ST6X86P120-HS - STMicroelectronics

ST6x86

P90+, P100+, P120+, P133+, P150+, P166+ 80 to 150 MHz

3.52 Volt ST6x86 CPU

BLOCK DIAGRAM

May 1996

This is advanced information on a new product now in development or undergoing evaluation. Details are subject to change without notice.

PRELIMINARY DATA

The ST6x86microprocessor is a superscalar,

superpipelined CPU that provides sixth-generation

performance for x86 software. Since the ST6x86

CPU is fully compatible with the x86 instruction

set, it is capable of executing a wide range of

existing operating systems and applications,

including Windows 95, DOS, Unix, Windows NT,

Novell, OS/2, and Solaris. The ST6x86 CPU

achieves top performance levels through the use

of two optimized superpipelined integer units and

an on-chip floating point unit. The superpipelined

architecture reduces timing constraints and allows

the ST6x86 CPU to operate at core frequencies

starting at 80 MHz. In addition, theST6x86 CPU’s

integer and floating point units are optimized for

maximum instruction throughput by using

advanced architectural techniques, including reg-

ister renaming, out-of-order execution, data for-

warding, branch prediction, and speculative

execution. These design innovations eliminate

many data dependencies and resource conflicts

that provide optimum performance for Windows 95

software.

Sixth-Generation Superscalar Superpipelined

Architecture

- Dual 7-stage integer pipelines

- High performance on-chip FPU with 64-bit

interface

- Operating frequencies of 80 MHz and above

- 16-KByte write-back cache

X86 InstructionSet Compatible

- Runs Windows 95, Windows NT, DOS, UNIX,

Novell,OS/2, Solaris, and others

Optimum Performance for Windows95

- Intelligent instruction dispatch

- Out-of-order completion

- Register renaming

- Data forwarding

- Branch prediction

- Speculative execution

64-Bit Data Bus

- P54C socket compatible for quick time to

market.

ST6x86

GENERAL INDEX

iii

PageChapter

1.0 ARCHITECTURE OVERVIEW

1.1 Major Functional Blocks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ......................1-1

1.2 Integer Unit . . . . . . . . . ......................................................1-2

1.3 Cache Units . . . . . . . . . .....................................................1-12

1.4 Memory Management Unit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..............1-14

1.5 Floating Point Unit . . . . . . . ..................................................1-15

1.6 Bus Interface Unit .. . . .....................................................1-15

2.0 PROGRAMMING INTERFACE

2.1 Processor Initialization ......................................................2-1

2.2 Instruction Set Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ......................2-3

2.3 Register Sets . . . . . . . . ......................................................2-4

2.4 System Register Set. . . . . . ..................................................2-11

2.5 Address Space . . . . . . .....................................................2-40

2.6 Memory Addressing Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-41

2.7 Memory Caches . . . . . .....................................................2-52

2.8 Interrupts and Exceptions . ..................................................2-55

2.9 System Management Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . ..............2-63

2.10 Shutdown and Halt . . . .....................................................2-69

2.11 Protection . . . . . . . . . .. .....................................................2-71

2.12 Virtual 8086 Mode . . . . .....................................................2-74

2.13 Floating Point Unit Operations . .. . . . . . . . . . . . . .. . . . . . . . . . .....................2-75

3.0 ST6x86 BUS INTERFACE

3.1 Signal Description Table . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . ......................3-2

3.2 Signal Descriptions. . . . ......................................................3-6

3.3 Functional Timing .. .. .....................................................3-24

4.0 ELECTRICAL SPECIFICATIONS

4.1 Electrical Connections . . . . ...................................................4-1

4.2 Absolute Maximum Ratings ...................................................4-2

4.3 Recommended Operating Conditions . . . . . . . . . . . . . . . . . . . .. ......................4-3

4.4 DC Characteristics . . . . .. . . . . . . . . . . . . . . . . . . . . . ...............................4-4

4.5 AC Characteristics . . . . ......................................................4-5

5.0 MECHANICAL SPECIFICATIONS

5.1 296-Pin SPGA Package .. . . . . .. . . . . . . . . . . . . .. . . . . . . . . . ......................5-1

5.2 Thermal Resistances . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . ...................5-6

6.0 INSTRUCTION SET

6.1 Instruction Set Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...................6-1

6.2 General InstructionFields . . . . . .. . . . . . . . . . . . . . . . . . . . . . . . ......................6-2

6.3 CPUID Instruction..........................................................6-11

6.4 Instruction Set Tables. . .....................................................6-12

6.5 FPU Clock Counts . . . . .....................................................6-40

LIST OF FIGURES

PageFigure

Figure 1.1. Integer Unit . . . . . . . ......................................................1-2

Figure 1.2. Cache Unit Operations . ..................................................1-13

Figure 1.3. Paging Mechanism within the Memory Management Unit . . . . . . . . . . ..............1-14

Figure 2.1. Application Register Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...................2-5

Figure 2.2. General Purpose Registers . . . . . . . . . . . . . . . . . . . . . . . . . . ......................2-6

Figure 2.3. Segment Selector in Protected Mode . . . . . . . . . . . . . . . . . . ......................2-7

Figure 2.4. EFLAGS Register . . .. . ...................................................2-9

Figure 2.5. System Register Set .....................................................2-12

Figure 2.6. Control Registers . . .....................................................2-13

Figure 2.7. Descriptor Table Registers . . . . . . . . . . . . . . . . . . . . . . . . . . .....................2-15

Figure 2.8. Application and SystemSegment Descriptors . .. . . . . . . . . . .. . ..................2-16

Figure 2.9. Gate Descriptor . . . .....................................................2-19

Figure 2.10. TaskRegister . . . . .....................................................2-20

Figure 2.11. 32-Bit Task State Segment (TSS) Table . . . . . . . . . . . . . . . . . . ..................2-21

Figure 2.12. 16-Bit Task State Segment (TSS) Table . . . . . . . . . . . . . . . . . . ..................2-22

Figure 2.13. ST6x86 Configuration Control Register 0 (CCRO) . . . . . . . . . . . ..................2-25

Figure 2.14. ST6x86 Configuration Control Register 1 (CCR1) . . . . . . . . .....................2-26

Figure 2.15. ST6x86 Configuration Control Register 2 (CCR2) . . . . . . . . .....................2-27

Figure 2.16. ST6x86 Configuration Control Register 3 (CCR3) . . . . . . . . .....................2-28

Figure 2.17. ST6x86 Configuration Control Register 4 (CCR4) . . . . . . . . .....................2-29

Figure 2.18. ST6x86 Configuration Control Register 5 (CCR5) . . . . . . . . .....................2-30

Figure 2.19. Address Region Registers (ARR0 - ARR7) . . . . . . . . . . . . . .. . . . .. ..............2-31

Figure 2.20. Region Control Registers (RCR0-RCR7) ....................................2-34

Figure 2.21. Device Identification Register 0 (DIR0) . . . . . . . . . . . . . . . . .....................2-36

Figure 2.22. Device Identification Register 1 (DIR1) . . . . . . . . . . . . . . . . .....................2-36

Figure 2.23. Debug Registers . . .....................................................2-37

Figure 2.24. Memory and I/O Address Spaces . . . . . . . . .. . . . . . . . . . . .. . . . . . ..............2-40

Figure 2.25. Offset Address Calculation . .. . . . . . . . . . . . . . . . . . . . . . . . .....................2-42

Figure 2.26. Real Mode Address Calculation . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-43

Figure 2.27. Protected Mode Address Calculation . . . . . . . . . . . . . . . . . . .....................2-43

Figure 2.28. Selector Mechanism . . . . . . .. . . . . . .. . . . . . . . . . . . . . . . . . . . . . . . ..............2-44

Figure 2.29. Paging Mechanisms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .....................2-45

Figure 2.30. TraditionalPaging Mechanism ............................................2-46

Figure 2.31. Directory and Page Table Entry (DTE and PTE) Format . . . .....................2-46

Figure 2.32. TLBTest Registers . . . ..................................................2-48

Figure 2.33. Variable-Size Paging Mechanism . . . . . . . . . . . . . . . . . . . . .. . ..................2-51

Figure 2.34. Unified Cache . . . . .....................................................2-53

Figure 2.35. Cache Test Registers . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . .....................2-54

Figure 2.36. Error Code Format .....................................................2-62

Figure 2.37. System Management Memory Address Space . . . . . . . . . . . . . ..................2-63

Figure 2.38. SMI Execution Flow Diagram . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . ..............2-64

Figure 2.39. SMM Memory Space Header . . . . . . . . . . . . . . . . . . . . . . . . .. . ..................2-65

Figure 2.40. SMM and Suspend ModeState Diagram . . . . . . . . . . . . . . . .....................2-70

Figure 2.41. FPU Tag Word Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . .....................2-76

Figure 2.42. FPUStatus Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .....................2-76

Figure 2.43. FPUMode Control Register . . . . . . . . . . . . . . . . . . . . . . . . . .....................2-77

Figure 3.1. ST6x86 CPU Functional Signal Groupings . . . .. . . . . . . . . . . . . ...................3-1

Figure 3.2. RESET Timing . . . . . . . ..................................................3-24

Figure 3.3. ST6x86 CPU Bus State Diagram . . . . .. . . . . . .. . . . . . . . . . .....................3-26

LIST OF FIGURES

PageFigure

Figure 3.4. Non-Pipelined Single Transfer Read Cycles . . . . . . . . . . . . . . . . ..................3-29

Figure 3.5. Non-Pipelined Single Transfer Write Cycles . .. . . . . . . . . . . .....................3-30

Figure 3.6. Non-Pipelined Burst Read Cycles . . .. . . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . .. . . . . .3-32

Figure 3.7. Burst Cycle with Wait States . . . . . . . . . . . . . . . . .......... . . . . . . . . . . . . . . . . . . . .3-33

Figure 3.8. “1+4” Burst Read Cycle . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . ..................3-34

Figure 3.9. Non-Pipelined Burst Write Cycles . . . .. . . . . . . . . . . . . . . . . . . . ..................3-36

Figure 3.10. Pipelined Single Transfer Read Cycles .....................................3-37

Figure 3.11. PipelinedBurst Read Cycles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3-38

Figure 3.12. Read Cycle Followedby Pipelined Write Cycle . . . . . . . . . . .. . ..................3-39

Figure 3.13. Interrupt Acknowledge Cycles . . . . . . . . . . . . . . . . . . . . . . . . . . ..................3-40

Figure 3.14. SMIACT# Timing . .....................................................3-41

Figure 3.15. SMM I/O TrapTiming . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..................3-42

Figure 3.16. Cache Invalidation Using FLUSH# . . . . . . . . . . . . . . . . . . . . .. . ..................3-43

Figure 3.17 External Write Buffer Empty (EWBE#) Timing . . .......... . . . . . . .. . . . . . .. . . . . .3-44

Figure 3.18. Requesting Hold from an Idle Bus . . . . . . . . . . . . . . . . . . . . .. . ..................3-45

Figure 3.19. Requesting Hold During a Non-Pipelined Bus Cycle . . . . . . .....................3-46

Figure 3.20. Requesting Hold During a Pipelined Bus Cycle . . . . . . . . . . .. . ..................3-47

Figure 3.21. Back-Off Timing . . . . . ..................................................3-48

Figure 3.22. HOLD Inquiry Cycle that Hits on a Modified Line . . . .. . . . . .....................3-50

Figure 3.23. BOFF# Inquiry Cycle that Hits on a Modified Line . . . . . . . . .....................3-51

Figure 3.24. AHOLD Inquiry Cycle that Hits on a Modified Line . . . . . . . . .....................3-52

Figure 3.25. AHOLD Inquiry Cycle During a Line Fill . . . . . . . . . . . . . . . . .....................3-53

Figure 3.26. APCHK# Timing . . .....................................................3-54

Figure 3.27. BHOLD and DHOLD Timing . . . . . . . . . . . . . . . . . . . . . . . . . .....................3-55

Figure 3.28. CPU Upper Byte Read from 32-Bit Bus Using Scatter/Gather . . ..................3-56

Figure 3.29. CPU Upper Byte Write to 32-Bit Bus Using Scatter/Gather . . . . . . . . . . . . . . . .. . . . . .3-57

Figure 3.30. Bus Master Read from 64-Bit Memory to 32-Bit Bus . . . . . . . . . ..................3-58

Figure 3.31. Bus Master Write to 64-Bit Memory from 32-Bit Bus . . . . . . .. . . . . . ..............3-59

Figure 3.32. SUSP# Initiated Suspend Mode . . . . . . . . . . . .. . . . . . .. . . .....................3-60

Figure 3.33. HALT Initiated Suspend Mode . . . . .. . . . . . . . . . . . . . . . . . .....................3-61

Figure 3.34. Stopping CLK During Suspend Mode . . . . . . . . . . . . . . . . . .....................3-62

Figure 4.1. Drive Level and Measurement Points for Switching Characteristics . . ...............4-6

Figure 4.2. CLK Timing and Measurement Points . . . . . . . . . . . . . . . . . . ......................4-7

Figure 4.3. Output Valid Delay Timing . . . . . . . . . .. . . . . . . . . . . . . .. . . ......................4-8

Figure 4.4. Output Float Delay Timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...................4-9

Figure 4.5. Input Setup and Hold Timing . . . . . . . . . . . . . .. . . . . . . . . . . . . . ..................4-11

Figure 4.6. TCK Timing and Measurement Points . . . . . . . . . . . . . . . . . . .. . . . . . ..............4-12

Figure 4.7. JTAG Test Timings . . . . ..................................................4-13

Figure 4.8. Test Reset Timing . .....................................................4-13

Figure 5.1. 296-Pin SPGA PackagePin Assignments . . . . . . . . . . . . . . . . . . ...................5-1

Figure 5.2. 296-Pin SPGA Package ...................................................5-4

Figure 5.3 Typical HeatSink/Fan . . . . . . .. . . . . . . . . . . . . .. . . . . . . . . . ......................5-7

Figure 6.1. Instruction Set Format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ......................6-1

LIST OF TABLES

PageTable

Table 1.1. Register Renaming with WAR Dependency . . . . . . . . . . . . . . ......................1-5

Table 1.2. Register Renaming with WAW Dependency . . . . . . . . . . . . . . . . . ...................1-6

Table 1.3. Example of Operand Forwarding . . . . . . . . . . . . . . . . . . . . . . . ......................1-8

Table 1.4. Result Forwarding Example . . . . . . . . . . . . . . . . . . . . . . . . . . ......................1-9

Table 1.5. Example of Data Bypassing . . . . . . . .. . . . . . . . . . . . . . . . . . .. . . . . . ..............1-10

Table 2.1. Initialized Register Controls . . .. . . . . . .. . . . . . . . . . . . . . . . . . . . . . . . ...............2-2

Table 2.2. Segment RegisterSelection Rules . . . . . . . . . . . . ...............................2-8

Table 2.3. EFLAGS Bit Definitions . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . ..................2-10

Table 2.4. CRO Bit Definitions . .....................................................2-14

Table 2.5. Effects of Various Combinations of EM, TS, and MP Bits . . . . . . . ..................2-14

Table 2.6 Descriptor Table Registers and Descriptors . . . . . . . . . . . . . . .. . ..................2-15

Table 2.7. Segment Descriptor Bit Definitions . . . . . . . . . . .. . . . . . . . . . . . . ..................2-17

Table 2.8. TYPE Field Definitions with DT = 0 . . .. . . . . . .. . . . . . . . . . . .....................2-17

Table 2.9. TYPE Field Definitions with DT = 1 . . .. . . . . . .. . . . . . . . . . . .....................2-18

Table 2.10. Gate Descriptor Bit Definitions . . . . . . . . . . . .. . . . . . . . . . . .. . . . . . ..............2-19

Table 2.11. ST6x86 CPU Configuration Registers . . . . . . . . . . . . . . . . . . .....................2-24

Table 2.12. CCRO Bit Definitions . . ..................................................2-25

Table 2.13. CCR1 Bit Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . . . .2-26

Table 2.14. CCR2Bit Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..................2-27

Table 2.15. CCR3Bit Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..................2-28

Table 2.16. CCR4Bit Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..................2-29

Table 2.17. CCR5Bit Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..................2-30

Table 2.18. ARR0 - ARR7 Register Index Assignment . . . . . . . . . . . . . . . . . ..................2-32

Table 2.19. Bit Definitions for SIZE Field . . . . . . . . . . . . . . . . . . . . . . . . . .. . ..................2-32

Table 2.20. RCR0-RCR7 Bit Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . .....................2-34

Table 2.21. DiR0 Bit Definitions .....................................................2-36

Table 2.22. DIR 1 Bit Definitions . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . .....................2-36

Table 2.23. DR6and DR7 Debug Register Field Definitions . . . . . . . . . . .....................2-38

Table 2.24. Memory AddressingModules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-42

Table 2.25. Directory and Page Table Entry (DTE and PTE) Bit Definitions . ..................2-47

Table 2.26. TLB Test Register Bit Definitions . . . . .. . . . . . .. . . . . . . . . . .....................2-49

Table 2.27. TR6Attribute Bit Pairs . ..................................................2-50

Table 2.28. TR6 Command Bits .....................................................2-50

Table 2.29. Cache Test Register Bit Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . ..............2-54

Table 2.30. InterruptVector Assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-58

Table 2.31. Interrupt and Exception Priorities . . . . . . . . . . . . . . . . . . . . . .....................2-60

Table 2.32. Exception Changes in Real Mode . . . . . . . . . . . . . . . . . . . . . .....................2-61

Table 2.33. Error Code Bit Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..............2-62

Table 2.34. Requirements for Recognizing SMI# and SMINT . . . . . . . . . .....................2-64

Table 2.35. SMM Memory Space Header . . . . . . .. . . . . . . . . . . . . .. . . .....................2-66

Table 2.36. SMM InstructionSet . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . ..................2-67

Table 2.37. Descriptor Types Used for Control Transfer . . . . .......... . . . . . . . . . . . . . . . . . . . .2-73

Table 2.38. FPUStatus Register Bit Definitions . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-76

Table 2.39. FPUMode Control Register Bit Definitions . . . . . . . . .. . . . . .....................2-77

Table 3.1. ST6x86 CPU Signals Sorted by Signal Name . . . . . . . . . . . . . ......................3-2

Table 3.2. Pins Sampled During RESET . . . . . . . . . . . . . . . . ...............................3-6

Table 3.3. Signal States During RESET . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...................3-7

Table 3.4. Byte Enable Signal to Data Bus Byte Correlation . . . . . . . . . . ......................3-8

Table 3.5. Parity Bit to Data Byte Correlation . . . .. . . . . . .. . . . . . . . . . . .. . . . . . ...............3-9

vii

LIST OF TABLES

PageTable

Table 3.6. Bus Cycle Types . . . . . . ..................................................3-11

Table 3.7. Effects of WB/WT# on Cache Line State . . . . . . . . . . . . . . . . . .....................3-14

Table 3.8. Signal States During Bus Hold . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3-16

Table 3.9. Scatter/Gather Cycles . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . .....................3-19

Table 3.10. ByteEnable Map for Scatter/Gather Cycles . .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3-20

Table 3.11. Signal States During Suspend Mode . . . . . . . . . . . . . . . . . . . .. . . . . . ..............3-22

Table 3.12. ST6x86 CPU Bus States . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..................3-25

Table 3.13. Bus State Transitions . ..................................................3-27

Table 3.14. “1+4”Burst Address Sequence . . . . . . . . . . . . .. . . . . . . . . . .....................3-34

Table 3.15. Linear Burst Address Sequence . . . . . . . . . . . . . .. . . . . . . . . . . ..................3-35

Table 4.1. Pins Connected to Internal Pull-Up and Pull Down Resistors . . . . ...................4-1

Table 4.2. Absolute Maximum Ratings . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . ...................4-2

Table 4.3. Recommended OperatingConditions . . . . . . . . . . . . . . . . . . . ......................4-3

Table 4.4. DC Characteristics (at Recommended Operating Conditions) ......................4-4

Table 4.5. Drive Level and Measurement Points for Switching Characteristics . . . ...............4-6

Table 4.6. Clock Specifications. ......................................................4-7

Table 4.7. Output Valid Delays . ......................................................4-8

Table 4.8. Output Float Delays...............................................................4-9

Table 4.9. Input Setup Times . . .. . ..................................................4-10

Table 4.10. Input Hold Times . . .....................................................4-10

Table 4.11. JTAGAC Specifications . . . . . . . . . .. . . . . . . . . . . . . . . . . . .....................4-12

Table 5.1. 296-Pin SPGA Package Signal Names Sorted by Pin Number . . . . . . ...............5-2

Table 5.2. 296-Pin SPGA Package Pin Numbers Sorted by Signal Name . . . . . . ...............5-3

Table 5.3. 296-Pin SPGA Package Dimensions . . . . . . . . .. . . . . . . . . . ......................5-5

Table 5.4 Required θCA to Maintain 70°C Case Temperature . . .. . . . . ......................5-6

Table 5.5 Heatsink/Fan Dimensions . . . .. . . . . . . . . . . . . . . . . . . . . . . . ......................5-7

Table 6.1. Instruction Fields . . . . . . ...................................................6-2

Table 6.2. Instruction Prefix Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . ......................6-3

Table 6.3. w Field Encoding . . . ......................................................6-4

Table 6.4. d Field Encoding . . . . . . ...................................................6-4

Table 6.5. s Field Encoding . . . ......................................................6-5

Table 6.6. eee Field Encoding . ......................................................6-5

Table 6.7. modr/m Field Encoding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ......................6-6

Table 6.8. modr/m Field Encoding Dependent on w Field . . . . . . . . . . . . . . . ...................6-7

Table 6.9. reg Field. . . . . . . . . . ......................................................6-7

Table 6.10. sreg3Field Encoding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...................6-8

Table 6.11. sreg2Field Encoding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...................6-8

Table 6.12. ss Field Encoding . ......................................................6-9

Table 6.13. Index Field Encoding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ......................6-9

Table 6.14. mod base Field Encoding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..................6-10

Table 6.15. CPUID Data Returned WhenEAX = 0 . . . . . . . . . . . . . . . . . .. . . . . . ..............6-11

Table 6.16. CPUID Data Returned WhenEAX = 1 . . . . . . . . . . . . . . . . . .. . . . . . ..............6-11

Table 6.17. CPUClock Count Abbreviations . . . . .. . . . . . . . . . . . . . . . . . . . ..................6-13

Table 6.18. Flag Abbreviations . . . . ..................................................6-13

Table 6.19. Actionof Instruction on Flag . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6-13

Table 6.20. ST6x86 CPU Instruction Set Clock Count Summary . . . . . . . . . . . . . . . . . . . . . .. . . . . .6-14

Table 6.21 FPU Clock Count Table Abbreviations . . . . . . . . . . . . . . . . . .....................6-40

Table 6.22 6x86 FPUInstruction Set Summary . . . . . . . .. . . . . . . . . . . .....................6-41

ST6x86

1-1

1.0 ARCHITECTURE OVERVIEW

The ST6x86 CPU is a leader in the sixth genera-

tion of high performance, x86-compatible micro-

processors. Increased performance is

accomplished by the use of superscalar and

superpipelined design techniques.

The ST6x86 CPU is superscalar in that it contains

two separate pipelines that allow multiple instruc-

tions to be processed at the sametime. The use of

advanced processing technology and the

increased number of pipeline stages (super-

pipelining) allow the ST6x86 CPU to achieve

clocks rates of 80 MHz and above.

Through the use of unique architectural features,

the ST6x86 processor eliminates many data

dependencies and resource conflicts, resulting in

optimal performance for both 16-bit and 32-bit x86

software.

The ST6x86 CPU contains two caches: a

16-KByte dual-ported unified cache and a

256-byte instruction line cache. Since the unified

cache can store instructions and data in any ratio,

the unified cache offers a higher hit rate than sep-

arate data and instruction caches of equal size. An

increase in overall cache-to-integer unit bandwidth

is achieved by supplementing the unified cache

with a small, high-speed, fully associative instruc-

tion line cache. The inclusion of the instruction line

cache avoids excessive conflicts between code

and data accesses in the unified cache.

The on-chip FPU allows floating point instructions

to execute in parallel with integer instructions and

features a 64-bit data interface. The FPU incorpo-

rates a four-deep instruction queue and a

four-deep store queue to facilitate parallel execu-

tion.

The ST6x86 CPU operates froma 3.52 volt power

supply resulting in reasonable power consumption

at all frequencies. In addition, the ST6x86 CPU

incorporates a low power suspend mode, stop

clock capability, and system management mode

(SMM) for power sensitive applications.

1.1 Major Functional Blocks

The ST6x86 processor consists of five major func-

tional blocks, as shown in the overall block dia-

gram on the first page of this manual:

- Integer Unit

- Cache Unit

- Memory Management Unit

- Floating Point Unit

- Bus Interface Unit

Instructions are executed in the X and Y pipelines

within the Integer Unit and also in the Floating

Point Unit (FPU). The Cache Unit stores the most

recently used data and instructions to allow fast

access to the information by the Integer Unit and

FPU.

ST6x86

1-2

Physical addresses are calculated by the Memory

Management Unit and passed to the Cache Unit

and the Bus InterfaceUnit (BIU). TheBIU provides

the interface between the external system board

and the processor’s internal execution units.

1.2 IntegerUnit

The Integer Unit (Figure 1.1) provides parallel

instruction execution using two seven-stage inte-

ger pipelines. Each of the two pipelines, X and Y,

can process several instructions simultaneously.

Figure 1.1. Integer Unit

ST6x86

1-3

The Integer Unit consists of the following pipeline

stages:

- Instruction Fetch (IF)

- Instruction Decode 1 (ID1)

- Instruction Decode 2 (ID2)

- Address Calculation 1 (AC1)

- Address Calculation 2 (AC2)

- Execute (EX)

- Write-Back (WB)

The instruction decode and address calculation

functions are both divided into superpipelined

stages.

1.2.1 Pipeline Stages

The Instruction Fetch (IF) stage, shared by both

the X and Y pipelines, fetches 16 bytes of code

from the cache unit in a single clock cycle. Within

this section, the code stream is checked for any

branch instructions that could affect normal pro-

gram sequencing.

If an unconditional or conditional branch is

detected, branch prediction logic within the IF

stage generates a predicted target address for the

instruction. The IF stage then begins fetching

instructions at the predicted address.

The superpipelined Instruction Decode function

contains the ID1 and ID2 stages. ID1, shared by

both pipelines, evaluates the code stream pro-

vided by the IF stage and determines the number

of bytes in each instruction. Up to two instructions

per clock are delivered to the ID2 stages, one in

each pipeline.

The ID2 stages decode instructions and send the

decoded instructions to either the X or Y pipeline

for execution. The particular pipeline is chosen,

based on which instructions are already in each

pipeline and how fast they are expected to flow

throughthe remaining pipeline stages.

The Address Calculation function contains two

stages, AC1 and AC2. If the instruction refers to a

memory operand, the AC1 calculates a linear

memory address for the instruction.

The AC2 stage performs any required memory

management functions, cache accesses, and reg-

ister file accesses. If a floating point instruction is

detected by AC2, the instruction is sent to theFPU

for processing.

The Execute (EX) stage executes instructions

using theoperands provided by theaddress calcu-

lation stage.

The Write-Back (WB) stage is the last IU stage.

The WB stage stores execution results either to a

cache control unit.

1.2.2 Out-of-Order Processing

If an instruction executes faster than the previous

instruction in the other pipeline, the instructions

may complete out of order. All instructions are pro-

cessed in order, up to the EX stage. While in the

EX and WBstages, instructions may be completed

out of order.

If there is a data dependency between two instruc-

tions, the necessary hardware interlocks are

enforced to ensure correct program execution.

Even though instructions may complete out of

order, exceptions and writes resulting from the

instructions are always issued in program order.

ST6x86

1-4

1.2.3 Pipeline Selection

In most cases, instructions are processed in either

pipeline and without pairing constraints on the

instructions. However, certain instructions are pro-

cessed only in the X pipeline:

- Branch instructions

- Floating point instructions

- Exclusive instructions

Branch and floating point instructions may be

paired with a second instruction in the Y pipeline.

Exclusive Instructions cannot be paired with

instructions in the Y pipeline. These instructions

typically require multiple memory accesses.

Although exclusive instructions may not be paired,

hardware from both pipelines is used to accelerate

instruction completion. Listed below are the

ST6x86 CPU exclusive instruction types:

- Protected mode segment loads

- Special register accesses

(Control, Debug, and Test Registers)

- String instructions

- Multiply and divide

- I/O port accesses

- Push all (PUSHA) and pop all (POPA)

- Intersegment jumps, calls, and returns

1.2.4 Data Dependency Solutions

When two instructions that are executing in paral-

lel require access to the same data or register, one

of the following types of data dependencies may

occur:

- Read-After-Write(RAW)

- Write-After-Read (WAR)

- Write-After-Write (WAW)

Data dependencies typically force serialized exe-

cution of instructions. However, the ST6x86 CPU

implements three mechanisms that allow parallel

execution of instructions containing data depen-

dencies:

- Register Renaming

- Data Forwarding

- Data Bypassing

The following sections provide detailed examples

of these mechanisms.

1.2.4.1 Register Renaming

The ST6x86 CPU contains 32 physical general

purpose registers. Each of the 32 registers in the

the general purpose registers defined by the x86

architecture (EAX, EBX, ECX, EDX, ESI, EDI,

EBP, and ESP). For each register write operation

a new physical register is selected to allow previ-

ous data to be retained temporarily. Register

renaming effectively removes all WAW and WAR

dependencies. The programmer does not have to

consider register renaming; it is completely trans-

parent to both the operating system and applica-

tion software.

ST6x86

1-5

Example #1 - Register Renaming Eliminates

Write-After-Read (WAR) Dependency

A WAR dependency exists when the first in a pair

of instructions reads a logical register, and the

second instruction writes to the same logical regis-

ter. This type of dependency is illustrated by the

pair of instructions shown below:

X PIPE Y PIPE

(1)MOV BX, AX (2) ADD AX, CX

BX ←AX AX ←AX + CX

Note: In this and the following examples the origi-

nal instruction order is shown in parentheses.

In the absence of register renaming, the ADD

instruction in the Y pipe would have to bestalled to

allow the MOV instruction in the X pipe to read the

AX register.

The ST6x86 CPU, however,avoids theY pipe stall

(Table 1.1). As each instruction executes, the

results are placed in new physical registers to

avoid thepossibility ofoverwriting a logical register

value and to allow the two instructions to complete

in parallel (or out of order) rather than in

sequence.

Table 1.1. Register Renaming with WAR Dependency

Instruction

Physical Register Contents Action

Reg0 Reg1 Reg2 Reg3 Reg4 Pipe

(Initial) AX BX CX

MOV BX, AX AX CX BX X Reg3 ←Reg0

ADD AX, CX CX BX AX Y Reg4 ←Reg0 + Reg2

Note: The representation of the MOV and ADD instructions in the final column of Table 1.1

are completely independent.

ST6x86

1-6

Example #2 - Register Renaming Eliminates

Write-After-Write (WAW) Dependency

A WAW dependency occurs when two consecu-

tive instructions perform writes to the same logical

the pair of instructions shown below:

X PIPE Y PIPE

(1) ADD AX, BX (2) MOV AX, [mem]

←AX + BX AX ←[mem]

Without register renaming, the MOV instruction in

the Y pipe would have to be stalled to guarantee

that the ADD instruction in the X pipe would write

its results to the AX register first.

The ST6x86 CPU uses register renaming and

avoids the Y pipe stall. The contents of the AX and

BX registers are placed in physical registers

(Table 1.2). As each instruction executes, the

results are placed in new physical registers to

avoid thepossibility ofoverwriting a logical register

value and to allow the two instructions to complete

in parallel (or out of order) rather than in

sequence.

Table 1.2. Register Renaming with WAW Dependency

Instruction

Physical Register Contents Action

Reg0 Reg1 Reg2 Reg3 Pipe

(Initial) AX BX

ADD AX, BX BX AX X Reg2 ←Reg0 + Reg1

MOV AX, [mem] BX AX Y Reg3←[mem]

Note: All subsequent reads of the logical register AX will refer to Reg 3, the result of the MOV

instruction.

ST6x86

1-7

1.2.4.2 Data Forwarding

dependencies. The ST6x86 CPU uses two types

of data forwarding in conjunction with register

renaming to eliminate RAW dependencies:

- Operand Forwarding

- Result Forwarding

Operand forwarding takes placewhen the first in a

pair of instructions performs a move from register

or memory, and the data that is read by the first

instruction is required by the second instruction.

The ST6x86 CPU performsthe read operation and

makes the data read available to both instructions

simultaneously.

Result forwarding takes place when the first in a

pair of instructions performs an operation (such as

an ADD) and the result is required by the second

instruction to perform a move toa register or mem-

ory. The ST6x86 CPU performs the required oper-

ation and stores the results of the operation to the

destination of both instructions simultaneously.

ST6x86

1-8

Example #3 - Operand Forwarding Eliminates

Read-After-Write (RAW) Dependency

A RAW dependency occurs when the first in a

pair of instructions performs a write, and the sec-

ond instruction reads the same register. This type

of dependency is illustrated by the pair of

instructions shown below in the X andY pipelines:

X PIPE Y PIPE

(1)MOV AX, [mem] (2) ADD BX, AX

AX ←[mem] BX ←AX + BX

The ST6x86 CPU uses operand forwarding and

avoids a Y pipe stall (Table 1.3). Operand for-

warding allows simultaneous execution of both

instructions by first reading memory and then

making the results available to both pipelines in

parallel.

Operand forwarding can only occur if the first

instruction does not modify its source data. In

other words, theinstruction is a move type instruc-

tion (for example, MOV, POP, LEA). Operand for-

warding occurs for both register and memory

operands. The size of the first instruction destina-

tion and the second instruction source must

match.

Table 1.3. Example of Operand Forwarding

Instruction

Physical Register Contents Action

Reg0 Reg1 Reg2 Reg3 Pipe

(Initial) AX BX

MOV AX, [mem] BX AX X Reg2 ←[mem]

ADD BX, AX AX BX Y Reg3←[mem] + Reg1

ST6x86

1-9

Example #4 - Result Forwarding Eliminates

Read-After-Write (RAW) Dependency

In this example, a RAW dependency occurs

when the first in a pair of instructions performs a

write, and the second instruction reads the same

of instructions in the X and Y pipelines, as shown

below:

X PIPE Y PIPE

(1) ADD AX, BX (2) MOV [mem], AX

AX ←AX + BX [mem] ←AX

The ST6x86 CPU uses result forwarding and

avoids a Y pipe stall (Table 1.4). Instead of trans-

ferring the contents of the AX register to memory,

the result of the previous ADD instruction (Reg0 +

Reg1) is written directly to memory, thereby saving

a clockcycle.

The second instruction must be a move instruction

and the destination of the second instruction may

be either a register or memory.

Table 1.4. Result Forwarding Example

Instruction

Physical Register Contents Action

Reg0 Reg1 Reg2 Pipe

(Initial) AX BX

ADD AX, BX BX AX X Reg2 ←Reg0 +Reg1

MOV [mem], AX BX AX Y [mem]←Reg0 +Reg1

ST6x86

1-10

1.2.4.3 Data Bypassing

In addition to register renaming and data forward-

ing, the ST6x86 CPU implements a third data

dependency-resolution technique called data

bypassing. Data bypassing reduces the perfor-

mance penalty of those memory data RAWdepen-

dencies that cannot be eliminated by data

forwarding.

Data bypassing is implemented when the first in a

pair of instructions writes to memory and the sec-

ond instruction reads the same data from memory.

The ST6x86 CPU retains the data from the first

instruction and passes it to the second instruction,

thereby eliminating a memory read cycle. Data

bypassing only occurs for cacheable memory loca-

tions.

Example #1- Data Bypassing with

Read-After-Write (RAW) Dependency

In this example, a RAW dependency occurs when

the first in a pair of instructions performs a write to

memory and the second instruction reads the

same memory location. This dependency is illus-

trated by the pair of instructions in the X and Y

pipelines as shown below:

X PIPE Y PIPE

(1) ADD [mem], AX (2) SUB BX, [mem]

[mem] ←[mem] + AX BX ←BX - [mem]

The ST6x86 CPU uses data bypassing and stalls

the Y pipe for only one clock by eliminating the Y

pipe’s memory read cycle (Table 1.5). Instead of

reading memory in theY pipe, the result of the pre-

vious instruction ([mem] + Reg0) is used to sub-

tract from Reg1, thereby saving a memory access

cycle.

Table 1.5. Example of Data Bypassing

Instruction

Physical Register

Contents Action

Reg0 Reg1 Reg2 Pipe

(Initial) AX BX

ADD [mem], AX AX BX X [mem] ←[mem] + Reg0

SUB BX, [mem] AX BX Y Reg2 ←Reg1 - {[mem] + Reg0}

ST6x86

1-11

1.2.5 Branch Control

Branch instructions occur on average every four to

six instructions in x86-compatible programs. When

the normal sequential flow of a program changes

due to a branch instruction, the pipeline stages

may stall while waiting for the CPU to calculate,

retrieve, and decode the new instruction stream.

The ST6x86 CPU minimizes the performancedeg-

radation and latency of branch instructions through

the use of branch prediction and speculative exe-

cution.

1.2.5.1 Branch Prediction

The ST6x86 CPU uses a 256-entry, 4-way set

associative Branch Target Buffer (BTB) to store

branch target addresses and branch prediction

information. During the fetch stage, the instruction

stream is checked for the presence of branch

instructions. If an unconditional branch instruction

is encountered, the ST6x86 CPU accesses the

BTB to check for the branch instruction’s target

address. If the branch instruction’s target address

is foundin the BTB, the ST6x86 CPU begins fetch-

ing at the target address specified by the BTB.

In case of conditional branches, the BTB also pro-

vides history information to indicate whether the

branch is more likely to be taken or not taken. If

the conditional branch instruction is found in the

BTB, the ST6x86 CPU begins fetching instructions

at the predicted target address. If the conditional

branch misses in the BTB, the ST6x86 CPU pre-

dicts that the branch will not be taken, and instruc-

tion fetching continues with the next sequential

instruction. The decision to fetch the taken or not

taken target address is based on a four-state

branch prediction algorithm.

Once fetched, a conditional branch instruction is

first decoded and then dispatched tothe X pipeline

only. The conditional branch instruction proceeds

through the X pipeline and is then resolved in

either the EX stage or the WB stage. The condi-

tional branch is resolved in the EX stage, if the

instruction responsible for setting the condition

codes is completed prior to the execution of the

branch. If the instruction that sets the condition

codes is executed in parallel with the branch, the

conditional branch instruction is resolved in the

WB stage.

Correctly predicted branch instructions execute in

a single core clock. If resolution of a branch indi-

cates that a misprediction has occurred, the

ST6x86 CPU flushes the pipeline and starts fetch-

ing from the correct target address. The ST6x86

CPU prefetches both the predicted and the

non-predicted path for each conditional branch,

thereby eliminating the cache access cycle on a

misprediction. If the branch is resolved in the EX

stage, the resulting misprediction latency is four

cycles. If the branch is resolved in the WB stage,

the latency is five cycles.

Since the target address of return (RET) instruc-

tions is dynamic rather than static, the ST6x86

CPU caches target addresses for RET instructions

in an eight-entry return stack rather than in the

BTB. The return address is pushed on the return

stack during a CALL instructionand poppedduring

the corresponding RET instruction.

ST6x86

1-12

1.2.5.2 Speculative Execution

The ST6x86 CPU is capable of speculative execu-

tion following a floating point instruction or pre-

dicted branch. Speculative execution allows the

pipelines to continuously execute instructions fol-

lowing a branch without stalling the pipelines wait-

ing for branch resolution. The same mechanism is

used to execute floating point instructions (see

Section 1.5) in parallel with integer instructions.

