Without any tuning of the
33 MHz 50 MHz 35% memory and depending on the application, only a
33 MHz 66 MHz 70% modest performance improvement may be ob-
served. For programs running entirely out of the on-
chip cache, however, performance can increase up
A few system details should be checked first to be to 50%. There are many factors which contribute to
sure the design is ready for the Intel486 OX2 CPU. the performance of an application, including whether
Check with your BIOS vendor to be sure any BIOS there is a second-level (L2) cache, the cache size if
issues have been resolved. The BIOS for the In- present, the memory subsystem design, and many
tel486 OX CPU may have timing loops. Since the other factors beyond the scope of this introduction.
Intel486 OX2 CPU runs instructions twice as fast as A comprehensive memory subsystem design guide,
the Intel486 OX CPU, timing loops may no longer AP469: Cache and Memory Design Considerations
return the re"quired results. Most of the timing loops for Intel486fM DX2 Microprocessor, is available
have been removed from a standard BIOS, but there which includes more detailed information on how
may be some versions that need updating. Another each of these many factors affects Intel486 OX2
BIOS issue that may not be critical, is the processor CPU-based system performance.
identification code. There are different 10 codes in
the Intel486 OX CPU and the Intel486 OX2 CPU. Because the Intel486 OX2 core runs twice as fast as
The BIOS may need to be modified to identify the its external bus, it is more sensitive to wait states.
Intel486 OX2 CPU properly. Refer to Table 6.3 for The Intel486 OX2 CPU needs to be fed instructions
the component 10 code. and data quickly. Either a high performance memory
subsystem is needed or an external cache should be
Other system parameters to watch out for are the added. An external cache benefits the Intel486 OX2
thermal and power supply specifications. Table 14.2 CPU even more than it benefits the Intel486 OX
details the Power Supply Current information, and CPU, and helps to hide the effects of a slower mem-
Table 15.2 outlines the Thermal Resistance. Since ory subsystem. The Intel486 OX CPU gains an aver-
the processor core runs twice as fast for the same age of 3%-9% performance by the addition of a
input clock, the Intel486 OX2 CPU uses more power second-level cache, but the Intel486 OX2 CPU gains
and generates more heat than the Intel486 OX CPU. an average of 20-30% performance by adding a
Be sure that there is adequate cooling and adequate second level cache. It should be noted however,
power built into the design. A heat sink is a recom- that an external cache does not preclude the bene-
mended method to help provide cooling for the In- fits of tuning the memory subsystem.
tel486 OX2 CPU.
13-1
intel.. Intel486™ DX2 MICROPROCESSOR
25 MHz Intel486™ OX CPU 33 MHz Intel486TM OX CPU
REMOVE REMOVE
Intel486 OX Intel486 OX
CPU CPU
REPLACE
INSTALL 33 MHz CPU
CRYSTAL
NEW BIOS WITH 25 MHZ
VERSION
INSTALL
NEW BIOS
MODIFY VERSION
POWER AND
COOLING
MODIFY
INSERT POWER AND
Inte1486Tt.l DX2 COOLING
CPU
INSERT
Inte1486Tt.l DX2
241245-92
CPU
TUNE
MEMORY
SYSTEM
241245-93
Figure 13.1. Flowchart for Intel486™ OX CPU to Intel486TM OX2 CPU Conversion
13·2
The graph shown in Figure 13.2 shows a set of A typical ISA chip set with an L2 cache, for example,
benchmarks known to have a poor cache hit rate. allows 6-4-4-4 bus cycles at 33 MHz with 80 ns
This is shown for purposes of memory tuning and DRAMs for the Intel486 OX CPU. Without modifying
not to be taken as absolute performance. Please re- the memory subsystem, the 50 MHz Intel486 DX2
fer to the /nte/486TM DX2 Microprocessor Perform- CPU achieved an average of 7%-12% improve-
ance Brief (Order # 241254) for performance de- ment over the 33 MHz Intel486 OX CPU. By reduc-
tails. ing the bus cycles at 25 MHz to 5-2-2-2 (still with
80 ns DRAMs), the 50 MHz Intel486 DX2 CPU im-
With the absence of a second-level cache, the mem- proved to achieve an average of 15%-20% more
ory subsystem becomes critical to gaining perform- performance than the 33 MHz Intel486 OX CPU. By
ance when converting from a 33 MHz Intel486 OX replacing the DRAMs with faster devices (70 ns) bus
CPU to a qO MHz Intel486 DX2 CPU. For slow mem- cycles could be reduced to 4-2-2-2 at 25 MHz, im-
ory systems without tuning, the 50 MHz Intel486 proving the performance of the 50 MHz Intel486
DX2 CPU can possibly run slower than the 33 MHz DX2 CPU even greater.
Intel486 OX CPU (see Figure 13.2). By tuning the
memory design, the 50 MHz Intel486 DX2 CPU can A typical EISA solution is shown in Figure 13.3, using
reach equivalent performance to the 33 MHz In- the Intel 82350DT Chip Set, which was specifically
tel486 OX CPU running applications with low cache designed to permit variation in CPU type and fre-
hit rates, and increase performance for applications quency.
with higher hit rates. Tuning the memory design can
be done easily by either removing a wait state from In an 82350DT based design the memory subsys-
the memory design (if timing permits), and/or adding tem iscQntrolled by the combination of a flexible
faster DRAM and removing wait state(s) from the Programmable State Tracker (PST) and a highly
memory deSign. configurable 82359 DRAM Controller. The PST,
which is typically implemented as a 3 to 5 PLD solu~
Changing the wait state configuration for the system tion, is responsible for converting the CPU's clock-
is often done by programming the DRAM controller dependent handshake protocol into a clock-less
in the chip set on the motherboard. Each chip set is memory interface protocol. The 82359 in turn uses
programmed differently at the BIOS level, requiring a the clock-less memory interface protocol to control
BIOS modification. For testing purposes, the chip main memory as well as to forward host CPU cycles
set may be programmed on the fly from a DOS pro- to the EISA bus if needed. As a result of this clock-
gram if the register locations are known.
- - 33MHz '-0- 33Mliz - - 50MHz -<>- 50MHz

Inlel486 ox Inlel486 ox Inlel4860X2 Inlel4860X2
CPu cpu cpu cpu
wI cache wI cache
140.00%
20.00%
0.00% +----II----+-,-...,..--t---+---t---f---i
0000(0) 3121(6) 3121(6) 3222(7) 3222(8) 4222(8) 4333(8) 6444(9)
0(0) 2(6) 3(6) 2(6) 3(6) 3(6) 3(6) 4(7)
Decreasing Uemory Subsystem Performance - Read Bus