The ST6x86 CPU is capable of up to four levels of

speculation (i.e., combinations of four conditional

branches and floating point operations). After

generating the fetch address using branch predic-

tion, the CPU checkpoints the machine state (reg-

isters, flags, and processor environment),

increments the speculation level counter, and

begins operating on the predicted instruction

stream.

Once the branch instruction is resolved, the CPU

decreases the speculation level. For a correctly

predicted branch, the status of the checkpointed

resources is cleared. For a branch misprediction,

the ST6x86 processor generates the correct fetch

address and uses the checkpointed values to

restore the machine state in a single clock.

In order to maintain compatibility, writes that result

from speculatively executed instructions are not

permitted to update the cache or external memory

until the appropriate branch is resolved. Specula-

tive execution continues until one of the following

conditions occurs:

1) A branch or floating point operation is decoded

and the speculation level is already at four.

2) An exception or a fault occurs.

3) The write buffers are full.

4) An attempt is made to modify a non-check-

pointed resource (i.e., segment registers, system

flags).

1.3 Cache Units

The ST6x86 CPU employs two caches, theUnified

Cache and theInstruction Line Cache

(Figure 1.2).

1.3.1 Unified Cache

The 16-KByte unified write-back cache functions

as the primary data cache and as the secondary

instruction cache. Configured as a four-way

set-associative cache, the cache stores up to

16 KBytes of code and data in 512 lines. The

cache is dual-ported and allows any two of the fol-

lowing operations to occur in parallel:

- Code fetch

- Data read (X pipe,Y pipeline or FPU)

- Data write (X pipe, Y pipeline or FPU)

The unified cache uses a pseudo-LRU replace-

ment algorithm and can be configured to allocate

new lines on read misses only or on read and write

misses.More information concerning the unified

cache can be found in 2.7.1 (Page 52).

ST6x86

1-13

FPU

1739503

Data Bus

Instruction Data

Set 0

Set 1

Set 2

Set 3

Integer

Unit

Bus

Interface

Unit

Pipe Y

Pipe

Cache

Tags

Instruction

Address Data

Bypass

Aligner

256-Byte Fully Associative, 8 Lines

Memory Management Unit

(TLB)

Modified X, Y

Physical Addresses

Linear

Address Line Cache

Miss Address

= Dual Bus

= Single Bus

Instruction

X, Y

Unified Cache

16-KByte, 4-Way Set Associative, 128 Lines/Set

Instruction Line Cache

1.3.2 Instruction Line Cache

The fully associative 256-byte instruction line

cache serves as the primary instruction cache.

The instruction line cache is filled from the unified

cache throughthe data bus. Fetches fromtheinte-

ger unit that hit in the instruction line cache do not

access the unified cache. If an instruction line

cache miss occurs, the instruction line data from

the unified cache is transferred to the instruction

line cache and the integer unit, simultaneously.

The instruction line cache uses a pseudo-LRU

replacement algorithm. To ensure proper opera-

tion in the case of self-modifying code, any writes

to the unified cache are checked against the con-

tents of the instruction line cache. If a hit occurs in

the instruction line cache, the appropriate line is

invalidated.

Figure 1.2. Cache Unit Operations

ST6x86

1-14

1.4 Memory Management Unit

The Memory Management Unit (MMU), shown in

Figure 1.3, translates the linear address supplied

by theIU into a physical address to be used by the

unified cache and the bus interface. Memory man-

agement procedures are x86 compatible,adhering

tostandard paging mechanisms.

The ST6x86 MMU includes two paging mecha-

nisms (Figure 1.3), a traditional paging mecha-

nism, and a ST6x86 variable-size paging

mechanism.

1.4.1 Variable-Size Paging Mechanism

The ST6x86 variable-size paging mechanism

allows software to map pages between 4 KBytes

and 4 GBytes in size. The large contiguous memo-

ries provided by this mechanism help avoid TLB

(Translation Lookaside Buffer) thrashing [see Sec-

tion 2.6.4] associated with some operating sys-

tems and applications. For example, use of a

single large page instead of a series of small

4-KByte pages can greatly improve performance

in an application using a large video memory

buffer.

Figure 1.3. Paging Mechanism within theMemory Management Unit

CR3

1728901

Physical PageDTE PTE

Control Register

127

Variable-Size Paging Mechanism

Control

Directory Table Page Table Page Frame

DTE Cache

Victim TLB

Linear

Address

Main TLB

Traditional Paging Mechanism

ST6x86

1-15

1.4.2 Traditional Paging Mechanism

The traditional paging mechanism has been

enhanced on the ST6x86 CPU with the addition of

the Directory Table Entry (DTE) cache and the

Victim TLB. The main TLB (Translation Lookaside

Buffer) is a direct-mapped 128-entry cache for

page table entries.

The four-entry fully associative DTE cache stores

the most recent DTE accesses. If a Page Table

Entry (PTE) miss occurs followed by a DTE hit,

only a single memory access to the PTE table is

required.

The Victim TLB stores PTEs which have been dis-

placed from the main TLB due to a TLB miss. If a

PTE access occurs while the PTE is stored in the

victim TLB, the PTE in the victim TLB is swapped

with a PTE in the main TLB. This has the effect of

selectively increasing TLB associativity. The

ST6x86 CPU updates the eight-entry fully associa-

tive victim TLB on an oldest entry replacement

basis.

1.5 Floating Point Unit

The ST6x86 Floating Point Unit (FPU) interfaces

to the integer unit and the cache unit through a

64-bit bus. The ST6x86 FPU is x87 instruction set

compatibleand adheres tothe IEEE-754standard.

Since most applications contain FPU instructions

mixed with integer instructions, the ST6x86 FPU

achieves high performance by completing integer

and FPU operations in parallel.

FPU Parallel Execution

The ST6x86 CPU executes integer instructions in

parallel with FPU instructions. Integer instructions

may complete out of order with respect to the FPU

instructions. The ST6x86 CPU maintainsx86 com-

patibility by signaling exceptions and issuing write

cycles in program order.

As previously discussed, FPU instructions are

always dispatched to the integer unit’s X pipeline.

The address calculation stage of the X pipeline

checks for memory management exceptions and

accesses memory operands used by the FPU. If

no exceptions are detected, the ST6x86 CPU

checkpoints thestate of the CPU and, during AC2,

dispatches the floatingpoint instruction to the FPU

instruction queue. The ST6x86 CPU can then

complete any subsequent integer instructions

speculatively and out of order relative to the FPU

instruction and relative to any potential FPU

exceptions which may occur.

As additional FPU instructions enter the pipeline,

the ST6x86 CPU dispatches up to four FPU

instructions to the FPU instruction queue. The

ST6x86 CPU continues executing speculatively

and out of order, relative to the FPU queue, until

the ST6x86 CPU encounters one of the conditions

that causes speculative execution to halt. As the

FPU completes instructions, the speculation level

decreases and the checkpointed resources are

available for reuse in subsequent operations. The

ST6x86 FPU also uses a set of four write buffers

to prevent stalls due to speculative writes.

1.6 Bus Interface Unit

The Bus Interface Unit (BIU) provides the signals

and timing required by external circuitry. The sig-

nal descriptions and bus interface timing informa-

tion is providedin Chapters 3 and 4 of this manual.

ST6x86

2-1

2.0 PROGRAMMING INTERFACE

In this chapter, the internal operations of the

ST6x86 CPU are described mainly from an appli-

cation programmer’s point of view. Included in this

chapter are descriptions of processor initialization,

the register set, memory addressing, various types

of interrupts and the shutdown and halt process.

An overview of real, virtual 8086, and protected

operating modes is also included in this chapter.

The FPU operations are described separately at

the end of the chapter.

This manual does not—and is not intended to—

describe the ST6x86 microprocessor or its opera-

tions at the circuit level.

2.1 Processor Initialization

The ST6x86 CPU is initialized when the RESET

signal is asserted. The processor is placed in real

mode and the registers listed in Table 2.1 are set

to their initialized values. RESET invalidates and

disables the cache and turns off paging. When

RESET is asserted, the ST6x86 CPU terminates

all local bus activity and all internal execution.

During the entire time that RESET is asserted, the

internal pipelines are flushed and no instruction

execution or bus activity occurs.

Approximately 150 to 250 external clock cycles

after RESET is negated, the processor begins

executing instructions at the top of physical mem-

ory (address location FFFF FFF0h). Typically, an

intersegment JUMP is placed at FFFF FFF0h. This

instruction will force the processor to begin execu-

tionin the lowest 1 MByteof address space.

Note: The actual time depends on the clock scal-

ing in use. Also an additional 220 clock cycles are

needed if self-test is requested

ST6x86

2-2

Table 2.1. Initialized Register Controls

EAX Accumulator xxxx xxxxh 0000 0000h indicates self-test passed.

EBX Base xxxx xxxxh

ECX Count xxxx xxxxh

EDX Data 05 + Device ID Device ID = 31h or 33h (2X clock)

Device ID = 35h or 37h (3X clock)

EBP Base Pointer xxxx xxxxh

ESI Source Index xxxx xxxxh

EDI Destination Index xxxx xxxxh

ESP Stack Pointer xxxx xxxxh

EFLAGS Flag Word 0000 0002h

EIP Instruction Pointer 0000 FFF0h

ES Extra Segment 0000h Base address set to 0000 0000h.

Limit set to FFFFh.

CS Code Segment F000h Base address set to FFFF 0000h.

Limit set to FFFFh.

SS Stack Segment 0000h Base address set to 0000 0000h.

Limit set to FFFFh.

DS Data Segment 0000h Base address set to 0000 0000h.

Limit set to FFFFh.

FS Extra Segment 0000h Base address set to 0000 0000h.

Limit set to FFFFh.

GS Extra Segment 0000h Base address set to 0000 0000h.

Limit set to FFFFh.

IDTR Interrupt Descriptor Table Reg-

ister Base = 0, Limit = 3FFh

GDTR Global Descriptor Table

LDTR Local Descriptor Table

TR TaskRegister xxxxh

CR0 Machine Status Word 6000 0010h

CR2 Control Register 2 xxxx xxxxh

CR3 Control Register 3 xxxx xxxxh

CCR (0-5) Configuration Control (0-5) 00h

ARR (0-7) Address Region Registers

(0-7) 00h

RCR (0-7) Region Control Registers (0-7) 00h

DIR0 Device Identification 0 31h or 33h (2X clock)

35h or 37h (3X clock)

DIR1 Device Identification 1 Step ID + Revision ID

DR7 Debug Register 7 0000 0400h

Note: x = Undefined value

ST6x86

2-3

2.2 Instruction Set Overview

The ST6x86 CPU instruction set performs nine

types of general operations:

- Arithmetic

- Bit Manipulation

- Control Transfer

- Data Transfer

- Floating Point

- High-Level Language Support

- Operating System Support

- Shift/Rotate

- String Manipulation

All ST6x86 CPU instructions operate on as few as

zero operandsand as many as three operands. An

NOP instruction (no operation) is an example of a

zero operand instruction. Two operand instruc-

tions allow the specification of an explicit source

and destination pair as part of the instruction.

These two operand instructions can be divided

into eight groups according to operand types:

- Register to Register

- Register to Memory

- Memory to Register

- Memory to Memory

- Register to I/O

- I/O to Register

- Immediate Data to Register

- Immediate Data to Memory

An operand can be held in the instruction itself (as

in the caseof an immediate operand),in one of the

processor’s registers or I/O ports, or in memory.

An immediate operand is prefetched as part of the

opcode for the instruction.

Operand lengths of 8, 16, or 32 bits are supported

as well as 64-or 80-bit associated with floating

point instructions. Operand lengths of 8 or 32 bits

are generallyused when executingcode written for

386- or 486-class (32-bit code) processors. Oper-

and lengths of 8 or 16 bits are generally used

when executing existing 8086 or 80286 code

(16-bit code).The default length of an operand can

be overridden by placing one or more instruction

prefixes in front of the opcode. For example, by

using prefixes, a 32-bit operand can be used with

16-bit code, or a 16-bit operand can be used with

32-bit code.

Chapter 6 of this manual lists each instruction in

the ST6x86 CPU instruction set along with the

associated opcodes, execution clock counts, and

effects on the FLAGS register.

2.2.1 Lock Prefix

The LOCK prefix may be placed before certain

instructions that read, modify, then write back to

memory. The prefix asserts the LOCK# signal to

indicate to the external hardware that the CPU is

in the process of running multiple indivisible mem-

ory accesses. The LOCK prefix can be used with

the following instructions:

- Bit Test Instructions (BTS, BTR, BTC)

- Exchange Instructions (XADD, XCHG,

CMPXCHG)

- One-operand Arithmetic and Logical

Instructions (DEC, INC, NEG, NOT)

- Two-operand Arithmetic and Logical

Instructions (ADC, ADD, AND, OR, SBB,

SUB, XOR).

An invalid opcode exception is generated if the

LOCK prefix is used with any other instruction, or

with the above instructions when no write opera-

tion to memory occurs (i.e., the destination is a

allow weak-locking for all of memory or on a

regional basis. Refer to the descriptions of the

NO-LOCK bit (within CCR1) and the WL bit (within

RCRx) later in this chapter.

ST6x86

2-4

2.3 Register Sets

From the programmer’s point of view there are 58

accessible registers in the ST6x86 CPU. These

registers are grouped into two sets. The applica-

tion register set contains the registers frequently

used by application programmers, and the system

reserved for use by operating system program-

mers.

The application register set is made up of general

purpose registers, segment registers, a flag regis-

ter, and an instruction pointer register.

The system register set is made up of the remain-

ing registers which include control registers, sys-

tem address registers, debug registers,

configuration registers, and test registers.

Each of the registers is discussed in detail in the

following sections.

2.3.1 Application Register Set

The application register set, Figure 2.1 consists of

the registers most often used by the applications

programmer. Theseregisters are generally acces-

sible and are not protected from read or write

access.

The General Purpose Register contents are fre-

quently modified by assembly language instruc-

tions and typically contain arithmetic and logical

instruction operands.

Segment Registers in realmode contain the base

address for each segment. In protected mode the

segment registerscontain segment selectors. The

segment selectors provide indexing for tables

(located in memory) that contain the base address

and limit for each segment, as well as access con-

trol information.

The Flag Register contains control bits used to

reflect the status of previously executed instruc-

tions. This register also contains control bits that

affect theoperation of some instructions.

The Instruction Pointer registerpoints to the next

instruction that the processor will execute. This

cessor as execution progresses.

ST6x86

2-5

Figure 2.1. Application Register Set

2.3.2 General Purpose Registers

The general purpose registers are divided into four

data registers, two pointer registers, and two index

registersasshownin(Figure 2.2).

The Data Registers are used by the applications

programmer to manipulate data structures and to

hold the results of logical and arithmetic opera-

tions. Different portions of the general data regis-

ters can be addressed by using different names.

An “E” prefix identifies the complete 32-bit register.

An “X” suffix without the “E” prefix identifies the

lower 16 bits of the register.

The lower two bytes of a data register can be

addressed with an “H” suffix (identifies the upper

byte) or an “L” suffix (identifies the lower byte). The

_L and _H portions of a data registers act as inde-

pendent registers. For example, if the AH register

is written to by an instruction, the AL register bits

remain unchanged.

ST6x86

2-6

Figure 2.2. General Purpose Registers

The Pointer and Index Registers arelisted below.

SI or ESI Source Index

DI or EDI Destination Index

SP or ESP Stack Pointer

BP or EBP Base Pointer

These registers can be addressed as 16- or 32-bit

registers, with the “E” prefix indicating 32 bits. The

pointer and index registers can be used as general

purpose registers, however, some instructions use

a fixed assignment of these registers. For exam-

ple, repeated string operations always use ESI as

the source pointer, EDI as the destination pointer,

and ECX as the counter. The instructions using

fixed registers include multiply and divide, I/O

access, string operations, translate, loop, variable

shift and rotate, and stack operations.

The ST6x86 CPU processor implements a stack

using the ESP register. This stack is accessed

during the PUSH and POP instructions, procedure

calls, procedure returns, interrupts, exceptions,

and interrupt/exception returns.

The microprocessor automatically adjusts the

value of the ESP during operation of these instruc-

tions.The EBP register may be used to reference

data passed on the stack during procedure calls.

Local data may also be placed on the stack and

referenced relative to BP. This register provides a

mechanism to access stack data in high-level lan-

guages.

EAX (Accumulator)

EBX (Base)

ECX (Count)

EDX (Data)

ESI (Source Index)

EDI (Destination Index)

EBP (Base Pointer)

ESP (Stack Pointer)

31 16 15 8 7 0

1746400

ST6x86

2-7

2.3.3 Segment Registers and Selectors

Segmentation provides a means of defining data

structures inside the memory space of the micro-

processor. There are three basic types of seg-

ments: code, data, and stack. Segments are used

automatically by the processor to determine the

location in memory of code, data, and stack refer-

ences.

There are six 16-bit segment registers:

CS Code Segment

DS Data Segment

ES Extra Segment

SS Stack Segment

FS Additional Data Segment

GS Additional Data Segment.

In real and virtual 8086 operating modes, a seg-

ment register holds a 16-bit segment base. The

16-bit segment is multiplied by 16 and a 16-bit or

32-bit offset is then added to it to create a linear

address. The offset size is dependent on the cur-

rent addresssize. In realmode and in virtual 8086

mode with paging disabled, the linear address is

also the physical address. In virtual 8086 mode

with paging enabled, the linear address is trans-

lated to the physical address using the current

page tables. Paging is described in Section 2.6.4

(Page 45).

In protected mode a segment register holds a

Segment Selector containing a 13-bit index, a

Table Indicator (TI) bit, and a two-bit Requested

Privilege Level (RPL) field as shown in Figure 2.3.

The Index points into a descriptor table in memory

and selects one of 8192 (213) segment descriptors

contained in the descriptor table.

A segment descriptor is an eight-byte value used

to describe a memory segment by defining the

segment base, the segment limit, and access con-

trol information. To address data within a seg-

ment, a 16-bit or 32-bit offset is added to the

segment’s base address. Once a segment selec-

tor has been loaded into a segment register, an

instruction needs only to specify the segment reg-

ister and the offset.

Figure 2.3. Segment Selector in Protected Mode

INDEX RPL

1741701

15 3 2 1 0

Descriptor

Descriptor Table

Segment

Main Memory

Segment Selector

Base

Limit

8191

ST6x86

2-8

The Table Indicator (TI) bit of the selector defines

which descriptor table the index points into. If

TI=0, the index references the Global Descriptor

Table (GDT). If TI=1, the index references the

Local Descriptor Table (LDT). The GDT and LDT

are described in more detail in Section Table 2.6.

Protected mode addressing is discussed further in

Sections 2.6.2 and 2.6.3.

The Requested Privilege Level (RPL) field in a

segment selector is used to determine the Effec-

tivePrivilege Level of an instruction(where RPL=0

indicates the most privileged level, and RPL=3

indicates the least privileged level).

If the level requested by RPL is less than the Cur-

rent Program Level (CPL), the RPL level is

accepted and the Effective Privilege Level is

changed to the RPL value. If the level requested

by RPL is greaterthan CPL, the CPL overrides the

requested RPL and Effective Privilege Level

remains unchanged.

When a segment register is loaded with a segment

selector, the segment base, segment limit and

access rights are loaded from the descriptor table

entry into a user-invisible or hidden portion of the

segment register (i.e., cached on-chip). The CPU

does not access the descriptor table entry again

until another segment register load occurs. If the

descriptor tables are modified in memory, the seg-

ment registers must be reloaded with the new

selector values by the software.

The processor automatically selects an implied

(default) segment register for memory references.

Table 2.2 describesthe selection rules. In general,

data references use the selector contained in the

DS register, stack references use the SS register

and instruction fetches use the CS register. While

some of these selections may be overridden,

instruction fetches, stack operations, and the desti-

nation write of string operations cannot be overrid-

den. Specialsegment overrideinstruction prefixes

allow the use of alternate segment registers

including the use of the ES, FS, and GS segment

registers.

Table 2.2. Segment Register Selection Rules

TYPE OF MEMORY REFERENCE IMPLIED (DEFAULT)

SEGMENT SEGMENT OVERRIDE PRE-

FIX

Code Fetch CS None

Destination of PUSH, PUSHF, INT,CALL,

PUSHA instructions SS None

Source of POP,POPA, POPF,IRET,

RET instructions SS None

Destination of STOS, MOVS, REP STOS,

REP MOVS instructions ES None

Other data references with effective

address using base registers of:

EAX, EBX, ECX,

EDX, ESI, EDI

EBP, ESP

CS,ES,FS, GS,SS

CS,DS, ES,FS, GS

ST6x86

2-9

2.3.4 Instruction Pointer Register

The Instruction Pointer (EIP) register contains

theoffset into the current code segment of the next

instruction to be executed. The register is normally

incremented with each instruction execution

unless implicitly modified through an interrupt,

exception or an instruction that changes the

sequential execution flow (e.g., JMP, CALL).

2.3.5 Flags Register

The Flags Register, EFLAGS, contains status

information and controls certain operations on the

ST6x86 CPU microprocessor. Thelower 16bits of this

used when executing 8086 or 80286 code. The flag

bits are shown in Figure 2.4 and defined in Table

2.3.

Figure 2.4. EFLAGS Register

Flags

Alignment Check

1701105

Virtual 8086 Mode

Resume Flag

NestedTaskFlag

I/O Privilege Level

Overflow

DirectionFlag

Interrupt Enable

TrapFlag

Sign Flag

ZeroFlag

Auxiliary Carry

ParityFlag

CarryFlag

0000000000 00

0or 1IndicatesReserved

A= ArithmeticFlag, D =DebugFlag, S =System Flag, C= ControlFlag

9876543 120

ZSTIDOION

RVA

9111111111

87654 3210

CMF T PL FFFFFF F F F

Identification S

D00

ST6x86

2-10

Table 2.3. EFLAGS Bit Definitions

BIT

POSITION NAME FUNCTION

0CF

Carry Flag: Set when a carry out of (addition) or borrow into (subtraction) the most

significant bit of the result occurs; cleared otherwise.

2PF

Parity Flag: Set when the low-order 8 bits of the result contain an even number of ones;

cleared otherwise.

4AF

Auxiliary Carry Flag: Set when a carry out of (addition) or borrow into (subtraction) bit posi-

tion 3 of the result occurs; cleared otherwise.

6 ZF Zero Flag: Set if result is zero; cleared otherwise.

7 SF Sign Flag: Set equal to high-order bit of result (0 indicates positive, 1 indicates negative).

8TF

Trap Enable Flag: Once set, a single-step interrupt occurs after the next instruction

completes execution. TF is cleared by the single-step interrupt.

9IF

Interrupt Enable Flag: When set, maskable interrupts (INTR input pin) are acknowledged

and serviced by the CPU.

10 DF Direction Flag: If DF=0, string instructions auto-

crement (default) the appropriate index

registers (ESI and/or EDI). If DF=1, string instructions auto-

crement the appropriate index

registers.

11 OF

Overflow Flag: Set if the operation resulted in a carry or borrow into the sign bit of the result

but did not result in a carry or borrow out of the high-order bit. Also set if the

operation resulted in a carry or borrow out of the high-order bit but did not result in a carry or

borrow into the sign bit of the result.

12,13 IOPL

I/O Privilege Level: While executing in protected mode, IOPLindicates the maximum

current privilege level (CPL) permitted to execute I/O instructions without generating an

exception 13 fault or consulting the I/O permission bit map. IOPL also indicates the

maximum CPL allowing alteration of the IF bit when new values are popped into the EFLAGS

14 NT Nested Task: While executing in protected mode, NT indicates that the execution of the cur-

rent task is nested within another task.

16 RF Resume Flag: Used in conjunction with debug register breakpoints. RF is checked at

instruction boundaries before breakpoint exception processing. If set, any debug fault is

ignored on the next instruction.

17 VM

Virtual 8086 Mode: If set while in protected mode, the microprocessor switches to virtual

8086 operation handling segment loads as the 8086 does, but generating exception 13 faults

on privileged opcodes. The VM bit can be set by the IRET instruction (if current privilege

level=0) or by task switches at any privilege level.

18 AC Alignment Check Enable: In conjunction with the AM flag in CR0, the AC flag determines

whether or not misaligned accesses to memory cause a fault. If AC is set, alignment faults

are enabled.

21 ID Identification Bit: The ability to set and clear this bit indicates that the CPUID instruction is

supported. The ID can be modified only if the CPUID bit in CCR4 is set.

ST6x86

2-11

2.4 System Register Set

The system register set, shown in Figure 2.5, con-

sists of registers not generally used by application

programmers. These registers are typically

employed by system level programmers who gen-

erate operating systems and memory manage-

ment programs.

The Control Registers control certain aspects of

the ST6x86 microprocessor such as paging,

coprocessor functions, and segment protection.

When a paging exception occurs while paging is

enabled, some control registers retain the linear

addressof the access that causedthe exception.

The Descriptor Table Registers and the Task

address or memory management registers.

These registers consist of two 48-bit and two

16-bit registers. These registers specify the loca-

tion of the data structures that control the segmen-

tation used by the ST6x86 microprocessor.

Segmentation is one available method of memory

management.

The Configuration Registers are used to config-

ure the ST6x86 CPU on-chip cache operation,

power management features and System Man-

agement Mode. The configuration registers also

provide information on the CPU device type and

revision.

The Debug Registers provide debugging facilities

to enable the use of data access breakpoints and

code execution breakpoints.

The Test Registers provide a mechanism to test

the contents of both the on-chip 16 KByte cache

and the Translation Lookaside Buffer (TLB). In the

following sections, the system register set is

described in greater detail.

ST6x86

2-12

Figure 2.5. System Register Set

Control

Test

DR0

DR1

DR2

DR3

DR6

DR7

GDTR

IDTR

LDTR

CR0

CR2

CR3

1531 16 0

1516 0

Page Fault Linear Address Register

Page Directory Base Register

31 0

Linear Breakpoint Address 0

Breakpoint Status

Breakpoint Control

Cache Test

CCR1

CCR2

31 0

TLB Test Control

TLB Test Status

Cache Test

Linear Breakpoint Address 1

Linear Breakpoint Address 2

Linear Breakpoint Address 3

7CCR0

CCR1

Base

Base Limit

Limit

Selector

Selector Task Register

Descriptor

1728200

Registers

Table

Registers

CCR2

Address Region Register 0

CCR3

ARR0

Registers

DIR0

DIR1 DIR0

DIR1

CCR3

CCR0

CCR4CCR4 CCR5CCR5

Address Region Register 1 ARR1

Address Region Register 2 ARR2

Address Region Register 3 ARR3

Address Region Register 4 ARR4

Address Region Register 5 ARR5

Address Region Register 6 ARR6

Address Region Register 7 ARR7

RCR0

RCR1

RCR2

RCR3

RCR4

RCR5

RCR6

RCR7

Configuration

Registers

CCR = Configuration Control Register

RCR = Region Control Register

DIR = Device Identification Register

Debug

Registers

TR3

TR4

TR5

TR6

TR7

ST6x86

2-13

2.4.1 Control Registers

The Control Registers (CR0, CR2 and CR3), are

shown in Figure 2-6. The CR0 register contains

system control bits which configure operating

modes and indicate the general state of the CPU.

The lower 16 bits of CR0 are referred to as the

Machine Status Word (MSW). The CR0 bit defini-

tions are described in Table 2.4 and Table 2.5.

The reserved bits inCR0 should not be modified.

When paging is enabled and a page fault is gener-

ated, the CR2 register retains the 32-bit linear

address of the address that caused the fault.

When a double page fault occurs, CR2 contains

the address for the second fault. Register CR3

contains the 20 most significant bits of the physical

base address of the page directory. The page

directory must always be aligned to a 4-KByte

page boundary, therefore, the lower 12 bits of CR3

are not required to specify the base address.

CR3 contains the Page Cache Disable (PCD) and

Page Write Through (PWT) bits. During bus

cycles that are not paged, the state of the PCD bit

is reflected on the PCD pin and the PWT bit is

driven on the PWT pin. These bus cycles include

interrupt acknowledge cycles and all bus cycles,

when paging is not enabled. The PCD pin should

be used to control caching in an external cache.

The PWT pin should be used to control write policy

in an external cache.

Figure 2.6. Control Registers

Flags

Alignment Check

1701105

Virtual 8086 Mode

Resume Flag

Nested Task Flag

I/O Privilege Level

Overflow

Direction Flag

Interrupt Enable

Trap Flag

Sign Flag

Zero Flag

Auxiliary Carry

Parity Flag

Carry Flag

0000000000 00

0 or 1 Indicates Reserved

A = Arithmetic Flag, D = Debug Flag, S = System Flag, C = Control Flag

9876543 120

ZSTIDOION

RVA

9111111111

87654 3210

CMF T PL FFFFFF F F F

Identification S

D00

ST6x86

2-14

Table 2.4. CRO Bit Definitions

Table 2.5. Effects of Various Combinations of EM, TS, and MP Bits

BIT

POSITION NAME FUNCTION

0PE

Protected Mode Enable: Enables the segment based protection mechanism. If PE=1, protected

mode is enabled. If PE=0, the CPU operates in real mode and addresses are formed as in an

8086-style CPU.

1MP

Monitor Processor Extension: If MP=1 and TS=1, a WAIT instruction causes Device Not Avail-

able (DNA) fault 7. The TS bit is set to 1 on task switches by the CPU. Floating point instruc-

tions are not affected by the state of the MP bit. The MP bit should be set to one during normal

operations.

2 EM Emulate Processor Extension: If EM=1, all floating point instructions cause a DNA fault 7.

3TS

Task Switched: Set whenever a task switch operation isperformed. Execution of a floating point

instruction with TS=1 causes a DNA fault. If MP=1 and TS=1, a WAIT instruction also causes a

DNA fault.

4 1 Reserved: Do not attempt to modify.

5NE

Numerics Exception. NE=1 to allow FPU exceptions to be handled by interrupt 16. NE=0 if FPU

exceptions are to be handled by external interrupts.

16 WP Write Protect: Protects read-only pages from supervisor write access. WP=0 allows a read-only

page to be written from privilege level 0-2. WP=1 forces a fault on a write to a

read-only page from any privilege level.

18 AM Alignment Check Mask: If AM=1, the AC bit in the EFLAGS register is unmasked and allowed to

enable alignment check faults. Setting AM=0 prevents AC faults from occurring.

29 NW

Not Write-Back: If NW=1, the on-chip cache operates in write-through mode. In write-through

mode, all writes (including cache hits) are issued to the external bus. If NW=0, the on-chip cache

operates in write-back mode. In write-back mode, writes are issued to the external bus only for a

cache miss, a line replacement of a modified line, or as the result of a cache inquiry cycle.

30 CD

Cache Disable: If CD=1, no further cache line fills occur. However, data already present in the

cache continues to be used if the requested address hits in the cache. Writes continue to

update the cache and cache invalidations due to inquiry cycles occur normally. The cache must

also be invalidated to completely disable any cache activity.

31 PG Paging Enable Bit: If PG=1 and protected mode is enabled (PE=1), paging is enabled. After

changing the state of PG, software must execute an unconditional branch instruction (e.g., JMP,

CALL) to have the change take effect.

CR0 BIT INSTRUCTION TYPE

EM TS MP WAIT ESC

0 0 0 Execute Execute

0 0 1 Execute Execute

0 1 0 Execute Fault 7

0 1 1 Fault 7 Fault 7

1 0 0 Execute Fault 7

1 0 1 Execute Fault 7

1 1 0 Execute Fault 7

1 1 1 Fault 7 Fault 7

ST6x86

2-15

Table 2.6 Descriptor TableRegisters

andDescriptors

Descriptor Table Registers

The Global, Interrupt, and Local Descriptor Table

Registers (GDTR, IDTR and LDTR), shown in Fig-

ure 2.7, are usedto specify the location of the data

structures that control segmented memory man-

agement. The GDTR, IDTR and LDTR are loaded

using the LGDT, LIDT and LLDT instructions,

respectively. The values of these registers are

stored using the corresponding store instructions.

The GDTR and IDTR load instructions are privi-

leged instructions when operating in protected

mode. The LDTR canonly be accessed in protected

mode.

The Global Descriptor Table Register (GDTR)

holds a 32-bit linear base address and 16-bit limit

for the Global Descriptor Table (GDT). The GDT is

an array of up to8192 8-byte descriptors. When a

segment register is loaded from memory, the TI bit

in the segment selector chooses either the GDT or

the Local Descriptor Table (LDT) to locate a

descriptor. IfTI = 0, the index portion of the selec-

tor is used to locate the descriptor within the GDT

table. The contents of the GDTR are completely

visible to the programmer by using a SGDT

instruction. The first descriptor in the GDT (loca-

tion 0) is not used by the CPU and is referred to as

the “null descriptor”. The GDTR is initialized using

a LGDT instruction.

The Interrupt Descriptor Table Register (IDTR)

holds a 32-bit linear base address and 16-bit limit

for the Interrupt Descriptor Table (IDT). The IDT is

an array of 256 interrupt descriptors, each of which

is used to point to an interrupt service routine.

Every interrupt that may occur in the system must

have an associated entry in the IDT. The contents

of the IDTR are completely visible to the program-

merby using a SIDT instruction. The IDTR is initial-

ized usingthe LIDT instruction.

The Local Descriptor Table Register (LDTR)

holds a 16-bit selector for the Local Descriptor

Table (LDT). The LDT is an array of up to 8192

8-byte descriptors. When the LDTR is loaded, the

LDTR selector indexes an LDT descriptor that

must reside in the Global Descriptor Table

(GDT). The base address and limit are loaded

automatically and cached from the LDT descriptor

within the GDT.

Figure 2.7. Descriptor Table Registers

1708003

BASEADDRESS LIMIT

SELECTOR

47 16 15 0

LDTR

IDTR

GDTR

BASEADDRESS LIMIT

ST6x86

2-16

Subsequent access to entries in the LDT use the

hidden LDTR cache to obtain linear addresses. If

the LDT descriptor is modified in the GDT, the

LDTR must be reloaded to update the hidden por-

tion of the LDTR.

When a segment register is loaded from memory,

the TI bit in the segment selector chooses either

the GDT or the LDT to locate a segment descrip-

tor. If TI = 1, the index portion of the selector is

used to locate a given descriptor within the LDT.

Each task in the system may be given its own LDT,

managed by the operating system. The LDTs pro-

vide a method of isolating a given task’s segments

from other tasks in the system.

The LDTR can be read or written by the LLDT and

SLDT instructions.

Descriptors

There are three types of descriptors:

- Application Segment Descriptors that define

code, data and stack segments.

- System Segment Descriptors that define an

LDT segment or a Task State Segment

(TSS) table described later in this text.

- Gate Descriptors that define task gates,

interrupt gates, trap gates and callgates.

Application Segment Descriptors can be located in

either the LDT or GDT. System Segment Descrip-

tors can only be located in the GDT. Dependent

on the gate type, gate descriptors may be located

in either the GDT, LDT or IDT. Figure 2.8 illus-

trates the descriptor format for both Application

Segment Descriptors and System Segment

Descriptors. Table 2.7 lists the corresponding bit

definitions.

Figure 2.8. Application and System Segment Descriptors

BASE15-0

PDPLDTYPE

1707803

2324 16

GD 0 ALIMIT19-16 BASE23-16

LIMIT15-0

15 14 13 12 11 87 0

22 21 20 19

BASE31-24

ST6x86

2-17

Table 2.7. Segment Descriptor Bit Definitions

Table 2.8. TYPE Field Definitions with DT = 0

BIT

POSITION MEMORY

OFFSET NAME DESCRIPTION

31-24

7-0

31-16

+0 BASE Segment base address.

32-bit linear address that points to the beginning of the segment.

19-16

15-0 +4

+0 LIMIT Segment limit.

23 +4 G Limit granularity bit:

0 = byte granularity, 1 = 4 KBytes (page) granularity.

22 +4 D Default length for operands and effective addresses.

Validfor code and stack segments only: 0 = 16 bit, 1 = 32-bit.

20 +4 AVL Segment available.

15 +4 P Segment present.

14-13 +4 DPL Descriptor privilege level.

12 +4 DT Descriptor type:

0 = system, 1 = application.

11-8 +4 TYPE Segment type. See Tables 2-7 and 2-8.

TYPE

(BITS 11-8) DESCRIPTION

0001 TSS-16 descriptor, task not busy.

0010 LDT descriptor.

0011 TSS-16 descriptor, task busy.

1001 TSS-32 descriptor, task not busy

1011 TSS-32 descriptor, task busy.

ST6x86

2-18

Table 2.9. TYPE Field Definitions with DT = 1

TYPE APPLICATION DESCRIPTOR INFORMATION

E C/D R/W A

0 0 x x data, expand up, limit is upper bound of segment

0 1 x x data, expand down, limit is lower bound of segment

1 0 x x executable, non-conforming

1 1 x x executable, conforming (runs at privilege level of calling procedure)

0 x 0 x data, non-writable

0 x 1 x data, writable

1 x 0 x executable, non-readable

1 x 1 x executable, readable

x x x 0 not-accessed

x x x 1 accessed

ST6x86

2-19

Gate Descriptors provide protection for execut-

able segments operating at different privilege lev-

els. Figure 2.9 illustrates the format for Gate

Descriptors and Table 2.10 lists the corresponding

bitdefinitions.

Task Gate Descriptors are used to switch the

CPU’s context during a task switch. The selector

portion of the task gate descriptor locates a Task

State Segment. These descriptors can be located

inthe GDT, LDTor IDTtables.

Interrupt Gate Descriptors are used to enter a

hardware interrupt service routine. Trap Gate

Descriptors are used to enter exceptions or soft-

ware interrupt service routines. Trap Gate and

Interrupt Gate Descriptors can only be located in

the IDT.

Call Gate Descriptors are used to enter a proce-

dure (subroutine) that executes at the same or a

more privileged level. A Call Gate Descriptor pri-

marily defines the procedure entry point and the

procedure’s privilege level.

Figure 2.9. Gate Descriptor

Table 2.10. Gate Descriptor Bit Definitions

BIT

POSITION MEMORY

OFFSET NAME DESCRIPTION

31-16

15-0 +4

+0 OFFSET Offset used during a call gate to calculate the branch target.

31-16 +0 SELECTOR Segment selector used during a call gate to calculate the branch target.

15 +4 P Segment present.

14-13 +4 DPL Descriptor privilege level.

11-8 +4 TYPE

Segment type:

0100 = 16-bit call gate

0101 = task gate

0110 = 16-bit interrupt gate

0111 = 16-bit trap gate

1100= 32-bit call gate

1110 = 32-bit interrupt gate

1111 = 32-bit trap gate.

4-0 +4 PARAMETERS Number of 32-bit parameters to copy from the caller’s stack to the called

procedure’s stack (valid for calls).

OFFSET 31-16

SELECTOR 15-0

PTYPE0 PARAMETERS

1707903

OFFSET 15-0

15 14 13 12 11 8 7 0

DPL

ST6x86

2-20

2.4.2 Task Register

The Task Register (TR) holds a 16-bit selector for

the current Task State Segment (TSS) table as

shown in Figure 2.10. The TR is loaded and

stored via the LTR and STR instructions, respec-

tively. The TR can only be accessed during pro-

tected mode and can only be loaded when the

privilege level is 0 (most privileged). When the TR

is loaded, the TR selector field indexes a TSS

descriptor that must reside in the Global Descrip-

tor Table (GDT). The contents of the selected

descriptor are cached on-chip in the hidden por-

tion of the TR.

During task switching, the processor saves the

current CPU state in the TSS before starting a new

task. The TR points to the current TSS. The TSS

can beeither a 386/486-style 32-bit TSS Figure 2.11

or a 286-style 16-bit TSS type Figure 2.12. An I/O

permission bit map is referenced in the 32-bit TSS

by the I/O Map Base Address.

Figure 2.10. Task Register

1708103

SELECTOR

15 0

ST6x86

2-21

Figure 2.11. 32-Bit Task State Segment (TSS) Table

+0h

+4h

+8h

+Ch

+10h

+14h

+18h

+1Ch

+20h

+24h

+28h

+2Ch

+30h

+34h

BACK LINK (OLD TSS SELECTOR)

SS for CPL = 0

SS for CPL = 1

SS for CPL = 2

+38h

+3Ch

+40h

+44h

+48h

+4Ch

+50h

+54h

+58h

+5Ch

+60h

+64h

SELECTOR FOR TASK’S LDT T

ESP for CPL = 0

ESP for CPL = 1

ESP for CPL = 2

CR3

EIP

EFLAGS

EAX

ECX

EDX

31 16 15 0

EBX

ESP

EBP

ESI

EDI

I/O MAP BASE ADDRESS

1708203

0000000000000000

000000000000000

0000000000000000

0 = RESERVED

ST6x86

2-22

Figure 2.12. 16-Bit Task State Segment (TSS) Table

1708803

BACK LINK (OLD TSS SELECTOR)

SP FOR PRIVILEGE LEVEL 0

SS FOR PRIVILEGE LEVEL 0

SP FOR PRIVILEGE LEVEL 1

SS FOR PRIVILEGE LEVEL 1

SP FOR PRIVILEGE LEVEL 2

SS FOR PRIVILEGE LEVEL 2

FLAGS

SELECTOR FOR TASK’S LDT

+0h

+2h

+4h

+6h

+8h

+Ah

+Ch

+Eh

+10h

+12h

+14h

+16h

+18h

+1Ah

+16h

+1Eh

+20h

+22h

+24h

+26h

+28h

+2Ah

ST6x86

2-23

2.4.3 6x86 Configuration Registers

A set of 24 on-chip ST6x86 configuration registers

are used to enable features in the ST6x86 CPU.

These registers assign non-cached memory

areas, set up SMM, provide CPU identification

information and control various features such as

cache write policy, and bus locking control. There

are four groups of registers within theST6x86 con-

figurationregister set:

- 6 Configuration Control Registers (CCRx)

- 8 Address Region Registers (ARRx)

- 8 Region Control Registers (RCRx)

- 2 Device Identification Registers (DIRx)

Access to the configuration registers is achieved

by writing the register index number for the config-

uration register to I/O port 22h. I/O port 23h is

then used for data transfer.

Each I/O port 23h data transfer must be preceded

by a valid I/O port 22h register index selection.

Otherwise, the current 22h, and the second and

later I/O port 23h operations communicate through

the I/O port to produce external I/O cycles. All

reads from I/O port 22h produce external I/O

cycles. Accesses that hit within the on-chip config-

uration registers do not generate external I/O

cycles.

After reset, configuration registers with indexes

CO-CFh and FE-FFh are accessible. To prevent

potential conflicts with other devices which may

use ports 22 and 23h to access their registers, the

remaining registers (indexes D0-FDh) are accessi-

ble only if the MAPEN(3-0) bits inCCR3 are set to

1h. See Figure 2.16 for more information on the

MAPEN(3-0) bit locations.

If MAPEN[3-0] = 1h, any access to indexes in the

range 00-FFh will not create external I/O bus

cycles. Registers with indexes C0-CFh, FE, FFh

are accessible regardless of the state of

MAPEN[3-0]. If the register index number is out-

side the C0-CFh or FE-FFh ranges, and

MAPEN[3-0] are set to 0h, external I/O bus cycles

occur. Table 2.11 lists the MAPEN[3-0] values

required to access each ST6x86 configuration

initialized to zero following reset unless specified

otherwise.

Valid register index numbers include C0h to E3h,

E8h, E9h, FEh and FFh (if MAPEN[3-0] = 1).

2.4.3.1 Configuration Control Registers

(CCR0 - CCR5) control several functions, includ-

ing non-cacheable memory, write-back regions,

and SMM features. A list of the configuration reg-

isters is listed in Table 2.11. The configuration reg-

isters are described in greater detail in the

following pages.

ST6x86

2-24

Table 2.11. ST6x86 CPU Configuration Registers

INDEX WIDTH

(Bits)

MAPEN VALUE

NEEDED FOR

ACCESS

Configuration Control 0 CCR0 C0h 8 x

Configuration Control 1 CCR1 C1h 8 x

Configuration Control 2 CCR2 C2h 8 x

Configuration Control 3 CCR3 C3h 8 x

Configuration Control 4 CCR4 E8h 8 1

Configuration Control 5 CCR5 E9h 8 1

Address Region 0 ARR0 C4h-C6h 24 x

Address Region 1 ARR1 C7h-C9h 24 x

Address Region 2 ARR2 CAh-CCh 24 x

Address Region 3 ARR3 CDh -CFh 24 x

Address Region 4 ARR4 D0h-D2h 24 1

Address Region 5 ARR5 D3h-D5h 24 1

Address Region 6 ARR6 D6h-D8h 24 1

Address Region 7 ARR7 D9h-DBh 24 1

Region Control 0 RCR0 DCh 8 1

Region Control 1 RCR1 DDh 8 1

Region Control 2 RCR2 DEh 8 1

Region Control 3 RCR3 DFh 8 1

Region Control 4 RCR4 E0h 8 1

Region Control 5 RCR5 E1h 8 1

Region Control 6 RCR6 E2h 8 1

Region Control 7 RCR7 E3h 8 1

Device Identification 0 DIR0 FEh 8 x

Device Identification 1 DIR1 FFh 8 x

Note: x = Don’t Care

ST6x86

2-25

Figure 2.13. ST6x86 Configuration Control Register 0 (CCRO)

Table 2.12. CCRO Bit Definitions

76543210

Reserved Reserved Reserved Reserved Reserved Reserved NC1 Reserved

BIT

POSITION NAME DESCRIPTION

1NC1

No Cache 640 KByte - 1 MByte

If = 1: Address region 640 KByte to 1 MByte is non-cacheable.

If = 0: Address region 640 KByte to 1 MByte is cacheable.

Note: Bits 0, 2 through 7 are reserved.

ST6x86

2-26

Figure 2.14. ST6x86 Configuration Control Register 1 (CCR1)

Table 2.13.CCR1 Bit Definitions

76543210

SM3 Reserved Reserved NO_LOCK Reserved SMAC USE_SMI Reserved

BIT

POSITION NAME DESCRIPTION

1 USE_SMI Enable SMM and SMIACT# Pins

If = 1: SMI# and SMIACT# pins are enabled.

If = 0: SMI# pin ignored and SMIACT# pin is driven inactive.

2 SMAC

System Management Memory Access

If = 1: Any access to addresses within the SMM address space, access system manage-

ment memory instead of main memory. SMI# input is ignored. Used when initializing or

testing SMM memory.

If = 0: No effect on access.

4 NO_LOCK

Negate LOCK#

If = 1: All bus cycles are issued with LOCK# pin negated except page table accesses and

interrupt acknowledge cycles. Interrupt acknowledge cycles are executed as locked

cycles even though LOCK# is negated. With NO_LOCK set, previously noncacheable

locked cycles are executed as unlocked cycles and therefore, may be cached. This

results in higher performance. Refer to Region Control Registers for information on elimi-

nating locked CPU bus cycles only in specific address regions.

7 SM3 SMM Address Space Address Region 3

If = 1: Address Region 3 is designated as SMM address space.

Note: Bits 0, 3, 5 and 6 are reserved.

ST6x86

2-27

Figure 2.15. ST6x86 Configuration Control Register 2 (CCR2)

Table 2.14. CCR2 Bit Definitions

76543 2 10

USE_SUSP Reserved Reserved WPR1 SUSP_HLT LOCK_NW Reserved Reserved

BIT

POSITION NAME DESCRIPTION

2 LOCK_NW

Lock NW

If = 1: NW bit in CR0 becomes read only and the CPU ignores any writes to the

NW bit.

If = 0: NW bit in CR0 can be modified.

3 SUSP_HLT Suspend on Halt

If = 1: Execution of the HLT instruction causes the CPU to enter low power sus-

pend mode.

4 WPR1 Write-Protect Region 1

If = 1: Designates any cacheable accesses in 640 KByte to 1 MByte address

region are write protected.

7 USE_SUSP Use Suspend Mode (Enable Suspend Pins)

If = 1: SUSP# and SUSPA# pins are enabled.

If = 0: SUSP# pin is ignored and SUSPA# pin floats.

Note: Bits 0,1, 5 and 6 are reserved.

ST6x86

2-28

Figure 2.16. ST6x86 Configuration Control Register 3 (CCR3)

Table 2.15. CCR3 Bit Definitions

7654321 0

MAPEN Reserved LINBRST NMI_EN SMI_LOCK

BIT

POSITION NAME DESCRIPTION

0 SMI_LOCK

SMI Lock

If = 1: The following SMM configuration bits can only be modified while in an SMI

service routine:

CCR1: USE_SMI, SMAC, SM3

CCR3: NMI_EN

ARR3: Starting address and block size.

Once set, the features locked by SMI_LOCK cannot be unlocked until the

RESET pin is asserted.

1 NMI_EN

NMI Enable

If = 1: NMI interrupt is recognized while servicing an SMI interrupt.

NMI_EN should be set only while in SMM, after the appropriate SMI interrupt ser-

vice routine has been setup.

2 LINBRST If = 1: Use linear address sequence during burst cycles.

If = 0: Use “1 + 4” address sequence during burst cycles. The “1 + 4” address

sequence is compatible with Pentium’s burst address sequence.

4-7 MAPEN

MAP Enable

If = 1h: All configuration registers are accessible.

If = 0h: Only configuration registers with indexes C0-CFh, FEh and FFh

are accessible.

Note: Bit 3 is reserved.

ST6x86

2-29

Figure 2.17. ST6x86 Configuration Control Register 4 (CCR4)

Table 2.16. CCR4 Bit Definitions

76543210

CPUID Reserved Reserved DTE_EN Reserved IORT

BIT

POSITION NAME DESCRIPTION

0-2 IORT

I/O Recovery Time

Specifies the minimum number of bus clocks between I/O accesses:

0h = 1 clock delay

1h = 2 clock delay

2h = 4 clock delay

3h = 8 clock delay

4h = 16 clock delay

5h = 32 clock delay (default value after RESET)

6h = 64 clock delay

7h = no delay

4 DTE_EN Enable Directory TableEntry Cache

If = 1: the Directory Table Entry cache is enabled.

7 CPUID

Enable CPUID instruction.

If = 1: the ID bit in the EFLAGS register can be modified and execution of the

CPUID instruction occurs as documented in section 6.3.

If = 0: the ID bit in the EFLAGS register can not be modified and execution of the

CPUID instruction causes an invalid opcode exception.

Note: Bits 3 and bits 5 and 6 are reserved.

ST6x86

2-30

Figure 2.18. ST6x86 Configuration Control Register 5 (CCR5)

Table 2.17. CCR5 Bit Definitions

7654321 0

Reserved Reserved ARREN LBR1 Reserved Reserved Reserved WT_ALLOC

BIT

POSITION NAME DESCRIPTION

0 WT_ALLOC Write-Through Allocate

If = 1: New cache lines are allocated for read and write misses.

If = 0: New cache lines are allocated only for read misses.

4 LBR1 Local Bus Region 1

If = 1: LBA# pin is asserted for all accesses to the 640 KByte to 1 MByte address

region.

5 ARREN

Enable ARR Registers

If = 1: Enables all ARR registers.

If = 0: Disables the ARR registers. If SM3 is set, ARR3 is enabled regardless of

the setting of ARREN.

Note: Bits 1 through 3 and 6 though 7 are reserved.

ST6x86

2-31

2.4.3.2 Address Region Registers

The Address Region Registers (ARR0 - ARR7)

(Figure 2.19) are used to specify the location and

size for the eight address regions.

Attributes for each address region are specified in

the Region Control Registers (RCR0-RCR7).

ARR7 and RCR7 are used to define system main

memory and differ from ARR0-6 and RCR0-6.

With non-cacheable regions defined on-chip, the

ST6x86 CPU delievers optimum performance by

using advanced techniques to eliminate data

dependencies and resource conflicts in its execu-

tion pipelines. If KEN# is active for accesses to

regions defined as non-cacheable by the RCRs,

the region is not cached. The RCRs take prece-

dence in this case.

A register index, shown in Table 2.18 is used to

select one of three bytes in each ARR.

The starting address of the ARR address region,

selected by the START ADDRESS field, must be

on a block size boundary. For example, a

128 KByte block is allowed to have a starting

address of 0 KBytes, 128 KBytes, 256 KBytes,

and so on.

The SIZE field bit definition is listed in Table 2.19.

If the SIZE field is zero, the address region is of

zero size and thus disabled.

Figure 2.19. Address Region Registers (ARR0 - ARR7)

START ADDRESS SIZE

Memory Address

BitsA31-A24 Memory Address

BitsA23-A16 MemoryAddress

BitsA15-A12 SizeBits

3-0

707 07430

ST6x86

2-32

Table 2.18. ARR0 - ARR7 Register Index Assignment

Table 2.19. Bit Definitions for SIZE Field

ARR

(A31 - A24) Memory Address

(A23 - A16) Memory Address

(A15 - A12) Address Region

Size (3 - 0)

ARR0 C4h C5h C6h C6h

ARR1 C7h C8h C9h C9h

ARR2 CAh CBh CCh CCh

ARR3 CDh CEh CFh CFh

ARR4 D0h D1h D2h D2h

ARR5 D3h D4h D5h D5h

ARR6 D6h D7h D8h D8h

ARR7 D9h DAh DBh DBh

SIZE (3-0) BLOCK SIZE SIZE (3-0) BLOCK SIZE

ARR0-6 ARR7 ARR0-6 ARR7

0h Disabled Disabled 8h 512 KBytes 32 MBytes

1h 4 KBytes 256 KBytes 9h 1 MBytes 64 MBytes

2h 8 KBytes 512 KBytes Ah 2 MBytes 128 MBytes

3h 16 KBytes 1 MBytes Bh 4 MBytes 256 MBytes

4h 32 KBytes 2 MBytes Ch 8 MBytes 512 MBytes

5h 64 KBytes 4 MBytes Dh 16 MBytes 1 GBytes

6h 128 KBytes 8 MBytes Eh 32 MBytes 2 GBytes

7h 256 KBytes 16 MBytes Fh 4 GBytes 4 GBytes

ST6x86

2-33

2.4.3.3 Region Control Registers

The Region Control Registers (RCR0 - RCR7)

specify the attributes associated with the ARRx

address regions. The bit definitions for the region

control registers are shown in Figure 2.20 and in

Table 2.20. Cacheability, weak write ordering,

weak locking, write gathering, cache write through

policies and control of the LBA# pin can be acti-

vated or deactivated using the attribute bits.

If an address is accessed that is not in a memory

region defined by the ARRx registers, the following

conditions will apply:

- LBA# pin is asserted

- If the memory address is cached, write-back is

enabled if WB/WT# is returned high.

- Writes are not gathered

- Strong locking takes place

- Strong write ordering takes place

- The memory access is cached, if KEN# is

returned asserted.

Overlapping Conditions Defined. If two regions

specified by ARRx registers overlap and conflict-

ing attributes are specified, the following attributes

take precedence:

- LBA# pin is asserted

- Write-back is disabled

- Writesare not gathered

- Strong locking takes place

- Strong write ordering takes place

- The overlapping regions are non-cacheable.

ST6x86

2-34

Figure 2.20. Region Control Registers (RCR0-RCR7)

Table 2.20. RCR0-RCR7 Bit Definitions

Region Cache Disable (RCD). Setting RCD to a

one defines the address region as non-cacheable.

Whenever possible, the RCRs should be used to

define non-cacheable regions rather than using

external address decoding and driving the KEN#

pin.

Region Cache Enable (RCE). Setting RCE to a

one defines the address region as cacheable.

RCE is used to define the system main memory as

cacheable memory. It is implied that memory out-

side the region is non-cacheable.

Weak Write Ordering (WWO). Setting WWO=1

enables weak write ordering for that address

region. Enabling WWO allowsthe ST6x86 CPU to

issue writes in its internal cache in an order differ-

ent than their order in the code stream. External

writes always occur in order (strong ordering).

Therefore, this should only be enabled for memory

regions that are NOT sensitive to this condition.

WWO should not be enabled for memory mapped

I/O. WWO only applies to memory regions that

have been cached and designated as write-back.

It also applies to previously cached addresses

even if the cache has been disabled (CD=1).

Enabling WWO removes the write-ordering restric-

tion and improves performance due to reduced

pipeline stalls.

Weak Locking (WL). Setting WL=1 enables weak

locking for that address region. With WL enabled,

all bus cycles are issued with the LOCK# pin

negated except for page table accesses and inter-

rupt acknowledge cycles. Interrupt acknowledge

cycles are executed as locked cycles even though

LOCK# is negated. With WL=1, previously

non-cacheable locked cycles are executed as

unlocked cycles and therefore, may be cached,

resulting in higher performance. The NO_LOCK

bit of CCR1 enables weak locking for the entire

address space. The WL bit allows weak locking

only for specific address regions. WL is indepen-

dent of the cacheability of the address region.

7654321 0

Reserved Reserved NLB WT WG WL WWO RCD/ RCE*

*Note: RCD is defined for RCR0-RCR6. RCE is defined for RCR7.

RCRx BIT

POSITION NAME DESCRIPTION

0-6 0 RCD If = 1: Disables caching for address region specified by ARRx.

7 0 RCE If = 1: Enables caching for address region ARR7.

0-7 1 WWO If = 1: Weak write ordering for address region specified by ARRx.

0-7 2 WL If = 1: Weak locking for address region specified by ARRx.

0-7 3 WG If = 1: Write gathering for address region specified by ARRx.

0-7 4 WT If = 1: Address region specified by ARRx is write-through.

0-7 5 NLB If = 1:LBA# pin is not asserted for access to address region specified by ARRx

Note: Bits 6 and 7 are reserved.

ST6x86

2-35

Write Gathering (WG). Setting WG=1 enables

write gathering for the associated address region.

Write gathering allows multiple byte, word, or

dword sequential address writes to accumulate in

the on-chip write buffer. (As instructions are exe-

cuted, the results are placed in a series of output

buffers. These buffers are gathered into the final

output buffer).

When access is made to a non-sequential memory

location or when the 8-byte buffer becomes full,

the contents of the buffer are written on the exter-

nal 64-bit data bus. Performance is enhanced by

avoiding as many as seven memory write cycles.

WG should not be used on memory regions that

are sensitive to write cycle gathering. WG can be

enabled for both cacheable and non-cacheable

regions.

Write Through (WT). Setting WT=1 defines the

address region as write-through instead of

write-back, assuming the region is cacheable.

Regions where system ROM are loaded (shad-

owed or not) should be defined as write-through.

LBA# Not Asserted (NLB). Setting NLB=1 pre-

vents the microprocessor from asserting the Local

Bus Access (LBA#) output pin for accesses to that

address region. The RCR regions may be used to

define non-local bus address regions. The LBA#

pin could then be asserted for all regions, except

those defined by the RCRs. The LBA# signal may

be used by the external hardware (e.g., chipsets)

as an indication that local bus accessesare occur-

ring.

ST6x86

2-36

2.4.3.4 Device Identification Registers

The Device Identification Registers (DIR0, DIR1)

contain CPU identification, CPU stepping and

CPU revision information. Bit definitions are shown

in (Figure 2.21), Table 2.21, Figure 2.22 and Table

2.22 respectively. Data in these registers cannot be

changed. Theseregisters canbe read by usingI/O

ports 22 and 23. The register index for DIR0 is

FEh and the register index for DIR1 is FFh.

Figure 2.21. Device Identification Register 0 (DIR0)

Table 2.21. DiR0 Bit Definitions

Figure 2.22. Device Identification Register 1 (DIR1)

Table 2.22. DIR 1 Bit Definitions

DEVID

BIT

POSITION NAME DESCRIPTION

7-0 DEVID CPU Device Identification Number (read only).

7430

SID RID

BIT

POSITION NAME DESCRIPTION

7-4 SID CPU Step Identification Number (read only).

3-0 RID CPU Revision Identification (read only).

ST6x86

2-37

2.4.4 Debug Registers

Six debug registers (DR0-DR3, DR6 and DR7),

shown in Figure 2.23, support debugging on the

ST6x86 CPU. The bit definitions for the debug

registers are listed in Table 2.23.

Memory addresses loaded in the debug registers,

referred to as “breakpoints”, generate a debug

exception when a memory access of the specified

type occurs to the specified address. A data

breakpoint can be specified for a particular kind of

memory access such as a read or a write. Code

breakpoints can also be setallowing debug excep-

tions to occur whenever a given code access (exe-

cution) occurs.

The size of the debug target can be set to 1, 2, or

4 bytes. The debug registers are accessed via

MOV instructions which can be executed only at

privilege level 0.

The Debug Address Registers (DR0-DR3) each

contain the linear address for one of four possible

breakpoints. Each breakpoint is further specified

by bits in the Debug Control Register (DR7). For

each breakpoint address in DR0-DR3, there are

corresponding fields L, R/W, and LEN in DR7 that

specify the type of memory access associated with

the breakpoint.

The R/W field can be used to specify instruction

execution as well as data access breakpoints.

Instruction execution breakpoints are always taken

before execution of the instruction that matches

the breakpoint.

The Debug Status Register (DR6) reflects condi-

tions that were in effect at the time the debug

exception occurred. The contents of the DR6 reg-

ister are not automatically cleared by the proces-

sor after a debug exception occurs and, therefore,

should be cleared by software at the appropriate

time.

Figure 2.23. Debug Registers

DR7

DR6

DR3

DR2

DR1

DR0

1703203

ALL BITS MARKED AS 0 OR 1 ARE RESERVED AND SHOULD NOT BEMODIFIED.

BREAKPOINT 3 LINEARADDRESS

BREAKPOINT2 LINEARADDRESS

BREAKPOINT 1 LINEAR ADDRESS

BREAKPOINT 0 LINEAR ADDRESS

0BBBBBB

010000000000000000

LEN R/W LEN R/W LEN R/W LEN R/W 00 GGLGLGLGLGL

001

3322

332222222222111111 1 1

9876543210

1098765 4321 09 87

110

65 4 32 0

D EE3322110

321

1111111

ST6x86

Code execution breakpoints may also be generated by placing the breakpoint instruction (INT 3) at the

location where control is to be regained. Additionally, the single-step feature may be enabled by setting

the TF flag in the EFLAGS register. This causes the processor to perform a debug exception after the

execution of every instruction.

Table 2.23. DR6 and DR7 Debug Register Field Definitions

OF BITS DESCRIPTION

DR6

Bi 1 Bi is set by the processor if the conditions described by DRi, R/Wi, and LENi

occurred when the debug exception occurred, even if the breakpoint is not

enabled via the Gi or Li bits.

BT 1 BT is set by the processor before entering the debug handler if a task switch

has occurred to a task with the T bit in the TSS set.

BS 1 BS is set by the processor if the debug exception was triggered by the sin-

gle-step execution mode (TF flag in EFLAGS set).

DR7

R/Wi 2

Specifies type of break for the linear address in DR0, DR1, DR3, DR4:

00 - Break on instruction execution only

01 - Break on data writes only

10 - Not used

11 - Break on data reads or writes.

LENi 2

Specifies length of the linear address in DR0, DR1, DR3, DR4:

00 - One byte length

01 - Two byte length

10 - Not used

11 - Four byte length.

Gi 1 If set to a 1, breakpoint in DRi is globally enabled for all tasks and is not

cleared by the processor as the result of a task switch.

Li 1 If set to a 1, breakpoint in DRi is locally enabled for the current task and is

cleared by the processor as the result of a task switch.

GD 1 Global disable of debug register access. GD bit is cleared whenever a

debug exception occurs.

ST6x86

2-39

2.4.5 Test Registers

The test registers can be used to test the on-chip

unified cache and to test the main TLB. The test

registers are also used to enable ST6x86 CPU

variable-size paging.

Test registers TR3, TR4, and TR5 are used to test

the unified cache. Use of these registers is

described with the memory caches later in this

chapter in Section 2.7.1.1.

Test registers TR6 and TR7 are used to test the

TLB. Use of these test registers is described in

Section 2.6.4.2.

ST6x86

2-40

2.5 Address Space

The ST6x86 CPU can directly address 64 KBytes

of I/O space and 4 GBytes of physical memory

(Fig.2.24).

Memory Address Space. Access can be made to

memory addresses between 0000 0000h and

FFFF FFFFh. This 4 GByte memory space can

be accessed using byte, word (16 bits), or double-

word (32 bits) format. Words and doublewords are

stored in consecutive memory bytes with the

low-order byte located in the lowest address. The

physical address of a word or doubleword is the

byte address of the low-order byte.

Figure 2.24. Memory and I/O Address Spaces

FFFF FFFFh

Physical Memory

Physical

0000 0000h

64 KBytes

Not

6x86

0000 FFFFh

0000 0000h

FFFF FFFFh

1730900

Memory Space

4 GBytes

I/O Adress Space

Accessible

Configuration

Space

00000023h

00000022h

ST6x86

2-41

I/O Address Space

The ST6x86 I/O address space is accessed using

IN and OUT instructions to addresses referred to

as “ports”. The accessible I/O address space size

is 64 KBytes and can be accessed through 8-bit,

16-bit or 32-bit ports. The execution of any IN or

OUT instruction causes the M/IO# pin to be driven

low, thereby selecting the I/O space instead of

memory space.

The accessible I/O address space ranges between

locations 0000 0000h and 0000 FFFFh (64

KBytes). The I/O locations (ports) 22h and 23h

can be used to access the ST6x86 configuration

registers.

2.6 Memory Addressing Methods

With the ST6x86 CPU, memory can be addressed

using nine different addressing modes (Table

2.24). These addressing modes are used to cal-

culate an offset address often referred to as an

effective address. Depending on the operating

mode of the CPU, the offset is then combined

using memory management mechanisms to cre-

ate a physical address that actually addresses the

physical memory devices.

Memory management mechanisms on theST6x86

CPU consist of segmentation and paging. Seg-

mentation allows each program to use several

independent, protected address spaces. Paging

supports a memory subsystem that simulates a

large address space using a small amount of RAM

and disk storage for physical memory. Either or

both of these mechanisms can be used for man-

agement of the ST6x86 CPU memory address

space.

ST6x86

2-42

2.6.1 OffsetMechanism

The offset mechanism computes an offset (effec-

tive) address by adding together one or more of

threevalues: abase, an index anda displacement.

When present, the base is the value of one of the

eight 32-bit general registers. The index if

present, like the base, is a value that is in one of

the eight 32-bit general purpose registers (not

including the ESP register). The index differs from

the base in that the index is first multiplied by a

scale factorof 1, 2, 4 or 8 beforethe summation is

made. The third component added to the memory

address calculation is the displacement. The dis-

placement is a value of up to 32-bits in length sup-

plied as part of the instruction. Figure 2.25

illustrates the calculation of the offset address.

Nine valid combinations of the base, index, scale

factor and displacement can be used with the

ST6x86 CPU instruction set. These combinations

are listed in Table 2.24. The base and index both

refer to contents of a register as indicated by

[Base] and [Index].

Figure 2.25. Offset Address Calculation

Table 2.24. Memory Addressing Modules

Index

Base Displacement

Scaling

Offset Address

1706603

x1, x2, x4,x8

(Effective Address)

ADDRESSING

MODE BASE INDEX SCALE

FACTOR

(SF)

DISPLACEMENT

(DP) OFFSET ADDRESS (OA)

CALCULATION

Direct x OA = DP

Based x x OA = [BASE] + DP

Index x x OA = [INDEX] + DP

Scaled Index x x x OA = ([INDEX] * SF) + DP

Based Index x x OA = [BASE] + [INDEX]

Based Scaled Index x x x OA = [BASE] + ([INDEX] * SF)

Based Index with

Displacement x x x OA = [BASE] + [INDEX] + DP

Based Scaled Index with

Displacement x x x x OA = [BASE] + ([INDEX] * SF) + DP

ST6x86

2-43

2.6.2 Memory Addressing

Real Mode Memory Addressing

In real mode operation, the ST6x86 CPU only

addresses the lowest 1 MByte of memory. To cal-

culate a physical memory address, the 16-bit seg-

ment base address located in the selected

segment register is multiplied by 16 and then the

16-bit offset address is added. The resulting 20-bit

address is then extended. Three hexadecimal

zeros are added as upper address bits to create

the 32-bit physical address. Figure 2.26 illustrates

the real mode address calculation.

The addition of the base address and the offset

address may result in a carry. Therefore, the

resulting address may actually contain up to 21

significant address bits that can address memory

in the first 64 KBytes above 1 MByte.

Protected Mode Memory Addressing

In protected mode, three mechanisms calculate a

physical memory address (Figure 2.27).

-Offset Mechanism that produces the offset or

effective address as in real mode.

-Selector Mechanism that produces the base

address.

- Optional Paging Mechanism that translates a

linear address to the physical memory

address.

The offset and base addressare added together to

produce the linear address. If paging is not

enabled, the linear addressis used as the physical

memory address. If paging is enabled, the paging

mechanism is used to translate the linear address

into the physical address. The offset mechanism

is described earlier in this section and applies to

both real and protected mode. The selector and

paging mechanisms are described in the following

paragraphs.

Figure 2.26. Real Mode Address Calculation

Figure 2.27. Protected Mode Address Calculation

Offset Mechanism

SelectedSegment

Offset Address

1708304

X16

16 20

20 32 Linear Address

(Physical Address)

000h

Offset Mechanism

Selector Mechanism

Optional Physical

1706504

Paging

Mechanism Memory

Address

32 32

Offset

Address

Linear

Address

Segment

Base

ST6x86

2-44

2.6.3 Selector Mechanism

Using segmentation, memory is divided into an

arbitrary number of segments, each containing

usually much less than the 232 byte (4 GByte)

maximum.

The six segment registers (CS, DS, SS, ES, FS

and GS) each contain a 16-bit selectorthat is used

when the register is loaded to locate a segment

descriptor in either the global descriptor table

(GDT) or the local descriptor table (LDT). The

segment descriptor defines the base address,

limit, and attributes of the selected segment and is

cached on the ST6x86 CPU as a result of loading

the selector. The cached descriptor contents are

not visible to the programmer. When a memory

reference occurs in protected mode, the linear

address is generated by adding the segment base

address in the hidden portion of the segment reg-

ister to the offset address. If paging is not

enabled, this linear address is used as the physical

memory address. Figure 2.28 illustrates the oper-

ation of the selector mechanism.

Figure 2.28. Selector Mechanism

Segment

15 0

1739100

INDEX TI RPL

Descriptor

Segment

Descriptor

TI=0

TI=1

Local Descriptor

Table

SELECTOR LOAD INSTRUCTION SEGMENT REGISTER

SELECTED BY DECODED

INSTRUCTION

Segment

File and

Descriptor

Cache

Segment

Identification

Selector

In Segment

GlobalDescriptor

Table Segment

Base Address

ST6x86

2-45

2.6.4 Paging Mechanisms

The paging mechanisms (Figure 2.29) translate

linear addresses to their corresponding physical

addresses. For traditional paging, the page size is

always 4 KBytes. If ST6x86 Variable-Size Paging

is selected, a page size may be as large as

4 GBytes. Use of larger page sizes allows large

memory areas such as video memory to be placed

in a single page, eliminating page table thrashing.

Paging is activated when the PG and the PE bits

within the CR0 register are set.

2.6.4.1 Traditional Paging Mechanism

The traditional paging mechanism translates the

20 most significant bits of a linear address to a

physical address. The linear address is divided

into three fields DTI, PTI, PFO (Figure 2.30).

These fields respectively select:

- an entry in the directory table,

- an entry in the page table selected by the

directory table

- the offset in the physical page selected by the

page table

The directory table and all the page tables can be

considered as pages as they are 4-KBytes in size

and are aligned on 4-KByte boundaries. Each

entry in these tables is 32 bits in length. The fields

within the entries are detailed in Figure 2.30 and

Table 2.25.

A single page directory table can address up to

4 GBytes of virtual memory (1,024 page tables—

each table can select 1,024 pages and each page

contains 4 KBytes).

Translation Lookaside Buffer (TLB) is made up

of three caches Figure 2.30.

- the DTE Cache caches directory table entries

- the Main TLB caches page tables entries

- the Victim TLB stores PTEs that have been

evicted from the Main TLB

The DTE cache is a 4-entry fully associative

cache, the main TLB is a 128-entry direct mapped

cache and the victim TLB is an 8-entry fully asso-

ciative cache.The DTE cache caches the four

most recent DTEs so that future TLB misses only

require a single page table read to calculate the

physical address. The DTE cache is disabled fol-

lowing RESET and is enabled by setting the

DTE_EN bit (CCR4 bit4).

Figure 2.29. Paging Mechanisms

1739600

PhysicalAddress

Linear Address

Variable-Size

PagingMechanism

Traditional Paging

Mechanism

ST6x86

2-46

Figure 2.30. Traditional Paging Mechanism

Figure 2.31. Directory and Page Table Entry (DTE and PTE) Format

CR3

1728800

Directory Table Index Page Table Index Page Frame Offset

31 22 21 12 11 0

Physical Page

DTE PTE

000

4Kb

(DTI) (PTI) (PFO)

127

Main TLB

128 Entry

Direct Mapped

DTE Cache

4Entry

Fully Associative

Page Table Memory

Directory Table

4Kb

4Gb

Linear

Address

Control

Victim TLB

8 Entry

Fully Associative

BASEADDRESS AVAILABLE P

31 0

12 11 9 8 123456710

1708503

RESERVED

Note: InDTE format, bit 6 is reserved

ST6x86

2-47

Table 2.25. Directoryand Page Table Entry (DTE and PTE) Bit Definitions

For a TLB hit, the TLB eliminates accesses to

external directory and page tables.

The victim TLB increases the apparent associativ-

ity of the main TLB and helps eliminate TLB trash-

ing (unproductive TLB management). When an

entry in the main TLB is replaced, a copy of the

replaced entry is sent to the victim TLB before the

entry in the main TLB is overwritten. If the victim

TLB receives a hit, its entry is swapped with a

main TLB entry.

The TLB must be flushed by the software when

entries in the page tables are changed. The TLB

is flushed whenever the CR3 register is loaded. A

particular page can be flushed from the TLB by

using the INVLPG instruction. This instruction also

flushes the entire DTE cache.

2.6.4.2 Translation Lookaside Buffer Testing

The TLB can be tested by writing to a main TLB

followed by performing a TLB lookup (TLB read) to

see if the expected contents are within the TLB.

TLB test operations are performed using test reg-

ister TR6 and TR7 shown in

Figure 2.32. Tables 2.26 through 2.28 list the bit

definitions for TR6 and TR7.

BIT POSITION FIELD NAME DESCRIPTION

31-12 BASE

ADDRESS Specifies the base address of the page or page table.

11-9 -- Undefined and available to the programmer.

8-7 -- Reserved and not available to the programmer.

6D Dirty Bit. If set, indicates that a write access has occurred to the page (PTE only,

undefined in DTE).

5A Accessed Flag. If set, indicates that a read access or write access has occurred

to the page.

4 PCD Page Caching Disable Flag. If set, indicates that the page is not cacheable in

the on-chip cache.

3PWT Page Write-Through Flag. If set, indicates that writes to the page or page tables

that hit in the on-chip cache must update both the cache and external memory.

2 U/S User/Supervisor Attribute. If set (user), page is accessible at privilege level 3. If

clear (supervisor), page is accessible only when CPL ≤2.

1 W/R Write/Read Attribute. If set (write), page is writable. If clear (read), page is read

only.

Present Flag. If set, indicates that the page is present in RAM memory,and

validates the remaining DTE/PTE bits. If clear, indicates that the page is not

present in memory and the remaining DTE/PTE bits can be used by the

programmer.

ST6x86

2-48

Main TLB Write. To perform a direct write to a

main TLB entry, the TR7 register is configured with

the desired physical address as well as the PCD

and PWT bits. The BI, HV, HD and HB bits are not

used. The TR6 register is then configured with the

linear address, D, U, W and V bits. The D, U, and

W bits must be complements of the D#, U#, and

W# bits during a write. When the TR6 register is

configured, the ST6x86 CPU writes the linear and

physical address into the main TLB along with the

A, D, U, and W bits. The main TLB entry is

selected by bits 12 through 18 of the linear

address field.

TLB Lookup. During a TLB lookup, the ST6x86

CPU queries the TLB with a given linear address

and expected A, W, U and D values. The query

returns a corresponding physical address, and the

source of the address. The address source could

be from the main TLB, from the victim TLB or from

the variable-size paging mechanism.

The TLB lookup involves a single TR6 register

write. The CMD bits are set to 0x1. The D, U, W,

D#, U# and W# bits are not used during TLB look-

ups.

After a TLB lookup, theHV, HD and HB bits in TR7

indicate which (if any) PTEs were found with the

requested linear address. If a TLB entry was

found for a PTE in the victim or variable size-pag-

ing cache, theBI bit inthe TR7 register will contain

the index of the particular entry. If multiple entries

respond, only the HV, HD and HB bits are valid

and all TR7 fields are undefined.

Figure 2.32. TLB Test Registers

ST6x86

2-49

Table 2.26. TLB TestRegister Bit Definitions

NAME NAME RANGE DESCRIPTION

TR7

ADR7 31-12 Physical address or variable page size mechanism mask.

TLB lookup: data field from the TLB.

TLB write: data field written into the TLB.

PCD 11 Page-level cache disable bit (PCD).

Corresponds to the PCD bit of a page table entry.

PWT 10 Page-level cache write-through bit (PWT).

Corresponds to the PWT bit of a page table entry.

BI 9-7 Cell index for victim TLB and block cache operations.

HV 5 Victim TLB hit.

HD 4 Main TLB hit.

HB 3 Variable-Size Paging Mechanism hit.

TR6

ADR6 31-12

Linear Address.

TLB lookup: The TLB is interrogated per this address. If one and only

one match occurs in the TLB, the rest of the fields in TR6 and TR7 are

updated per the matching TLB entry.

TLB write: A TLB entry is allocated to this linear address.

V11 PTE Valid.

TLB write: If set, indicates that the TLB entry contains valid data. If

clear, target entry is invalidated.

D,D# 10-9 Dirty Attribute Bit and its complement.

Refer to Table 2.27.

U,U# 8-7 User/Supervisor Attribute Bit and its complement.

Refer to Table 2.27.

W,W# 6-5 Write Protect bit and its complement.

Refer to Table 2.27.

A,A# 4-3 Accessed Bit and its complement.

Used for block cache entries only.

Refer to Table 2.27.

CMD 2-0 Array Command Select.

Determines TLB array command.

Refer to Table 2.28.

ST6x86

2-50

Table 2.27. TR6 Attribute Bit Pairs

Table 2.28. TR6 Command Bits

BIT BIT# EFFECT ON TLB LOOKUP EFFECT ON TLB WRITE

0 0 Do not match. Undefined.

0 1 If bit = 0, match. Bit is cleared.

1 0 If bit = 1, match. The bit is set.

1 1 If bit = 0 or 1, match. Undefined.

Note: “BIT” applies to A, D, U or W fields in TR6; “BIT#” applies to A#, D#, U#, or W# fields in TR6.

CMD Command

0x0 Direct write to main TLB.

0x1 TLB lookup for a linear address in all arrays.