Cycles (Page lIiss) I Wrile Bus Cycles (Page Miss)
241245-94
Figure 13.2. Performance of 50 MHz Intel486TM DX2 CPU vs. 33 MHz Intel486TM DX CPU
13-3
_.
l
Modular
HOST BUS
Asynch Interface
128-BIT
-i
5'
CD
Ii!
MAIN
DATA
EVEN BYTE ~=============i====:i
g c
><
N
MEMORY 128-BIT is:
(;
ODD BYTE
DATA .. 11:==========: :zJ
o
'U
:zJ
g
m
~:zJ
X-Bus
EISA BUS
241245-95
less protocol, the system design becomes indepen- length tracking, CPU "Ready" generation, and
dent of the CPU and cache combination being used cache invalidation control. Although the PST con-
and the speed of the CPU clock. Therefore, whenev- tains a number of state machines only a few of the
er a new CPU and cache combination is to be used state machines need to be re-evaluated to deter-
with an 82350DT based system, the only re-design mine whether any wait states can be removed for
that is necessary is to the CPU subsection, leaving converting from a 33 MHz Intel486 DX CPU to a
the main memory and EISA subsections unchanged. 50 MHz Intel486 DX2 CPU. The state machines that
Typically, this CPU subsection re-design entails need to be re-evaluated are the deterministic cycle
modifying only the PST functionality and the pro- tracker and the snoop cycle tracker.
grammable registers of the 82359.
The deterministic cycle tracker is responsible for
There are five steps to determine whether wait generating RDY or BRDY to the CPU and cache for
states can be removed from the main memory de- cycles that are deterministic in length. All main mem-
sign of an 82350DT system when converting from a ory cycles, except locked cycles which require EISA
33 MHz Intel486 DX CPU to a 50 MHz Intel486 DX2 arbitration, are deterministic cycles. Once the deter-
CPU. An overview of these five steps is covered ministic cycle tracker knows that a deterministic cy-
here; the system designer is referred to the cle is occurring, it uses the 82359 CYCLN(2:0) and
82350DT EISA Chip Set Design Guide (Order PAGEHIT# outputs to determine when to generate
# 296911) for detailed design information. RDY or BRDY to the CPU. For burst cycles the de-
1. Calculate the 82359 delay line tap values for opti- terministic cycle tracker also uses the IF(1 :0) and
mal 25 MHz operation SPEED(1 :0) outputs of the 82359 for generating
BRDY. After this analysis has been completed the
2. Determine all memory cycle lengths for operation system designer can then determine if the determi-
at 25 MHz nistic cycle tracker can be optimized to take advan-
3. Re-evaluate the PST design (deterministic & tage of converting from a 33 MHz Intel486 DX CPU
snoop cycle trackers) to a 50 MHz Intel486 DX2 CPU.
4. Modify the PLD equations for the PST
The other state machine that must be re-evaluated
5. Update system BIOS to reflect new 82359 pro- for correct system functionality is the snoop cycle
grammable register values tracker. The snoop cycle tracker state machine de-
sign must meet two goals; respond to a SNUPRQ
Step one is to perform a timing analysis· of the main with a SNUPACK # within 180 ns (based on an EISA
memory subsystem to determine the minimum num- burst write cycle), and maintain a snoop cycle fre-
ber of CPU clocks required for each memory cycle. quency capability that is equal to or faster than the
Once the memory cycle lengths are known, the PST fastest system bus master write cycle frequency.
design can be re-evaluated with the goal of remov- Due to the change of CPU clock frequency from
ing unnecessary wait states. Before the system de- 33 MHz to 25 MHz, the system designer must re-
signer can determine the memory cycle lengths, the evaluate the snoop cycle tracker state machine to
delay line timings of the 82359 must be analyzed. determine if the two design goals are still being met
in the 50 MHz Intel486 DX2 CPU implementation.
The timing for the DRAM control and address sig-
nals of the 82359 is based on four integrated asyn- In conclusion, when converting an 82350DT based
chronous delay line elements which can be con- design from a 33 MHz Intel486 DX CPU to a 50 MHz
trolled by the 82359 programmable registers. Once Intel486 DX2 CPU the system designer must re-eval-
the delay line tap values have been verified or modi- uate the main memory cycle timings to determine
fied, the system designer should determine the mini- whether the PST and 82359 programmable registers
mum number of CPU clocks required for the differ- need to be modified to take advantage of the in-
ent memory cycles (Le., read page hit, page miss creased performance benefits of the 50 MHz In-
write, burst read, etc.). Armed with the delay line tap tel486 DX2 CPU. Once the system designer has de-
programming values and the number of CPU clocks cided to modify the PST and the 82359 programma-
required for each type of memory cycle, the system ble registers, the conversion from a 33 MHz Intel486
designer can now evaluate the PST design to deter- DX CPU to a 50 MHz Intel486 DX2 CPU is usually
mine if any unneeded wait states can be removed. just as simple as modifying the PLD equations, re-
programming the PST PLDs, and upgrading the sys-
The PST for an 82350DT based system can be sep- tem BIOS to reflect the new 82359 programmable
arated into four primary functions: bus cycle Gontrol register values.
(including arbitration and posted write control), cycle
13-5
14.0 ELECTRICAL DATA

The following sections describe recommended elec- 14.1.3 OTHER CONNECTION
trical connections for the Intel486 DX2 microproces- RECOMMENDATIONS
sor, and its electrical specifications.
N.C. pins should always remain unconnected.
14.1 Power and Grounding For reliable operation, always connect unused in-
puts to an appropriate signal level. Active LOW in-
puts should be connected to Vee through a pullup
14.1.1 POWER CONNECTIONS
resistor. Pullups in the range of 20 KO are recom-
The Intel486 DX2 microprocessor is implemented in mended. Active HIGH inputs should be connected to
CHMOS V technology and has modest power re- GND.
quirements. However, its high clock frequency out-
put buffers can cause power surges as multiple out-
put buffers drive new signal levels simultaneously. 14.2 Maximum Ratings
For clean on-chip power distribution at high frequen-
Table 14.1 is a stress rating only, and functional op-
cy, 24 Vee and 28 Vss pins feed the Intel486 DX2
microprocessor. eration at the maximums is not guaranteed. Function
operating conditions are given in 14.3 D.C. Specifi-
Power and ground connections must be made to all cations and 14.4 A.C. Specifications.
external Vee and GND pins of the Intel486 DX2 mi-
Extended exposure to the Maximum Ratings may af-
croprocessor. On the circuit board, all Vee pins must
fect device reliability. Furthermore, although the In-
be connected on a Vee plane. All VSS pins must be
likewise connected on a GND plane. tel486 DX2 microprocessor contains protective cir-
cuitry to resist damage from static electric discharge,
always take precautions to avoid high static voltages
14.1.2 POWER DECOUPLING or electric fields.
RECOMMENDATIONS
Table 12.1. Absolute Maximum Ratings
Liberal decoupling capacitance should be placed
near the Intel486 DX2 microprocessor. The Intel486 Case Temperature under Bias ... - 65°C to + 110°C
DX2 microprocessor driving its 32-bit parallel ad-
dress and data busses at high frequencies can
Storage Temperature .......... - 65°C to + 150°C
cause transient power surges, particularly when driv- Voltage on Any Pin with
ing large capacitive loads. Respect to Ground ......... -0.5 to Vee + 0.5V
Supply Voltage with
Low inductance capacitors and interconnects are Respectto Vss ............... -0.5V to + 6.5V
recommended for best high frequency electrical per-
formance. Inductance can be reduced by shortening
circuit board traces between the Intel486 DX2 micro-
processor and decoupling capacitors as much as
possible. Capacitors specifically for PGA packages
are also commercially available.
14-1
ini'eL Intel486™ DX2 MICROPROCESSOR
14.3 Intel486 DX2 D.C. Specifications

Functional Operating Range: Vcc = 5V ± 5%; T CASE = O°C to + 85°C
Table 14-2. DC Parametric Values

Symbol Parameter Min Max Unit Notes
VIL Input low Voltage -0.3 +0.8 V
VIH Input High Voltage 2.0 VCC +0.3 V
VOL Output low Voltage 0.45 , ~ V (Note 1)
VOH Output High Voltage 2.4 ~,'!ki% V (Note 2)
ICC Power Supply Current p ~f"
(66 MHz) 0 mA (Note 3)
(50 MHz)
ICCF Power Supply Current in 50 mA (Note 8)
Power Down Mode ~
III Input leakage Current ±15 JJ-A (Note 4)