100 Write to variable page size mask only.

110 Write to variable page size linear and physical address fields.

101 Read variable page size mask and linear address.

111 Read variable page size cache physical and linear address.

Note: x = don’t care

ST6x86

2-51

2.6.5 Variable-Size Paging Mechanism

The Variable-Size Paging Mechanism (VSPM) is

an advanced alternative to traditional paging. As

shown in Figure 2.33, VSPM allows the creation

of pages ranging in size from 4 KBytes to

4 GBytes. The larger page size nearly eliminates

page table thrashing associated with using multi-

ple 4-KByte pages.

For example, paging 1 MByte of memory requires

256 4-KByte pages using traditional paging. The

software not only incurs overhead during setting

up the 256 pages, but also incurs additional over-

head accessing the page tables each time a page

is not found in the on-chip TLB. In contrast, a sin-

gle 1-MByte page virtually eliminates the over-

head.

Configuring Variable-Size Pages. The VSPM is

configured using TLB test registers, TR6 and

TR7 (These registers are also used to test the

TLB). The VSPM configuration is performed in

much the samemanner aswhen writing to a line of

the TLB (Refer to Section 2.6.4.2.). The major

exception to this, is that a mask field is written to

the VSPM as part of the VSPM configuration.

The physical address, linear address, valid bit and

attribute bits in a main TLB write all have the same

meaning as in a main TLB read except for that

CMD=110. The BI field is used to select the VSPM

cell to be written.

A VSPM mask setup operation is performed when

CMD=100 and a test register write is performed.

During aVSPM mask setup, the TR7 address field

is used as the mask field. The mask field selec-

tively masks linear address bits 31-12 from the

VSPM tag compare. This has the effect of allow-

ing the VSPM to map pages greater than

4 KBytes.

Figure 2.33. Variable-Size Paging Mechanism

1739200

Physical Page

Memory

< 4 GByte

4GByte

Linear

Address

Variable-Size

Paging Mechanism

Physical

Address

ST6x86

2-52

After a VSPM mask setup, the valid bit, attribute

bits, and the linear address are left in undefined

states. Therefore, the VSPM mask setup should

be performed prior to other VSPM operations.

Unlike the victim and main TLBs, the VSPM opera-

tions make use of the accessed bit. During a

VSPM mask or physical address write the A and

A# fields are written to the VSPM.

VSPM Reads. VSPM reads are performed with

the address of the entry to be read in the BI field of

the TR7 register and with CMD=111. The entry’s

and physical address is read intothe TR6 andTR7

address fields as well as the valid bit, and attribute

bits.

If CMD=101, the linear address, mask, valid bit

and attribute bits are read.

2.7 Memory Caches

The ST6x86 CPU contains two memory caches as

described in Chapter 1. The Unified Cache acts as

the primary data cache, and secondary instruction

cache. The Instruction Line Cache is the primary

instruction cache and provides a high speed

instruction stream for the Integer Unit.

The unified cache is dual-ported allowing simulta-

neous access to any two unique banks. Twodiffer-

ent banks may be accessed at the same time

permitting any two of the following operations to

occur in parallel:

- Code fetch

- Data read (X pipe, Y pipe or FPU)

- Data write (X pipe, Y pipe or FPU).

2.7.1 Unified Cache MESI States

The unified cache lines are assigned one of four

MESI states as determined by MESI bits stored in

tag memory. Each 32-byte cache line is divided

into two 16-byte sectors. Each sector contains its

own MESI bits. The four MESI states are

described below:

Modified

MESI cache lines are those that have

been updated by the CPU, but the corresponding

main memory location has not yet been updated

by an external write cycle. Modified cache lines

are referred to as dirty cache lines.

Exclusive

MESI lines are lines that are exclusive to

the ST6x86 CPU and are not duplicated within

another caching agent’s cache within the same

system. A write to this cache line may be per-

formed without issuing an external write cycle.

Shared

MESI lines may be present in another

caching agent’s cache within the same system. A

write to this cache line forces a corresponding

external write cycle.

Invalid

MESI lines are cache lines that do not con-

tain any valid data.

ST6x86

2-53

2.7.1.1 UnifiedCache Testing

The unified cache can be tested through the useof

TR3, TR4, and TR5 on-chip test registers. Fields

within these test registers identify which area of

cache will be selected for testing.

Cache Organization. The unified cache (Figure

2.34) is divided into 32-bytes lines. This cache is

divided into four sets. Since a set (as well as the

cache) is smaller than main memory, each line in

the set corresponds to more than one line in main

memory. When a cache line is allocated, bits

A31-A12 of the main memory address are stored

in the cache line tag. The remaining address bits

are used to identify the specific 32-byte cache line

(A11-A5), and the specific 4-byte entry within the

cache line (A4-A2).

Test Initiation. A test register operation is initiated

by writing to the TR5 register shown in Figure 2.35

using a special MOV instruction. The TR5 CTL

field, detailed in Table 2.29, determines the func-

tion to be performed. For cache writes, the regis-

ters TR4and TR3 must beinitialized beforea write

is made to TR5. Eight 4-byte accesses are

required to access a complete cache line.

Figure 2.34. Unified Cache

1739700

SET 0

SET 1

SET 2

SET 3

ENT = 4-byte entry

32 Bytes of Data

512 Lines

ENT ENT ENT ENT ENT ENT ENT ENT

Lower SectorUpper Sector Typical

Single

Line

128 Lines

ST6x86

2-54

Figure 2.35. Cache Test Registers

Table 2.29. Cache Test Register Bit Definitions

NAME FIELD

NAME RANGE DESCRIPTION

TR5

SET 13-12 Cache set selection (one of four “sets”).

LINE 11-5 Cache line selection (one of 128 lines).

ENT 4-2 Entry selection (one of eight 4-byte entries in a line).

CTL 1 - 0

Control field

If = 00: flush cache without invalidate

If = 01: write cache

If = 10: read cache

If = 11: no cache or test register modification

TR4

TAG 31 -12 Physical address for selected line

MESIU 7 - 6

If = 00, Modified Upper Sector MESI bits

If = 01, Shared Upper Sector MESI bits

If = 10, Exclusive Upper Sector MESI bits

If = 11, Invalid Upper Sector MESI bits*

MESIL 5 -4

If = 00, Modified Lower Sector MESI bits

If = 01, Shared Lower Sector MESI bits

If = 10, Exclusive Lower Sector MESI bits

If = 11, Invalid Lower Sector MESI bits*

MRU 3 -0 Used to determine the Least Recently Used (LRU) line.

TR3 DATA 31 -0 Data written or read during a cache test.

*Note: All 32 bytes should contain valid data before a line is marked as valid.

1729400

TR5

DATA(CACHEDATA)

MESIL TR4

TR3

CTL

MRUTAG (CACHE TAG ADDRESS)

111098765432 01

98765432 01

1213

LINESET ENT

11 1012

MESIU

RESERVED

ST6x86

2-55

Write Operations. During a write, the TR3 DATA

(32-bits) and TAG field information is written to the

address selected by the SET, LINE, and ENT

fields in TR5.

Read Operations. During a read, the cache

address selected bythe SET, LINE and ENT fields

in TR5 are used to read data into the TR3 DATA

(32-bits) field. The TAG, MESI and MRU fields in

TR4 are updated with the information from the

selected line. TR3 holds the selected read data.

Cache Flushing. A cache flush occurs during a

TR5 write if the CTL field is set to zero. During

flushing, the CPU’s cache controller reads through

all the lines in the cache. “Modified” lines are rede-

fined as “shared” by setting the shared MESI bit.

Clean lines are left in their original state.

2.8 Interrupts and Exceptions

The processing of either an interrupt or an excep-

tion changes the normal sequential flow of a pro-

gram bytransferring program control toa selected

service routine. Except for SMM interrupts, the

location of the selected service routine is deter-

mined by one of the interrupt vectors stored in the

interrupt descriptor table.

Hardware interrupts are generated by signal

sources external to the CPU. Allexceptions (includ-

ingso-called software interrupts) are producedinter-

nally by the CPU.

2.8.1 Interrupts

External events can interrupt normal program exe-

cution by using one of the three interrupt pins on

the ST6x86 CPU.

- Non-maskable Interrupt (NMI pin)

- Maskable Interrupt (INTR pin)

- SMM Interrupt (SMI# pin).

For most interrupts, program transfer to the inter-

rupt routine occurs after the current instruction has

been completed. When the executionreturns to the

original program, it begins immediately following the

lastcompleted instruction.

With the exception of stringoperations, interrupts

are acknowledged between instructions. Long

string operations have interrupt windows between

memory moves that allow interrupts to be

acknowledged.

The NMI interrupt cannot be masked by software

and always uses interrupt vector2 to locate its ser-

vice routine. Since the interrupt vector is fixed and

is supplied internally, no interrupt acknowledge

bus cycles are performed. This interrupt is nor-

mally reserved for unusual situations such as par-

ity errors and has priority over INTR interrupts.

Once NMI processing has started, no additional

NMIs are processed until an IRET instruction is

executed, typically at the end of the NMI service

routine. If NMI is re-asserted prior to execution of

the IRET instruction, one and only one NMI rising

edge is stored and processed after execution of

the nextIRET.

ST6x86

2-56

During the NMI service routine, maskable inter-

rupts may be enabled (unmasked). If an

unmasked INTR occurs during the NMI service

routine, the INTR is serviced and execution

returns to the NMI service routine following the next

IRET. If a HALT instruction is executed within the

NMI service routine, the ST6x86 CPU restarts exe-

cution only in response to RESET, an unmasked INTR

or an SMM interrupt. NMI does not restart CPU

execution under this condition.

The INTR interrupt is unmasked when the Inter-

rupt EnableFlag (IF) in the EFLAGS register is set

to 1. When an INTR interrupt occurs, the CPU

performs two locked interrupt acknowledge bus

cycles. During the second cycle, the CPU reads

an 8-bit vector that is supplied by an external inter-

rupt controller. This vector selects one of the 256

possible interrupt handlers which will be executed

in response to the interrupt.

The SMM interrupt has higher priority than either

INTR or NMI. After SMI# is asserted, program

execution is passed to an SMI service routine that

runs in SMM address space reserved for this pur-

pose. The remainder of this section does not

apply to the SMM interrupts. SMM interrupts are

described in greater detail later inthis chapter.

2.8.2 Exceptions

Exceptions are generated by an interrupt instruc-

tion or a program error. Exceptions are classified

as traps, faults or aborts depending on the mecha-

nism used to report them and the restartability of

the instruction that first caused the exception.

ATrap Exception is reported immediately follow-

ing the instruction that generated the trap excep-

tion. Trap exceptions are generated by execution

of a software interrupt instruction (INTO, INT 3,

INT n,BOUND), by a single-step operation or by a

data breakpoint.

Software interrupts can be used to simulate hard-

ware interrupts. Forexample, an INT n instruction

causes the processor to execute the interrupt ser-

vice routine pointed to by the nth vector in the

interrupt table. Execution of the interrupt service

routine occurs regardless of the state of the IF flag

in the EFLAGS register.

The one byte INT 3, or breakpoint interrupt (vector

3), is a particular case of the INT n instruction. By

inserting this one byte instruction in a program, the

user can set breakpoints in the code that can be

used during debug.

Single-step operation is enabled by setting the TF

bit in the EFLAGS register. When TF is set, the

CPU generates a debug exception (vector 1) after

the execution of every instruction. Data break-

points also generate a debug exception and are

specified by loading the debug registers

(DR0-DR7) with the appropriate values.

ST6x86

2-57

AFault Exception is reported prior to completion

of the instruction that generated the exception.

By reporting the fault prior to instruction comple-

tion, the CPU is left in a state that allows the

instruction to be restarted and the effects of the

faulting instruction to be nullified. Fault exceptions

include divide-by-zero errors, invalid opcodes,

page faults and coprocessor errors. Instruction

breakpoints (vector 1) are also handled as faults.

After execution of the fault service routine, the

instruction pointer points to the instruction that

caused the fault.

An Abort Exception is a type of fault exception

that is severe enough that the CPU cannot restart

the program at the faulting instruction. The double

fault (vector 8) is the only abort exception that

occurs on the ST6x86 CPU.

2.8.3 Interrupt Vectors

When the CPU services an interrupt or exception,

the current program’s FLAGS, code segment and

instruction pointer are pushed onto the stack to

allow resumption of execution of the interrupted

program. In protected mode, the processor also

saves an error code for some exceptions. Pro-

gram control is then transferred to the interrupt

handler (also called the interrupt service routine).

Upon execution of an IRET at the end of the ser-

vice routine, program execution resumes by pop-

ping from the stack, the instruction pointer, code

segment, and FLAGS.

Interrupt Vector Assignments

Each interrupt (except SMI#) and exception is

assigned one of 256 interrupt vector numbers

Table 2.30. The first 32 interrupt vector assign-

ments are defined or reserved. INT instructions

acting as software interrupts may use any of the

interrupt vectors, 0 through 255.

ST6x86

2-58

Table 2.30. Interrupt Vector Assignments

INTERRUPT VECTOR FUNCTION EXCEPTION TYPE

0 Divide error FAULT

1 Debug exception TRAP/FAULT*

2 NMI interrupt

3 Breakpoint TRAP

4 Interrupt on overflow TRAP

5 BOUND range exceeded FAULT

6 Invalid opcode FAULT

7 Device not available FAULT

8 Double fault ABORT

9 Reserved

10 Invalid TSS FAULT

11 Segment not present FAULT

12 Stack fault FAULT

13 General protection fault TRAP/FAULT

14 Page fault FAULT

15 Reserved

16 FPU error FAULT

17 Alignment check exception FAULT

18-31 Reserved

32-255 Maskable hardware interrupts TRAP

0-255 Programmed interrupt TRAP

*Note: Data breakpoints and single-steps are traps. All other debug exceptions are faults.

ST6x86

2-59

In response to a maskable hardware interrupt

(INTR), the ST6x86 CPU issues interrupt acknowl-

edge bus cycles used to read the vector number

from external hardware. These vectors should be in

the range 32 - 255 as vectors 0 - 31 are reserved.

Interrupt Descriptor Table

The interrupt vector number is used by the ST6x86

CPU to locate an entry in the interrupt descriptor

table (IDT). In real mode, each IDT entry consists

of a four-byte far pointer to the beginning of the

corresponding interrupt service routine. In pro-

tected mode, each IDT entry is an eight-byte

descriptor. The Interrupt Descriptor Table Register

(IDTR) specifies the beginning address and limit of

theIDT. Following reset, theIDTR contains a base

address of 0h with a limit of 3FFh.

The IDT can be located anywhere in physical

memory as determined by the IDTR register. The

IDT may contain different types of descriptors:

interrupt gates, trap gates and task gates. Inter-

rupt gates are used primarily to enter a hardware

interrupt handler. Trap gates are generally used to

enter an exception handler or software interrupt

handler. If an interrupt gate is used, the Interrupt

Enable Flag (IF) in the EFLAGS register is cleared

before the interrupt handler is entered. Task gates

are used to make the transition to a new task.

2.8.4 Interrupt and Exception Priorities

As the ST6x86 CPU executes instructions, it fol-

lows a consistent policy for prioritizing exceptions

and hardware interrupts. The priorities for compet-

ing interrupts and exceptions are listed in Table

2.31. Debug traps for the previous instruction and

the next instructions always take precedence.

SMM interrupts are the next priority. When NMI

and maskable INTR interrupts are both detected at

the same instruction boundary, the ST6x86 micro-

processorservices the NMI interrupt first.

The ST6x86 CPU checks for exceptions in parallel

with instruction decoding and execution. Several

exceptions can result from a single instruction.

However, only one exception is generated upon

each attempt to execute the instruction. Each

exception service routine should make the appro-

priate corrections to the instruction and then

restart the instruction. In this way, exceptions can

be serviced until the instruction executes properly.

The ST6x86 CPU supports instruction restart after

all faults, except when an instruction causesa task

switch to a task whose task state segment (TSS) is

partially not present. A TSS can be partially not

present if the TSS is not page aligned and one of

the pages where the TSS resides is not currently

in memory.

ST6x86

2-60

Table 2.31. Interrupt and Exception Priorities

PRIORITY DESCRIPTION NOTES

0 Warm Reset Caused by the assertion of WM_RST.

1Debug traps and faults from previous

instruction. Includes single-step trap and data breakpoints specified

in the debug registers.

2 Debug traps for next instruction. Includes instruction execution breakpoints specified in

the debug registers.

3 Hardware Cache Flush Caused by the assertion of FLUSH#.

4 SMM hardware interrupt. SMM interrupts are caused by SMI# asserted and always

have highest priority.

5 Non-maskable hardware interrupt. Caused by NMI asserted.

6 Maskable hardware interrupt. Caused by INTR asserted and IF = 1.

7Faults resulting from fetching the next

instruction. Includes segment not present, general protection fault

and page fault.

8 Faults resulting from instruction decoding. Includes illegal opcode, instruction too long, or privilege

violation.

9 WAIT instruction and TS = 1 and MP = 1. Device not available exception generated.

10 ESC instruction and EM = 1 or

TS = 1. Device not available exception generated.

11 Floating point error exception. Caused by unmasked floating point exception

with NE = 1.

Segmentation faults (for each memory ref-

erence required by the instruction) that pre-

vent transferring the entire memory

operand.

Includes segment not present, stack fault, and general

protection fault.

13 Page Faults that prevent transferring the

entire memory operand.

14 Alignment check fault.

ST6x86

2-61

2.8.5 Exceptions in Real Mode

Many of the exceptions describedin Table 2.31 are

not applicable in real mode. Exceptions 10, 11,

and 14 do not occur in real mode.

Other exceptions have slightly different meanings

in real mode as listed in Table 2.32.

Table 2.32. Exception Changes in Real Mode

VECTOR

NUMBER PROTECTED MODE FUNCTION REAL MODE FUNCTION

8 Double fault. Interrupt table limit overrun.

10 Invalid TSS. x

11 Segment not present. x

12 Stack fault. SS segment limit overrun.

13 General protection fault. CS, DS, ES, FS, GS segment limit overrun.

14 Page fault. x

Note: x = does not occur

ST6x86

2-62

2.8.6 Error Codes

When operating in protected mode, the following

exceptions generate a 16-bit error code:

•Double Fault

•Alignment Check

•Page Fault

•Invalid TSS

•Segment Not Present

•Stack Fault

•General Protection Fault

The error code is pushed onto the stack prior to

entering the exception handler. The error code for-

mat is shown in Figure 2.36 and the error code bit

definitions are listed in Table 2.33. Bits 15-3

(selector index) are not meaningful if the error

code was generated as the result of a page fault.

The error code is always zero for double faults and

alignment check exceptions.

Figure 2.36. Error Code Format

Table 2.33. ErrorCode Bit Definitions

153210

SelectorIndex S2 S1 S0

FAULT

TYPE

SELECTOR

INDEX

(BITS 15-3)

(BIT 2) S1

(BIT 1) S0

(BIT 0)

Double Fault or Align-

ment Check 0000

Page Fault Reserved.

Fault caused by:

0 = not present page

1 = page-level

protection violation.

Fault occurred during:

0 = read access

1 = write access.

Fault occurred during:

0 = supervisor access

1 = user access.

IDT Fault Index of faulty

IDT selector. Reserved. 1

If = 1, exception

occurred while trying

to invoke exception

or hardware interrupt

handler.

Segment

Fault Index of faulty

selector. TI bit of faulty

selector. 0

If =1, exception

occurred while trying

to invoke exception

or hardware interrupt

handler.

ST6x86

2-63

2.9 System Management Mode

System Management Mode (SMM) provides an

additional interrupt which can be used for system

power management or software transparent emu-

lation of I/O peripherals. SMM is entered usingthe

System Management Interrupt (SMI#) that has a

higher priority than any other interrupt, including

NMI. An SMI interrupt can also be triggered via

software using an SMINT instruction. After an

SMI interrupt, portions of the CPU state are auto-

matically saved, SMM is entered, and program

execution begins at the base of SMM address

space (Figure 2.37). Running in SMM address

space, the interrupt routine does not interfere with

the operating system or any application program.

Eight SMM instructions have been added to the

x86 instruction set that permit software initiated

SMM, and saving and restoring of the total CPU

state when in SMM mode. Two SMM pins, SMI#

and SMIACT#, support SMM functions.

Figure 2.37. System Management Memory Address Space

FFFF FFFFh

Physical Memory

Physical

0000 0000h

Potential

Defined

0000 0000h

FFFF FFFFh

1713604

Non-SMM Mode

SMIACT#Active

4 KBytes to

SMM Mode

4 GBytes

Memory Space SMM Address

Space

SMM

Address

Space

4 GBytes

SMIACT# Negated

ST6x86

2-64

2.9.1 SMM Operation

SMM operation is summarized in Figure 2.38.

Entering SMM requires the assertion of the SMI#

pin forat leasttwoCLK periods orexecution of the

SMINT instruction. For theSMI# orSMINT instruc-

tion to be recognized, the following configuration

The configuration registers are discussed in detail

earlier in this chapter.

Table 2.34. Requirementsfor

Recognizing SMI# and SMINT

After recognizing SMI# or SMINT and prior to exe-

cuting the SMI service routine, some of the CPU

state information is changed. Prior to modification,

this information is automatically saved in the SMM

memory space header located at the top of SMM

memory space. After the header is saved, the

CPU enters real mode and begins executing the

SMI service routine starting at the SMM memory

base address.

The SMI service routine is user definable and may

contain system or power management software. If

the power management software forces the CPU

to power down, orthe SMI service routinemodifies

more than what is automatically saved, the com-

plete CPU state information can be saved.

Figure 2.38. SMI Execution Flow Diagram

SMI CCR1 (1) 1 1

SMAC CCR1 (2) 0 1

ARR3 SIZE (3-0) >0 >0

SM3 CCR1 (7) 1 1

1713703

SMI# Sampled Active or

CPU State Stored in SMM

CPU Enters Real Mode

ExecutionBegins at SMM

RSM InstructionRestores CPU

NormalExecution Resumes

AddressSpace Header

Address SpaceBase Address

State UsingHeader Information

SMINTInstruction Executed

ST6x86

2-65

2.9.2 SMM Memory Space Header

With every SMI interrupt or SMINT instruction, cer-

tain CPU state information is automatically saved

in the SMM memory space header located at the

top of SMM address space as shown Figure 2.39

and Table 2.35.

The header contains CPU state information that is

modified when servicing an SMI interrupt.

Included in this information are two pointers. The

Current IP points to the instruction that was exe-

cuting when the SMI was detected.

Figure 2.39. SMM Memory Space Header

DR7

EFLAGS

CR0

031 Top of SMM

-4h

-8h

-Ch

-10h

-14h

-18h

-1Ch

-20h

-24h

-28h

Current IP

Next IP

CS Selector

CS Descriptor (Bits 63-32)

CS Descriptor (Bits 31-0)

ESI or EDI

1713504

31 16 15 0

31 210

-2Ch

-30h

Address Space

I/O Write AddressI/O Write Data Size

I/O Write Data

16 15

2122

CPL

Reserved

ST6x86

2-66

The Next IP points to the instruction that will be

executed after exiting SMM. Also saved are the

contents of debug register 7 (DR7), the extended

flags register (EFLAGS), and control register 0

(CR0). If SMM has been entered due to an I/O

trap for a REP INSx or REP OUTSx instruction,

the Current IP and Next IP fields contain the same

addresses and the I and P field contain valid infor-

mation.

If entry into SMM was caused by an I/O trap it is

useful for the programmer to know the port

address, data size and data value associated with

thatI/Ooperation. Thisinformation is also saved in

the header and is only valid for an I/O write opera-

tion. The I/O write information is not restored within

the CPU when executing a RSM instruction.

Table 2.35. SMM Memory Space Header

NAME DESCRIPTION SIZE

DR7 The contents of Debug Register 7. 4Bytes

EFLAGS The contents of Extended Flags Register. 4Bytes

CR0 The contents of Control Register 0. 4Bytes

Current IP The address of the instruction executed prior to servicing SMI interrupt. 4Bytes

Next IP The address of the next instruction that will be executed after exiting SMM mode. 4Bytes

CS Selector Code segment register selector for the current code segment. 2Bytes

CPL Current privilege level for current code segment. 2Bits

CS Descriptor Code segment register descriptor for the current code segment. 8Bytes

HIf set indicates the processor was in a halt or shutdown prior to servicing the SMM

interrupt. 1Bit

SSoftware SMM Entry Indicator.

S = 1, if current SMM is the result of an SMINT instruction.

S = 0, if current SMM is not the result of an SMINT instruction. 1Bit

PREP INSx/OUTSx Indicator.

P = 1 if current instruction has a REP prefix.

P = 0 if current instruction does not have a REP prefix. 1Bit

IIN, INSx, OUT,or OUTSx Indicator.

I = 1 if current instruction performed is an I/O WRITE.

I = 0 if current instruction performed is an I/O READ. 1Bit

I/O Write Data Size

Indicates size of data for the trapped I/O write.

01h = byte

03h = word

0Fh = dword

2Bytes

I/O Write Address Processor port used for the trapped I/O write. 2Bytes

I/O Write Data Data associated with the trapped I/O write. 4Bytes

ESI or EDI Restored ESI or EDI value. Used when it is necessary to repeat a REP OUTSx or

REP INSx instruction when one of the I/O cycles caused an SMI# trap. 4Bytes

Note: INSx = INS, INSB, INSW or INSD instruction.

Note: OUTSx = OUTS, OUTSB, OUTSW and OUTSD instruction.

ST6x86

2-67

2.9.3 SMM Instructions

The ST6x86 CPU automatically saves the minimal

amount of CPU state information when entering

SMM which allows fast SMI service routine entry

and exit. After entering the SMI service routine,

the MOV, SVDC, SVLDT and SVTS instructions

can be used to savethe complete CPU state infor-

mation. If the SMI service routine modifies more

than what is automatically saved or forces the CPU

to power down, the complete CPU state informa-

tion must be saved. Since the CPU is a static

device, its internal state is retained when the input

clock is stopped. Therefore, an entire CPU state

save is not necessary prior to stopping the input

clock.

The new SMM instructions, listed in Table 2.36,

can only be executed if:

1)SMI# = 0

2)SM3 = 1

3)ARR3 SIZE > 0

4)Current Privilege Level = 0

5)SMAC bit is set or the CPU is in an

SMI service routine.

If the above conditions are not met and an attempt

is made to execute an SVDC, RSDC, SVLDT,

RSLDT, SVTS, RSTS, SMINT or RSM instruction,

an invalid opcode exception is generated. These

instructions can be executed outside of defined

SMMspace provided theabove conditions are met.

The SMINT instruction may be used as a software

controlled mechanism to enter SMM.

Table 2.36. SMM Instruction Set

INSTRUC-

TION OPCODE FORMAT DESCRIPTION

SVDC 0F 78 [mod sreg3 r/m] SVDC mem80, sreg3

Save Segment Register and Descriptor

Saves reg (DS, ES, FS, GS, or SS) to mem80.

RSDC 0F 79 [mod sreg3 r/m] RSDC sreg3, mem80

Restore Segment Register and Descriptor

Restores reg (DS, ES, FS, GS, or SS) from mem80.

Use RSM to restore CS.

Note: Processing “RSDC CS, Mem80” will

produce an exception.

SVLDT 0F 7A [mod 000 r/m] SVLDT mem80

Save LDTR and Descripto

Saves Local Descriptor Table (LDTR) to mem80.

RSLDT 0F 7B [mod 000 r/m] RSLDT mem80

Restore LDTR and Descriptor

Restores Local Descriptor Table(LDTR) from mem80.

SVTS 0F 7C [mod 000 r/m] SVTS mem80

Save TSR and Descriptor

Saves Task State Register (TSR) to mem80.

RSTS 0F 7D [mod 000 r/m] RSTS mem80

Restore TSR and Descriptor

Restores Task State Register (TSR) from mem80.

SMINT 0F 7E SMINT

Software SMM Entry

CPU enters SMM mode. CPU state information is

saved in SMM memory space header and execution

begins at SMM base address.

RSM 0F AA RSM

Resume Normal Mode

Exits SMM mode. The CPU state is restored using

the SMM memory space header and execution

resumes at interrupted point.

Note: mem80 = 80-bit memory location

ST6x86

2-68

All of the SMM instructions (except RSM and

SMINT) save or restore 80 bits of data, allowing

the saved values to include the hidden portion of

the register contents.

2.9.4 SMM Memory Space

SMM memory space is defined by setting the SM3

bit and specifyingthe baseaddress and size of the

SMM memory space in the ARR3 register. The

base address must be a multiple of the SMM

memory space size. For example, a 32 KByte

SMM memory space must be located at a

32 KByte address boundary. The memory space

sizecan range from4 KBytesto 4 GBytes.

SMM memory space accesses are always

non-cacheable. SMM accesses ignore the state of

the A20M# input pin and drive the A20 address bit

tothe unmasked value.

SMM memory space can be accessed while in

normal mode by setting the SMAC bit in the CCR1

SMM memory space.

2.9.5 SMI Service Routine Execution

Upon entry into SMM, after the SMM header has

beensaved, theCR0, EFLAGS, and DR7 registers

are set to their reset values. The Code Segment

(CS) register is loaded with the base, as defined

by the ARR3 register, and a limit of 4 GBytes. The

SMI service routine then begins execution at the

SMM base address in real mode.

The programmer must savethe valueof any regis-

ters that may be changed by the SMI service rou-

tine. For data accesses immediately after entering

the SMI service routine, the programmer must use

CS as a segment override. I/O port access is pos-

sible during the routine but care must be taken to

save registers modified by the I/O instructions.

Before using a segment register, the register and

the register’s descriptor cache contents should be

saved using the SVDC instruction. While execut-

ing in the SMM space,execution flow cantransferto

normal memory locations.

Hardware interrupts, (INTRs and NMIs), may be

serviced during a SMI service routine. If interrupts

are to be serviced while executing in the SMM

memory space, the SMM memory space must be

within the 0 to 1 MByte address range to guaran-

tee proper return to the SMI service routine after

handling the interrupt.

INTRs are automatically disabled when entering

SMM since the IF flag is set to its reset value.

Once in SMM, the INTR can be enabled by setting

the IF flag. NMI is also automatically disable when

entering SMM. Once in SMM, NMI can be

enabled by settingNMI_EN in CCR3. If NMI is not

enabled, the CPU latches one NMI event and ser-

vices the interrupt after NMI has been enabled or

after exiting SMM throughthe RSM instruction.

Within the SMI service routine, protected mode

maybe entered and exited as required, andreal or

protected mode device drivers may be called.

ST6x86

2-69

To exit the SMI service routine, a Resume (RSM)

instruction, rather than an IRET, is executed. The

RSM instruction causes the ST6x86 processor to

restore the CPU state usingthe SMM headerinfor-

mation and resume execution at the interrupted

point. If the full CPU state was saved by the pro-

grammer, the stored values should be reloaded

prior to executing the RSM instruction using the

MOV, RSDC, RSLDT and RSTS instructions.

CPU States Related to SMM and Suspend

Mode

The state diagram shown in Figure 2.40 illustrates

the various CPU states associated with SMM and

suspend mode. While in the SMI service routine,

the ST6x86 CPU can enter suspend mode either

by (1) executing a halt (HLT) instruction or (2) by

asserting the SUSP# input.

During SMM operations and while in SUSP# initi-

ated suspend mode, an occurrence of SMI#, NMI,

or INTR is latched. (In order for INTR to be

latched, the IF flagmust be set.) The INTRor NMI

is serviced after exiting suspend mode.

If suspend mode is entered via a HLT instruction

from the operating system or application software,

the reception of an SMI# interrupt causes the CPU

to exit suspend mode and enter SMM.

2.10 Shutdown and Halt

The Halt Instruction (HLT) stops program execu-

tion and prevents the processor from using the

local bus until restarted. The ST6x86 CPU then

issues a special Stop Grant bus cycle and enters a

low-power suspend mode if the SUSP_HLT bit in

CCR2 is set. SMI, NMI, INTR with interrupts

enabled (IF bit in EFLAGS=1), WM_RST or

RESET forces the CPU out of the halt state. If

interrupted, the saved code segment and instruc-

tion pointer specify the instruction following the

HLT.

Shutdown occurs when a severe error is detected

thatprevents furtherprocessing. An NMI input can

bring the processor out of shutdown if the IDT limit

is large enough to contain the NMI interrupt vector

andthe stack has enough room to contain the vec-

tor and flag information. Otherwise, shutdown can

only be exited by a processorreset.

ST6x86

2-70

Figure 2.40. SMM and Suspend Mode State Diagram

OS/Application

Software

RESET

RSM*SMI#=0

HLT*

SUSP#=1

NMI or INTR

SUSP#=0

SUSP#=1

HLT*

INTR or NMI IRET*

INTR and NMI

IRET*

* Instructions

SMI# = 0

(INTR, NMI and SMI latched)

(INTR and NMI latched)

SMI Service

1715903

Suspend Mode Interrupt Service

Suspend Mode

SUSP#=0

Non-SMM Operations

SMM Operations

(SUSPA# = 0) Routine

(SUSPA# = 0)

Routine

(SMI#=0)

(SUSPA# = 0)

Interrupt Service

Routine Interrupt Service

Routine

SMINT*

NMI or INTR

ST6x86

2-71

2.11 Protection

Segment protection and page protection are safe-

guards built into the ST6x86 CPU protected mode

architecture which deny unauthorized or incorrect

access to selected memory addresses. These

safeguards allow multitasking programs to be iso-

lated from each other and from the operating sys-

tem. Page protection is discussed earlier in this

chapter. This section concentrates on segment

protection.

Selectors and descriptors are the key elements in

the segment protection mechanism. The segment

base address, size, and privilege level are estab-

lished by a segment descriptor. Privilege levels

control the use of privileged instructions, I/O

instructions and access to segments and segment

descriptors. Selectors are used to locate segment

descriptors.

Segment accesses are divided into two basic

types, those involving code segments (e.g., control

transfers) and those involving data accesses.

The ability of a task to access a segment depends

on the:

- segment type

- instruction requesting access

- type of descriptor used to define the segment

- associated privilege levels (described below).

Data stored in a segmentcan be accessedonly by

code executing at the same or a more privileged

level. A code segment or procedure can only be

called by a task executing at the same or a less

privileged level.

2.11.1 Privilege Levels

The values for privilege levels range between 0

and 3. Level 0 is the highest privilege level (most

privileged), and level 3 is the lowest privilege level

(least privileged). The privilege level in real mode

is effectively 0.

The Descriptor Privilege Level (DPL) is the privi-

lege level defined for a segment in the segment

descriptor. The DPL field specifies the minimum

privilege level needed to access the memory seg-

ment pointed to by the descriptor.

The Current Privilege Level (CPL) is defined as

the current task’s privilege level. The CPL of an

executing task is stored in the hidden portion of

the code segment register and essentially is the

DPL for the current code segment.

The Requested Privilege Level (RPL) specifies a

selector’s privilege level and is used to distinguish

between the privilege level of a routine actually

accessing memory (the CPL), and the privilege

level of theoriginal requestor (theRPL) of themem-

ory access. The lesser of the RPL and CPL is

calledtheeffectiveprivilege level (EPL). Therefore, if

RPL = 0 in a segment selector, the effective privi-

lege level is always determined by the CPL. If

RPL = 3, the effective privilege level is always 3

regardless of the CPL.

For a memory access to succeed, the effective

privilege level (EPL) must be at least as privileged

as the descriptor privilege level (EPL ≤DPL). If

the EPL is less privileged than the DPL (EPL >

DPL), a general protection fault is generated. For

example, if a segment has a DPL = 2, an instruc-

tion accessing the segment only succeeds if exe-

cuted with an EPL ≤2.

ST6x86

2-72

2.11.2 I/O Privilege Levels

The I/O Privilege Level (IOPL) allows the operat-

ing system executing at CPL=0 to define the least

privileged level at which IOPL-sensitive instruc-

tions can unconditionally be used. The IOPL-sen-

sitive instructions include CLI, IN, OUT, INS,

OUTS, REP INS, REP OUTS, and STI. Modifica-

tionof the IFbit in the EFLAGS register isalso sen-

sitive to the I/O privilege level. The IOPL is stored

in the EFLAGS register.

An I/O permission bit map is available as defined

by the 32-bit Task State Segment (TSS). Since

each task can have its own TSS, accessto individ-

ual processor I/O ports can be granted through

separate I/O permission bit maps.

If CPL ≤IOPL, IOPL-sensitive operations can be

performed. If CPL > IOPL, a general protection

fault is generated if the current task is associated

with a 16-bit TSS. If the current task is associated

with a 32-bit TSS and CPL > IOPL, the CPU con-

sults the I/O permission bitmap in the TSS to deter-

mine on a port-by-port basis whether or not I/O

instructions (IN, OUT, INS, OUTS, REP INS, REP

OUTS) are permitted, and the remaining

IOPL-sensitive operations generate a general pro-

tection fault.

2.11.3 Privilege Level Transfers

A task’s CPL can be changed only through inter-

segment control transfers using gates or task

switches to a code segment with a different privi-

lege level. Control transfers result from exception

and interrupt servicing and from execution of the

CALL, JMP, INT,IRET and RET instructions.

There are five types of control transfers that are

summarized in Table 2.37. Control transfers can be

made only when the operation causing the control

transfer references the correct descriptor type. Any

violation of these descriptor usage rules causes a

general protection fault.

Any control transfer that changes the CPL within a

task results in a changeof stack. The initial values

for the stack segment (SS) and stack pointer

(ESP) for privilege levels 0, 1, and 2 are stored in

the TSS. During a CALL control transfer, the SS

and ESP are loaded with the new stack pointer

andthe previousstackpointer is saved on the new

stack. When returning to the original privilege

level, the RET or IRET instruction restores the

less-privileged stack.

ST6x86

2-73

Table 2.37. Descriptor Types Used for ControlTransfer

Gates

Gate descriptors provide protection for privilege

transfers among executable segments. Gates are

used to transition to routines of the same or a

more privileged level. Call gates, interrupt gates

andtrap gates are used for privilege transfers within

a task. Task gates are used to transfer between

tasks.

Gates conform to the standard rules of privilege.

In other words, gates can be accessed by a task if

the effective privilege level (EPL) is the same or

more privilegedthan the gate descriptor’s privilege

level (DPL).

2.11.4 Initialization and Transition to

Protected Mode

The ST6x86 microprocessor switches to real

mode immediately after RESET. While operating

in real mode, the system tables and registers

should be initialized. The GDTR and IDTR must

point to a valid GDT and IDT, respectively. The GDT

must contain descriptors which describe the initial

code and data segments.

The processor can be placed in protected mode by

setting the PE bit in the CR0 register. After

enabling protected mode, the CS register should

be loaded and the instruction decode queue

should be flushed by executing an intersegment

JMP. Finally, all data segment registers should be

initialized with appropriate selector values.

TYPE OF CONTROL TRANSFER OPERATION

TYPES DESCRIPTOR

REFERENCED DESCRIPTOR

TABLE

Intersegment within the same privilege level. JMP, CALL, RET, IRET* Code Segment GDT or LDT

Intersegment to the same or a more privileged

level.

Interrupt within task (could change CPL level).

CALL Gate Call GDT or LDT

Interrupt Instruction,

Exception, External

Interrupt Trap or Interrupt Gate IDT

Intersegment to a less privileged level (changes

task CPL). RET,IRET* Code Segment GDT or LDT

Task Switch via TSS CALL, JMP Task State Segment GDT

Task Switch via Task Gate

CALL, JMP Task Gate GDT or LDT

IRET**, Interrupt Instruc-

tion, Exception, External

Interrupt Task Gate IDT

* NT (Nested Taskbit in EFLAGS) = 0

** NT (Nested Taskbit in EFLAGS) = 1

ST6x86

2-74

2.12 Virtual 8086 Mode

Both real mode and virtual 8086 (V86) mode are

supported by the ST6x86 CPUallowing execution of

8086application programs and 8086 operating sys-

tems. V86 mode allows the execution of

8086-type applications, yet still permits use of the

ST6x86 CPU paging mechanism. V86 tasks run

at privilege level 3. When loaded, all segment lim-

its are set to FFFFh(64K) as in real mode.

2.12.1 V86 Memory Addressing

While in V86 mode, segment registers are used in

an identical fashion to real mode. The contents of

the segment register are multiplied by 16 and

added to the offset to form the segment base lin-

ear address. The ST6x86 CPU permits the oper-

ating system to select which programs use the

V86 address mechanism and which programs use

protected mode addressing for each task.

The ST6x86 CPU also permits the use of paging

when operating in V86 mode. Using paging, the

1-MByte address space of the V86 task can be

mapped to anywhere in the 4-GByte linear

address space of the ST6x86 CPU.

The paging hardware allows multiple V86 tasks to

run concurrently, and provides protection and

operating system isolation. The paging hardware

must be enabled to run multiple V86 tasks or to

relocate the address space of a V86 task to physi-

cal address space greater than 1 MByte.

2.12.2 V86 Protection

All V86 tasks operate withthe least amount of priv-

ilege (level 3) and are subject to all of the ST6x86

CPU protected mode protection checks. As a

result, any attempt to execute a privileged instruc-

tion within a V86 task results in a general protec-

tion fault.

In V86 mode, a slightly different set of instructions

are sensitive to the I/O privilege level (IOPL) than

in protected mode. These instructions are: CLI,

INT n, IRET, POPF, PUSHF, and STI. The INT3,

INTO and BOUND variations of the INT instruction

are not IOPL sensitive.

2.12.3 V86 Interrupt Handling

To fully support the emulation of an 8086-type

machine, interrupts in V86 mode are handled as

follows. When an interrupt or exception is ser-

viced in V86 mode, program executiontransfers to

the interrupt service routine at privilege level 0

(i.e., transition from V86 to protected mode

occurs) and the VM bit in the EFLAGS register is

cleared. The protected mode interrupt service

routine then determines if the interrupt came from

a protected mode or V86 application by examining

the VM bit in the EFLAGS image stored on the

stack. The interrupt service routine may then

choose to allow the 8086 operating system to han-

dle theinterrupt or may emulate the function of the

interrupt handler. Following completion of the

interrupt service routine, an IRET instruction

restores the EFLAGS register (restores VM=1)

and segment selectors and control returns to the

interrupted V86 task.

ST6x86

2-75

2.12.4 Entering and Leaving V86 Mode

V86 mode is entered from protected mode by

either executing an IRET instruction at CPL = 0 or

by task switching. If an IRET is used, the stack

must contain an EFLAGS image with VM = 1. If a

task switch is used, the TSS must contain an

EFLAGS image containing a 1 in the VM bit posi-

tion. The POPF instruction cannot be used to

enter V86 mode sincethe state of the VM bit is not

affected. V86 mode can only be exited as the

result of an interrupt or exception. The transition

out must use a 32-bit trap or interrupt gate which

must point to a non-conforming privilege level 0

segment (DPL = 0), or a 32-bit TSS. These

restrictions are required to permit the trap handler

to IRET back to the V86 program.

2.13 Floating Point Unit Operations

The ST6x86 CPU includes an on-chip FPU that

provides the user access to a complete set of

floating point instructions (see Chapter 6). Infor-

mation is passed to and from the FPU using eight

data registers accessed in a stack-like manner, a

control register, and a status register. The ST6x86

CPU also provides a data register tag word which

improves context switching and performance by

maintaining empty/non-empty status for each of

the eight data registers. In addition, registers in

the CPU contain pointers to (a) the memory loca-

tion containing the current instruction word and (b)

the memory location containing the operand asso-

ciated withthe current instruction word (if any).

FPU Tag Word Register. The ST6x86 CPU main-

tains a tag word register ((Figure 2.41)) comprised

of two bits for each physical data register. Tag

Word fields assume one of four values depending

on the contents of their associated data registers,

Valid (00), Zero (01), Special (10), and Empty (11).

Note: Denormal, Infinity, QNaN, SNaN and unsup-

ported formats are tagged as “Special”. Tag val-

ues are maintained transparently by the ST6x86

CPU and are only available to the programmer indi-

rectly through the FSTENV and FSAVE instruc-

tions.

FPU Control and Status Registers. The FPU

circuitry communicates information aboutits status

and the results of operations to the programmer

via the status register. The FPU status register is

comprised of bit fields that reflect exception status,

operation execution status, register status, oper-

and class, and comparison results. The FPU sta-

tus register bit definitions are shown in Figure 2.42

and Table 2.38.

The FPU Mode Control Register (MCR) is used by

the CPU to specify the operating modeof theFPU.

The MCR contains bit fields which specify the

rounding mode to be used, the precision by which

to calculate results, and the exception conditions

which should be reported to the CPU via traps.

The user controls precision, rounding, and excep-

tion reporting by setting or clearing appropriate

bits in the MCR. The FPU mode control register

bit definitions are shown in Figure 2.43 and Table

2.39.

ST6x86

2-76

Figure 2.41. FPU Tag Word Register

Figure 2.42. FPU Status Register

Table 2.38. FPU Status Register Bit Definitions

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0

Tag(7) Tag(6) Tag(5) Tag(4) Tag(3) Tag(2) Tag(1) Tag(0)

15 12 11 8 7 4 3 0

B C3 S S S C2 C1 C0 ES SF P U O Z D I

BIT

POSITION NAME DESCRIPTION

15 B Copy of the ES bit. (ES is bit 7 in this table.)

14, 10 - 8 C3 - C0 Condition code bits.

13 - 11 SSS Top of stack register number which points to the current TOS.

7 ES Error indicator. Set to 1 if an unmasked exception is detected.

6 SF Stack Fault or invalid register operation bit.

5 P Precision error exception bit.

4 U Underflow error exception bit.

3 O Overflow error exception bit.

2 Z Divide by zero exception bit.

1 D Denormalized operand error exception bit.

0 I Invalid operation exception bit.

ST6x86

2-77

Figure 2.43. FPU Mode Control Register

Table 2.39. FPU Mode Control Register Bit Definitions

15 12 11 8 7 4 3 0

---- RC RC PC PC- - P UO Z D I

BIT

POSITION NAME DESCRIPTION

11 - 10 RC

Rounding Control bits:

00 Round to nearest or even

01 Round towards minus infinity

10 Round towards plus infinity

11 Truncate

9-8 PC

Precision Control bits:

00 24-bit mantissa

01 Reserved

10 53-bit mantissa

11 64-bit mantissa

5 P Precision error exception bit mask.

4 U Underflow error exception bit mask.

3 O Overflow error exception bit mask.

2 Z Divide by zero exception bit mask.

1 D Denormalized operand error exception bit mask.

0 I Invalid operation exception bit mask.

ST6x86

3-1

3.0 ST6x86 BUS INTERFACE

The signalsused in the ST6x86 CPU businterface

are described in this chapter. Figure 3.1 shows the

signal directions and the major signal groupings. A

description of each signal and their reference to

the text are provided in Table 3.1.

Figure 3.1. ST6x86 CPU Functional Signal Groupings

1737900

INTR

NMI Interrupt

EWBE#

FLUSH#

KEN#

PCD Cache

BRDYC#

ADS#

Data D63 - D0

Reset RESET

A31 -A3

BE7# - BE0#

Address

Bus

W/R#

D/C#

M/IO#

LOCK#

SMIACT#

DP7 - DP0

PCHK#

Data

NA#

BRDY#

AHOLD

EADS#

HIT#

INV

WM_RST

Cache

PWT

Bus

Parity

Cycle

Definition

Bus

Cycle

Control

Coherency

SUSP#

SUSPA# Power

Management

ADSC#

CLK

CPU

A20M#

APCHK#

Address

Parity

SCYC

CACHE#

SMI#

WB/WT#

BREQ

HOLD Bus

HLDA

BOFF#

Arbitration

HITM#

FERR#

IGNNE# FPU Error

DHOLD

LBA# Scatter

QDUMP#

BHOLD

Gather Buffer

TCK

TDI

TDO

TRST#

JTAG

TMS

CLKMUL

Clock

Control

6x86

ST6x86

3-2

3.1 Signal Description Table

The Signal Summary Table (3.1) describes the sig-

nals in their active state unless otherwise men-

tioned. Signals containing slashes (/) have logic

levels defined as “1/0.” For example the signal

W/R#, is defined as write when W/R#=1, and as

read when W/R#=0. Signals ending with a “#”

character are active low.

Table 3.1. ST6x86 CPU Signals Sorted by Signal Name

SignalName Description I/O Reference

A20M#

A20 Mask causes the CPU to mask (force to 0) the A20 address bit when

driving the external address bus or performing an internal cache access.

A20M# is provided to emulate the 1 MByte address wrap-around that

occurs on the 8086. Snoop addressing is not effected.

Input Page 3-8

A31-A3

The Address Bus, in conjunction with the Byte Enable signals

(BE7#-BE0#), provides addresses for physical memory and external I/O

devices. During cache inquiry cycles, A31-A5 are used as inputs to perform

cache line invalidations.

3-state

I/O Page 3-8

ADS# Address Strobe begins a memory/I/O cycle and indicates the address bus

(A31-A3, BE7#-BE0#) and bus cycle definition signals (CACHE#, D/C#,

LOCK#, M/IO#, PCD, PWT, SCYC, W/R#) are valid.

Output Page 3-12

ADSC# Cache Address Strobe performs the same function as ADS#. Output Page 3-12

AHOLD Address Hold allows another bus master access to the ST6x86 CPU

address bus for a cache inquiry cycle. In response to the assertion of

AHOLD, the CPU floats AP and A31-A3 in the following clock cycle.

Input Page 3-17

Address Parity is the even parity output signal for address lines A31-A5

(A4 and A3 are excluded). During cache inquiry cycles, AP is the even-par-

ity input to the CPU, and is sampled with EADS# to produce correct parity

check status on the APCHK# output.

3-state

I/O Page 3-9

APCHK#

Address Parity Check Status is asserted during a cache inquiry cycle if an

address bus parity error has been detected. APCHK# is valid two clocks

after EADS# is sampled active. APCHK# will remain asserted for one clock

cycle if a parity error is detected.

Output Page 3-9

BE7#-BE0# The Byte Enables, in conjunction with the address lines, determine the

active data bytes transferred during a memory or I/O bus cycle. 3-state

I/O Page 3-8

BHOLD

Byte Enable Hold forces the byte enables (BE7#-BE0#) to float during the

next clock cycle. The ST6x86 CPU continues to generate additional bus

cycles while BHOLD is asserted. While BHOLD is asserted, the byte

enables are driven by an external source and select which data bytes are

accessed through the scatter/gather buffer. BHOLD is ignored if the scat-

ter/gather interface is disabled.

Input Page 3-19

BOFF#

Back-Off forces the ST6x86 CPU to abort the current bus cycle and relin-

quish control of the CPU local bus during the next clock cycle. The ST6x86

CPU enters the bus hold state and remains in this state until BOFF# is

negated.

Input Page 3-15

BRDY#

Burst Ready indicates that the current transfer within a burst cycle, or the

current single transfer cycle, can be terminated. The ST6x86 CPU samples

BRDY# in the second and subsequent clocks of a bus cycle. BRDY# is

active during address hold states.

Input Page 3-12

BRDYC# Cache Burst Ready performs the same function as BRDY# and is logically

ORed with BRDY# within the ST6x86 CPU. Input Page 3-12

BREQ

Bus Request is asserted by the ST6x86 CPU when an internal bus cycle is

pending. The ST6x86 CPU always asserts BREQ, along with ADS#, during

the first clock of a bus cycle. If a bus cycle is pending, BREQ is asserted

during the bus hold and address hold states. If no additional bus cycles are

pending, BREQ isnegated prior to termination of the current cycle.

Output Page 3-15

ST6x86

3-3

CACHE#

Cacheability Status indicates that a read bus cycle is a potentially cache-

able cycle; or that a write bus cycle is a cache line write-back or line

replacement burst cycle. If CACHE# is asserted for a read cycle and KEN#

is asserted by the system, the read cycle becomes a cache line fill burst

cycle.

Output Page 3-10

CLK Clock provides the fundamental timing for the ST6x86 CPU. The frequency

of the ST6x86 CPU input clock determines the operating frequency of the

CPU’s bus. External timing is defined referenced to the rising edge of CLK. Input Page 3-6

CLKMUL

The Clock Multiplier input is sampled during RESET to determine the

ST6x86 CPU core operating frequency. If CLKMUL=0 or is left uncon-

nected, the core frequency is 2x the frequency of the CLK input. If CLK-

MUL=1, the core frequency is 3x the frequency of CLK.

Input Page 3-6

D63-D0

Data Bus signals are three-state, bi-directional signals which provide the

data path between the ST6x86 CPU and external memory and I/O devices.

The data bus is only driven while a write cycle is active (state=T2). The data

bus is floated when DHOLD is asserted.

3-state

I/O Page 3-9

D/C#

Data/Control Status. If high,indicates that thecurrent bus cycle is an I/O or

memory data access cycle. If low, indicates a code fetch or special bus

cycle such as a halt, prefetch, or interrupt acknowledge bus cycle. D/C# is

driven valid in the same clock as ADS# is asserted.

Output Page 3-10

DHOLD

Data Bus Hold forces the ST6x86 CPU to float the data bus (D63-D0) and

the data parity lines (DP7-DP0) in the next clock. While DHOLD is asserted,

only the data and data parity buses are disabled. The current bus cycle

remains active and is completed in the normal fashion in response to

BRDY#. The ST6x86 CPU generates additional bus cycles while DHOLD is

asserted. DHOLD is ignored if the scatter/gather interface is disabled.

Input Page 3-20

DP7-DP0

Data Parity signals provide parity for the data bus, one data parity bit per

data byte. Even parity is driven on DP7-DP0 for all data write cycles.

DP7-DP0 are read by the ST6x86 CPU during read cycles to check for even

parity. The data parity bus is only driven while a write cycle is active

(state=T2).

3-state

I/O Page 3-9

EADS#

External Address Strobe indicates that a valid cache inquiry address is

being driven on the ST6x86 CPU address bus (A31-A5) and AP. The state

of INV at the time EADS# is sampled active determines the final state of the

cache line. A cache inquiry cycle using EADS# may be run while the

ST6x86 CPU is in the address hold or bus hold state.

Input Page 3-17

EWBE#

External Write Buffer Empty indicates that there are no pending write

cycles in the external system. EWBE# is sampled only during I/O and mem-

ory write cycles. If EWBE# is negated, the ST6x86 CPU delays all subse-

quent writes to on-chip cache lines in the “exclusive” or “modified” state until

EWBE# is asserted.

Input Page 3-13

FERR# FPU Error Status indicates an unmasked floating point error has occurred.

FERR# is asserted during execution of the FPU instruction that caused the

error.FERR# does not float during bus hold states. Output Page 3-18

FLUSH# Cache Flush forces the ST6x86 CPU to flush the cache. External interrupts

and additional FLUSH# assertions are ignored during the flush. Cache

inquiry cycles are permitted during the flush. Input Page 3-13

HIT#

Cache Hit indicates that the current cache inquiry address has been found

in the cache (modified, exclusive or shared states). HIT# is valid two clocks

after EADS# is sampled active, and remains valid until the next cache

inquiry cycle.

Output Page 3-17

HITM#

Cache Hit Modified Data indicates that the current cache inquiry address

has been found in the cache and dirty data exists in the cache line (modified

state). The ST6x86 CPU does not accept additional cache inquiry cycles

while HITM# is asserted. HITM# is valid two clocks after EADS#.

Output Page 3-17

Table 3.1. ST6x86 CPU Signals Sorted by Signal Name (Continued)

SignalName Description I/O Reference

ST6x86

3-4

HLDA

Hold Acknowledge indicates that the ST6x86 CPU has responded to the

HOLD input and relinquished control of the local bus. The ST6x86 CPU

continues to operate during bus hold as long as the on-chip cache can sat-

isfy bus requests.

Output Page 3-15

HOLD Hold Request indicates that another bus master has requested control of

the CPU’s local bus. Input Page 3-15

IGNNE# Ignore Numeric Error forces the ST6x86 CPU to ignore any pending

unmasked FPU errors and allows continued execution of floating point

instructions. Input Page 3-18

INTR

Maskable Interrupt forces the processor to suspend execution of the cur-

rent instruction stream and begin execution of an interrupt service routine.

The INTR input can be masked (ignored) through the IF bit in the Flags

Input Page 3-12

INV

Invalidate Request is sampled with EADS# to determine the final state of

the cache line in the case of a cache inquiry hit. An asserted INV directs the

processor to change the state of the cache line to “invalid”. A negated INV

directs the processor to change the state of the cache line to “shared.”

Input Page 3-17

KEN#

Cache Enable allows the data being returned during the current cycleto be

placed in the CPU’s cache. When the ST6x86 CPU is performing a cache-

able code fetch or memory data read cycle (CACHE# asserted), and KEN#

is sampled asserted, the cycle is transformed into a 32-byte cache line fill.

KEN# is sampled with the first asserted BRDY# or NA# for the cycle.

Input Page 3-14

LBA#

Local Bus Access indicates that the current bus cycle is for an address

within the local bus address region. If LBA# is asserted during a CPU write

cycle with BE3#-BE0# negated, the ST6x86 CPU automatically maps the

upper DWORD of data to the lower DWORD of the data bus. LBA# floats if

scatter/gather pins are disabled.

Output Page 3-20

LOCK# Lock Status indicates that other system bus masters are denied access to

the local bus. The ST6x86 CPU does not enter the bus hold state in

response to HOLD while LOCK# is asserted. Output Page 3-10

M/IO# Memory/IO Status. If high, indicates that the current bus cycle is a memory

cycle (read or write). If low, indicates that the current bus cycle is an I/O

cycle (read or write, interrupt acknowledge, or special cycle). Output Page 3-10

NA#

Next Address requests the next pending bus cycle address and cycle defi-

nition information. If either the current or next bus cycle is a locked cycle, a

line replacement, a write-back cycle, or if there is no pending bus cycle, the

ST6x86 CPU does not start a pipelined bus cycle regardless of the state of

NA#.

Input Page 3-12

NMI Non-Maskable Interrupt Request forces the processor to suspend execu-

tion of the current instruction stream and begin execution of an NMI inter-

rupt service routine. Input Page 3-13

PCD

Page Cache Disable reflects the state of the PCD page attribute bit in the

page table entry or the directory table entry. If paging is disabled, or for

cycles that are not paged, the PCD pin is driven low.PCD is masked by the

cache disable (CD) bit in CR0, and floats during bus hold states.

Output Page 3-14

PCHK#

Data Parity Check indicates that a data bus parity error has occurred dur-

ing a read operation. PCHK# is only valid during the second clock immedi-

ately after read data is returned to the ST6x86 CPU (BRDY# asserted) and

is inactive otherwise. Parity errors signaled by a logic low on PCHK# have

no effect on processor execution.

Output Page 3-9

PWT

Page Write Through reflects the state of the PWT page attribute bit in the

page table entry or the directory table entry. PWT pin is negated during

cycles that are not paged, or if paging is disabled. PWT takes priority over

WB/WT#.

Output Page 3-14

Table 3.1. ST6x86 CPU Signals Sorted by Signal Name (Continued)

SignalName Description I/O Reference

ST6x86

3-5

QDUMP#

Q Buffer Dump is used to dump the contents of the scatter/gather buffer

onto the data bus. The data bytes specified by the byte enables

(BE7#-BE0#) are driven onto the data bus during the clock after QDUMP#

is sampled asserted. QDUMP# is ignored if the scatter/gather pins are dis-

abled.

Input Page 3-20

RESET Reset suspends all operations in progress and places the ST6x86 CPU into

a reset state. Reset forces the CPU to begin executing in aknown state. All

data in the on-chip caches is invalidated. Input Page 3-6

SCYC Split Locked Cycle indicates that the current bus cycle is part of a mis-

aligned locked transfer. SCYC is defined for locked cycles only. A mis-

aligned transfer is defined as any transfer that crosses an 8-byte boundary. Output Page 3-10

SMI#

SMM Interrupt forces the processor to save the CPU state to the top of

SMM memory and to begin execution of the SMI service routine at the

beginning of the defined SMM memory space. An SMI is a higher-priority

interrupt than an NMI.

Input Page 3-13

SMIACT# SMM Interrupt Active indicates that the processor is operating in System

Management Mode. SMIACT# does not float during bus hold states. Output Page 3-12

SUSP# Suspend Request requests that the CPU enter suspend mode. SUSP# is

ignored following RESET and is enabled by setting the SUSP bit in CCR2. Input Page 3-21

SUSPA# Suspend Acknowledge indicates that the ST6x86 CPU has entered

low-power suspend mode. SUSPA# floats following RESET and is enabled

by setting the SUSP bit in CCR2. Output Page 3-21

TCK Test Clock (JTAG) is the clock input used by the ST6x86 CPU’s boundary

scan (JTAG) test logic. Input Page 3-23

TDI Test Data In (JTAG) is the serial data input used by the ST6x86 CPU’s

boundary scan (JTAG) test logic. Input Page 3-23

TDO Test Data Out (JTAG) is the serial data output used by the ST6x86 CPU’s

boundary scan (JTAG) test logic. Output Page 3-23

TMS Test Mode Select (JTAG) is the control input used by the ST6x86 CPU’s

boundary scan (JTAG) test logic. Input Page 3-23

TRST# Test Mode Reset (JTAG) initializes the ST6x86 CPU’s boundary scan

(JTAG) test logic. Input Page 3-23

WB/WT#

Write-Back/Write-Through is sampled during cache line fills to define the

cache line write policy. If high, the cache line write policy is write-back. If

low, the cache line write policy is write-through. (PWT forces write-through

policy when PWT=1.)

Input Page 3-14

WM_RST

Warm Reset forces the ST6x86 CPU to complete the current instruction

and then places the ST6x86 CPU in a known state. Once WM_RST is sam-

pled active by the CPU, the reset sequence begins on the next instruction

boundary. WM_RST does not change the state of the configuration regis-

ters, the on-chip cache, the write buffers and the FPU registers. WM_RST

is sampled during reset.

Input Page 3-8

W/R# Write/Read Status. If high, indicates that the current memory, or I/O bus

cycle is a write cycle. If low, indicates that the current bus cycle is a read

cycle. Output Page 3-10

Table 3.1. ST6x86 CPU Signals Sorted by Signal Name (Continued)

SignalName Description I/O Reference

ST6x86

3-6

3.2 Signal Descriptions

The following paragraphs provide additional infor-

mation about the ST6x86 CPU signals. For ease

of this discussion, the signals are divided into 16

functional groups as illustrated in Figure 3.1.

3.2.1 Clock Control

The Clock Input (CLK) signal, supplied by the

system, is the timing reference use by the ST6x86

CPU bus interface. All external timing parameters

are defined with respect to the CLK rising edge.

The CLK signal enters the ST6x86 CPU where it is

doubled or tripled to produce the ST6x86 CPU

internal clock signal. During power on, the CLK

signal must be running even if CLK does not meet

AC specifications.

The Clock Multiplier (CLKMUL) input is sampled

during RESET to determine the CPU’s core oper-

ating frequency. If CLKMUL=0, the core fre-

quency is 2x the frequency of the CLK input. If

CLKMUL=1, the core frequency is 3x the fre-

quency of the CLK input. The CLKMUL input is

connected to an internal pull-down resistor.

Therefore, if CLKMUL is left unconnected, the

core frequency defaults to 2x the input CLK. CLK-

MUL should be connected to Vss, to Vcc through a

pull-up, or left unconnected. CLKMUL should not

be connected to a switching signal.

3.2.2 Reset Control

The ST6x86 CPU output signals are initialized to

their reset states during the CPU reset sequence,

as shown in Table 3.3. The signal states given in

Table3.3 assume thatHOLD, AHOLD, andBOFF#

are negated.

Asserting RESET suspends all operations in

progress and places the ST6x86 CPU in a reset

state. RESET is an asynchronous signal but must

meet specified setup and hold times to guarantee

recognition at a particular clock edge.

On system power-up, RESET must be held

asserted for at least 1 msec after Vcc and CLK

have reached specified DC and AC limits. This

delay allows the CPU’s clock circuit to stabilize

and guarantees proper completion of the reset

sequence.

During normal operation, RESET must be

asserted for at least 15 CLK periods in order to

guarantee the proper reset sequence is

executed. When RESET negates (on its falling

edge), the pins listed in Table 3.2 determine if cer-

tain ST6x86 CPU functions are enabled.

Table 3.2. Pins Sampled During RESET

SIGNAL

NAME DESCRIPTION

FLUSH# If = 0, three-state test mode enabled.

QDUMP# If = 0, scatter/gather interface enabled.

WM_RST If = 1, built-in self test initiated.

ST6x86

3-7

Table 3.3. Signal States During RESET

SIGNAL LINE STATE SIGNAL LINE STATE

A20M# Ignored INTR Ignored

A31-A3 Undefined until first ADS# INV Ignored

ADS# 1 KEN# Ignored

ADSC# 1 LBA# 1

AHOLD Recognized LOCK# 1

AP Undefined until first ADS# M/IO# Undefined until first ADS#

APCHK# 1 NA# Ignored

BE7#-BE0# Undefined until first ADS# NMI Ignored

BHOLD Ignored PCD Undefined until first ADS#

BOFF# Recognized PCHK# 1

BRDY# Ignored PWT Undefined until first ADS#

BRDYC# Ignored QDUMP# Enables scatter/gather interface pins

BREQ 0 RESET 1

CACHE# Undefined until first ADS# SCYC Undefined until first ADS#

D(63-0) Float SMI# Ignored

D/C# Undefined until first ADS# SMIACT# 1

DHOLD Ignored SUSP# Ignored

DP(7-0) Float SUSPA# Float

EADS# Ignored TCK Recognized

EWBE# Ignored TDI Recognized

FERR# 1 TDO Responds to TCK, TDI, TMS, TRST#

FLUSH# Initiates three-state test mode TMS Recognized

HIT# 1 TRST# Recognized

HITM# 1 W/R# Undefined until first ADS#

HLDA Responds to HOLD WB/WT# Ignored

HOLD Recognized WM_RST Initiates self-test

IGNNE# Ignored

ST6x86

3-8

Warm Reset (WM_RST) allows the ST6x86 CPU

to complete the current instruction and then places

the ST6x86 CPU in a known state. WM_RST is an

asynchronous signal, but must meet specified

setup and hold times in order to guarantee

recognition at a particular CLK edge. Once

WM_RST is sampled active by the CPU, the reset

sequence begins on the next instruction boundary.

WM_RST differs from RESET in that the contents

of theon-chip cache,the write buffers, the configu-

ration registers and the floating point registers

contents remain unchanged.

Following completion of the internal reset

sequence, normal processor execution begins

even if WM_RST remains asserted. If RESET and

WM_RST are asserted simultaneously, WM_RST

is ignored and RESET takes priority. If WM_RST

is asserted at the falling edge of RESET, built-in

self test (BIST) is initiated.

3.2.3 Address Bus

The Address Bus (A31-A3) lines provide the

physical memory and external I/O device

addresses. A31-A5 are bi-directional signals used

by the ST6x86 CPU to drive addresses to both

memory devices and I/O devices. During cache

inquiry cycles the ST6x86 CPU receives

addresses from the system using signals A31-A5.

Using signals A31-A3, the ST6x86 CPU can

address a 4-GByte memory address space. Using

signals A15-A3, the ST6x86 CPU can address a

64-KByte I/O space through the processor’s I/O

ports. During I/O accesses, signals A31-A16 are

driven low. A31-A3 float during bus hold and

address hold states.

The Byte Enable (BE7#-BE0#) lines are bi-direc-

tional signalsthat define the valid data bytes within

the 64-bit data bus. The correlation between the

enable signals and data bytes is shown in

Table 3.4.

Table 3.4. Byte Enable Signal to

Data Bus Byte Correlation

During a cache line fill, (burst read or “1+4” burst

read) the ST6x86 CPU expects data to be returned

as if all data bytes are enabled, regardless of the

state of the byte enables. BE7#-BE0# float during

bus hold and byte enable hold states.

Address Bit 20 Mask (A20M#) is an active low

input which causes the ST6x86 CPU to mask

(force low) physical address bit 20 when driving

the external address bus or when performing an

internal cache access. Asserting A20M# emulates

the 1 MByte address wrap-around that occurs on

the 8086. The A20 signal is never masked during

write-back cycles, inquiry cycles, system manage-

ment address space accesses or when paging is

enabled, regardless of the state of the A20M#

input.

BYTE

ENABLE CORRESPONDING DATA

BYTE

BE7# D63-D56

BE6# D55-D48

BE5# D47-D40

BE4# D39-D32

BE3# D31-D24

BE2# D23-D16

BE1# D15-D8

BE0# D7-D0

ST6x86

3-9

3.2.4 Address Parity

Address Parity (AP) is a bi-directional signal

which provides the parity associated with address

lines A31-A5. (A4 and A3 are not included in the

parity determination.) During ST6x86 CPU gener-

ated bus cycles, while the address bus lines are

driven, AP becomes an output supplying even

address parity. During cache inquiry cycles, AP

becomes an input and is sampled by EADS#.

During cache inquiry cycles, even-parity must be

placed on the AP line to guarantee an accurate

result on the APCHK# (Address Parity Check Sta-

tus) pin.

Address Parity Check Status (APCHK#) is

driven active by the CPU when an address bus

parity error has been detected for a cache inquiry

cycle. APCHK# is asserted two clocks after

EADS# is sampled asserted, and remains valid for

one clock only. Address parity errors signaled by

APCHK# have no effecton processor execution.

3.2.5 Data Bus

Data Bus (D63-D0) lines carry three-state,

bi-directional signals between the ST6x86 CPU

and the system (i.e., external memory and I/O

devices). The data bus transfers data to the

ST6x86 CPU during memory read, I/O read, and

interrupt acknowledge cycles. Data is transferred

from the ST6x86 CPU during memory and I/O

write cycles.

Data setup and hold times must be met for correct

read cycle operation. The data bus is driven only

while a write cycle is active.

3.2.6 Data Parity

The Data Parity Bus (DP7-DP0) provides and

receives parity data for each of the eight data bus

bytes (Table 3.5). The ST6x86 CPU generates

even parity on the bus during write cycles and

accepts even parity from the system during read

cycles. DP7-DP0 is driven only while a write cycle

is active.

Table 3.5. Parity Bit to Data Byte Correlation

Parity Check (PCHK#) is asserted when a data

bus parity error is detected. Parity is checked dur-

ing code, memory and I/O reads, and the second

interrupt acknowledge cycle. Parity is not checked

during the first interruptacknowledge cycle.

Parity is checked for only the active data bytes as

determined by the active byte enable signals

except during a cache line fill (burst read or “1+4”

burst read). During a cache line fill, the ST6x86

CPU assumes all data bytes are valid and parity is

checked for all data bytes regardless of the state

of the byte enables.

PCHK# is valid only during the second clock

immediately after read data is returned to the

ST6x86 CPU (BRDY# asserted). At other times

PCHK# is not active. Parityerrors signaled by the

assertion of PCHK# have no effect on processor

execution.

PARITY BIT DATA BYTE

DP7 D63-D56

DP6 D55-D48

DP5 D47-D40

DP4 D39-D32

DP3 D31-D24

DP2 D23-D16

DP1 D15-D8

DP0 D7-D0

ST6x86

3-10

3.2.7 Bus Cycle Definition

Each bus cycle is assigned a bus cycle type. The

bus cycle types are defined by six three-state out-

puts: CACHE#, D/C#, LOCK#, M/IO#, SCYC, and

W/R# as listed in Table3.6.

These bus cycle definition signals are driven valid

while ADS# is active. D/C#, M/IO#, W/R#, SCYC

and CACHE# remain valid until the clock following

the earliest of two signals: NA# asserted, or the

last BRDY# for the cycle.

LOCK# continues asserted until after BRDY# is

returned for the last locked bus cycle. The bus

cycle definition signals float duringbus holdstates.

Cache Cycle Indicator (CACHE#) is an output

that indicates that the current bus cycle is a poten-

tially cacheable cycle (for a read), or indicates that

the current bus cycle is a cache line write-back or

line replacement burst cycle (for a write). If

CACHE# is asserted for a read cycle and the

KEN# input is returned active by the system, the

read cycle becomes a cache line fill burst cycle.

Data/Control (D/C#) distinguishes between data

and control operations. When high, this signal indi-

cates that the current bus cycle is a data transfer

to or from memory or I/O. When low, D/C# indi-

cates that the current bus cycle involves a control

function such as a halt, interrupt acknowledge or

code fetch.

Bus Lock (LOCK#) is an active low output which,

when asserted, indicates that other system bus

masters are denied access to control of the CPU

bus. The LOCK# signal may be explicitly activated

during bus operations by including the LOCK pre-

fix on certain instructions. LOCK# is also asserted

during descriptor updates, page table accesses,

interrupt acknowledge sequences and when exe-

cuting the XCHG instruction. However, if the

NO_LOCK bit in CCR1 is set, LOCK# is asserted

only during page table accesses and interrupt

acknowledge sequences. The ST6x86 CPU does

not enter the bus hold state in response to HOLD

while the LOCK# output is active.

Memory/IO (M/IO#) distinguishes between mem-

ory and I/O operations. When high,this signal indi-

cates that the current bus cycle is a memory read

or memory write. When low, M/IO# indicates that

the current bus cycle is an I/O read, I/O write,

interrupt acknowledge cycle or special bus cycle.

Split Cycle (SCYC) is an active high output that

indicates thatthe current bus cycleis part ofa mis-

aligned locked transfer. SCYC is defined for

locked cycles only. A misaligned transfer is

defined as any transfer that crosses an 8-byte

boundary.

Write/Read (W/R#) distinguishes between write

and read operations. When high, this signal indi-

cates that the current bus cycle is a memory write,

I/O writeor a special bus cycle. When low, this sig-

nal indicates that the current cycle is a memory

read, I/Oread or interrupt acknowledge cycle.

ST6x86

3-11

Table 3.6. Bus Cycle Types

BUS CYCLE TYPE M/IO# D/C# W/R# CACHE# LOCK#

Interrupt Acknowledge 0 0 0 1 0

Does not occur. 0 0 0 X 1

Does not occur. 0 0 1 X 0

Special Cycles:

If BE(7-0)# = FEh: Shutdown

If BE(7-0)# = FDh: Flush (INVD, WBINVD)

If A4 = 0 and BE(7-0)# = FBh: Halt (HLT)

If BE(7-0)# = F7h: Write-Back (WBINVD)

If BE(7-0)# = EFh: Flush Acknowledge (FLUSH#)

If A4 = 1 and BE(7-0)# = FBh: Stop Grant (SUSP#)

00111

Does not occur. 0 1 X X 0

I/O Data Read 0 1 0 1 1

I/O Data Write 0 1 1 1 1

Does not occur. 1 0 X X 0

Cacheable Memory Code Read

(Burst Cycle if KEN# Returned Active) 10001

Non-cacheable Memory Code Read 1 0 0 1 1

Does not occur. 1 0 1 X 1

Locked Memory Data Read 1 1 0 1 0

Cacheable Memory Data Read

(Burst Cycle if KEN# Returned Active) 11001

Non-cacheable Memory Data Read 1 1 0 1 1

Locked Memory Write 1 1 1 1 0

Burst Memory Write

(Writeback or Line Replacement) 11101*

Single Transfer Memory Write 1 1 1 1 1

Note: X = Don’t Care

*Note: LOCK# continues to be asserted during a write-back cycle that occurs following an aborted (BOFF# asserted)

locked bus cycle.

ST6x86

3-12

3.2.8 Bus Cycle Control

The bus cycle control signals (ADS#, ADSC#,

BRDY#, BRDYC#, NA#, and SMIACT#) indicate

the beginning of a bus cycle and allow system

hardware to control bus cycle termination timing

and address pipelining.

Address Strobe (ADS#) is an active low output

which indicates that the CPU has driven a valid

address and bus cycle definition on the appropri-

ate output pins. ADS# floats during bus hold

states.

Cache Address Strobe (ADSC#) performs the

same function as ADS#. ADSC# is used to inter-

face directly to a secondary cache controller.

Burst Ready (BRDY#) is an active low input that

is driven by the system to indicate that the current

transfer within a burst cycle or the current single

transfer bus cycle can be terminated. The CPU

samples BRDY# in the second and subsequent

clocks of a cycle. BRDY# is active during address

hold states.

Cache Burst Ready (BRDYC#) performs the

same function as BRDY# and is logically ORed

with BRDY internally by the CPU. BRDYC# is

used to interface directly to a secondary cache

controller.

Next Address (NA#) is an active low input that is

driven by the system to request the next pending

bus cycle address and cycle definition information

even though all data transfers for the current bus

cycle are not complete. This new bus cycle is

referred to as a “pipelined” cycle. If either the cur-

rent or next bus cycle is a locked cycle, a line

replacement, a write-back cycle or there is no

pending bus cycle, the ST6x86CPU does not start

a pipelined bus cycle regardless of the state of the

NA# input.

System Management Mode Active (SMIACT#)

is an active low output which indicates that the

CPU is operating in System Management Mode.

SMIACT# is asserted in response to the assertion

of SMI# or due to execution of the SMINT instruc-

tion. SMIACT# is also asserted during accesses

to defined SMM memory if the SMAC bit in CCR1

is set. This bit allows access to SMM memory

while not in SMM mode and is typically used for

initialization purposes.

While servicing an SMI# interrupt or SMINT

instruction, SMIACT# remains asserted until a

RSM instruction is executed. The RSM instruction

causes the ST6x86 CPU to exit SMM mode and

negate the SMIACT# output. If a cache inquiry

cycle occurs while SMIACT# is active, any result-

ing write-back cycle is issued with SMIACT#

asserted. This occurs even though the write-back

cycle is intended for normal memory rather than

SMM memory.

During RESET, the USE_SMI bit in CCR1 is

cleared. While USE_SMI is zero, SMIACT# is

always negated. SMIACT# does not float during

bus hold states.

3.2.9 Interrupt Control

The interrupt control signals (INTR, NMI, SMI#)

allow the execution of the current instruction

stream to be interrupted and suspended.

Maskable Interrupt Request (INTR) is an active

high level-sensitive input which causes the proces-

sor to suspend execution of the current instruction

stream and begin execution of an interrupt service

routine. The INTR input can be masked (ignored)

through the IF bit in the Flags Register.

When not masked, the ST6x86 CPU responds to

the INTR input by performing two locked interrupt

acknowledge bus cycles. During the second inter-

rupt acknowledge cycle, the ST6x86 CPU reads

an 8-bit value, the interrupt vector, from the data

bus. The 8-bit interrupt vector indicates the inter-

rupt level that caused generation of the INTR and

is used by the CPU to determine the beginning

address of the interrupt service routine. To assure

recognition of the INTR request, INTR must

remain active until the start of the first interrupt

acknowledge cycle.

ST6x86

3-13

Non-Maskable Interrupt Request (NMI) is a ris-

ing-edge sensitive input which causes the proces-

sor to suspend execution of the current instruction

stream and begin execution of an NMI interrupt

service routine. The NMI interrupt cannot be

masked by the IF bit in the Flags Register. Assert-

ing NMI causes an interrupt which internally sup-

plies interrupt vector 2h to the CPU core.