IIH Input leakage Current ,~,r:f&" 200 JJ-A (Note 5)
IlL Input leakage curren\r&~$? -400 JJ-A (Note 6)
ILO Output leakage Curr~t ±15 JJ-A
CIN Input Capacitance 13 pF Fc = 1 MHz (Note 7)
Co 1/0 or Output Capacitance 17 pF Fc = 1 MHz (Note 7)
CCLK ClK Capacitance 15 pF Fc = 1 MHz (Note 7)
NOTES:
Address, Data, BEn 4.0 mA
Definition, Control 5.0 mA
Address, Data, BEn -1.0 mA
Definition, Control -0.9 mA
3. Typical supply current:
775 mA @ 50 MHz
975 mA @ 66 MHz
4. This parameter is for inputs without internal pullups or pulldowns and 0 ~ VIN ~ Vcc.
5. This parameter is for inputs with internal pull downs and VIH = 2.4V.
6. This parameter is for inputs with internal pullups and VIL = 0.45V.
7. Not 100% tested.
8. The ICCF specification in the above table is a target value. It has not been tested.
14.4 A.C. Specifications the voltage levels indicated by Figure 14.3 when
A.C. specifications are measured. Intel486 DX2 mi-
The A.C. specifications, given in Table 14.3, consist croprocessor output delays are specified with mini-
of output delays, input setup requirements and input mum and maximum limits, measured as shown. The
hold requirements. All A.C. specifications are rela- minimum Intel486 DX2 microprocessor delay times
tive to the rising edge of the ClK signal. are hold times provided to external circuitry. Intel486
DX2 microprocessor input setup and hold times are
A.C. specifications measurement is defined by Fig- specified as minimums, defining the smallest ac-
ures 14.1-14.7. All timings are referenced to 1.5V ceptable sampling window. Within the sampling win-
unless otherwise specified. Inputs must be driven to dow, a synchronous input signal must be stable for
correct Intel486 DX2 microprocessor operation.
14-2
Table 14.4.1.50 MHz Intel486 DX2 Microprocessor A.C. Characteristics

VCC = 5V ±5%; Tcase = O°C to + 85°C; CI = 50 pF unless otherwise specified
Symbol Parameter Min Max Unit Figure Notes
Frequency 8 25 MHz 1X Clock Driven to Intel486 DX2
t1 ClK Period 40 125 ns 14.1
t1a ClK Period Stability 0.1% t:.. Adjacent Clocks
t2 ClK High Time 14 ns 14.1 at2V
t3 ClK low Time 14 ns 14.1 at 0.8V
t4 ClKFaliTime 4 ns 14.1 2Vto 0.8V
t5 ClK Rise Time 4 ns 14.1 0.8Vto 2V
t6 A2-A31, PWT, PCD, BEO-3#, 3 19 ns 14.5
M/IO#, D/C#, W/R#, ADS#,
lOCK#, FERR#,BREQ, HlDA
Valid Delay
t7 A2-A31, PWT, PCD, BEO-3#, 28 ns 14.6 (Note 1)
lOCK # Float Delay
t8 PCHK# Valid Delay 3 24 ns 14.4 (Note 3)
t8a BLAST #, PLOCK # Valid Delay 3 24 ns 14.5 (Note 3)
t9 BlAST#, PlOCK# Float Delay 28 ns 14.6 (Note 1)
t10 DO-D31, DPO-3 Write Data Valid 3 20 ns 14.5 (Note 3)
Delay
t11 DO-D31, DPO-3 Write Data Float 28 ns 14.6 (Note 1)
Delay
t12 EADS # Setup Time 8 ns 14.2
t13 EADS # Hold Time 3 ns 14.2
t14 KEN#, BS16#, BS8# Setup Time 8 ns 14.2
t15 KEN #, BS16 #, BS8 # Hold Time 3 ns 14.2
t16 RDY #, BRDY # Setup Time 8 ns 14.3
t17 RDY #, BRDY # Hold Time 3 ns 14.3
t18 HOLD, AHOlD, BOFF # Setup Time 8 ns 14.2
t19 HOLD, AHOlD, BOFF # Hold Time 3 ns 14.2
t20 RESET, FlUSH#, A20M#, NMI, 8 ns 14.2 (Note 4)
INTR, IGNNE# Setup Time
INTR, IGNNE# Hold Time
t22 DO-D31, DPO-3, A4-A31 Read 5 ns 14.2,14.3
Setup Time
Hold Time
NOTES:
1. Not 100% tested. Guaranteed by design characterization.
2. All timing specifications assume CL = 50 pF. Charts 14.4.3 provides the charts that may be used to determine the delay
due to derating, depending on the lumped capacitive loading, that must be added to these specification values.
3. The minimum Intel486 DX2 output valid delays are hold times provided to external circuitry.
4. A reset pulse width of 15 ClK cycles is required for warm resets. Power-up resets require RESET to be asserted for at
least 1 ms after Vce and ClK are stable.
14-3
Table 14.4.266 MHz Intel486 DX2 Microprocessor A.C. Characteristics

Vce = 5V ±5%; Tcase = O°C to + 85°C; CI = 50 pF unless otherwise specified (Note 2)
Frequency 8 33 MHz 1X Clock Driven to Intel486 DX2
t1 ClK Period 30 125 ns 14.1
t1a ClK Period Stability 0.1% t;. Adjacent Clocks
t2 ClK High Time 11 ns 14.1 at2V
t3 ClKlowTime 11 ns 14.1 atO.8V
t4 ClK Fall Time 3 ns 14.1 2Vto 0.8V
t5 ClK Rise Time 3 ns 14.1
t6 A2-A31, PWT, PCD, BEO-3#, 3 14 ns 14.5
lOCK#,FERR#,BREQ,HlDA
Valid Delay
t7 A2-A31, PWT, PCD, BEO-3#,
lOCK # Float Delay
ts PCHK# Valid Delay
tSa BlAST#, PlOCK# Valid Delay
t9
tlO DO-D31, DPO-3 Write Da (Note 3)
Delay
t11 DO-D31, DPO-3 Wei 14.6 (Note 1)
Delay 'ilk
":&"
t12 EADS # Setup Time 14.2

t13 EADS # Hold Time ns 14.2
t14 KEN#, BS16#, BS8 ns 14.2
t15 ns 14.2
t16 ns 14.3
t17 RDY#, B old Time ns 14.3
t1S HOLD, AHM:D, Setup Time ns 14.2
t1Sa BOFF # Setup Time 7 ns 14.2
t19 HOLD, AHOlD, BOFF # Hold Time 3 ns 14.2
INTR, IGNNE# Setup Time
INTR, IGNNE# Hold Time
Setup Time
Hold Time
NOTES:
1. Not 100% tested. Guaranteed by design characterization.
2. All timing specifications assume CL = 50 pF. Charts 14.4.3 provides the charts that may be used to determine the delay
due to derating, depending on the lumped capacitive loading, that must be added to these specification values.
3. The minimum Intel486 DX2 output valid delays are hold times provided to external circuitry.
4. A reset pulse width of 15 ClK cycles is required for warm resets. Power·up resets require RESET to be asserted for at
least 1 ms after Vce and ClK are stable.
14-4
Table 14.4.3. Intel486 DX2 Microprocessor A.C. Characteristics for Boundary Scan Test Signals
Vee = 5V ± 5%, T case = O·C to + 85·C, CL = 0 pF
All Inputs and Outputs are TTL Level (Note 4)
t24 TCK Frequency 25 MHz 1xCIock
t25 TCK Period 40 ns (Note 2)
t26 TCK High Time 10 ns at 2.0V
t27 TCKLowTime 10 ns at O.BV
t28 TCK Rise Time 4 ns (Note 1)
t29 TCKFaliTime 4 ns (Note 1)
t30 TDI, TMS Setup Time B ns 14.7 (Note 3)
t31 TDI, TMS Hold Time 7 ns 14.7 (Note 3)
t32 TOO Valid Delay 3 25 ns 14.7 (Note 3)
t33 TOO Float Delay TBD
t34 All Outputs (Non-Test) Valid Delay 3 25 ns 14.7 (Note 3)
t35 All Outputs (Non-Test) Float Delay 36 ns 14.7 (Note 3)
t36 All Inputs (Non-Test) Setup Time B ns 14.7 (Note 3)
t37 All Inputs (Non-Test) Hold Time 7 ns 14.7 (Note 3)
NOTES:
1. Rise/Fall times are measured between 0.8V and 2.0V. Rise/Fall times can be relaxed by 1 ns per 10 ns increase in TCK
period.
2. TCK period :2: ClK period.
3. Parameter measured from TCK.
4. Boundary Scan A.C. Specifications in the above table are target values. They have not been characterized. Therefore
they are subject to change.
14-5
1.5V
t5
k------- t1 ------~
241245-70
Figure 14.1. elK Waveforms
Tx Tx Tx Tx
ClK [
EADS# [
~~~---+----~~
BS8#, BS 16#, [
KEN# ~~~~_ _ + __ ~~~
BOFF#, AHOlD,
HOLD [
RESET, FLUSH#,
A20t.4#, IGNNE#,
INTR, Nt.41
[
A4-A31
(READ) [
241245-71
Figure 14.2. Input Setup and Hold Timing
Tx Tx Tx
ClK [
RDY#, BRDY# [~~~[:::t~::j~~-

DO-D31 [
DPO-DP3 ~~~;a... __ + __ ....G~oIU
241245-72
Figure 14.3. Input Setup and Hold Timing
14-6
Tx Tx Tx
ClK [
BROY#, ROY# [ .u.l~It.Mo"-_ _-+-__....,j~~
00-031 [
OPO-OP3 .u.l~It.Mo"-~--t---....,j~~
PCHK# [
241245-73
Figure 14.4. PCHK# Valid Delay Timing
Tx Tx Tx Tx
ClK [
A2-A31, PWT, PCO,

BEO-3#,II/10#,
O/C#,W/R#, AOS#, [
lOCK#, fERR#, BREQ,
HlOA
00-031, DPO-3, [
(WRITE)
BlAST#, PlOCK# [
241245-74
Figure 14.5. Output Valid Delay Timing
Tx Tx Tx Tx
ClK [
A2-A31, PWT, PCD,

BEO-3#,II/10#,
D/C#,W/R#,ADS#, [
lOCK#, fERR#, BREQ,
HlDA
DO-D31, DPO-3, [
(WRITE)
BLAST#, PlOCK# [
241245-75
Figure 14.6. Maximum Float Delay Timing
14-7
infel· Intel486™ DX2 MICROPROCESSOR
TCK
TOO
~~~~~~~~"~--------'
t34i _------t3-5~
S~~~~! XXXXXXXXXXXXX X"'------r-
"l;:t36 t37:::j~
Si~~~! ~XXXXXXXXXX~~~~~~~ ~
241245-76
Figure 14.7. Test Signal Timing Diagram
14.4.1 TYPICAL OUTPUT VALID DELAY VERSUS LOAD CAPACITANCE UNDER WORST CASE
CONDITIONS FOR THE 50 MHz AND 66 MHz INTEL486 DX2 CPU
nom+6 .---.---.---.---,.......,."'"
nom+4 1---+--,
j
'"c....
'"0.
....
'"o
-'
~
ii:
~
100 125 150

G.. (picofarads)
NOTE: 241245-77
Thi.s graph will not be linear outside of the CL range shown.
nom = nominal value given in A.C. Characteristics table.
14.4.2 TYPICAL OUTPUT RISE TIME VERSUS LOAD CAPACITANCE UNDER WORST-CASE
CONDITIONS
241245-80
NOTE:
This graph will not be linear outside of the CL range shown.
14-8
14.4.3.a TYPICAL LOADING DELAY VERSUS CAPACITIVE LOADING UNDER WORST-CASE

CONDITIONS FOR A HIGH TO LOW TRANSITION ON THE INTEL486 DX2 CPU
5
/
4 /
3
/
Loading Delay 2
/
(ns) /
o V
-1 ./
-2 V
-3 ~
o 25 50 100 150
Capacitive Loading (pF)

241245-78
14.4.3.b TYPICAL LOADING DELAY VERSUS CAPACITIVE LOADING UNDER WORST-CASE

CONDITIONS FOR A LOW TO HIGH TRANSITION ON THE INTEL486 DX2 CPU
2.5 /
2 /
1.5 /
/
Loading Delay 0 5
(ns) .
/
o /
-0.5 ./
./
-----
-1
-1.5
-2
o 25 50 100 150
Capaoitive Loading (pf)

241245-79
14-9
15.0 MECHANICAL DATA

SEATING
PLANE =r--r
A3 -
_
A
+ ~L~'r-
¢1.65 @@@@@@@@@@@@@@@@@
R~F.
L-@@@@@@@@@@@@@@@@@
.-@@@@@@@@@@@@@@~@@
T @@@ @@@
11
......
@@@
@@@
@@@
@@@
- .-.. SEATING
@@@
(
@@@ -- PLANE ~
¢B (ALL PINS) I
@@@
@@@
@@@
@@@ \ D ......
f=~
m
@@@ @@@
PIN C 3 " @@@
@@@
'- / @@@
@@@ .-..... SWAGGED
PIN
DETAIL
o@@@@
@ @ @@@
...-=
@@o@@@@@@@@@@@il@@
@@@@@@@@@@@@@@@o@
~@@@@@@@@@@@@@@@o@
-- -
r-
~:;~ REF. SW~f~ED
\ Al-~L
BASE - A2
450 CHAMFER (4 PL) PLANE-
(INDEX CORNER)
241245-81
Family: Ceramic Pin Grid Array Package

Millimeters Inches
Symbol
Min Max Notes Min Max Notes
A 3.56 4.57 0.140 0.180
Al 0.64 1.14 SOLID LID 0.025 0.045 SOLID LID
A2 2.8 3.5 SOLID LID 0.110 0.140 SOLID LID
A3 1.14 1.40 0.045 0.055
B 0.43 0.51 0.017 0.020
0 44.07 44.83 1.735 1.765
01 40.51 40.77 1.595 1.605
91 2.29 2.79 0.090 0.110
L 2.54 3.30 0.100 0.130
N 168 168
Sl 1.52 2.54 0.060 0.100
Figure 15.1. 168 Lead Ceramic PGA Package Dimensions
15-1
Table 15.1 Ceramic PGA Package Dimension Symbols

Letter or
Description of Dimensions
Symbol
A Distance from seating plane to highest point of body
A1 Distance between seating plane and base plane (lid)
A2 Distance from base plane to highest point of body
A3 Distance from seating plane to bottom of body
B Diameter of terminal lead pin
D Largest overall package dimension of length
D1 A body length dimension, outer lead center to outer lead center
e1 Linear spacing between true lead position centerlines
L Distance from seating plane to end of lead
S1 Other body dimension, outer lead center to edge of body
NOTES:
1. Controlling dimension: millimeter.
2. Dimension "e1" ("e") is non-cumulative.
3. Seating plane (standoff) is defined by P.C. board hole size: 0.0415-0.0430 inch.
4. Dimensions "S", "S1" and "c" are nominal.
5. Details of Pin 1 identifier are optional.
15.1 Package Thermal Specifications where TJ, T A, TC = Junction, Ambient and Case
Temperature respectively. OJC, OJA = Junction-to-
The Intel486 DX2 microprocessor is specified for op- Case and Junction-to-Ambient Thermal Resistance,
eration when T C (the case temperature) is within the respectively.
range of DOC-85°C. T C may be measured in any en-
vironment to determine whether the Intel486 DX2 P = Maximum Power Consumption
microprocessor is within specified operating range.
The case temperature should be measured at the The values for OJA and OJC are given in Table 13.2
center of the top surface opposite the pins. lor the 1.75 sq. in., 168-pin, ceramic PGA.
The ambient temperature (TA) is guaranteed as long Table 13.3 shows the TA allowable (without exceed-
as TC is not violated. The ambient temperature can ing T cl at various airflows and operating frequencies
be calculated from 0JC and 0JA from the following (fCLK)'
equations.
Note that TA is greatly improved by attaching "fins"
TJ = Tc + P • i!JC or a "heat sink" to the package. P (the maximum
power consumption) is calculated by using the maxi-
TA=TJ-P*i!JA
mum Icc at 5V as tabulated in the DC Characteris-
TA = Tc - (P * i!CA) tics of Section 14.
Tc = TA + P' [i!JA -i!Jcl
Table 15.2. Thermal Resistance ("C/W) OJC and OCA for the 50 MHz and 66 MHz Intel486 DX2 CPU
OCA vs Airflow-ft/min (m/sec)
OJC 0 200 400 600 800 1000
(0) (1.01) (2.03) (3.04) (4.06) (5.07)
I With Heat Sink' 2.5 10.5 7.0 4.5 3.5 3.0 2.5
I Without Heat Sink 2.0 16 14.0 10.5 9.0 8.0 7.5