Therefore, external interrupt acknowledge cycles

are not issued.

Once NMI processing has started, no additional

NMIs are processed until an IRET instruction is

executed, typically at the end of the NMI service

routine. If NMI is re-asserted prior to execution of

the IRET, one and only one NMI rising edge is

stored and then processed after execution of the

next IRET.

System Management Interrupt Request (SMI#)

is an interrupt input with higher priority than the

NMI input. SMI# is a falling edge sensitive input

and is sampled on every rising edge of the proces-

sor input clock. Asserting SMI# forces the proces-

sor to save the CPU state to the top of SMM

memory and to begin execution of the SMI service

routine at the beginning of the defined SMM mem-

ory space. After the processor internally acknowl-

edges the SMI# interrupt, the SMIACT# output is

driven low for the duration of the interrupt service

routine.

Once SMI# servicing has started, no additional

SMI# interrupts are processed until a RSM instruc-

tion is executed. If SMI# is re-asserted prior to

execution of a RSM instruction, one and only one

SMI# falling edge is stored and then processed

after execution of the next RSM. SMI# is ignored

following reset and recognition is enabled by set-

ting the USE_SMI bit in CCR1.

3.2.10 Cache Control

The cache control signals (EWBE#, FLUSH#,

KEN#, PCD, PWT, WB/WT#) are used to indicate

cache status and control caching activity.

External Write Buffer Empty (EWBE#) is an

active low input driven by the system to indicate

when there are no pending write cycles in the

external system. The ST6x86 CPU samples

EWBE# during write cycles (I/O and memory)

only. If EWBE# is not asserted, the processor

delays all subsequent writes to on-chip cache lines

in the “exclusive” or “modified” state until EWBE#

is asserted. Regardless of the state of EWBE#, all

writes to the on-chip cache are delayed until any

previously issued external write cycle is complete.

This ensures that external write cycles occur in

program order and is referred to as “strong write

ordering”. To enhance performance, “weak write

ordering” may be allowed for specific address

regions using the Address Region Registers

(ARRs) and Region Control Registers (RCRs).

Cache Flush (FLUSH#) is a falling-edge sensitive

input that forces the processor to write-back all

dirty data in the cache and then invalidate the

entire cache contents. FLUSH# need only be

asserted for a single clock but must meet specified

setup and hold times to guarantee recognition at a

particular clock edge.

Once FLUSH# is sampled active, the ST6x86

CPU begins the cache flush sequence after com-

pletion of the current instruction. External inter-

rupts and additional FLUSH# requests are ignored

while the cache flush is in progress. However,

cache inquiry cycles are permitted during the flush

sequence. The ST6x86 CPU issues a flush

acknowledge special cycle to indicate completion

of the flush sequence. If the processor is in a halt

or shutdown state, FLUSH# is recognized and the

ST6x86 CPU returns to the halt or shutdown state

following completion of the flush sequence. If

FLUSH# is active at the falling edge of RESET,

the processor enters three state test mode.

ST6x86

3-14

Cache Enable (KEN#) is an active low input which

indicates that the data being returned during the

current cycle is cacheable. When the ST6x86 CPU

is performing a cacheable code fetch or memory

data read cycle and KEN# is sampled asserted,

the cycle is transformed into a cache line fill (4

transfer burst cycle) or a “1+4” cache line fill.

KEN# is sampled with the first asserted BRDY# or

NA# for the cycle. I/O accesses, locked reads,

system management memory accesses and inter-

rupt acknowledge cycles are never cached.

Page Cache Disable (PCD) is an active high out-

put that reflects the state of the PCD page attribute

bit in the page table entry or the directory table

entry. If paging is disabled or for cycles that are

not paged, the PCD pin is driven low. PCD is

masked by the cache disable (CD) bit in CR0

(driven high if CD=1) and floats during bus hold

states.

Page Write Through (PWT) is an active high out-

put that reflects the state of the PWT page

attribute bit in the page table entry or the directory

table entry. If paging is disabled or for cycles that

are not paged, the PWT pin is driven low. If PWT

is asserted, PWT takes priority over the WB/WT#

input. If PWT is asserted for either reads or writes,

the cache line is saved in, or remains in, the

shared (write-through) state. PWT floats during

bus hold states.

The Write-Back/Write-Through (WB/WT#) input

allows the system to define the write policy of the

on-chip cache on a line-by-line basis. If WB/WT#

is sampled high during a line fill cycle and PWT is

low, the line is defined as write-back and is stored

in the exclusive state. If WB/WT# is sampled high

during a write to a write-throughcache line(shared

state) and PWT is low, the line is transitioned to

write-back (exclusive state). If WB/WT# is sam-

pled low or PWT is high, the line is defined as

write-through and is stored in (line fill), or remains

in (write), the shared state. Table 3.7 lists the

effects of WB/WT# on the state of the cache line

for various bus cycles.

Table 3.7. Effects of WB/WT# on Cache

Line State

BUS CYCLE

TYPE PWT WB/

WT# WRITE

POLICY MESI

STATE

Line Fill 0 0 Write-

through Shared

Line Fill 0 1 Write-

back Exclusive

Line Fill 1 x Write-

through Shared

Memory Write

(Note) 00

Write-

through Shared

Memory Write

(Note) 01

Write-

back Exclusive

Memory Write

(Note) 1x

Write-

through Shared

Note: Only applies to memory writes to addresses that

are currently valid in the cache.

ST6x86

3-15

3.2.11 Bus Arbitration

The bus arbitration signals (BOFF#, BREQ,

HOLD, and HLDA) allow the ST6x86 CPU to relin-

quish control of its local bus when requested by

another bus master device. Once the processor

has released its bus, the bus master device can

then drive the local bus signals.

Back-Off (BOFF#) is an active low input that

forces the ST6x86 CPU to abort the current bus

cycle and relinquish control of the CPU’s local bus

in the next clock. The ST6x86 CPU responds to

BOFF# by entering the bus hold state as listed in

Table 3.8. The ST6x86 CPU remains in bus hold

until BOFF# is negated. Once BOFF# is negated,

the ST6x86 CPU restarts any aborted bus cycle in

its entirety. Any data returned to the ST6x86 CPU

while BOFF# is asserted is ignored. If BOFF# is

asserted in the same clock that ADS# is asserted,

the ST6x86 CPU may float ADS# while in the

active low state.

Bus Request (BREQ) is an active high output

asserted by the ST6x86 CPU whenever a bus

cycle is pending internally. The ST6x86 CPU

always asserts BREQ in the first clock of a bus

cycle with ADS# as well as during bus hold and

address hold states if a bus cycle is pending. If no

additional bus cycles are pending, BREQ is

negated prior to termination of the current cycle.

Bus Hold Request (HOLD) is an active high input

used to indicate that another bus master requests

control of the CPU’s local bus. After recognizing

the HOLD request and completing the current bus

cycle or sequence of locked bus cycles, the

ST6x86 CPU responds by floating the local bus

and asserting the hold acknowledge (HLDA) out-

put. The bus remains granted to the requesting

bus master until HOLD is negated. Once HOLD is

sampled negated, the ST6x86 CPU simulta-

neously drives the local bus and negates HLDA.

Hold Acknowledge (HLDA) is an active high out-

put used to indicate that the ST6x86 CPU has

responded to the HOLD input and has relin-

quished control of its local bus. Table 3.8 lists the

state of all the ST6x86 CPU signals during a bus

hold state. The ST6x86 CPU continues to operate

during bus hold states as long as the on-chip

cache can satisfybus requests. HLDA is asserted

until HOLD is negated. Once HOLD is sampled

negated, the ST6x86 CPU simultaneously drives

the local bus and negates HLDA.

ST6x86

3-16

Table 3.8. Signal States During Bus Hold

SIGNAL LINE STATE SIGNAL LINE STATE

A20M# Recognized internally INTR Recognized internally

A31-A3 Float INV Recognized

ADS# Float KEN# Ignored

ADSC# Float LBA# Float

AHOLD Ignored LOCK# Float

AP Float M/IO# Float

APCHK# Driven NA# Ignored

BE7#-BE0# Float NMI Recognized internally

BHOLD Ignored PCD Float

BOFF# Recognized PCHK# Driven

BRDY# Ignored PWT Float

BRDYC# Ignored QDUMP# Recognized

BREQ Driven RESET Recognized

CACHE# Float SCYC Float

D/C# Float SMI# Recognized

D63-D0 Float SMIACT# Driven

DHOLD Ignored SUSP# Recognized

DP7-DP0 Float SUSPA# Driven

EADS# Recognized TCK Recognized

EWBE# Recognized internally TDI Recognized

FERR# Driven TDO Responds to TCK, TDI, TMS, TRST#

FLUSH# Recognized TMS Recognized

HIT# Driven TRST# Recognized

HITM# Driven W/R# Float

HLDA Responds to HOLD WB/WT# Ignored

HOLD Recognized WM_RST Recognized

IGNNE# Recognized internally

ST6x86

3-17

3.2.12 Cache Coherency

The cache coherency signals (AHOLD, EADS#,

HIT#, HITM#, and INV) are used to initiate and

monitor cache inquiry cycles. These signals are

intended to be used to ensure cache coherency in

a uni-processor environment only. Contact Cyrix

for additional specifications on maintaining coher-

ency in a multi-processor environment.

Address Hold Request (AHOLD) is an active

high input which forces the ST6x86 CPU to float

A31-A3 and AP in the next clock cycle. While

AHOLD is asserted, only the address bus is dis-

abled. The current bus cycle remains active and

can be completed in the normal fashion. The

ST6x86 CPU does not generate additional bus

cycles while AHOLD is asserted except write-back

cycles in response to a cache inquiry cycle.

External Address Strobe (EADS#) is an active

low input used to indicate to the ST6x86 CPU that

a valid cache inquiry address is being driven on

the ST6x86 CPU address bus (A31-A5) and AP.

The ST6x86 CPU checks the on-chip cache for

thisaddress. If theaddress is present in the cache

the HIT# signal is asserted. If the data associated

with the inquiry address is “dirty” (modified state),

the HITM# signal is also asserted. If dirty data

exists, a write-back cycle is issued toupdate exter-

nal memory with the dirty data. Additional cache

inquiry cycles are ignored while HITM# is

asserted.

The stateof the INV pin at the timeEADS# is sam-

pled active determines the final state of the cache

line. If INV is sampled high, the final state of the

cache line is “invalid”. If INV is sampled low, the

final state of the cache line is “shared.” A cache

inquiry cycle using EADS# may be run while the

ST6x86 CPU is in either an address hold or bus

hold state. The inquiry address must be driven by

an external device.

Hit on Cache Line (HIT#) is an active low output

used to indicate that the current cache inquiry

address has been found in the cache (modified,

exclusive or shared states). HIT# is valid two

clocks after EADS# is sampled active, and

remains valid until the next cache inquiry cycle.

Hit on Modified Data (HITM#) is an active low

output used to indicate that the current cache

inquiry address has been found in the cache and

dirty data exists in the cache line (modified state).

If HITM# is asserted, a write-back cycle is issued

to update external memory. HITM# is valid two

clocks after EADS# is sampled active, and

remains asserted until two clocks after the last

BRDY# of the write-back cycle is sampled active.

The ST6x86 CPU does not accept additional

cache inquiry cycles while HITM# is asserted.

Invalidate Request (INV) is an active high input

used to determine the final state of the cache line

in the case of a cache inquiry hit. INV is sampled

with EADS#. A logic one on INV directs the pro-

cessor to change the state of the cache line to

“invalid”. A logic zero on INV directs the proces-

sor to change the state of the cache line to

“shared.”

ST6x86

3-18

3.2.13 FPUError Interface

The FPU interface signals FERR# and IGNNE#

are used to control error reporting for the on-chip

floating point unit. These signals are typically used

for a PC-compatible system implementation. For

other applications, FPU errors are reported to the

ST6x86 CPU CPU core through an internal inter-

face.

Floating Point Error Status (FERR#) is an active

low output asserted by the ST6x86 CPU when an

unmasked floating point error occurs. FERR# is

asserted during execution of the FPU instruction

that causedthe error. FERR# does not float during

bus hold states.

Ignore Numeric Error (IGNNE#) is an active low

input which forces the ST6x86 CPU to ignore any

pending unmasked FPU errors and allows contin-

ued execution of floating point instructions. When

IGNNE# is not asserted and an unmasked FPU

error is pending, the ST6x86 CPU only executes

the following floating point instructions: FNCLEX,

FNINIT, FNSAVE, FNSTCW, FNSTENV, and

FNSTSW#. IGNNE# is ignored when the NE bit in

CR0 is set to a 1.

3.2.14 Scatter/Gather Buffer Interface

The scatter/gather buffer interface signals

(BHOLD, DHOLD, LBA#, QDUMP#), in conjunc-

tion with the byte enables (BE7#-BE0#) and

address hold (AHOLD), can be used by the sys-

tem hardware to transfer data to/from a 32-bit

peripheral interface bus. A 64-bit buffer resides in

the ST6x86 CPU to assist the system in these

transfers. This buffer provides scatter/gather capa-

bility during four different types of transfers as

listed in Table 3.9.

ST6x86

3-19

Table 3.9. Scatter/Gather Cycles

Byte Enable Hold (BHOLD) is an active high

input that causes the ST6x86 CPU to float the byte

enable outputs (BE7#-BE0#) in the next clock.

While BHOLD is asserted, only the byte enables

are disabled. The current bus cycle remains active

and can be completed in the normal fashion. The

ST6x86 CPU continues to generate additional bus

cycles while BHOLD is asserted, so BHOLD

should only be asserted while AHOLD is asserted.

BHOLD is asserted by the external system during

scatter/gather buffer cycles. While BHOLD is

asserted, the byte enables are driven by an exter-

nal source and indicate which bytes of the data

bus should be loaded into/written out of the scat-

ter/gather buffer. The ST6x86 CPU samples the

byte enables at each rising clock edge while

BHOLD is asserted. Table 3.10 lists the byte

enable mappings for the scatter/gather cycles.

CYCLE TYPE BHOLD

USED DHOLD

USED QDUMP#

USED DATA BUS TIMING

CPU Write to 32-Bit Bus x -- -- Data driven 1 clock after byte enables

asserted.

CPU Read from 32-Bit Bus x -- -- Data sampled 1 clock after byte

enables asserted.

32-Bit Bus Master Write to Memory *

(1) Scatter/gather buffer load from

32-bit bus master. x x -- Data sampled 1 clock after byte

enables asserted.

(2) Scatter/gather buffer write

to memory. x-- x

Data driven 1 clock after QDUMP#

asserted.

32-Bit Bus Master Read from Memory *

(1) Scatter/gather buffer load

from memory. x x -- Data sampled 1 clock after byte

enables asserted.

(2) Scatter/gather buffer write to 32-bit

bus master. x-- x

Data driven 1 clock after QDUMP#

asserted.

*Note: Bus master transfers using the scatter/gather buffer must be initiated while the CPU bus is in a bus hold state

or an idle state. These cycles cannot occur during CPU initiated bus cycles.

ST6x86

3-20

Table 3.10. Byte Enable Map for Scatter/Gather Cycles

Data Bus Hold (DHOLD) is an active high input

that forces the ST6x86 CPU to float the data bus

lines (D63-D0) and the data parity lines

(DP7-DP0) in the next clock. While DHOLD is

asserted, only the data and data parity buses are

disabled. The current bus cycle remains active

and is completed in the normal fashion in

response to BRDY#. The ST6x86 CPU generates

additional bus cycles while DHOLD is asserted. To

avoid writing invalid data, during a write cycle,

DHOLD and BRDY# should not be asserted at the

same time,

The external system asserts DHOLD during scat-

ter/gather buffer load cycles when the ST6x86

CPU is not the bus master. While DHOLD is

asserted, the data bus is driven by an external

source and the information is loaded into the scat-

ter/gather buffer based on the state of the byte

enables (BHOLD asserted). The data bus is sam-

pled one clock after the clock edge at which an

active byte enable is sampled.

Local Bus Access (LBA#) is an active low output

asserted by the ST6x86 CPU for any I/O bus cycle

or for any bus access that resides within a “local

bus” address region as specified by the on-chip

configuration registers. LBA# is asserted during

the clock that ADS# is asserted and remains

asserted for only one clock. LBA# is used to indi-

cate a cycle intended to address a device using

the 32-bit peripheral bus. If LBA# is activeduring a

CPU write cycle with BE(3-0)# inactive, the

ST6x86 CPU automatically maps the upper dword

of data to the lower dword of the data bus.

Q Buffer Dump (QDUMP#) is an active low input

asserted by the external system to dump the con-

tents of the scatter/gather buffer to the data bus.

The data bytes specified by the asserted byte

enables are driven onto the data bus during the

clock after QDUMP# is sampled asserted.

QDUMP# must be asserted at the falling edge of

RESET to enable the scatter/gather interface pins.

CYCLE TYPE BE7-BE0# SOURCE DESTINATION

CPU Read from 32-Bit Bus

CPU Data Bus Scatter/Gather Buffer

FF No Transfer No Transfer

Fx 31-0 31-0

x F 31-0 63-32

xx 63-0 63-0

CPU Write to 32-Bit Bus*

Scatter/Gather Buffer CPU Data Bus

FF No Transfer No Transfer

Fx 31-0 31-0

x F 63-32 31-0

xx 63-0 63-0

Scatter/Gather Buffer Load for

32-Bit Bus Master

CPU Data Bus Scatter/Gather Buffer

FF No Transfer No Transfer

Fx 31-0 31-0

x F 31-0 63-32

xx 63-0 63-0

Scatter/Gather Buffer Dump

using QDUMP#

Scatter/Gather Buffer CPU Data Bus

FF No Transfer No Transfer

Fx 31-0 31-0

x F 63-32 31-0

xx 63-0 63-0

*Note: If LBA# is active during a CPU write cycle with BE3-BE0# inactive, the ST6x86 CPU automatically maps the

upper dword of data (D63-D32) to the lower dword of the data bus (D31-D0).

ST6x86

3-21

3.2.15 Power Management Interface

The two power management signals (SUSP#,

SUSPA#) allow the ST6x86 CPU to enter and exit

suspend mode. The ST6x86 CPU also enters sus-

pend mode as the result of executing a HALT

instruction if theHALT bit is set in CCR2. Suspend

mode circuitry forces the ST6x86 CPU to consume

minimal power whilemaintaining the entire internal

CPU state.

Suspend Request (SUSP#) is an active low input

which requests that the ST6x86 CPU enter sus-

pend mode. After recognition of an active SUSP#

input, the ST6x86 CPU completes execution of the

current instruction, any pending decoded instruc-

tions and associated bus cycles, issues a stop

grant bus cycle, and then asserts the SUSPA#

output. SUSP# is ignored following RESET and is

enabled by setting the SUSP bit in CCR2.

The Suspend Acknowledge (SUSPA#) output

indicates that the ST6x86 CPU has entered

low-power suspend mode as the result of either

assertion of SUSP# or execution of a HALT

instruction. SUSPA# remains asserted until

SUSP# is negated, or until an interrupt is serviced

if suspend mode was entered via the HALT

instruction.If SUSP# is asserted andthen negated

prior to SUSPA# assertion, SUSPA# may toggle

stateafter SUSP# negates.

The ST6x86 CPU accepts cache flush requests

and cache inquiry cycles while SUSPA# is

asserted. If FLUSH# is asserted, the CPU exits

the low power state and servicesthe flush request.

After completion of all required write-back cycles,

the CPU returns to the low power state. SUSPA#

negates during the write-back cycles. Before issu-

ing the write-back cycle, the CPU may execute

several code fetches.

If AHOLD, BOFF# or HOLD is asserted while

SUSPA# is asserted, the CPU exits the low power

state in preparation for a cache inquiry cycle. After

completion of any required write-back cycles

resulting from the cache inquiry, the CPU returns

to the low power state only if HOLD, BOFF# and

AHOLD are negated. SUSPA# negates during the

write-back cycle.

Table 3.11 lists the ST6x86 CPU signal states for

suspend mode when initiated by either SUSP# or

the HALT instruction. SUSPA# is disabled

(three-state) following RESET and is enabled by

setting the SUSP bit in CCR2.

ST6x86

3-22

Table 3.11. Signal States During Suspend Mode

SIGNAL LINE SUSP# INITIATED/

HALT INITIATED SIGNAL LINE SUSP# INITIATED/

HALT INITIATED

A20M# Ignored INTR Latched/Recognized

A31-A3 Driven INV Recognized

ADS# 1 KEN# Ignored

ADSC# 1 LBA# 1

AHOLD Recognized LOCK# 1

AP Driven M/IO# Driven

APCHK# 1 NA# Ignored

BE7#-BE0# Driven NMI Latched/Recognized

BHOLD Ignored PCD Driven

BOFF# Recognized PCHK# 1

BRDY# Ignored PWT Driven

BRDYC# Ignored QDUMP# Ignored

BREQ 0 RESET Recognized

CACHE# Driven SCYC Driven

D/C# Driven SMI# Latched/Recognized

D63-D0 Float SMIACT# 1

DHOLD Ignored SUSP# 0 / Recognized

DP7-DP0 Float SUSPA# 0

EADS# Recognized TCK Recognized

EWBE# Ignored TDI Recognized

FERR# 1 TDO Responds to TCK, TDI, TMS, TRST#

FLUSH# Recognized TMS Recognized

HIT# Driven TRST# Recognized

HITM# 1 W/R# Driven

HLDA Driven in response to HOLD WB/WT# Ignored

HOLD Recognized WM_RST Latched/Recognized

IGNNE# Ignored

ST6x86

3-23

3.2.16 JTAG Interface

The ST6x86 CPU can be tested using JTAGInter-

face (IEEE Std. 1149.1) boundary scan test logic.

The ST6x86 CPU pin state can be set according to

serial data supplied to the chip. The ST6x86 CPU

pin state can also be recorded and supplied as

serial data.

Test Clock (TCK) is the clock input used by the

ST6x86 CPU boundary scan (JTAG) test logic.

The rising edge of TCK is used to clock control

and data information into the ST6x86 CPU using

the TMS and TDI pins. The falling edge of TCK is

used to clock data information out of the ST6x86

CPU using the TDO pin.

Test Data Input (TDI) is the serial data input used

by the ST6x86 CPU boundary scan (JTAG) test

logic. TDI is sampled on the rising edge of TCK.

Test Data Output (TDO) is the serial data output

used by the ST6x86 CPU boundary scan (JTAG)

test logic. TDO is output on the falling edge of

TCK.

Test Mode Select (TMS) is the control input used

by the ST6x86 CPU boundary scan (JTAG) test

logic. TMS is sampled on the rising edge of TCK.

Test Reset (TRST#) is an active low input used to

initialize the ST6x86 CPU boundary scan (JTAG)

test logic.

ST6x86

3-24

3.3 Functional Timing

3.3.1 Reset Timing

Figure 3.2 illustrates the required RESET timing

for both a power-on reset and a reset that occurs

during operation.

The WM_RST, FLUSH# and QDUMP# inputs are

sampled at the falling edge of RESET to determine

if the ST6x86 CPU should enter built-in self-test,

enable tri-state test mode or enable the

scatter-gather interface pins, respectively.

WM_RST, FLUSH# and QDUMP#must be valid at

least two clocks prior to the RESET falling edge.

Figure 3.2. RESET Timing

VALID

Reset after Power-On = 15 CLKs Min.

Reset Inactive = 2 CLKs Min.

Power-On Reset = 1 msec Min.

CLK

RESET

WM_RST

FLUSH#

QDUMP#

1734900

Note 1. ADS# asserted approximately 150-200 clocks after RESET falling edge if no built-in self-test

Note 2. ADS# asserted approximately 2**19 clocks after RESET falling edge if built-in self-test requested.

Note 3. Output pins driven to specified RESET state a maximum of 2 CLKs after RESET rising edge.

ST6x86

3-25

3.3.2 Bus State Definition

The ST6x86 CPU bus controller supports

non-pipelined and pipelined operation as well as

single transfer and burst bus cycles. During each

CLK period, the bus controller exists in one of six

states as listed in Table 3.12. Each of these bus

states and its associated state transitions is illus-

trated in (Figure 3.3) and listed in Table 3.13.

Table 3.12. ST6x86 CPU Bus States

STATE NAME DESCRIPTION

Ti Idle Clock During Ti, no bus cycles are in progress. BOFF# and RESET force the bus

to the idle state. The bus is always in the idle state while HLDA is active.

T1 First Bus Cycle Clock During the first clock of a non-pipelined bus cycle, the bus enters the T1

state. ADS# is asserted during T1 along with valid address and bus cycle

definition information.

T2 Second and Subsequent Bus

Cycle Clock

During the second clock of a non-pipelined bus cycle, the bus enters the T2

state. The bus remains inthe T2 state for subsequent clocks of the bus cycle

as long as a pipelined cycle is not initiated. During T2, valid data is driven

during write cycles and data is sampled during reads. BRDY# is also sam-

pled during T2. The bus also enters the T2 state to complete bus cycles that

were initiated as pipelined cycles but complete as the only outstanding bus

cycle.

T12 First Pipelined Bus Cycle

Clock

During the first clock of a pipelined cycle, the bus enters the T12 state. Dur-

ing T12, data is being transferred and BRDY# is sampled for the current

cycle at the same time that ADS# is asserted and address/bus cycle defini-

tion information is driven for the next (pipelined) cycle.

T2P Second and Subsequent

Pipelined Bus Cycle Clock

During the second and subsequent clocks of apipelined bus cycle where two

cycles are outstanding, the bus enters the T2P state. During T2P, data is

being transferred and BRDY# is sampled for the current cycle. However,

valid address and bus cycle definition information continues to be driven for

the next pipelined cycle.

Td Dead Clock

The bus enters the Td state if a pipelined cycle was initiated that requires

one idle clock to turn around the direction of the data bus. Td is required for

a read followed immediately by a pipelined write, and for a write followed

immediately by a pipelined read.

ST6x86

3-26

Figure 3.3. ST6x86 CPU Bus State Diagram

T2P

1741800

T12

P (from any state)

ST6x86

3-27

Table 3.13. Bus State Transitions

TRANSITION CURRENT

STATE NEXT

STATE EQUATION

A Ti Ti No Bus Cycle Pending.

B Ti T1 New or Aborted Bus Cycle Pending.

C T1 T2 Always.

DT2 T2

Not Last BRDY# and No New Bus Cycle Pending, or

Not Last BRDY# and New Bus Cycle Pending and NA# Negated.

E T2 T1 Last BRDY# and New Bus Cycle Pending and HITM# Negated.

FT2 Ti

Last BRDY# and No New Bus Cycle Pending, or

Last BRDY# and HITM# Asserted.

G T2 T12 Not Last BRDY# and New Bus Cycle Pending and NA# Sampled

Asserted.

H T12 T2 Last BRDY# and No Dead Clock Required.

I T12 Td Last BRDY# and Dead Clock Required.

J T12 T2P Not Last BRDY#.

K T2P T2P Not Last BRDY#.

L T2P T2 Last BRDY# and No Dead Clock Required.

M T2P Td Last BRDY# and Dead Clock Required.

N Td T12 New Bus Cycle Pending and NA# Sampled Asserted.

OTd T2

No New Bus Cycle Pending, or

New Bus Cycle Pending and NA# Negated.

P Any State Ti RESET Asserted, or

BOFF# Asserted.

ST6x86

3-28

3.3.3 Non-pipelined Bus Cycles

Non-pipelined bus operation may be used for all

bus cycle types. The term “non-pipelined” refers

to a mode of operation where the CPU allows only

one outstanding bus cycle. In other words, the

current bus cycle must complete before a second

bus cycle is allowed to start.

3.3.3.1 Non-pipelinedSingle Transfer Cycles

Single transfer read cycles occur during

non-cacheable memory reads, I/O read cycles,

and special cycles. A non-pipelined single transfer

read cycle begins with address and bus cycle defi-

nition information driven onthe bus during the first

clock (T1 state) of the bus cycle. The CPU then

monitors the BRDY# input at theend of the second

clock (T2 state). If BRDY# is asserted, the CPU

reads the appropriate data and data parity lines

and terminates the bus cycle. If BRDY# is not

active, the CPU continues to sample the BRDY#

input at the end of each subsequent cycle (T2

states). Each of the additional clocks is referred to

as a wait state.

The CPU uses the data parity inputs to check for

even parity on the active data lines. If the CPU

detects an error, the parity check output (PCHK#)

asserts during the second clock following the ter-

mination of the read cycle.

Figure 3.4 illustrates the functional timing for two

non-pipelined single-transfer read cycles. Cycle 2

is a potentially cacheablecycle as indicated by the

CACHE# output. Because this cycle is potentially

cacheable, the CPU samples the KEN# input at

the same clock edge that BRDY# is asserted. If

KEN# is negated, the cycle terminates as shown

in the diagram. If KEN# is asserted, the CPU con-

verts this cycle into a burst cycle as described in

the next section. NA# must be negated for

non-pipelined operation. Pipelined bus cycles are

described later in this chapter.

ST6x86

3-29

Figure 3.4. Non-Pipelined Single Transfer Read Cycles

VALID

CLK

ADS#

Address, AP

CACHE#

W/R#

Ti T1 T2 T1 T2

VALID

NA#

BRDY#

KEN#

DATA,DP

PCHK#

VALID

Cycle1:

0 WaitState Read

Cycle 2:

Potentially Cacheable,

2 Wait-StateRead

Non-Cacheable,

CYCLE 1 CYCLE 2

1735000

T2 Ti Ti Ti

VALID

ST6x86

3-30

Single transfer write cycles occur for writes that

are neither line replacement nor write-back cycles.

The functional timing of two non-pipelined single

transfer write cycles is shown in Figure 3.5. Dur-

ing a write cycle, the data and data parity lines are

outputs and are driven valid during the second

clock (T2 state) of thebus cycle.

Data and data parity remain valid during all wait

states. If the write cycle is a write to a valid cache

location in the “shared” state, the WB/WT# pin is

sampled with BRDY#. If WB/WT# is sampled

high, the cacheline transitions fromthe “shared”to

the “exclusive” state.

Figure 3.5. Non-Pipelined Single Transfer Write Cycles

VALID

CLK

ADS#

Address, AP

CACHE#

W/R#

Ti T1 T2 T1 T2

VALID

NA#

BRDY#

DATA, DP OUT

CYCLE 1 CYCLE 2

Cycle 1:

0 Wait-State Write Cycle 2:

2 Wait-State Write

WB/WT# VALID

1735100

T2 Ti

OUT

VALID

ST6x86

3-31

3.3.3.2 Non-pipelined Burst Read Cycles

The ST6x86 CPU uses burst read cycles to per-

form cache line fills. During a burst read cycle,

four 64-bit data transfers occur to fill one of the

CPU’s 32-byte internal cache lines. A

non-pipelined burst read cycle begins with address

and bus cycle definition information driven on the

bus during the first clock (T1 state) of the bus

cycle. The CACHE# output is always active during

a burst read cycle and is driven during the T1

clock.

The CPU then monitors the BRDY# input at the

end of the second clock (T2 state). If BRDY# is

asserted, the CPU reads the data and data parity

and also checks the KEN# input. If KEN# is

negated, the CPU terminates the bus cycle as a

single transfer cycle. If KEN# is asserted, the

CPU converts the cycle into a burst (cache line fill)

by continuing to sample BRDY# at the end of each

subsequent clock. BRDY# must be asserted a total

of four times to complete the burst cycle.

WB/WT# is sampled at the same clock edge as

KEN#. In conjunction with PWT and the on-chip

configuration registers, WB/WT# determines the

MESI state of the cache line forthe current line fill.

Each time BRDY# is sampled asserted during the

burst cycle, a data transfer occurs. The CPU

reads the data and data parity busses and assigns

the data to an internally generated burst address.

Although the CPU internally generates the burst

address sequence, only the first address of the

burst is driven on the external address bus. Sys-

tem logic must predict the burst address sequence

based on the first address. Wait states may be

added to any transfer within a burstby delaying the

assertion of BRDY# by the desired number of

clocks.

The CPU checks even data parity for each of the

four transfers within the burst. If the CPU detects

an error, the parity check output (PCHK#) asserts

during the second clock following the BRDY#

assertion of the data transfer.

Figure 3.6 illustrates two non-pipelined burst read

cycles. The cycles shown are the fastest possible

burst sequences (2-1-1-1). NA# must be negated

for non-pipelined operation as shown in the dia-

gram. Pipelined bus cycles are described later in

this chapter.

Figure 3.7 depicts a burst read cycle with wait

states. A 3-2-2-2burst read is shown.

ST6x86

3-32

Figure 3.6. Non-Pipelined Burst Read Cycles

VALID

CLK

ADS#

Address, AP

CACHE#

W/R#

Ti T1 T2 T2 T2 T2 T1 T2 T2

VALID

NA#

BRDY#

KEN#

DATA, DP

PCHK#

IN IN

VALID

Cycle 1: 2-1-1-1 Burst Read Cycle 1735200

T2 T2 Ti

IN IN IN ININ IN

VALID VALID VALID VALID VALID VALID

Cycle 2: 2-1-1-1 Burst Read Cycle

WB/WT# VALID VALID

CYCLE2CYCLE 1

ST6x86

3-33

Figure 3.7. Burst Cycle with Wait States

Burst Cycle Address Sequence.

The ST6x86 CPU provides two different address

sequences for burst read cycles. The ST6x86

CPU burst cycle address sequence modes are

referred to as “1+4” and “linear”. After reset, the

CPU default mode is “1+4”.

In “1+4” mode, the CPU performs a single transfer

read cycle prior to the burst cycle, if the desired

first address is (...xx8). During this single transfer

read cycle, the CPU reads the critical data. In

addition, the ST6x86 CPU samples the state of

KEN#.

If KEN# is active, the CPU then performs the burst

cycle with the address sequence shown in Table

3.14. The ST6x86 CPU CACHE# output is not

asserted during the single read cycle prior to the

burst. Therefore, CACHE# must not be used to

qualify the KEN# input to the processor. In addi-

tion, if KEN# is returned active for the “1” read

cycle in the “1+4”, all data bytes supplied to the

CPU must be valid. The CPU samples WB/WT#

during the “1” read cycle, and does not resample

WB/WT# during the following burst cycle. Figure

3.8 illustrates a “1+4” burst read cycle.

VALID

CLK

ADS#

Address, AP

CACHE#

W/R#

Ti T1 T2 T2 T2 T2 T2 T2 T2

BRDY#

KEN#

DATA, DP

PCHK#

Cycle 1: 3-2-2-2 Burst Read Cycle 1735400

T2 Ti Ti

VALID VALID VALID VALID

IN IN IN

CYCLE1

VALIDWB/WT#

ST6x86

3-34

Table 3.14. “1+4” Burst Address Sequence

Figure 3.8. “1+4” Burst Read Cycle

BURST CYCLE FIRST

ADDRESS SINGLE READ CYCLE PRIOR TO

BURST BURST CYCLE ADDRESS

SEQUENCE

0 None 0-8-10-18

8 Address8 0-8-10-18

10 None 10-18-0-8

18 Address 18 10-18-0-8

CLK

ADS#

Address, AP

CACHE#

W/R#

Ti T1 T2 T1 T2 T2 T2 T2 Ti

NA#

BRDY#

DATA, DP IN

1740300

Cycle 1: Single transfer read

WB/WT#

PCHK# VALID VALID VALID VALID VALID

IN IN IN IN

CYCLE 1 CYCLE 2

KEN#

VALID

C ycle 2: 2-1-1-1 Burst Re ad C ycle

VALID (A4-A0 = 08h or 18h) VALID (A4-A0 = 00h or 10h)

KEN# must be asserted for both cycles.

ST6x86

3-35

The address sequences for the ST6x86 CPU’s lin-

ear burst mode are shown in Table 3.15. Operat-

ing the CPU in linear burst mode minimizes

processor bus activity resulting in higher system

performance. Linear burst mode can be enabled

through the ST6x86 CPU CCR3 configuration reg-

ister.

Table 3.15. Linear BurstAddress Sequence

BURST CYCLE FIRST

ADDRESS BURST CYCLE ADDRESS

SEQUENCE

0 0-8-10-18

88-10-18-0

10 10-18-0-8

18 18-0-8-10

ST6x86

3-36

3.3.3.3 Burst Write Cycles

Burst write cycles occur for line replacement and

write-back cycles. Burst writes are similar to burst

read cycles in that the CACHE# output is asserted

and four 64-bit data transfers occur. Burst writes

differ from burst reads in that the data and data

parity lines are outputs rather than inputs. Also,

KEN# and WB/WT# are not sampled during burst

write cycles.

Data and data parity for the first data transfer are

driven valid during the second clock (T2 state) of

the bus cycle. Once BRDY# is sampled asserted

forthe first data transfer, valid data and data parity

for the second transfer are driven during the next

clock cycle. The same timing relationship between

BRDY# and data applies for the third and fourth

data transfers as well. Wait states may be added

to any transferwithin a burst bydelaying the asser-

tion of BRDY# by the required number of clocks.

As on burst read cycles, only the first address of a

burst write cycle is driven on the external address

bus. System logic must predict the remaining

burst address sequence based on the first

address. Burst write cycles always begin with a

first address ending in 0 (signalsA4-A0=0) and fol-

low an ascending address sequence for the

remaining transfers (0-8-10-18).

Figure 3.9 illustrates two non-pipelined burst write

cycles. The cycles shown are the fastest possible

burst sequences (2-1-1-1). As shown, an idle

clock always exists between two back-to-back

burst write cycles. Therefore, the second burst

write cycle in a pair of back-to-back burst writes is

always issued as a non-pipelined cycle regardless

of the state of the NA# input.

Figure 3.9. Non-Pipelined Burst Write Cycles

VALID (A4-A0 = 00h)

CLK

ADS#

Address, AP

CACHE#

W/R#

Ti T1 T2 T2 T2 T2 Ti* T1 T2

VALID (A4-A0 = 00h)

NA#

BRDY#

DATA, DP OUT OUT

Cycle 1: 2-1-1-1 Burst Write Cycle 1735300

T2 T2 T2

OUT OUT OUT OUTOUT OUT

Cycle 2: 2-1-1-1 Burst Write Cycle

*Note: Ti statealways exists between two back-to-back burstwrite cycles.

CYCLE 1 CYCLE 2

ST6x86

3-37

3.3.4 Pipelined Bus Cycles

Pipelined addressing is a mode of operation where

the CPU allows up to two outstanding bus cycles

at any given time. Using pipelined addressing, the

address of the first bus cycle is driven on the bus

and while the CPU waits for the data for the first

cycle, the address for a second bus cycle is

issued. Pipelined bus cycles occur for all cycle

types except locked cycles and burst write cycles.

Pipelined cycles are initiated by asserting NA#.

The CPU samples NA# at the end of eachT2, T2P

and Td state. KEN# and WB/WT# are sampled at

either the same clock as NA# is active, or at the

same clock as the first BRDY# for that cycle,

whichever occurs first. The CPU issues the next

address a minimum of two clocks after NA# is

sampled asserted.

The CPU latches the state of the NA# pin inter-

nally. Therefore, even if a new bus cycle is not

pending internally at the time NA# was sampled

asserted, the CPU still issues a pipelined bus

cycle if an internal bus request occurs prior to

completion of the current bus cycle. Once NA# is

sampled asserted, the state of NA# is ignored until

the current bus cycle completes. If two cycles are

outstanding and the second cycle is a read, the

CPU samples KEN# and WB/WT# for the second

cycle when NA# is sampled asserted.

Figure 3.10 and Figure 3.11 illustrate pipelined

single transfer read cycles and pipelined burst

read cycles, respectively.