'0.350" high omnidirectional heat sink (AI alloy 6063, 40 mil fin width, 155 mil center-to-center fin spacing).
15-2
DDDDDDDDDDD
DDDDDDDDDDD I
1.540"
DDDDDDDDDDD
DDDDDDDDDDD I
1-------1.536"'----------J 0.079"-/ I-
24124S-A2
Table 15.3. Maximum T A at Various Airflows In °C

Airflow-ft/min (m/sec)
0 200 400 600 800 1000
(0) (1.01) (2.03) (3.04) (4.06) (5.07)
TA with Heat Sink 50 MHz 32.6 50.0 62.5 67.5 70.0 72.5
66 MHz 18.9 40.9 56.7 62.9 66.1 69.3
TA without Heat Sink 50 MHz 5.2 15.1 32.6 40.1 45.1 47.6
66 MHz -15.8 -3.2 18.9 28.3 34.6 37.8
15-3
16.0 SUGGESTED SOURCES FOR

INTEL486 DX2 ACCESSORIES
Following are some suggested sources of accesso- Heat Sinks/Fins
ries for ,the Intel486 OX2. They are not an endorse-
ment of any kind, nor a warrarity of the performance 1. AAVIO Engineering, Inc.
of any of the listed products and/or companies. One Kool Path
P.O. Box 400
Laconia, NH 03247
Sockets Tel: (603) 528-3400
1. McKenzie Technology
44370 Old Palmspring Blvd. TTL Crystals/Oscillators
Fremont, CA 94538
Tel: (415) 651-2700 1. NFL Frequency Controls, Inc.
2. E-CAM Technology, Inc. 357 Beloit Street
14455 North Hayden Rd. Burlington, WI 53105
Suite 208 Tel: (414) 763-3591
Scottsdale, AZ 85260 2. M-Tron
Tel: (602) 443-1949 P.O. Box 630
3. Augat Inc. (for sockets with decaps) Yankton, SO 57078
Interconnection Products Group Tel: (605) 665-9321
33 Perry Ave.
P.O. Box 779 Debugging Tower
Attleboro, MA 02703
Tel: (508) 222-2202 1. Emulation Technology
2344 Walsh Ave., Building F
Santa Clara, CA 95051
Tel: (408) 982-0664
16-1
inter DOMESTIC SALES OFFICES
ALABAMA CONNECTICUT MASSACHUSETTS Intel Corp. UTAH
5540 Centerview Or.
tlntal Corp.
5015 Bradford Dr., #2
tlntel Corp.
301 Lee Farm Corporate Park ~~~r~rp. Center Suite 215
Raleigh 27606 ~::~'K400 South
Huntsville 35805 83 Wooster Heights Rd. 3 ca~lsle Rood Tel: (919) 851-9537 Suite 104
Danbury 06810 2nd Floor
~~j}~~)~~~ FAX: (919) 851·8974 Murray 84107
Tel: (203) 748-3130 Westiord 01886 Tel: (801) 263-8051
FAX: (203) 794-0339 Tel: (508) 692-3222 OHIO FAX: (801) 268-1457
TWX: 710-343-6333
ARIZONA FAX: (508) 692·7867 tlntal Corp. *
FLORIDA 3401 Park Center Drive VIRGINIA
tlntel Corp. Suite 220
MICHIGAN
11225 N. 26th Dr.
Suite D·214 ~31 ~":l"6th Way Dayton 45414 tlntel Corp.
1504 Santa Rosa Road
Phoenix 85029
Tel: (602) 869-4980
Suite 100
Ft. Lauderdale 33309
tlntel Corp.
7071 Orchard Lake Rood i~:lJrL~~ Sune 108
Suite 100 FAX: (513) 890-8658 Richmond 23288
FAX: (602) 869-4294 Tel: (305) 771-0800 Tel: (804) 282-5668
TWX: 510-956-9407 West Bloomfield 48322
FAX: (305) 772-11193 Tel: (313) 851·8096 ~~~C~~ Pal1< Dr. FAX: (216) 464-2270
rJ!s~ona
Suite 215
Usa Rd.
tlntel Corp.
FAX: (313) 851·8770
Suite 100
Beachwood 44122 WASHINGTON
Tucson 85741 5850 T.G. Lee Blvd. MINNESOTA Tel: (216) 464·2738
Tel: (802) 544-0227 Suite 340 TWX: 810·427·9298 tlntel Corp.
FAX: (602) 544·0232 Orlando 32822 tlntel Corp. 155 1oath Avenue N.E.
3500 W. BOth SI. FAX: (804) 282-Q673
Tel: (4O~240-80oo Suite 386
FAX: (40 240-8097 Suite 380 Bellevue 98004
CALIFORNIA Bloomington 55431 OKLAHOMA
~~t3~~~' Street North

Tel: (612) 835·6722 ~\~f~:tgo~
tlntel Corp.
21515 Vanowen Street SUite 170
TWX: 910-576-2867
FAX: (612) 831·6497
ll:\ 1f.~roadway FAX: (206) 451·9556
Suite 115
Suite 116
f./(~~~U-!miJ6 Oklahoma Cfty 73162 Intel Corp.
~f8)amlJ:lg FAX: (813) 576-1607
MISSOURI Tel: (405) 846-8086
FAX: (405) 840-9819
408 N. Mullan Road
Suite 102
FAX: (818) 340-1144 tlntel Corp. Spokane 99206
GEORGIA 4203 Earth Cfty Expressway OREGON Tel: (509) 928-11086
tlntel Corp. Suite 131
2250 E. Imperial Highway FAX: (509) 928-9467
Suite 218 Intel Corp.
20 Technology Parkway, N.W.
Earth Cfty63045
Tel: (314) 291·1990 t~~~~: Greenbrier Parkway
f~~~~;)d~~ Su~e 150
Norcross 30092
FAX: (314) 291-4341 Building B
Beaverton 97005
WISCONSIN
FAX: (213) 640-7133 Tel: (503) 645·8051 Intel Corp.
Tel: (404) 449-0541 NEW JERSEY
FAX: (404) 605-9762 TWX: 910-467·8741 330 S. Executive Dr.
Intel Corp. FAX: (503) 645-11181 Suite 102
1 Sierra Gate Plaza tlmel Corp. *
Parkway 109 Office Center Brooktleld 53005
Sune 280C ILLINOIS PENNSYLVANIA Tel: (414) 784-8087
Roseville 95678 328 Newman Springs Road
Red Bank 07701 FAX: (414) 796-2115
Tel: (916) 782-11086 tlmel Corp. * tlntel Corp.-
FAX: (916) 782-11153 300 N. Martingale Road Tel: (201) 747·2233 455 Pennsylvania Avenue
Suite 400 FAX: (201) 747-0983 Suite 230
tlntel Corp. Schaumburg 60173 tlntel Corp. Fort Washington 19034 CANADA
~\2Jf~.:1:1g~
9665 Chesapeake Dr. Tel: (708) 805·8031 280 Corporate Center
Suite 325 FAX: (708) 706-9762 75 Uvingston Avenue BRITISH COLUMBIA
~~f£o~~~86 INDIANA
First Ftoor
Roseland 07068
FAX: (215) 641-0785
tlntel Corp. *
FAX: (619) 292·0628 Intel Semiconductor of
Tel: (201) 740·0111 400 Penn Center Blvd. Canada, Ltd.
tlntel Corp. FAX: (201) 74Q-0828 Suite 610
tlntel Corp. * 8n7 Purdue Road 4585 Canada Way
400 N. Tustin Avenue Pittsburgh 15235 Suite 202
Suite 125 NEWVORK Tel: (412) 823-4970
Suite 450 Indianapolis 46268 Burnaby VSG 4L6
Santa Ana 92705 FAX: (412) 829-7578 Tel: (604) 298-0387
Tel: (317) 875-0623 Intel Corp.-
Tel: (714) 835·9642 FAX: (317) 875-11938 FAX: (604) 298-8234
TWX: 910-595·1114 850 Cross Keys Office Park PUERTO RICO
FAX: (714) 541-9157 Fairport 14450
IOWA Tel: (716) 425-2750 tlntel Corp. ONTARIO
tlntel Corp.- TWX: 510-253·7391 South Industriel Park
San Tomas 4 Intel Corp. FAX: (716) 223·2561 P.O. Box 910 tlntel Semiconductor of
2700 San Tomas Expressway 1930 St. Andrews Drive N.E. Las Piedras 00671 Canada, Ud.
2nd Floor tlntel Corp. * Tel: (809) 733-l1616 2650 Queensvlew Drive
2nd Floor 2950 Expressway Dr., South
Santa Clara 95051 Cedar RapidS 52402 Suite 250
Tel: (319) 393-1294 Suite 130 TEXAS Ottawa K2B 8H6
~(~~~= Islandia 11722
Tel: (516) 231·3300 Intel Corp. Tel: (613) 829·9714
FAX: (613) 820-5936
FAX: (408) 727-2620 KANSAS TWX: 510·227·6238 1~~inC~~ of Texas Hwy.
tlntel Corp. FAX: (516) 346-7939 tlmel Semiconductor of
COLORADO Tel: (512) 794-8086
Canada, Ltd.
~~:l~~.D tlntel Corp. FAX: (512) 336-9335
190 Attwell Drive
Intel Corp. Westage Business Center tlntel Corp.* Suite 500
4445 Northpark Drive Overland Park 66210 Bldg. 300, Route 9
Tel: (913) 345-2727 12000 Ford Road Rexdale M9W 6H8
Suite 100 Fishkill 12524 Suite 400 Tel: (416) 675-2105
Colorado Springs 80907 FAX: (913) 345·2076 Tel: (914) 897-3860 Dallas 75234 FAX: (416) 675-2438
Tel: (719) 5 _ 2 FAX: (914) 897-3125 Tel: (214) 241-l1087
FAX: (303) 594-0720 MARYLAND FAX: (214) 484-1180
NORTH CAROUNA QUEBEC
;~21 ~.;t;reowey
tlntel Corp.- tlntel Corp. *
650 S. Cherry St. 10010 Junction Dr. tlntel Corp. Intel Semiconductor of
Suite 915 Suite 200 5800 Executive Center Dr. Suite 1490 Canada, Ltd.
Denver 80222 Annapolis Junction 20701 Suite 105 Houston n074 620 St. Jean Boulevard
Pointe Clelre H9R 3K2
~m&:t~~
Tel: (303) 321-l1088 Tel: (301) 206-2860 Charlotte 28212
TWX: 910-931·2289 FAX: !301l206-3877 Tel: (704) 566-8966 Tel: (514) 694-9130
FAX: (303) 322-l1670 301 206-3678 FAX: (704) 535-2238 FAX: (713) 986-3860 FAX: 514-694-0064
tSales and Service Office

*Reld AppIicadon locatIon
EUROPEAN SALES OFFICES
FINLAND Intel GmbH ITALY SPAIN SWITZERLAND
Abraham Lincoln $trasse 16-18
Intel Finland OY 6200 Wiesbaden Intel Corporation Italia S.p.A. Intel Iberia SA Intel Semiconductor A.G.
Ruosilantie 2 Tel: (49) 06121/7605-0 Milanofiori Palazzo E Zurbaran, 28 Zuerichstrasse
00390 Helsinki FAX: (49) 06121718615 20094 Assago 28010 Madrid 8185 Winkel-Rueti bei Zuerich
Tel: (358) 0 544 644 Milano Tel: (34) 308 25 52 Tel: (41) 01/8606262
FAX: (358) 0 544 030 Intel GmbH Tel: (39) (02) 89200950 FAX: (34) 410 7570 FAX: (41) 01/860 0201
Zettachring 1QA FAX: (39) (2) 3498464
FRANCE 7000 Stuttgart ao
Intel Corporation S.A.R.L. Tel: (49) 0711/7287-280 SWEDEN UNITED KINGDOM
1, Rue Edison-BP 303 FAX: (49) 0711 7280137 NETHERLANDS
7805481. Quentin-en-YveJines Intel Sweden A. B. Intel Corporation (U.K.) Ltd.
Cedex Intel Semiconductor B.V. Dalvagen 24 Pipers Way
Tel: (33) (1) 30 57 70 00 ISRAEL Postbus 84130 171 36 Salna Swindon, Wiltshire SN3 1RJ
FAX: (33) (1) 30 64 6032 3009 CC Rotterdam Tel: (46) 8 734 01 00 Tel: (44) (0793) 696000
Intel Semiconductor Ltd Tel: (31) 1040711 11 FAX: (46) 8 278085 FAX: (44) (0793) 641440
GERMANY Atidim Industrial Park-Neve Sharet FAX: (31) 10 455 46 88
P.O. Box 43202
Intel GmbH Tel-Aviv 61430
Dornacher Strasse 1 Tel: (972) 03-498080
8016 Feldkirchen bel Muenchen FAX: (972) 03-491870
Tel: (49) 089/90992-0
FAX: (49) 089/904/3948
EUROPEAN DISTRIBUTORS/REPRESENTATIVES
AUSTRIA Metrologie GmbH Lasi Elettronica S.pA SCANDINAVIA Bytech Systems
Steinerstrasse 15 P.I. 00839000155 Unit 3
Bacher Electronics GmbH 8000 Muenchen 70 Viale Fulvio Testi, N.280 OY Fintronic AB The Western Centre
Rotenmuehlgasse 26 Tel: 49 89 724470 20126 Milano Heikkilantie 2a Western Road
A-1120 Wien SF-02100 Helsinki
FAX: 49 89 72447111 Tel: 39 2 66101370 Bracknell
Tel: 43 222 81356460 FAX: 39 2 66101385 Finland Berks RG12 1RW
FAX: 43 222 834276 ITT Multikomponent Elektronik Tel: 358 0 6926022 Tel: 0344 55333
Vertrieb In Multicomponents FAX: 358 0 6821251 FAX: 0344 867270
BELGIUM Bahnhofstr. 44 P.1. 06550110156
Palazzo E5 Milanofiori ITT Multikomponent A/S Conformix
Inelco Belgium SA 7141 Moeglmgen Naverland 29
Tel: 49 7141 4879 20094 Assago (Milano) Rapid House
Oorlogskruisenlaan 94 Tel: 39 2 824701 DK-2600 Glostrup Oxford Road
B-1120 Bruxelles FAX: 49 7141487210 Denmark
FAX: 39 2 8242631 High Wycombe
Tel: 32 2 244 2811 Proelectron Vertriebs GmbH Tel: 0104542451822 Bucks
FAX: 32 2 2163304 Max-Planck-Strasse 1-3 Silverstar Ltd. S.p.A. FAX: 010 45 42 457624 Herts HP11 2EE
6072 Dreieich P.I. 00751300153 Tel: 0494 474147
FRANCE Viale Fulvio Testi N.280 Nordisk Elektronik A/S
Tel: 4961033040 Postboks 122 FAX: 0494452144
FAX: 49 6103 304344 20126 Milano
Almex Smedsvingen 4 Jermyn
Tel: 392 66125
48, Rue de l'Aubepine N-1364 Hvalstad Vestry Estate
FAX: 39 2 66101359
B.P.102 GREECE Norway Otford Road
92164 Antony Cedex Telcom s.r.1. - Divisione MDS Tel: 47 2 846210 Sevenoaks
Tel: 33 1 40965400 Pouliadis Associates Corp. Via Trombetta FAX: 47 2 846545 Kent TN 14 5EU
FAX: 33 1 4666 6028 5 Koumbari Street Zona Marconi - Strada Cassanese Tel: 0732450144
Nordisk Electronik AB
Kolonaki Square Segrate - Milano FAX: 0732 451251
Jermyn Box 36
10674 Athens Tel: 39248704100
73-79 Rue des Solets Torshamnsgatan 39
Tel: 30 1 3603741 FAX: 39 2 48705355 MMD
Silic 585 S-16493 Kista
FAX: 30 1 360 7501 3 Bennet Court
94663 Rungis Cedex Sweden
NETHERLANDS Bennet Road
Tel: 33 1 49784878 Tel: 46 8 7034630 Reading
FAX: 33 1 4978 0599 IRELAND Konin~ en Hartman B.V. FAX: 4687039845 Berkshire RG2 OOX
Metrologie Micro Marketing Energleweg 1 Tel: 0734313232
2627 AP Delft SWITZERLAND
Tour d'Asnieres Tony Hall FAX: 0734 313255
4, Avenue Laurent Cely The Netherlands Industrade A.G.
Eglinton Terrace Rapid Silicon
92606 Asnieres Cedex Dundrum, Dublin Tel: 31 15609906 Hertistrasse 31
FAX: 31 15619194 CH-8304 Wallis ellen 3 Bennet Court
Tel: 33 1 47906240 Tel: 0001 989 400
Tel: 41 1 8328111 Bennet Road
FAX: 33 1 4790 5947 FAX: 0001 989 8282 Reading
PORTUGAL FAX: 41 1 8307550
Tekelec-Airtronic Berks RG2 OOX
Cite des Bruyeres ISRAEL ATD Electronica LOA UNITED KINGDOM Tel: 0734750697
Rue Carle Vernet - BP 2 Rua Dr. Faria de Vasconcelos, 3a FAX: 0734312728
92310 Sevres Eastronics Ltd. 1900 Lisboa Accent Elect Comp Ltd.
Rozanis 11 Tel: 351 1 8472200 Jubilee House Metro Systems
Tel: 33 1 4534 7535
P.O.B.39300 FAX: 351 1 8472197 Jubilee Road Rapid House
FAX: 33 1 45072191
Tel Baruch, Tel-Aviv 61392 Letchworth Oxford Road
Tel: 972 3 475151 SPAIN Hertsfordshire High Wycombe
GERMANY
FAX: 972 3 475125 SG610H Bucks HP11 2EE
E2000 Vertriebs-AG ATD Electronica Tel: 0462 480888 Tel: 0494 474171
Stahlgruberring 12 Plaza Ciudad de Viena, 6 FAX: 0462 682467 FAX: 0494 21860
8000 Muenchen 82 ITALY 28040 Madrid
Tel: 49 89 420010 Tel: 34 1 5344000/09 Bytech Components Limited YUGOSLAVIA
FAX: 49 89 42001209 Intesi Div. DeHa Deutsche FAX: 34 1 534 7663 12a Cedarwood
Divisione In Industries GmbH Chineham Business Park H.R. Microelectronics Corp.
Jermyn GmbH P.I. 06550110156 Metrologia Iberica Crockford Lane 2005 de la Cruz Blvd., Ste. 223
1m Dachsstueck 9 Milanoffori palazzo E5 Ctra De Fuencarral N.80 Basingstoke Santa Clara, CA 95050
6250 Limburg 20094 Assago (Milano) 28100 Alcobendas (Madrid) Hants RG12 lRW U.S.A.
Tel: 49 6431 5080 Tel: 39 2 824701 Tel: 34 1 6538611 Tel: 0256 707107 Tel: (1) (408) 988-0286