Figure 3.10. Pipelined Single Transfer Read Cycles

VALID 1

CLK

ADS#

Address,AP

CACHE#

W/R#

1735500

Ti T1 T2 T12 T2 T2 Ti

VALID 2

NA#

BRDY#

KEN#

DATA, DP

PCHK#

IN 1 IN 2

VALID 1 VALID 2

Cycle 1: 2WaitStateRead Cycle 2: Potent ially Cacheable,

Pipelined Read Cycle

Non-Cacheable,

CYCLE 1 CYCLE 2 CPU enters idle bus state because

no bus cycle pending internally.

KEN# sampled when NA# sampled asserted.

ST6x86

3-38

Figure 3.11. Pipelined Burst Read Cycles

VALID 1

CLK

ADS#

Address,AP

CACHE#

W/R#

Ti T1 T2 T2 T12 T2P T2 T2 T2

VALID 2

NA#

BRDY#

KEN#

DATA,DP

PCHK#

IN 1 IN1

VALID 1

Cycle1: 2-1-1-1 Burst Read Cycle 1741500

T2 Ti Ti

IN1 IN1 IN2 IN 2 IN 2

VALID 1 VALID1 VALID 1 VALID2 VALID 2 VALID 2

Cycle 2: Pipelined Burst Read Cycle

IN 2

VALID 2

CYCLE 1 CYCLE 2

WB/WT# VALID VALID

ST6x86

3-39

3.3.4.1 Pipelined Back-to-Back

Read/Write Cycles

Figure 3.12 depicts a read cycle followed by a

pipelined write cycle. Under this condition, the

data bus must change from an input for the read

cycle to an output for the write cycle. In order to

accomplish this transition without causingdata bus

contention, the CPU automatically inserts a “dead”

(Td) clock cycle. During the Td state, the data bus

floats. The CPU then drives the write data onto

the bus in the following clock. The CPU also

inserts a Td clock between a write cycle and a

pipelined read cycle to allow the data bus to

smoothly transition from an output to an input.

Figure 3.12. Read Cycle Followed by Pipelined Write Cycle

VALID 1

CLK

ADS#

Address,AP

CACHE#

W/R#

1735700

Ti T1 T2 T2 T12 T2P Td T2 Ti

VALID2

NA#

BRDY#

KEN#

DATA,DP

PCHK#

Cycle 1: 2-1-1-1BurstRead Cycle 2: Pipelined Write

CYCLE 1 CYCLE 2

IN 1 IN 1IN 1 IN 1

VALID1 VALID 1 VALID 1 VALID 1

OUT 2

ST6x86

3-40

3.3.5 Interrupt Acknowledge Cycles

The CPU issues interrupt acknowledge bus cycles

in response to an active INTR input. Interrupt

acknowledge cycles are single transfer cycles and

always occur in locked pairs as shown in Figure

3.13. The CPU reads the interrupt vector from the

lower eight bits of the data bus at the completionof

the second interrupt acknowledge cycle. Parity is

not checked during the first interrupt acknowledge

cycle.

M/IO#, D/C#and W/R# are always logic low during

interrupt acknowledge cycles. Additionally, the

address bus is driven with a value of 0000 0004h

for the first interrupt acknowledge cycle and with a

value of0000 0000h for the second. A minimum of

one idle clock always occurs between the two

interrupt acknowledge cycles.

Figure 3.13. Interrupt Acknowledge Cycles

0000 0004h

CLK

ADS#

Address

LOCK#

1735800

Ti T1 T2 Ti T1 T2 Ti

0000 0000h

Acknowledge Cycle.

InterruptVector Read

DuringSecondInterrupt

RDY#, BRDY#

DATA IN IN

CYCLE1 CYCLE 2

M/IO#,

D/C#, W/R#

VALID

Idle States= 1CLK MIN

ST6x86

3-41

3.3.6 SMI# Interrupt Timing

The CPU samples the System Management Inter-

rupt (SMI#) input at each clock edge. At the next

appropriate instruction boundary, the CPU recog-

nizes the SMI# and completes all pending write

cycles. The CPU then asserts SMIACT# and

begins saving the SMM header information to the

SMM address space. SMIACT# remains asserted

until after execution of a RSM instruction. Figure

3.14 illustrates the functional timing of the SMI-

ACT# signal.

To facilitate using SMI# to power manage I/O

peripherals, the ST6x86 CPU implements a fea-

ture called I/O trapping. If the current bus cycle is

an I/O cycle and SMI# is asserted a minimum of

three clocks prior to BRDY#, the CPU immediately

begins execution of theSMI service routine follow-

ing completion of the I/O instruction. No additional

instructions are executed prior to entering the SMI

service routine. I/O trap timing requirements are

shown in Figure 3.15.

Figure 3.14. SMIACT# Timing

CLK

ADS#

RDY# orBRDY#

SMI#

SMIACT#

1739900

Normal

Access Normal

Access SMI

Handler Normal

Access

4CLK

MIN 1 CLK

MIN 4CLK

MIN

1 CLK

MIN

ST6x86

3-42

Figure 3.15. SMM I/O Trap Timing

3.3.7 Cache Control Timing

3.3.7.1 Invalidating the Cache Using FLUSH#

The FLUSH# input forces the CPU to write-back

and invalidate the entire contents of the on-chip

cache. FLUSH# is sampled at each clock edge,

latched internally and then recognized internally at

the next instruction boundary. Once FLUSH# is

recognized, the CPU issues a series of burst write

cycles to write-back any “modified” cache lines.

The cache lines are invalidated as they are written

back. Following completion of the write-back

cycles, the CPU issues a flush acknowledge spe-

cial bus cycle.

The latency between when FLUSH# occurs and

when the cache invalidation actually completes

varies depending on:

(1) the state of the processor when FLUSH# is

asserted,

(2) the number of modified cache lines,

(3) the number of wait states inserted during the

write-back cycles.

Figure 3.16 illustrates the sequence of events that

occur on the bus in response to a FLUSH#

request.

CLK

Address,

ADS#

BRDY#

SMI#

1736000

T1 T2 T2 T2 T2 T2

I/O Cycle (Read or Write)

3CLKMin.

Byte Enables VALID

ST6x86

3-43

Figure 3.16. Cache Invalidation Using FLUSH#

CLK

ADS#

BRDY#

Address

FLUSH#

1736100

Wait for Processor

to Complete Current

Instruction

Write-Back of all Modified Lines

in Internal Cache Flush Acknowledge

Special Cycle

Write-Back Cycle 0000 0004h

ST6x86

3-44

3.3.7.2 EWBE# Timing

During memory and I/O write cycles, the ST6x86

CPU samples the external write buffer empty

(EWBE#) input. If EWBE# is negated, the CPU

does not write any data to “exclusive” or “modified”

internal cache lines.

After sampling EWBE# negated, the CPU contin-

ues to sample EWBE# at each clock edge until it

asserts. Once EWBE# is asserted, all internal

cache writes are allowed. Through use of this sig-

nal, the external system may enforce strong write

ordering when external write buffers are used.

EWBE# functional timing is shown in Figure 3.17.

Figure 3.17. External Write Buffer Empty (EWBE#) Timing

CLK

ADS#

W/R#

DATA

EWBE#

1737800

Write Cycle:

EWBE# sampled

with each BRDY#.

Writes to E or M-State lines

T1 T2

BRDY#

OUT

that hit in the internal cache

can complete.

No writes to E or M-State lines

that hit in the internal cache.

EWBE# sampled at each

clock edge.

ST6x86

3-45

3.3.8 Bus Arbitration

An external bus master can take control of the

CPU’s bus using either the HOLD/HLDA hand-

shake signals or the back-off (BOFF#) input. Both

mechanisms force the ST6x86 CPU to enter the

bus hold state.

3.3.8.1 HOLD and HLDA

Using the HOLD/HLDA handshake, an external

bus master requests control of the CPU’s bus by

asserting the HOLD signal. In response to an

active HOLD signal, the CPU completes all out-

standing bus cycles, enters the bus hold state by

floating the bus, and asserts the HLDA output.

The CPU remains in the bus hold state until HOLD

is negated. Figures 3-18, 3-19 (Page 3-47) and

3-20 (Page 3-48) illustrate the timing associated

with requesting HOLD during an idle bus, during a

non-pipelined bus cycle and during a pipelined bus

cycle, respectively.

Figure 3.18. Requesting Hold from an Idle Bus

CLK

ADS#

Address

HOLD

1736200

Ti Ti Ti Ti Ti T1 T2

VALID

HLDA

MIN

ZeroClocks

Min OneClock

Functional Timing

ST6x86

3-46

Figure 3.19. Requesting Hold During a Non-Pipelined Bus Cycle

CLK

ADS#

Address

RDY#

1736300

T1 T2 T2 Ti Ti Ti

VALID

HLDA

HOLD

Functional Timing

ST6x86

3-47

Figure 3.20. Requesting Hold During a Pipelined Bus Cycle

VALID 1

CLK

ADS#

Address,AP

Ti T1 T2

BRDY#

DATA,DP

CYCLE 1

HOLD

HLDA

1736400

T12 T2 T2 Ti Ti Ti

VALID 2

IN 1 IN 2

CYCLE 2

NA#

Functional Timing

ST6x86

3-48

3.3.8.2 Back-Off Timing

An external bus master requests immediate con-

trol of the CPU’s bus by asserting the back-off

(BOFF#) input. The CPU samples BOFF# at each

clock edge and responds by floating the bus in the

next clock cycle as shown in Figure 3.21. The

CPU remains in the bus hold state until BOFF# is

negated.

If the assertion of BOFF# interrupts a bus cycle,

the bus cycle is restarted in its entirety following

the negation of BOFF#. If KEN# was sampled by

the processor before the cycle was aborted, it

must be returned with the same value during the

restarted cycle. The state of WB/WT# may be

changed during the restarted cycle.

If BOFF# and BRDY# are active at the same clock

edge, the CPU ignores BRDY#. Any data returned

to the CPU with the BRDY# is also ignored. If

BOFF# interrupts a burst read cycle, the CPU

does not cache any data returned prior to BOFF#.

However, this data may be used for internal CPU

execution.

Figure 3.21. Back-Off Timing

Functional Timing

ST6x86

3-49

3.3.9 Cache Inquiry Cycles

Cache inquiry cycles are issued by the system

with the CPU in either a bus hold or address hold

state. Bus hold is requested by asserting either

HOLD or BOFF#, and address hold is requested

by asserting AHOLD. The system initiates the

cache inquiry cycle by asserting the EADS# input.

The system must also drive the desired inquiry

address on the address lines, and a valid state on

the INV input.

In response to the cache inquiry cycle, the CPU

checks to see if the specified address is present in

the internal cache. If the address is present in the

cache, the CPU checks the MESI state of the

cache line. If the line is in the “exclusive” or

“shared” state, the CPU asserts the HIT# output

and changes the cache line state to “invalid” if the

INVinput was sampled logic high with EADS#.

If the line is in the “modified” state, the CPU

asserts both HIT# and HITM#. The CPU then

issues a bus cycle request to write the modified

cache line to external memory. HITM# remains

asserted until the write-back bus cycle com-

pletes. No additional cache inquiry cycles are

accepted while HITM# is asserted. Write-

back cycles always start at burst address 0. Once

the write-back cycle has completed, the CPU

changes the cache line state to “invalid” if the INV

input was sampled logic high, or “shared” if the

INV input was sampled low.

In addition to checking the cache, the CPU also

snoops the internal line fill and cache write-back

buffers in response to a cache inquiry cycle. The

following sections describethe functional timing for

cache inquiry cycles and the corresponding

write-back cycles for the various types of inquiry

cycles.

Functional Timing

ST6x86

3-50

3.3.9.1 InquiryCycles Using HOLD/HLDA

Figure 3.22 illustrates an inquiry cycle where

HOLD is used to force the CPU into a bus hold

state. In this case, the system asserts HOLD and

must wait for the CPU to respond with HLDA

before issuing the cache inquiry cycle. To avoid

address bus contention, EADS# should not be

asserted until the second clock after HLDA as

shown in the diagram. If the inquiry address hits

on a modified cache line, HIT# and HITM# are

asserted during the second clock following

EADS#. Once HITM# asserts, the system must

negate HOLD to allow the CPU to run the corre-

sponding write-back cycle. The first cycle issued

following negation of HLDA is the write-back bus

cycle.

Figure 3.22. HOLD Inquiry Cycle that Hits on a Modified Line

To CPU

CLK

ADS#

Address

BRDY#

HOLD

T2 Ti Ti Ti Ti Ti Ti Ti Ti

FromCPU

EADS#

INV

HIT#

HITM#

1736600

T1 T2 T2 T2

Write-Back Cycle

T2 Ti Ti

VALID

HLDA

Functional Timing

ST6x86

3-51

3.3.9.2 InquiryCycles Using BOFF#

Figure 3.23 illustrates an inquiry cycle where

BOFF# is used to force the CPU into a bus hold

state. In this case, the system asserts BOFF# and

the CPU immediately relinquishes control of the

bus in the next clock. Toavoid address bus conten-

tion, EADS# should not be asserted until the sec-

ond clock edge after BOFF# as shown in the

diagram. If the inquiry address hits on a modified

cache line, HIT# and HITM# are asserted during

the second clock following EADS#. Once HITM#

asserts, the system must negate BOFF# to allow

the CPU to run the corresponding write-back

cycle. The first cycle issued following negation of

BOFF# is the write-back bus cycle.

Figure 3.23. BOFF# Inquiry Cycle that Hits on a Modified Line

To CPU

CLK

ADS#

Address

BRDY#

BOFF#

T1 Ti Ti Ti Ti Ti T1 T2 T2

From CPU

EADS#

INV

HIT#

HITM#

1736700

T2 T2 Ti T1

Write-Back Cycle

VALID

Cycle 1

(Restarted)

Functional Timing

ST6x86

3-52

3.3.9.3 InquiryCycles Using AHOLD

Figure 3.24 illustrates an inquiry cycle where

AHOLD is used to force the CPU into an address

hold state. In this case, the system asserts

AHOLD and the CPU immediately floats the

address bus in the next clock. To avoid address

bus contention, EADS# should not be asserted

until the second clock edge after AHOLD as

shown in the diagram. If the inquiry address hits

on a modified cache line, the CPU asserts HIT#

and HITM# during the second clock following

EADS#. The CPU then issues the write-back

cycle even if AHOLD remains asserted. ADS# for

the write-back cycle asserts two clocks after

HITM# is asserted. To prevent the address bus

and data bus from switching simultaneously, the

system must adhere to the restrictions on negation

of AHOLD as shown in Figure 3.24.

Figure 3.24. AHOLD Inquiry Cycle that Hits on a Modified Line

To CPU

CLK

ADS#

Address

BRDY#

Data, DP

T1 T2 Ti Ti Ti Ti Ti T1 T2

FromCPU

AHOLD

EADS#

INV

HIT#

1736800

T2 T2 T2 T2

Write-Back Cycle

VALID

HITM#

OUT OUT OUT OUT

Restrictionson negatingAHOLD:

1. During a write cycle, AHOLDshould not be negated inthe same clockthat BRDY# is asserted.

2. During pipelined buscycles, AHOLD should not be negated duringthe Td clock between a read cycle

followed by a pipelined write cycle.

3. While HITM# is asserted,AHOLD shouldnot be negated in thesame clock thatADS# is asserted.

Functional Timing

ST6x86

3-53

Figure 3.25 depicts an AHOLD inquiry cycle dur-

ing a line fill. In this case, the write-back cycle

occurs after the line fill is completed. At least one

idle clock exists between the final BRDY# of the

line fill and the ADS# for the write-back cycle. If

the inquiry cycle hits on the address of the line fill

that is in progress, the data from the line fill cycle is

always used to complete the pending internal

operation. However, the data is not placed in the

cache if INV is sampled asserted with EADS#.

The data is placed in the cache in a “shared” state

if INV is sampled negated.

Figure 3.25. AHOLD Inquiry Cycle During a Line Fill

To CPU

CLK

ADS#

Address

BRDY#

Data, DP

T1 T2 T2 T2 T2 T2 T2

From CPU

AHOLD

EADS#

INV

HIT#

1736900

VALID

HITM#

IN IN IN

Line Fill

Note: If the inquiry cycle hits on the line fill inprogress, the data from theline fill will be used tocomplete the pending internal operation.

The line is not placed in the cache if INVis sampled asserted with EADS#. The line is placed in the cache in a ”shared”

state if INV is sampled negated with EADS#.

T1 T2 T2 T2 T2 Ti Ti

OUT OUT OUT OUTIN

Write-Back Cycle

Functional Timing

ST6x86

3-54

During cache inquiry cycles, the CPU performs

address parity checking using A31-A5 and the AP

signal. The CPU checks for even parity and

asserts the APCHK# output if a parity error is

detected. Figure 3.26 illustrates the functional tim-

ing of the APCHK# output.

Figure 3.26. APCHK# Timing

CLK

EADS#

Address

1737000

Tx Tx Tx Tx Tx

To CPU

APCHK#

To CPU

VALID

Functional Timing

ST6x86

3-55

3.3.10 Scatter/Gather Buffer Interface

The scatter/gather buffer interface signals, in con-

junction with the byte enables and address hold,

can be used by the system hardware to transfer

data to/from a 32-bit peripheral interface bus. A

64-bit buffer resides in the CPU to assist the sys-

tem in these transfers.

As shown in Figure 3.27 when BHOLD is asserted

the CPU floats the byte enable outputs

(BE7#-BE0#) in the next clock. While BHOLD is

asserted, only the byte enables are disabled. The

current bus cycle remains active and can be com-

pleted in the normal fashion. The CPU continues

to generate additional bus cycles while BHOLD is

asserted, so BHOLD should only be asserted

while AHOLD is asserted.

Figure 3.27 also illustrates DHOLDtiming. DHOLD

forces the CPU to float the data and data parity

buses in the next clock. While DHOLD is

asserted, the current bus cycle remains active and

additional bus cycles may be generated by the

CPU.

Figure 3.27. BHOLD and DHOLD Timing

CLK

DHOLD

D63-D0

BHOLD

BE7#-BE0#

1737100

D1 D1

BEx BEx

Functional Timing

ST6x86

3-56

Figure 3.28 and Figure 3.29 illustrate CPU read

and write cycles that access a 32-bit device using the scatter/gather buffer.

Figure 3.28. CPU Upper Byte Read from 32-Bit Bus Using Scatter/Gather

CLK

ADS#

LBA#

D63-D32

D31-D0

1737200

BE7#-BE0# BE# = 0xBF From CPU BE# From CPU

BHOLD

BRDY#

D1 (to S/G Buffer))

BE# = 0xBF To CPU

BHOLD is asserted in order to

issue the MUX command

via the BE#s (BE# = 0xBFh).

Controller detects CPU read of

upper byte to 32-bit peripheral bus

via LBA# and BE#s.

The clock following BE# = 0xBFh,

the CPU maps D31-D0 to D63-D32

of the scatter/gather buffer to read byte 6.

Functional Timing

ST6x86

3-57

Figure 3.29. CPU Upper Byte Write to 32-Bit Bus Using Scatter/Gather

CLK

ADS#

LBA#

D63-D32

D31-D0

1737300

BE7#-BE0# BE# = 0xBF From CPU BE# From CPU

BHOLD

BRDY#

D2 (from S/G Buffer)

Controller detects CPU write of

upper byte to 32-bit peripheral bus

via LBA# and BE#s.

BHOLD need not be asserted

because the CPU automatically

maps D63-D32 to D31-D0 when

LBA# asserted and BE3-BE0 = Fh.

During the clock following BE# = 0xBFh,

the CPU maps D63-D32 to D31-D0

for transfer on 32-bit bus.

Functional Timing

ST6x86

3-58

Figures 3.30 and 3.31 illustrate bus master reads

and writes between a 32-bit device and 64-bit main memory. The CPU bus must be idle when a

bus master initiates a scatter/gather cycle.

Figure 3.30. Bus Master Read from 64-Bit Memory to 32-Bit Bus

CLK

D63-D32

D31-D0

BE7#-BE0#

BHOLD

1737400

DHOLD

BE#=0x00 BE#=0xF0

QDUMP#

D2from Memory

D1 from Memory

D2 from S/G Buffer D1 from S/G Buffer

BE#=0x0FBE#=0xFF

Controller asserts BHOLDand DHOLD

to transferdata from memory

to CPU’s internal scatter/gather buffer.

BE#=0x00 causes the64-bit data from

memory tobe written into CPU’sbuffer.

The controller negates BE# (BE=0xFF)

so that data in the scatter/gather buffer is

not corrupted and tristates the data bus

to allow for a scatteroperation to proceed.

The controller negates DHOLD and

asserts BE#=0x0F followed by 0xF0

along with QDUMP# to transferthe

upperword (D2=D63-D32) followed

by the lower word (D1=D31-D0),

respectively, to the 32-bit bus.

Functional Timing

ST6x86

3-59

Figure 3.31. Bus Master Write to 64-Bit Memory from 32-Bit Bus

CLK

D32-D63

D0-D31

BE0-BE7

BHOLD

1737500

DHOLD

BE#=FFh

QDUMP#

D2 (to Memory)

D1 (toMemory)

BE#=0xF0BE#=0x0F

D1(toS/GBuffer)D2 (toS/G Buffer)

BE#=0x00

Controller asserts BHOLD and DHOLD

to transfer data from the 32-bit bus

to CPU’s internal scatter/gatherbuffer.

The MUX command along with a word

write is issued by thecontroller to

write D1 from the 32-bitbus into

D63-D32 of CPU’s bufferfollowed by

a 2nd word write to D31-D0.

The controller relinquishescontrol of

CPU data bus,negates DHOLD and

asserts QDUMP# to dump the 64-bitdata

on to the CPU local bus for transfer to memory.

Functional Timing

ST6x86

3-60

3.3.11 Power Management Interface

SUSP# InitiatedSuspend Mode

The ST6x86 CPU enters suspend mode when the

SUSP# input is asserted and execution of the cur-

rent instruction, any pending decoded instructions

and associated bus cycles are completed. A stop

grant bus cycle is then issued and the SUSPA#

output is asserted. The CPU responds to SUSP#

and asserts SUSPA# only if the SUSP bit is set in

the CCR2 configuration register.

SUSP# is sampled (Figure 3.32) on the rising

edge of CLK. SUSP# must meet specified setup

and hold times to be recognized at a particular

CLK edge. The time from assertion of SUSP# to

activation of SUSPA# varies depending on which

instructions were decoded prior to assertion of

SUSP#. Theminimum timefrom SUSP# sampled

active to SUSPA# asserted is eight CLKs. As a

maximum, theCPU may execute up to two instruc-

tions and associated bus cycles prior to asserting

SUSPA#. The time requiredfor the CPU to deacti-

vate SUSPA# once SUSP# has been sampled

inactive is five CLKs.

If the CPU is in a hold acknowledge state and

SUSP# is asserted, the CPU may or may not enter

suspend mode depending on the state of the CPU

internal execution pipeline. If the CPU is in a

SUSP# initiated suspend mode, one occurrence of

NMI, INTR and SMI# is stored for execution once

suspend mode is exited. The ST6x86 CPU also

recognizes and acknowledgesthe HOLD, AHOLD,

BOFF# and FLUSH# signals while in suspend

mode.

Figure 3.32. SUSP# Initiated Suspend Mode

CLK

SUSP#

SUSPA#

1737600

Tx Tx Ti Ti Ti Ti Tx

8 CLKs 5 CLKs

Functional Timing

ST6x86

3-61

HALT Initiated Suspend Mode

The CPU also enters suspend mode as a result of

executing a HALT instruction if the HALT bit in

CCR2 is set. The SUSPA# output is asserted no

later than 40 CLKs following BRDY# sampled active

for the HALT bus cycle as shown in Figure 3.33.

Suspend mode is then exited upon recognition of

an NMI, an unmasked INTR or an SMI#. SUSPA#

is deactivated 10 CLKs after sampling of an active

interrupt.

Figure 3.33. HALT Initiated Suspend Mode

CLK

ADS#

M/IO#,

BRDY#

1737700

INTR, NMI

SUSPA#

T1 T2 Ti Ti Ti Ti Ti Ti

Non-Pipelined HALT

BE(0, 1, 3-7)#,

W/R#

10 CLKs

A3-A31,

BE#2, D/C#, IO#

40 CLKs (Max)

Functional Timing

ST6x86

3-62

Stopping the Input Clock

Once the CPU has entered suspend mode, the

input clock (CLK) can be stopped and restarted

without loss of any internal CPU data. The CLK

input can be stopped at either a logic high or logic

low state.

The CPU remains suspended until CLK is

restarted and suspend mode is exited as

described earlier. While the CLK is stopped, the

CPU can no longer sample and respond to any

input stimulus.

Figure 3.34 illustrates the recommended sequence

for stopping the CLK using SUSP# to initiate sus-

pend mode. CLK may be started prior to or follow-

ing negation of the SUSP# input. The system must

allow sufficient time for the CPU’s internal PLL to

lock to the desired frequency before exiting sus-

pend mode.

Figure 3.34. Stopping CLK During Suspend Mode

CLK

SUSP#

SUSPA#

1731901

Tx Tx Tx Tx

ST6x86

4-1

4.0 ELECTRICAL SPECIFICATIONS

4.1 Electrical Connections

This section provides information on electrical con-

nections, absolute maximum ratings, recom-

mended operating conditions, DC characteristics,

and AC characteristics. All voltage values in Elec-

trical Specifications are measured with respect to

VSS unless otherwise noted.

4.1.1 Power and Ground Connections and

Decoupling

Testing and operating the ST6x86 CPU requires

the use of standard high frequency techniques to

reduce parasitic effects. The high clock frequen-

cies used in the ST6x86 CPU and its output buffer

circuits can cause transient power surges when

several output buffers switch output levels simulta-

neously. These effects can be minimized by filter-

ing the DC power leads with low-inductance

decoupling capacitors, using low impedance wir-

ing, and by utilizing all of the VCC and GND pins.

The ST6x86 CPU contains 296 pins with 53 pins

connected to VCC and 53 connected to VSS

(ground).

4.1.2 Pull-Up/Pull-Down Resistors

Table 4.1 lists the input pins that are internally con-

nected to pull-up and pull-down resistors. The

pull-up resistors are connected to VCC and the

pull-down resistors are connected to VSS.When

unused, these inputs do not require connection to

external pull-up or pull-down resistors. The

SUSP# pin is unique in that it is connected to a

pull-up resistor only when SUSP# is notasserted.

Table 4.1. Pins Connected to Internal Pull-Up

and Pull Down Resistors

SIGNAL PIN NO. RESISTOR

BRDYC# Y3 20-kΩpull-up

CLKMUL Y33 20-kΩpull-down

QDUMP# AL7 20-kΩpull-up

SMI# AB34

SUSP# Y34 20-kΩpull-up (see text)

TCK M34

20-kΩpull-up

TDI N35

TMS P34

TRST# Q33

Reserved J33

Reserved W35

Reserved Y35

Reserved AN35 20-kΩpull-down

ST6x86

4-2

4.1.3 Unused Input Pins

All inputs not used bythe systemdesigner and not

listed in Table 4.1 should be connected either to

ground or to VCC. Connect active-high inputs to

groundthrough a 20 kΩ(±10%) pull-down resistor

and active-low inputs to VCC through a 20 kΩ(±

10%) pull-up resistor to prevent possible spurious

operation.

4.1.4 NC and Reserved Pins

Pins designated NC have no internal connec-

tions. Pins designated RESV or RESERVED

should be left disconnected. Connecting a

reserved pin to a pull-up resistor, pull-down resis-

tor, or an active signal could cause unexpected

results and possible circuit malfunctions.

4.2 AbsoluteMaximum Ratings

The following table lists absolute maximum ratings

for the ST6x86 CPU microprocessors. Stresses

beyond those listed under Table 4.2 limits may

cause permanent damage to the device. These

are stressratings only and do not implythat opera-

tion under any conditions other than those listed

under “Recommended Operating Conditions”

Table 4.3 is possible. Exposure to conditions

beyond Table 4.2 may (1) reduce device reliability

and (2) result in premature failure even when there

is no immediately apparent sign of failure. Pro-

longed exposure to conditions at or near the abso-

lute maximum ratings may also result in reduced

useful life and reliability.

Table 4.2. Absolute Maximum Ratings

PARAMETER MIN MAX UNITS NOTES

Operating Case Temperature

Storage Temperature

Supply Voltage, VCC

Voltage On Any Pin

Input Clamp Current, IIK

Output Clamp Current, IOK

-65

-66

-0.5

110

150

4.0

VCC +0.5

°C

Power Applied

Absolute Maximum Ratings

ST6x86

4-3

4.3 Recommended Operating Conditions

Table 4.3 presents the recommended operating conditions for the ST6x86 CPU device.

Table 4.3. Recommended Operating Conditions

PARAMETER MIN MAX UNITS NOTES

TCOperating Case Temperature 0 70 °C Power Applied

VCC Supply Voltage 3.15 3.7 V

VIH High-Level Input Voltage 2.0 5.5 V

VIL Low-Level Input Voltage -0.3 0.8 V

IOH High-Level Output Current

All outputs except A20-A3 and W/R#

A20-A3 and W/R# -1.0

-2.0 mA VO=VOH(MIN)

IOL Low-Level Output Current

All outputs except A20-A3 and W/R#

A20-A3 and W/R# 5.0

10.0 mA VO=VOL(MAX}

Recommended Operating Conditions

ST6x86

4-4

4.4 DC Characteristics

Table 4.4. DC Characteristics (at Recommended Operating Conditions)

PARAMETER MIN TYP MAX UNITS NOTES

VOL Output Low Voltage

IOL = 5 mA 0.4 V

VOH Output High Voltage

IOH =-1mA 2.4 V

IInput Leakage Current

For all pins except those

listed in Table4-1. ±15 µA0<V

IN <V

IIH Input Leakage Current

For all pins with internal

pull-downs. 200 µAVIH = 2.4 V

See Table 4-1.

IIL Input Leakage Current

For all pins with internal pull-ups. -400 µAVIL = 0.45 V

See Table 4-1.

ICC Active ICC

80 MHz

100 MHz

110 MHz

120 MHz

133 MHz

3.9

4.5

4.8

5.1

5.5

4.7

5.4

5.8

6.1

6.6

ANote 1, 5

ICCSM Suspend Mode ICC

80 MHz

100 MHz

110 MHz

120 MHz

133 MHz

105

115

mA Note 1, 3, 5

ICCSS Standby ICC

0 MHz (Suspended/CLK Stopped) 35 75 mA Note 4,5

CINInput Capacitance 15 pF f = 1 MHz, Note 2

COUTOutput Capacitance 20 pF f = 1 MHz, Note 2

CIOI/O Capacitance 25 pF f = 1 MHz, Note 2

CCLKCLK Capacitance 15 pF f = 1 MHz, Note 2

Notes:

1. Frequency (MHz) ratings refer to the internal clock frequency.

2. Not 100% tested.

3. All inputs at 0.4 or VCC - 0.4 (CMOS levels). All inputs held static except clock and all outputs unloaded

(static IOUT = 0 mA).

4. All inputs at 0.4 or VCC - 0.4 (CMOS levels). All inputs held static and all outputs unloaded (static IOUT = 0 mA).

5. Typical, measured at VCC = 3.3 V

DC Characteristics

ST6x86

4-5

4.5 AC Characteristics

Tables 4-6 through 4-11 list the AC characteristics

including output delays, input setup requirements,

input hold requirements and output float delays.

These measurements are based on the measure-

ment points identified in Figure 4.1 and Figure 4.2.

The rising clock edge reference level VREF

, and

other reference levels are shown in Table 4.5.

Input or output signals must cross these levels during

testing.

Figure 4.1 shows output delay (A and B) and input

setup and hold times (C and D). Input setup and

hold times (C and D) are specified minimums,

defining the smallest acceptable sampling window

a synchronous input signal must be stable for cor-

rectoperation.

AC Characteristics

ST6x86

4-6

Figure 4.1. Drive Level and Measurement Points for Switching Characteristics

Table 4.5. Drive Level and Measurement Points for Switching Characteristics

SYMBOL VOLTAGE

(Volts)

VREF 1.5

VIHD 2.3

VILD 0

Note: Refer to Figure 4-1.

MIN MAX

Valid

CLK:

LEGEND: A - Maximum Output Delay Specification

OUTPUTS:

INPUTS:

1709406

VREF VREF

Valid

VREF VREF

IHD

VILD

B - Minimum Output Delay Specification

C - Minimum Input Setup Specification

D - Minimum Input Hold Specification

Outputn Output n+1

Input

VIHD

VILD

AC Characteristics

ST6x86

4-7

AC Characteristics

Table 4.6. ClockSpecifications

Tcase =0°Cto70°C, See Figure 4.2

Figure 4.2. CLK Timing and Measurement Points

SYMBOL PARAMETER 40-MHz BUS 50-MHz BUS 55-MHz BUS 60-MHz BUS 66-MHz BUS UNITS

MIN MAX MIN MAX MIN MAX MIN MAX MIN MAX

CLK Frequency 40 50 55 60 66.6 MHz

T1 CLK Period 25 20 18 16.67 33.33 15.0 30.0 ns

T2 CLK Period Stability ±250 ±250 ±250 ±250 ±250 ps

T3 CLK High Time 9 7 4.0 4.0 4.0 ns

T4 CLK Low Time 9 7 4.0 4.0 4.0 ns

T5 CLK Fall Time 0.15 2 0.15 2 0.15 1.5 0.15 1.5 0.15 1.5 ns

T6 CLK Rise Time 0.15 2 0.15 2 0.15 1.5 0.15 1.5 0.15 1.5 ns

T6 T4

CLK

1740502

IH(MIN)

VREF

VIL(MAX)

ST6x86

4-8

Table 4.7. OutputValid Delays

CL=50 pF,Tcase =0°Cto70°C, See Figure 4.3

Figure 4.3. Output Valid Delay Timing

SYM-

BOL PARAMETER 40-MHz BUS 50-MHz BUS 55-MHz BUS 60-MHz BUS 66-MHz BUS UNITS

MIN MAX MIN MAX MIN MAX MIN MAX MIN MAX

A31-A3,BE7#-BE0#,

CACHE#, D/C#, LBA#,

LOCK#,PCD,PWT,

SCYC, SMIACT#, W/R#

3 14 1.0 12 1.0 7.0 1.0 8.0 1.0 7.0 ns

T7b ADS#, M/IO# 3 14 1.0 12 1.0 7.5 1.0 7.5 1.0 6.0 ns

T8 ADSC# 3 14 1.0 12 1.0 7.0 1.0 8.0 1.0 7.0 ns

T9 AP 3 14 1.0 12 1.0 8.5 1.0 8.5 1.0 8.5 ns

T10 APCHK#,PCHK#,

FERR# 3 16 1.0 14 1.0 8.3 1.0 7.0 1.0 7.0 ns

T11 D63-D0,DP7-DP0

(Write) 3 14 1.3 12 1.3 9.0 1.3 9.0 1.3 7.5 ns

T12a HIT# 3 14 1.0 12 1.0 8.0 1.0 8.0 1.0 8.0 ns

T12b HITM# 3 14 1.1 12 1.1 7.0 1.1 7.0 1.1 6.0 ns

T13 BREQ, HLDA 3 14 1.0 12 1.0 8.0 1.0 8.0 1.0 8.0 ns

T14 SUSPA# 3 16 1.0 14 1.0 8.0 1.0 8.0 1.0 8.0 ns

Tx Tx Tx Tx

CLK

1740900

MIN MAX

VALIDn+1

VALIDn

T7- T14

OUTPUTS

ST6x86

4-9

Table 4.8. OutputFloat Delays

CL=50 pFcase =0°Cto70°C, See Figure 4.4

Figure 4.4. Output Float Delay Timing

SYMBOL PARAMETER 40-MHz BUS 50-MHz BUS 55-MHz BUS 60-MHz BUS 66-MHz BUS UNITS

MIN MAX MIN MAX MIN MAX MIN MAX MIN MAX

T15

A31-A3,ADS#,

BE7#-BE0#,

BREQ,CACHE#,

D/C#,LBA#,

LOCK#,M/IO#,

PCD,PWT,

SCYC,SMIACT#,

W/R#

19 16 10.0 10.0 10.0 ns

T16 AP 19 16 10.0 10.0 10.0 ns

T17 D63-D0,DP7-DP0

(Write) 19 16 10.0 10.0 10.0 ns

Tx Tx Tx Tx

CLK

1741000

MIN

VALID

MAX

T15 -T17

OUTPUTS

ST6x86

4-10

Table 4.9. Input Setup Times

Tcase =0°Cto70°C, See Figure 4.5

Table 4.10. Input Hold Times

Tcase =0°Cto 70 °C, See Figure 4.5

SYMBOL PARAMETER

40-MHz

BUS 50-MHz

BUS 55-MHz

BUS 60-MHz

BUS 66-MHz

BUS UNITS

MIN MIN MIN MIN MIN

T18 A20M#, FLUSH#, IGNNE#,

SUSP# 5.0 5.0 5.0 5.0 5.0 ns

T19 AHOLD, BHOLD, BOFF#,

DHOLD, HOLD 5.0 5.0 5.0 5.0 5.0 ns

T20 BRDY# 5.0 5.0 5.0 5.0 5.0 ns

T21 BRDYC# 5.0 5.0 5.0 5.0 5.0 ns

T22 A31-A3, AP,BE7#-BE0#, 5.0 5.0 5.0 5.0 5.0 ns

T22a D63-D0(Read),DP7-DP0

(Read) 3.8 3.8 3.8 3.0 3.0 ns

T23 EADS#, INV 5.0 5.0 5.0 5.0 5.0 ns

T24 INTR, NMI, RESET, SMI#,

WM_RST 5.0 5.0 5.0 5.0 5.0 ns

T25 EWBE#,KEN#,NA#, WB/WT# 5.0 5.0 4.5 4.5 4.5 ns

T26 QDUMP# 5.0 5.0 5.0 5.0 5.0 ns

SYMBOL PARAMETER

40-MHz

BUS 50-MHz

BUS 55-MHz

BUS 60-MHz

BUS 66-MHz

BUS UNITS

MIN MIN MIN MIN MIN

T27 A20M#,FLUSH#,IGNNE#,

SUSP# 3.0 2.0 1.0 1.0 1.0 ns

T28 AHOLD,BHOLD,BOFF#,

DHOLD, HOLD 3.0 2.0 1.0 1.0 1.0 ns

T29 BRDY# 3.0 2.0 1.0 1.0 1.0 ns

T30 BRDYC# 3.0 2.0 1.0 1.0 1.0 ns

T31a A31-A3,AP, BE7#-BE0# 3.0 2.0 1.0 1.0 1.0 ns

T31b D63-D0,DP7-DP0(Read) 3.0 2.0 2.0 2.0 2.0 ns

T32 EADS#, INV 3.0 2.0 1.0 1.0 1.0 ns

T33 INTR,NMI,RESET,SMI#,

WM_RST 3.0 2.0 1.0 1.0 1.0 ns

T34 EWBE#,KEN#,NA#,WB/WT# 3.0 2.0 1.0 1.0 1.0 ns

T35 QDUMP# 3.0 2.0 1.0 1.0 1.0 ns

ST6x86

4-11

Figure 4.5. Input Setup and Hold Timing

Tx Tx Tx Tx

SETUP HOLD

CLK

1740600

T18-T26 T27- T35

ST6x86

4-12

Table 4.11. JTAG AC Specifications

Figure 4.6. TCK Timing and Measurement Points

SYMBOL PARAMETER ALL BUS FREQUENCIES UNITS FIGURE

MIN MAX

TCK Frequency (MHz) 20 ns

T36 TCK Period 50 ns 4-6

T37 TCK High Time 25 ns 4-6

T38 TCK Low Time 25 ns 4-6

T39 TCK Rise Time 5 ns 4-6

T40 TCK Fall Time 5 ns 4-6

T41 TDO Valid Delay 3 20 ns 4-7

T42 Non-test Outputs Valid Delay 3 20 ns 4-7

T43 TDO Float Delay 25 ns 4-7

T44 Non-test Outputs Float Delay 25 ns 4-7

T45 TRST# Pulse Width 40 ns 4-8

T46 TDI, TMS Setup Time 20 ns 4-7

T47 Non-test Inputs Setup Time 20 ns 4-7

T48 TDI, TMS Hold Time 13 ns 4-7

T49 Non-test Inputs Hold Time 13 ns 4-7

T37

T39 T38

T36

T40

TCK

1741102

VREF

VIL

ST6x86

4-13

Figure 4.7. JTAG Test Timings

Figure 4.8. Test Reset Timing

TCK

TDO

1740400

1.5 V

T46 T48

T41 T43

T42 T44

T47 T49

OUTPUT

SIGNALS

INPUT

SIGNALS

TDI

TMS

TRST#

1741200

T45

1.5V

ST6x86

5-1

5.0 MECHANICAL SPECIFICATIONS

5.1 296-Pin SPGA Package

The pin assignments for the 6x86CPUin a 296-pin

SPGA package are shown in Figure 5.1. The pins

are listed by signal name in Table5.1 (Page2) and

by pin number in Table 5.2 (Page 3). Dimensions

are shown in Table 5.2 (Page 3) and Table 5.3

(Page 5).