FAX: 49 6431 508289 FAX: 39 2 8242631 FAX: 34 1 6517549 FAX: 0256 707162 TLX: 387452
CG/SALE/07319
INTERNATIONAL SALES OFFICES
AUSTRALIA INDIA Intel Japan K.K. * KOREA
Kawa-asa Bldg.
Intel Australia Ply. Ltd. Intel Asia Electronics, Inc. 2-11-5 Shin-Yokohama Intel Korea, Ltd.
Unit 13 4/2, Samrah Plaza Kohoku-ku, Yokohama-shi 16th Floor, Life Bldg.
Allambie Grove Business Park St. Mark's Road Kanagawa, 222 61 VOldo-dong, Youngdeungpo-Ku
25 Frenchs Forest Road East Bangalore 560001 Tel: 045-474-7661 Seoul 150-010
Frenchs Forest, NSW, 2086 Tel: 91-812-215773 FAX: 045-471-4394 Tel: (2) 784-8186
Tel: 61-2975-3300 TLX: 953-845-2646 INTEL IN FAX: (2) 784-8096
FAX: 61-2975-3375 FAX: 091-812-215067 Intel Japan K.K. *
Ryokuchi-Eki Bldg.
BRAZIL 2-4-1 T erauchi SINGAPORE
JAPAN
Intel Semiconductores do Brazil LTDA
Avenida Paulista, 1159-CJS 404/405
+~r:oon6~~~i~io~saka 560 Intel Singapore Technology, Ltd.
01311· Sao Paulo - S.P. Intel Japan K.K. FAX: 06-863-1084 101 Thomson Road #08-03/06
Tel: 55-11-287-5899 5-6 Tokodai, Tsukuba-shi United Square
TLX: 11-37-557-1508 Ibaraki, 300-26 Intel Japan K.K. Singapore 1130
FAX: 55-11-287-5119 Tet: 0298-47-8511 Shinmaru Bldg. Tel: (65) 250-7611
FAX: 0298-47-8450 1-5-1 Marunouchi FAX: (65) 250-9256
CHINA/HONG KONG Chiyoda-ku, Tokyo 100
Intel Japan K.K. * Tel: 03-3201-3621
Intel PRC Corporation Hachioji ON Bldg. FAX: 03-3201-6850 TAIWAN
15/F, Office 1, Citic Bldg. 4-7-14 Myojin-machi
Jian Guo Men Wai Street Hachloji-shi, Tokyo 192 Intel Japan K.K. Intel Technology Far East Ltd.
Beijing, PRC Tel: 0426-48-8770 Green Bldg. Taiwan Branch Office
Tel: (1) 500-4850 FAX: 0426-48-8775 1-16-20 Nishiki 8th Floor, No. 205
TLX: 22947 INTEL CN Naka-ku, Nagoya-shi Bank Tower Bldg.
FAX: (1) 500-2953 Intel Japan K. K * Aichi 450 Tung Hua N. Road
Bldg. Kumagaya Tel: 052-204-1261 Taipei
Intel Semiconductor Ltd, '* 2-69 Hon-cho Tel: 886-2-5144202
10fF East Tower FAX: 052-204-1285
Kumagaya-shi, Saitama 360 FAX: 886-2-717-2455
Bond Center Tel: 0485-24-6871
Queensway, Central FAX: 0485-24-7518
Hong Kong
Tel: (852) 844-4555
FAX: (852) 868-1989
INTERNATIONAL DISTRIBUTORS/REPRESENTATIVES
ARGENTINA Micronic Devices Okaya Koki NEW ZEALAND
No. 516 5th Floor 2-4-18 Sakae
Dafsys S.R.L. Swastik Chambers Naka-ku, Nagoya-shi 460 Email Electronics
Chacabuco, 90-6 Piso Sion, Trombay Road Tel: 052-204-2916 36 Olive Road
1069"Buenos Aires Chembur FAX: 052-204-2901 Penrose, Auckland
Tel: 54-1-34-7726 Tel: 011-64-9-591-155
Bombay 400 071
FAX: 54-1-34-1871 Ryoyo Electro Corp. FAX: 011-64-9-592-681
TLX: 9531 171447 MOEV
Konwa Bldg.
AUSTRALIA Micronic Devices 1-12-22 Tsukiji SAUDI ARABIA
25/6, 1st Floor Chuo-ku, Tokyo 104
Email Electronics Tel: 03-3546-5011
Bada Bazaar Marg ME Systems, Inc.
15-17 Hume Street FAX: 03-3546-5044
Old Rajinder Nagar 642 N. Pastoria Ave
Huntingdale, 3166
New Delhi 110060 Sunnyvale, CA 94086
Tel: 011-61-3-544-8244 KOREA
Tel: 011-91-11-5723509 U.SA
TLX: M30895 Tel: (408) 732-1710
FAX: 011-61-3-543-8179 011-91-11-589771 J-T ek Corporation
TLX: 031-63253 MONO IN FAX: (408) 732-3095
Dong Sung Bldg. 9/F
NSD-Australia TLX: 494-3405 ME SYS
158-24. Samsung-Dong, Kangnam-Ku
205 Middleborough Rd. Micronic Devices Seoul 135-090
Box Hill, Victoria 3126 6-3-346/12A owarakapuri Colony Tel: (822) 557-8039 SINGAPORE
Tel: 03 8900970 Hyderabad 500 482 FAX: (822) 557-8304
FAX: 03 8990819 Tel: 011-91-842-226748 Electronic Resources Pte, Ltd.
Samsung Electronics 17 Harvey Road
BRAZIL S&S Corporation Samsung Main Bldg. #03·01 Singapore 1336
1587 Kooser Road 150 Taepyung-Ro-2KA, Chung-Ku Tel: (65) 283-0888
Eleora Componentes Seoul 100-102 TWX: AS 56541 EAS
San Jose, CA 95118
Rua Geraldo Flausina Gomes, 76 C.P.O. Box 8780 FAX: (65) 289-5327
Tel: (408) 978-6216
7 Andar TLX: 820281 Tel: (822) 751-3680
04575 - Sao Paulo - S.P. TWX: KOASST K 27970
FAX: (408) 978-8635 SOUTH AFRICA
Tel: 55-11-534-9641 FAX: (822) 753-9065
TLX: 55-11-54593/54591
FAX: 55+11-534-9424 JAPAN MEXICO ~j~ct~~~~~~~i~;.nroNlw~~~~eyet St.)
Meyerspark. Pretoria, 0184
CHINA/HONG KONG Asahi Electronics Co. Ltd. SSB Electronics, Inc. Tel: 011-2712-803-7680
KMM Bldg. 2-14-1 Asano 675 Palomar Street, Bldg. 4, Suite A FAX: 011-2712-803-8294
Novel Precision Machinery Co., Ltd. Chula Vista, CA 92011
Room 726 Trade Square Kokurakita-ku
Kitakyushu-shi 802 Tel: (619) 585-3253
661 Cheung Sha Wan Road TLX: 287751 CBALL UA TAIWAN
Kowloon, Hong Kong Tel: 093-511-6471
FAX: 093-551-7861 FAX: (619) 585-8322 Micro Electronics Corporation
Tel: (852) 360-8999
TWX: 32032 NVTNL HX Dicopet SA 12th Floor, Section 3
FAX: (852) 725-3695 CTC Components Systems Co., Ltd. Tochtli 368 Fracc. Ind. San Antonio 285 Nanking East Road
4-8-1 Dobashi, Miyamae-ku Azcapotzalco Taipei, R.O.C.
INDIA Kawasaki-shi, Kanagawa 213 C.P. 02760-Mexico, D.F. Tel: (886) 2-7198419
Tel: 044-852-5121 Tel: 52-5-561-3211 FAX: (886) 2-7197916
Micronic Devices FAX: 044-877-4268 TLX: 177 3790 Dicome
Arun Complex FAX: 52-5-561-1279 Acer Sertek Inc.
No. 65 D.V.G. Road Dia Semicon Systems, Inc. 15th Floor, Section 2
Basavanagudi Flower Hill Shinmachi Higashl-kan PSI SA de C.V. Chien Kuo North Rd.
Bangalore 560 004 1-23-9 Shlnmachi, Setagaya-ku Fco. Villa esq. Ajusco sIn Taipei 18479 R.O.C.
Tel: 011-91-612-600-631 Tokyo 154 Cuernavaca - Morelos Tel: 886-2-501-0055
011-91-812-611-365 Tel: 03-3439-1600 Tel: 52-73-13-9412 TWX: 23756 SEATEK
TLX: 9538458332 MOBG FAX: 03-3439-1601 FAX: 52-73-17-5333 FAX: (886) 2-5012521
"'Field Application Location CG/SALE/C

Intel486 DX2 Microprocessor Data Book Jul92

Uploaded by

Copyright:

Available Formats

Intel486 DX2 Microprocessor Data Book Jul92

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Intel486 DX2 Microprocessor Data Book Jul92

Uploaded by

Copyright:

Available Formats

Intel486™ DX2 MICROPROCESSOR

- MS-DOS·, OS/2··, Windows

• -168-Pin Grid Array Package

Intel486™ DX2 Microprocessor Pipelined 32-Bit Microarchitecture

32-bit Data Bus Core

J-.m.'e<.o-.'.".,."ct.'o•• .-,D:iSPO::::I"_=mo,,,.,..::""::..+;3:22_1---,::P,::,",::O':::ChO::"_-I __ .. ________ .. ~IGNNE#

376'" i7504!> MAPNET'"

2.0 ARCHITECTURAL OVERViEW ...... 2-1 11.0 DIFFERENCES WITH THE

9.0 DEBUGGING SUPPORT ............. 9-1

2.3 Memory Organization ............. 2-19 4.3 Segmentation ..................... 4-2

2.5 Addressing Modes ................ 2-21 4.3.4 Descriptors ................... 4-3

2.5.1 Addressing Modes 4.4 Protection ........................ 4-12

4.6.2 Virtual 8086 Addressing 6.2.16 Boundary Scan Test

4.6.6 Entering and leaving Virtual 6.4 Interrupt and Non-Maskable

6.2.2 Address Bus 7.2 Bus Functional Description ......... 7-7

13.0 CONVERTING AN EXISTING 15.0 MECHANICAL DATA .............. 15-1

Data Sheet Marking Description

Pin Cross Reference by Pin Name

QUICK PIN REFERENCE

QUICK PIN REFERENCE (Continued)

QUICK PIN REFERENCE (Continued)

QUICK PIN REFERENCE (Continued)

QUICK PIN REFERENCE (Continued)

QUICK PIN REFERENCE (Continued)

Table 1.1. Output Pins Table 1.2. Input Pins

Table 1.3.lnput/Output Pins Table 1-4. Test Pins

2.0 ARCHITECTURAL OVERVIEW

Finally 8-bit operations can individually access the

[FlAGS RESERVED FOR INTEL

Figure 2.2. Flags Register

Table 2.1. Data Type Alignment Requirements

SF (Sign Flag, bit 7) NOTE:

31 24123 16115 al7 0

SYSTEM ADDRESS REGISTERS

indicates Intel reserved: Do not define; See Section 2.1.6

Figure 2.5. Control Register 0

Intel386 microprocessor software may load in- TS (Task Switched, bit 3)

PAGE DIRECTORY BASE REGISTER

Control Register 3 (CR3) 2.1.2.2 System Address Registers

2.1.3.1 Data Registers 2.1.3.3 Status Word

Figure 2.8. FPU Tag Word

r-,--.--------------------------- TOP OF STACK POINTER

ERROR SUMMARY STATUS

111 ~ Register 7 is Top 01 Stack

Figure 2.9. FPU Status Word

Table 2.5. FPU Condition Code Interpretation

Table 2.6. Condition Code Interpretation after FPREM and FPREM11nstructions

Table 2.8. Condition Code Defining Operand Class

Table 2.9. FPU Exceptions

The instruction and data pointers appear in one of NOTE:

32-BIT PROTECTED MODE FORMAT

RESERVED CONTROL WORD 0

RESERVED STATUS WORD 4

RESERVED TAG WORD 8

DATA OPERAND OFFSET 14

RESERVED OPERAND SELECTOR 18

32-BIT REAL-ADDRESS MODE FORMAT

RESERVED TAG WORD 8

RESERVED INSTRUCTION POINTER 15 .. 0 C

J-.m.'e<.o-.'.".,."ct.'o•• .-,D:iSPO::::I"_=mo,,,.,..::""::..+;3:22_1---,::P,::,",::O':::ChO::"_-I .. ______ .. ~IGNNE#