Figure 5.1. 296-Pin SPGA Package Pin Assignments

37 36 35 34 33 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1

37363534333231302928272625242322212019181716151413121110987654321

TOP VIEW

NCD41VCCVCCVCCVCCVCCVCCVCCVCCVCCVCCVCCVCCD22D18D15NC

NCD43VSSVSSVSSVSSVSSVSSVSSVSSVSS

VSS

VSSVSSD20D16D13D11

NCD47D45DP4D38D36D34D32D31D29D27D25DP2D24D21D17D14D10D9

D50D48D44D40D39D37D35D33DP3D30D28D26D23D19DP1D12D8DP0

D54D52D49D46D42D7D6VCC

DP6D51DP5D5D4

VCCD55D53

VSSD56

VCCD57D58

VSSD59

D3D1VCC

NCVSS

RESVD2VCC

D0VSS

VCCD61D60

VSSD62

VCCD63DP7

VSSNC

VCCRESVFERR#

VCCNCVCC

TCKVSS

TDOTDIVCC

TMSVSS

TRST#NCVCC

VSSRESV

VCCRESVLBA#

VSSMI/O#

VCCCACHE#INV

VSSAHOLD

VCCEWBE#KEN#

VSSBRDY#

VCCBRDYC#NA#

VSSBOFF#

VCCRESVWB/WT#

VSSHOLD

BHOLDVSS

RESVDHOLDVCC

VCCVSS

VCCVSSVCC

SUSP#VSS

SUSPA#RESVVCC

RESVVSS

CLKMULRESVVCC

NCVSS

WM_RSTIGNNE#VCC

SMI#VSS

VCCRESVNC

VSSNC

VCCNCAPCHK#

VSSPCHK#

VCCSMIACT#PCD

VSSLOCK#

BREQHLDAADS#

NMINCVCC

INTRVSS

A23NCVCC

A21VSS

A27A24VCC

A26A22

A31A25VSS

APD/C#HIT#A20M#BE1#BE3#BE5#BE7#CLKRESETA19A17A15A13A9A5A29A28

NCPWTHITM#QDUMP#BE0#BE2#BE4#BE6#SCYCRESVA20A18A16A14A12A11A7A3VSS

ADSC#EADS#W/R#VSSVSSVSSVSSVSSVSSVSSVSSVSSVSSVSSVSSA8A4A30

NCNCNCFLUSH#VCCVCCVCCVCCVCCVCCVCCVCCVCCVCCVCCA10A6RESVVSS

1740200

6x86 CPU

ST6x86

5-2

Table 5.1. 296-Pin SPGA Package Signal Names Sorted by Pin Number

Pin Signal Pin Signal Pin Signal Pin Signal Pin Signal Pin Signal

A3 NC C29 D21 J35 D2 U35 Vss AE35 NC AL21 A20

A5 D41 C31 D17 J37 Vcc U37 Vcc AE37 Vcc AL23 A18

A7 Vcc C33 D14 K2 Vss V2 Vss AF2 Vss AL25 A16

A9 Vcc C35 D10 K4 D59 V4 AHOLD AF4 PCHK# AL27 A14

A11 Vcc C37 D9 K34 D0 V34 SUSP# AF34 A21 AL29 A12

A13 Vcc D2 D50 K36 Vss V36 Vss AF36 Vss AL31 A11

A15 Vcc D4 D48 L1 Vcc W1 Vcc AG1 Vcc AL33 A7

A17 Vcc D6 D44 L3 D61 W3 EWBE# AG3 SMIACT# AL35 A3

A19 Vcc D8 D40 L5 D60 W5 KEN# AG5 PCD AL37 Vss

A21 Vcc D10 D39 L33 Vcc W33 SUSPA# AG33 A27 AM2 ADSC#

A23 Vcc D12 D37 L35 NC W35 Reserved AG35 A24 AM4 EADS#

A25 Vcc D14 D35 L37 Vcc W37 Vcc AG37 Vcc AM6 W/R#

A27 Vcc D16 D33 M2 Vss X2 Vss AH2 Vss AM8 Vss

A29 Vcc D18 DP3 M4 D62 X4 BRDY# AH4 LOCK# AM10 Vss

A31 D22 D20 D30 M34 TCK X34 Reserved AH34 A26 AM12 Vss

A33 D18 D22 D28 M36 Vss X36 Vss AH36 A22 AM14 Vss

A35 D15 D24 D26 N1 Vcc Y1 Vcc AJ1 BREQ AM16 Vss

A37 NC D26 D23 N3 D63 Y3 BRDYC# AJ3 HLDA AM18 Vss

B2 NC D28 D19 N5 DP7 Y5 NA# AJ5 ADS# AM20 Vss

B4 D43 D30 DP1 N33 TDO Y33 CLKMUL AJ33 A31 AM22 Vss

B6 Vss D32 D12 N35 TDI Y35 Reserved AJ35 A25 AM24 Vss

B8 Vss D34 D8 N37 Vcc Y37 Vcc AJ37 Vss AM26 Vss

B10 Vss D36 DP0 P2 Vss Z2 Vss AK2 AP AM28 Vss

B12 Vss E1 D54 P4 NC Z4 BOFF# AK4 D/C# AM30 Vss

B14 Vss E3 D52 P34 TMS Z34 NC AK6 HIT# AM32 A8

B16 Vss E5 D49 P36 Vss Z36 Vss AK8 A20M# AM34 A4

B18 Vss E7 D46 Q1 Vcc AA1 Vcc AK10 BE1# AM36 A30

B20 Vss E9 D42 Q3 Reserved AA3 Reserved AK12 BE3# AN1 NC

B22 Vss E33 D7 Q5 FERR# AA5 WB/WT# AK14 BE5# AN3 NC

B24 Vss E35 D6 Q33 TRST# AA33 WM_RST AK16 BE7# AN5 NC

B26 Vss E37 Vcc Q35 NC AA35 IGNNE# AK18 CLK AN7 FLUSH#

B28 Vss F2 DP6 Q37 Vcc AA37 Vcc AK20 RESET AN9 Vcc

B30 D20 F4 D51 R2 Vss AB2 Vss AK22 A19 AN11 Vcc

B32 D16 F6 DP5 R4 Reserved AB4 HOLD AK24 A17 AN13 Vcc

B34 D13 F34 D5 R34 BHOLD AB34 SMI# AK26 A15 AN15 Vcc

B36 D11 F36 D4 R36 Vss AB36 Vss AK28 A13 AN17 Vcc

C1 NC G1 Vcc S1 Vcc AC1 Vcc AK30 A9 AN19 Vcc

C3 D47 G3 D55 S3 Reserved AC3 Reserved AK32 A5 AN21 Vcc

C5 D45 G5 D53 S5 LBA# AC5 NC AK34 A29 AN23 Vcc

C7 DP4 G33 D3 S33 Reserved AC33 NMI AK36 A28 AN25 Vcc

C9 D38 G35 D1 S35 DHOLD AC35 NC AL1 NC AN27 Vcc

C11 D36 G37 Vcc S37 Vcc AC37 Vcc AL3 PWT AN29 Vcc

C13 D34 H2 Vss T2 Vss AD2 Vss AL5 HITM# AN31 A10

C15 D32 H4 D56 T4 MI/O# AD4 NC AL7 QDUMP# AN33 A6

C17 D31 H34 NC T34 Vcc AD34 INTR AL9 BE0# AN35 Reserved

C19 D29 H36 Vss T36 Vss AD36 Vss AL11 BE2# AN37 Vss

C21 D27 J1 Vcc U1 Vcc AE1 Vcc AL13 BE4#

C23 D25 J3 D57 U3 CACHE# AE3 NC AL15 BE6#

C25 DP2 J5 D58 U5 INV AE5 APCHK# AL17 SCYC

C27 D24 J33 Reserve

dU33 Vcc AE33 A23 AL19 Reserved

Note:

Reserved

pins are reserved for future use by SGS-Thomson only. Pins marked NC are not internally connected.

296-Pin SPGA Package

ST6x86

5-3

Table 5.2. 296-Pin SPGA Package Pin Numbers Sorted by Signal Name

Signal Pin Signal Pin Signal Pin Signal Pin Signal Pin Signal Pin

A3 AL35 CLKMUL Y33 D48 D4 NC AN3 Vcc AA37 Vss AM12

A4 AM34 D/C# AK4 D49 E5 NC AN5 Vcc AC1 Vss AM14

A5 AK32 D0 K34 D50 D2 NC B2 Vcc AC37 Vss AM16

A6 AN33 D1 G35 D51 F4 NC C1 Vcc AE1 Vss AM18

A7 AL33 D2 J35 D52 E3 NC H34 Vcc AE37 Vss AM20

A8 AM32 D3 G33 D53 G5 NC L35 Vcc AG1 Vss AM22

A9 AK30 D4 F36 D54 E1 NC P4 Vcc AG37 Vss AM24

A10 AN31 D5 F34 D55 G3 NC Q35 Vcc AN11 Vss AM26

A11 AL31 D6 E35 D56 H4 NC Z34 Vcc AN13 Vss AM28

A12 AL29 D7 E33 D57 J3 NMI AC33 Vcc AN15 Vss AM30

A13 AK28 D8 D34 D58 J5 PCD AG5 Vcc AN17 Vss AM8

A14 AL27 D9 C37 D59 K4 PCHK# AF4 Vcc AN19 Vss AN37

A15 AK26 D10 C35 D60 L5 PWT AL3 Vcc AN21 Vss B6

A16 AL25 D11 B36 D61 L3 QDUMP# AL7 Vcc AN23 Vss B8

A17 AK24 D12 D32 D62 M4 RESET AK20 Vcc AN25 Vss B10

A18 AL23 D13 B34 D63 N3 SCYC AL17 Vcc AN27 Vss B12

A19 AK22 D14 C33 DHOLD S35 Reserved AA3 Vcc AN29 Vss B14

A20 AL21 D15 A35 DP0 D36 Reserved AC3 Vcc AN9 Vss B16

A20M# AK8 D16 B32 DP1 D30 Reserved AL19 Vcc E37 Vss B18

A21 AF34 D17 C31 DP2 C25 Reserved AN35 Vcc G1 Vss B20

A22 AH36 D18 A33 DP3 D18 Reserved J33 Vcc G37 Vss B22

A23 AE33 D19 D28 DP4 C7 Reserved Q3 Vcc J1 Vss B24

A24 AG35 D20 B30 DP5 F6 Reserved R4 Vcc J37 Vss B26

A25 AJ35 D21 C29 DP6 F2 Reserved S3 Vcc L1 Vss B28

A26 AH34 D22 A31 DP7 N5 Reserved S33 Vcc L33 Vss H2

A27 AG33 D23 D26 EADS# AM4 Reserved W35 Vcc L37 Vss H36

A28 AK36 D24 C27 EWBE# W3 Reserved X34 Vcc N1 Vss K2

A29 AK34 D25 C23 FERR# Q5 Reserved Y35 Vcc N37 Vss K36

A30 AM36 D26 D24 FLUSH# AN7 SMI# AB34 Vcc Q1 Vss M2

A31 AJ33 D27 C21 HIT# AK6 SMIACT# AG3 Vcc Q37 Vss M36

ADS# AJ5 D28 D22 HITM# AL5 SUSP# V34 Vcc S1 Vss P2

ADSC# AM2 D29 C19 HLDA AJ3 SUSPA# W33 Vcc S37 Vss P36

AHOLD V4 D30 D20 HOLD AB4 TCK M34 Vcc T34 Vss R2

AP AK2 D31 C17 IGNNE# AA35 TDI N35 Vcc U1 Vss R36

APCHK# AE5 D32 C15 INTR AD34 TDO N33 Vcc U33 Vss T2

BE0# AL9 D33 D16 INV U5 TMS P34 Vcc U37 Vss T36

BE1# AK10 D34 C13 KEN# W5 TRST# Q33 Vcc W1 Vss U35

BE2# AL11 D35 D14 LBA# S5 Vcc A7 Vcc W37 Vss V2

BE3# AK12 D36 C11 LOCK# AH4 Vcc A9 Vcc Y1 Vss V36

BE4# AL13 D37 D12 MI/O# T4 Vcc A11 Vcc Y37 Vss X2

BE5# AK14 D38 C9 NA# Y5 Vcc A13 Vss AB2 Vss X36

BE6# AL15 D39 D10 NC A3 Vcc A15 Vss AB36 Vss Z2

BE7# AK16 D40 D8 NC A37 Vcc A17 Vss AD2 Vss Z36

BHOLD R34 D41 A5 NC AC35 Vcc A19 Vss AD36 WB/WT# AA5

BOFF# Z4 D42 E9 NC AC5 Vcc A21 Vss AF2 W/R# AM6

BRDY# X4 D43 B4 NC AD4 Vcc A23 Vss AF36 WM_RST AA33

BRDYC# Y3 D44 D6 NC AE3 Vcc A25 Vss AH2

BREQ AJ1 D45 C5 NC AE35 Vcc A27 Vss AJ37

CACHE# U3 D46 E7 NC AL1 Vcc A29 Vss AL37

CLK AK18 D47 C3 NC AN1 Vcc AA1 Vss AM10

Note:

Reserved

pins are reserved for future use by SGS-Thomson only. Pins marked NC are not internally connected.

269-Pin SPGA Package

ST6x86

5-4

Figure 5.2. 296-Pin SPGA Package

296-Pin SPGA Package

ST6x86

5-5

Table 5.3. 296-Pin SPGA Package Dimensions

SYMBOL MILLIMETERS INCHES

MIN MAX MIN MAX

A 3.91 4.70 0.154 0.185

A1 0.33 0.43 0.013 0.017

A2 2.51 3.07 0.099 0.121

B 0.43 0.51 0.017 0.020

D 49.28 49.91 1.940 1.965

D1 45.47 45.97 1.790 1.810

D2 31.50 Sq. 32.00 Sq. 1.240 Sq. 1.260 Sq.

D3 33.99 34.59 1.338 1.362

D4 8.00 9.91 0.315 0.390

E1 2.41 2.67 0.095 0.105

E2 1.14 1.40 0.045 0.055

F - 0.127 Diag. - 0.005 Diag.

L 3.05 3.30 0.120 0.130

N 296 (Pin Count)

S1 1.65 2.16 0.065 0.085

Thermal Characteristics

ST6x86

5-6

5.2 Thermal Characteristics

The ST6x86 processor is designed to operate

when the case temperature at the top center of the

package is between 0°C and 70°C. The maximum

die (junction) temperature, TJ MAX, and the maxi-

mum ambient temperature, TA MAX, can be calcu-

lated by substituting thermal resistance and

maximum values for case or junction temperature

and power dissipation in the following equations:

Table 5.4 lists the junction-to-case and

case-to-ambient thermal resistances for the SPGA

package.

Thermal Characteristics

TJ=T

C+(P*θ

JC)

TA=T

J-(P*θ

JA)

where:

TA= Ambient temperature (°C)

TJ= Average junction temperature (°C)

TC= Case temperature at top center of package

(°C)

P= Power dissipation (W)

θJC = Junction-to-case thermal resistance (°C/W)

θJA = Junction-to-ambient thermal resistance

(°C/W)

ST6x86

5-7

Table 5.4. Thermal Resistances for SPGA Package With and Without Heatsinks

Thermal Resistance θJC °C/W θCA °C/W

Laminar Air Flow (ft/min) 0 0 100 200 400 600 800

1.95 x 1.95 x 0.25 Heatsink 0.9 8.4 7.4 6.0 4.0 3.1 2.6

1.95 x 1.95 x 0.40 Heatsink 0.9 7.7 6.6 4.9 3.2 2.7 2.1

1.95 x 1.95 x 0.65 Heatsink 0.9 5.9 4.7 3.2 2.1 1.7 1.4

Without Heatsink 1.4 14.7 11.5 9.1 7.3 7.0 6.2

Notes:

For a ST6x86 processor with 1.25 x 1.25 x 0.40 inch CuW heat spreader.

Heatsinks are omni-directional pin aluminum alloy.

Features are based on standard extrusion practices for a given height.

Heatsink attachment was made with 0.006 inch of thermal grease applied between heatsink and case.

Maximum air temperature is assumed to be 40 °C

ST6x86

5-8

ST6x86

6-1

6.0 INSTRUCTION SET

This sectionsummarizes the ST6x86 CPU instruc-

tion set and provides detailed information on the

instruction encodings. All instructions are listed in

the CPU Instruction Set Summary Table (Table

6-20, Page 6-14), and the FPU Instruction Set

Summary Table (Table 6-22, Page 6-30). These

tables provide information on the instruction encod-

ing, and the instruction clock counts for each

instruction. The clock count values for both tables

are based on the assumptions described in

Section 6.3.

6.1 InstructionSet Summary

Depending on the instruction, the ST6x86 CPU

instructions follow the general instruction format

shown in Figure 6.1. These instructions vary in

length and can start at any byte address. An

instruction consists of one or more bytes that can

include: prefix byte(s), at least one opcode

byte(s), mod r/m byte, s-i-b byte, address dis-

placement byte(s) and immediate data byte(s). An

instruction can be as short as one byte and as

long as 15 bytes. If there are more than 15 bytes

in the instruction a general protection fault (error

code of 0) is generated.

Figure 6.1. Instruction Set Format

PPPPPPPP TTTTTTTT ss index base 32 16 8 none 32 16 8 none

7070

mod r/m s-i-b

address immediate

1703103

P = prefix bit

opcode

optional prefix byte(s) (one or two bytes) byte

mode specifier

byte displacement

(4,2,1bytes,

or none)

data

(4, 2, 1 bytes,

or none)

T = opcode bit

R = opcode bit or reg bit

76 543 210

mod RRR r/m 76 543 210

ST6x86

6-2

6.2 General Instruction Fields

The fields in the general instruction format at the byte level are listed in Table 6.1.

Table 6.1. Instruction Fields

6.2.1 Optional Prefix Bytes

Prefix bytes can be placed in front of any instruction. The prefix modifies the operation of the next

instruction only. When more than one prefix is used, the order is not important. There are five type of

prefixes as follows:

1. Segment Override explicitly specifies which segment register an instruction will use for effective

address calculation.

2. Address Size switches between 16- and 32-bit addressing. Selectsthe inverse of the default.

3. Operand Size switches between 16- and 32-bit operand size. Selects theinverse of the default.

4. Repeat is used with a string instruction which causes the instruction to be repeated for each element

of the string.

5. Lock is used to assert the hardware LOCK# signal during execution of the instruction.

FIELD NAME DESCRIPTION WIDTH

Optional Prefix Byte(s) Specifies segment register override, address and operand size,

repeat elements in string instruction, LOCK# assertion. 1 or more bytes

Opcode Byte(s) Identifies instruction operation. 1 or 2 bytes

mod and r/m Byte Address mode specifier. 1 byte

s-i-b Byte Scale factor,Index and Base fields. 1 byte

Address Displacement Address displacement operand. 1, 2 or 4 bytes

Immediate data Immediate data operand. 1, 2 or 4 bytes

ST6x86

6-3

Table 6.2 lists the encodings for each of the available prefix bytes.

Table 6.2. Instruction Prefix Summary

PREFIX ENCODING DESCRIPTION

ES: 26h Override segment default, use ES for memory operand

CS: 2Eh Override segment default, use CS for memory operand

SS: 36h Override segment default, use SS for memory operand

DS: 3Eh Override segment default, use DS for memory operand

FS: 64h Override segment default, use FS for memory operand

GS: 65h Override segment default, use GS for memory operand

Operand Size 66h Make operand size attribute the inverse of the default

Address Size 67h Make address size attribute the inverse of the default

LOCK F0h Assert LOCK# hardware signal.

REPNE F2h Repeat the following string instruction.

REP/REPE F3h Repeat the following string instruction.

ST6x86

6-4

6.2.2 Opcode Byte

The opcode field specifies the operation to be performed by the instruction. The opcode field is either

one or two bytes in length and may be further defined by additional bits in the mod r/m byte. Some oper-

ations have more than one opcode, each specifying a different form of the operation. Some opcodes

name instruction groups. For example, opcode 80hnames a groupof operations that have an immediate

operand and a registeror memory operand. The reg field may appearin the secondopcode byte orin the

mod r/m byte.

6.2.2.1 w Field

The 1-bit w field (Table 6.3) selects the operand size during 16 and 32 bit data operations.

Table 6.3. w Field Encoding

6.2.2.2 d Field

The d field (Table 6.4) determines which operand is taken as the source operand and which operand is

takenas the destination.

Table 6.4. d Field Encoding

w FIELD OPERAND SIZE

16-BIT DATA OPERATIONS 32-BIT DATA OPERATIONS

08Bits 8Bits

1 16Bits 32 Bits

d FIELD DIRECTION OF OPERATON SOURCE OPERAND DESTINATION

OPERAND

0Register --> Register or

mod ss-index-base

1Register --> Register or

Memory --> Register mod r/m or

mod ss-index-base reg

ST6x86

6-5

6.2.2.3 s Field

The s field (Table 6.5) determines the size of the immediate data field. If the S bit is set, the immediate

fieldof the OP code is 8-bits wide and is sign extended to match the operand size of the opcode.

Table 6.5. s Field Encoding

6.2.2.4 eee Field

The eee field (Table 6.6) is used to select the control, debug and test registers in the MOV instructions.

The type of register and base registers selected by the eee field are listed in Table6.6. Thevalues shown

in Table 6.6 are the only validencodingsfor the eee bits.

Table 6.6. eee Field Encoding

s FIELD Immediate Field Size

8-Bit Operand Size 16-Bit Operand Size 32-Bit Operand Size

(or not present) 8 bits 16 bits 32 bits

1 8 bits 8 bits (sign extended) 8 bits (sign extended)

eee FIELD REGISTER TYPE BASE REGISTER

000 Control Register CR0

010 Control Register CR2

011 Control Register CR3

000 Debug Register DR0

001 Debug Register DR1

010 Debug Register DR2

011 Debug Register DR3

110 Debug Register DR6

111 Debug Register DR7

011 Test Register TR3

100 Test Register TR4

101 Test Register TR5

110 Test Register TR6

111 Test Register TR7

ST6x86

6-6

6.2.3 mod and r/m Byte

The mod and r/m fields (Table 6.7), within the mod

r/m byte, select the type of memory addressing to

be used. Some instructions use a fixed address-

ing mode (e.g., PUSH or POP) and therefore, these

fields are notpresent. Table 6.7 lists the addressing

method when 16-bit addressing is used and a mod

r/m byte is present. Some mod r/m field encod-

ings are dependent on the w field and are shown

in Table 6.8(Page 6-7).

Table 6.7. mod r/m Field Encoding

mod and r/m fields 16-BIT ADDRESS MODE

with mod r/m Byte

32-BIT ADDRESS MODE

with mod r/m Byte and

No s-i-b Byte Present

00 000 DS:[BX+SI] DS:[EAX]

00 001 DS:[BX+DI] DS:[ECX]

00 010 DS:[BP+SI] DS:[EDX]

00 011 DS:[BP+DI] DS:[EBX]

00 100 DS:[SI] s-i-b is present (See 6.2.4)

00 101 DS:[DI] DS:[d32]

00 110 DS:[d16] DS:[ESI]

00 111 DS:[BX] DS:[EDI]

01 000 DS:[BX+SI+d8] DS:[EAX+d8]

01 001 DS:[BX+DI+d8] DS:[ECX+d8]

01 010 DS:[BP+SI+d8] DS:[EDX+d8]

01 011 DS:[BP+DI+d8] DS:[EBX+d8]

01 100 DS:[SI+d8] s-i-b is present (See 6.2.4)

01 101 DS:[DI+d8] SS:[EBP+d8]

01 110 SS:[BP+d8] DS:[ESI+d8]

01 111 DS:[BX+d8] DS:[EDI+d8]

10 000 DS:[BX+SI+d16] DS:[EAX+d32]

10 001 DS:[BX+DI+d16] DS:[ECX+d32]

10 010 DS:[BP+SI+d16] DS:[EDX+d32]

10 011 DS:[BP+DI+d16] DS:[EBX+d32]

10 100 DS:[SI+d16] s-i-b is present (See 6.2.4)

10 101 DS:[DI+d16] SS:[EBP+d32]

10 110 SS:[BP+d16] DS:[ESI+d32]

10 111 DS:[BX+d16] DS:[EDI+d32]

11 000-11 111 See Table6-8 See Table 6-8

ST6x86

6-7

Table 6.8. mod r/m Field Encoding Dependent on w Field

6.2.3.1 reg Field

The reg field (Table 6.9) determines which general registers are to be used. The selected register is

dependent on whether a 16 or 32 bit operation is current and the status of the w bit.

Table 6.9. reg Field

mod r/m 16-BIT

OPERATION

w=0

16-BIT

OPERATION

w=1

32-BIT

OPERATION

w=0

32-BIT

OPERATION

w=1

11 000 AL AX AL EAX

11 001 CL CX CL ECX

11 010 DL DX DL EDX

11 011 BL BX BL EBX

11 100 AH SP AH ESP

11 101 CH BP CH EBP

11 110 DH SI DH ESI

11 111 BH DI BH EDI

reg

16-BIT

OPERATION

w Field Not

Present

32-BIT

OPERATION

w Field Not

Present

16-BIT

OPERATION

w=0

16-BIT

OPERATION

w=1

32-BIT

OPERATION

w=0

32-BIT

OPERATION

w=1

000 AX EAX AL AX AL EAX

001 CX ECX CL CX CL ECX

010 DX EDX DL DX DL EDX

011 BX EBX BL BX BL EBX

100 SP ESP AH SP AH ESP

101 BP EBP CH BP CH EBP

110 SI ESI DH SI DH ESI

111 DI EDI BH DI BH EDI

ST6x86

6-8

6.2.3.2 sreg3 Field

The sreg3field (Table 6.10) is 3-bit field that is similar to the sreg2 field, but allows use of the FS and GS

segment registers.

Table 6.10. sreg3 Field Encoding

6.2.3.3 sreg2 Field

The sreg2 field (Table 6.11) is a 2-bit field that allows one of the four 286-type segment registers to be

specified.

Table 6.11. sreg2 Field Encoding

sreg3 FIELD SEGMENT REGISTER SELECTED

000 ES

001 CS

010 SS

011 DS

100 FS

101 GS

110 undefined

111 undefined

sreg2 FIELD SEGMENT REGISTER SELECTED

00 ES

01 CS

10 SS

11 DS

ST6x86

6-9

6.2.4 s-i-b Byte

The s-i-b fields provide scale factor, indexing and a base field for address selection.

6.2.4.1 ss Field

The ss field (Table 6.12) specifies the scale factor used in the offset mechanism for address calculation.

The scale factor multiplies the index value to provide one of the components used to calculate the offset

address.

Table 6.12. ss Field Encoding

6.2.4.2 indexField

The index field (Table 6.13) specifies the index register used by the offset mechanism for offset address

calculation. When no index register is used (index field = 100), the ss value must be 00 or the effective

addressis undefined.

Table 6.13. Index Field Encoding

ss FIELD SCALE FACTOR

00 x1

01 x2

10 x4

11 x8

Index FIELD INDEX REGISTER

000 EAX

001 ECX

010 EDX

011 EBX

100 none

101 EBP

110 ESI

111 EDI

ST6x86

6-10

6.2.4.3 Base Field

In (Table 6.7), the note “s-i-b present” for certain

entries forces the useof the modand base field as

listed in Table 6.14. The first two digits in the first

column of Table 6.14 identifies the mod bits in the

mod r/m byte. The last three digits in the first col-

umn of this table identifies the base fields in the

s-i-b byte.

Table 6.14. modbase Field Encoding

mod FIELD WITHIN

mode/rm BYTE

base FIELD

WITHIN

s-i-b BYTE

32-BIT ADDRESS MODE

with mod r/m and

s-i-b Bytes Present

00 000 DS:[EAX+(scaled index)]

00 001 DS:[ECX+(scaled index)]

00 010 DS:[EDX+(scaled index)]

00 011 DS:[EBX+(scaled index)]

00 100 SS:[ESP+(scaled index)]

00 101 DS:[d32+(scaled index)]

00 110 DS:[ESI+(scaled index)]

00 111 DS:[EDI+(scaled index)]

01 000 DS:[EAX+(scaled index)+d8]

01 001 DS:[ECX+(scaled index)+d8]

01 010 DS:[EDX+(scaled index)+d8]

01 011 DS:[EBX+(scaled index)+d8]

01 100 SS:[ESP+(scaled index)+d8]

01 101 SS:[EBP+(scaled index)+d8]

01 110 DS:[ESI+(scaled index)+d8]

01 111 DS:[EDI+(scaled index)+d8]

10 000 DS:[EAX+(scaled index)+d32]

10 001 DS:[ECX+(scaled index)+d32]

10 010 DS:[EDX+(scaled index)+d32]

10 011 DS:[EBX+(scaled index)+d32]

10 100 SS:[ESP+(scaled index)+d32]

10 101 SS:[EBP+(scaled index)+d32]

10 110 DS:[ESI+(scaled index)+d32]

10 111 DS:[EDI+(scaled index)+d32]

ST6x86

6-11

6.3 CPUID Instruction

The ST6x86 CPU executes the CPUID instruction

(opcode 0FA2) as documented in this section only

if the CPUID bit in the CCR4 configuration register

is set. The CPUID instruction may be used by

softwareto determine the vendor and type ofCPU.

When the CPUID instruction is executed with EAX

= 0, the ASCII characters “CyrixInstead” are

placed in the EBX, EDX, and ECX registers as

shown in Table 6.15:

Table 6.15. CPUID Data Returned

When EAX = 0

When the CPUID instruction is executed with EAX

= 1, EAX and EDX contain the values shown in

Table 6.16.

Table 6.16. CPUID Data Returned

When EAX = 1

(D31 - D0)

EBX 69 72 79 43

iryC*

EDX 73 6E 49 78

snIx*

ECX 64 61 65 74

d aet*

*ASCII equivalent

EAX(3-0) 0

EAX(7-4) 3

EAX(11-8) 5

EAX(13-12) 0

EAX(31-14) reserved

EDX If EDX = 00, FPU not on-chip.

If EDX = 01, FPU on-chip.

ST6x86

6-12

6.4 Instruction Set Tables

The ST6x86 CPU instruction set is presented in

two tables: Table 6.20 ”. ST6x86 CPU Instruction

Set Clock Count Summary” and Table6.21 ”. FPU

Clock Count TableAbbreviations”. Additional infor-

mation concerning the FPU Instruction Set is pre-

sented in section 6.5.

6.4.1 Assumptions Made in Determining

Instruction Clock Count

The assumptions made in determining instruction

clock counts are listed below:

1. All clock counts refer to the internal CPU inter-

nal clock frequency. For example, the clock

counts for a clock-doubled ST6x86 CPU-100

refer to 100 MHz clocks while theexternal clock

is50MHz.

2. The instruction has been prefetched, decoded

and is readyfor execution.

3. Bus cycles do not require wait states.

4. There are no local bus HOLD requests delay-

ing processor access to the bus.

5. No exceptions are detected during instruction

execution.

6. If an effective addressis calculated, it does not

use two general register components. One

used within the clock count shown. However,

if the effective address calculation uses two

general register components, add 1 clock to

the clock count shown.

7. All clock counts assume aligned 32-bit

memory/IO operands.

8. If instructions access a 32-bit operand that

crosses a 64-bit boundary, add 1 clock for read

or write andadd 2 clocks for read and write.

9. For non-cached memory accesses, add two

clocks (ST6x86 CPU with 2x clock) or four

clocks (ST6x86 CPU with 3x clock). (Assumes

zero wait state memory accesses).

10. Locked cycles are not cacheable. Therefore,

using the LOCK prefix with an instruction adds

additional clocks as specified in paragraph 9

above.

11. No parallel execution of instructions.

6.4.2 CPU Instruction Set Summary Table

Abbreviations

The clock counts listed in the CPU Instruction Set

Summary Table are grouped by operating mode

and whether there is a register/cache hit or a

cache miss. In some cases, more than one clock

count is shown in a column for a given instruction,

or a variable is used in the clock count. The

abbreviations used for these conditions are listed

in Table 6.17.

ST6x86

6-13

Table 6.17. CPU Clock Count Abbreviations

6.4.3 CPU Instruction Set Summary Table Flags Table

The CPU Instruction SetSummary Table lists nine flags that areaffected by the execution of instructions.

The conventions shown in Table 6.18 are used to identify the different flags. Table 6.19 lists the conven-

tions used to indicate what action the instruction has on the particular flag.

Table 6.18. Flag Abbreviations

Table 6.19. Action of Instruction on Flag

CLOCK COUNT SYMBOL EXPLANATION

/ Register operand/memory operand.

n Number of times operation is repeated.

L Level of the stack frame.

|Conditional jump taken | Conditional jump not taken.

(e.g. “4|1” = 4 clocks if jump taken, 1 clock if jump not taken)

\CPL ≤IOPL \ CPL > IOPL

(where CPL = Current Privilege Level, IOPL = I/O Privilege Level)

m Number of parameters passed on the stack.

ABBREVIATION NAME OF FLAG

OF Overflow Flag

DF Direction Flag

IF Interrupt Enable Flag

TF Trap Flag

SF Sign Flag

ZF Zero Flag

AF Auxiliary Flag

PF Parity Flag

CF Carry Flag

INSTRUCTION

TABLE SYMBOL ACTION

x Flag is modified by the instruction.

- Flag is not changed by the instruction.

0 Flag is reset to “0”.

1 Flag is set to “1”.

uFlag is undefined following execution of the

instruction.

ST6x86

6-14

Table6.20. ST6x86 CPU Instruction Set Clock Count Summary

INSTRUCTION OPCODE

FLAGS

REAL

MODE CLOCK

COUNT

PROTECTED

MODE CLOCK

COUNT NOTES

OF DF IF TF SF ZF AF PFCF Reg/

Cache Hit Reg/

Cache Hit Real

Mode Protected

Mode

AAA

ASCII Adjust AL after Add

37 u---uuxux 7 7

AAD

ASCII Adjust AX before Divide

D50A u---xxuxu 7 7

AAM ASCII

Adjust AX after Multiply

D40A u---xxuxu 13-21 13-21

AAS ASCII

Adjust AL after Subtract

3F u---uuxux 7 7

ADC

Add with Carry

Memory to Register

Immediate to Register/Memory

Immediate to Accumulator

1 [00dw] [11 reg r/m]

1 [000w] [mod reg r/m]

1 [001w] [mod reg r/m]

8 [00sw] [mod 010 r/m]###

1 [010w] ###

x---xxxxx

ADD

Integer Add

Memory to Register

Immediate to Register/Memory

Immediate to Accumulator

0 [00dw] [11 reg r/m]

0 [000w] [mod reg r/m]

0 [001w] [mod reg r/m]

8 [00sw] [mod 000 r/m]###

0 [010w] ###

x---xxxxx

# = immediate 8-bit data + = 8-bit signed displacement x = modified

## = immediate 16-bit data +++ = full signed displacement (16, 32 bits) -= unchanged

### = full immediate 32-bit data (8, 16, 32 bits) u = undefined

ST6x86

6-15

AND

Boolean AND

Memory to Register

Immediate to Register/Memory

Immediate to Accumulator

2 [00dw] [11reg r/m]

2 [000w] [mod reg r/m]

2 [001w] [mod reg r/m]

8 [00sw] [mod 100 r/m]###

2 [010w] ###

0---xxux0

ARPL

Adjust Requested Privilege Level

From Register/Memory 63 [mod reg r/m]

-----x--- 9 a h

BOUND

Check Array Boundaries

If Out of Range (Int 5)

If In Range

62 [mod reg r/m]

---------

20+INT

b, e g,h,j,k,r

BSF

Scan Bit Forward

BSR

Scan Bit Reverse

BSWAP

Byte Swap

0F C[1 reg] - -------- 4 4

TestBit

0F BA [mod 100 r/m]#

0F A3 [mod reg r/m]

--------x

5/6

BTC

TestBit and Complement

0F BA [mod 111r/m]#

0F BB [mod reg r/m]

--------x

5/6

Table6.20. ST6x86 CPU Instruction Set Clock Count Summary (Continued)

INSTRUCTION OPCODE

FLAGS

REAL

MODE CLOCK

COUNT

PROTECTED

MODE CLOCK

COUNT NOTES

OF DF IF TF SF ZF AF PFCF Reg/

Cache Hit Reg/

Cache Hit Real

Mode Protected

Mode

# = immediate 8-bit data + = 8-bit signed displacement x = modified

## = immediate 16-bit data +++ = full signed displacement (16, 32 bits) -= unchanged

### = full immediate 32-bit data (8, 16, 32 bits) u = undefined

ST6x86

6-16

BTR

TestBit and Reset

0F BA [mod 110 r/m]#

0F B3 [mod reg r/m]

--------x

5/6

BTS

Test Bit and Set

0F BA [mod 101 r/m]

0F AB [mod reg r/m]

--------x

5/6

Table6.20. ST6x86 CPU Instruction Set Clock Count Summary (Continued)

INSTRUCTION OPCODE

FLAGS

REAL

MODE CLOCK

COUNT

PROTECTED

MODE CLOCK

COUNT NOTES

OF DF IF TF SF ZF AF PFCF Reg/

Cache Hit Reg/

Cache Hit Real

Mode Protected

Mode

# = immediate 8-bit data + = 8-bit signed displacement x = modified

## = immediate 16-bit data +++ = full signed displacement (16, 32 bits) -= unchanged

### = full immediate 32-bit data (8, 16, 32 bits) u = undefined

ST6x86

6-17

CALL

Subroutine Call

Direct Within Segment

Direct Intersegment

Call Gate to Same Privilege

Call Gate to Different Privilege No Param-

eters

Call Gate to Different Privilege m Par’s

16-bit Taskto 16-bit TSS

16-bit Taskto 32-bit TSS

16-bit Taskto V86 Task

32-bit Taskto 16-bit TSS

32-bit Taskto 32-bit TSS

32-bit Taskto V86 Task

Indirect Intersegment

Call Gate to Same Privilege

Call Gate to Different Privilege No Param-

eters

Call Gate to Different Privilege Level m

Par’s

16-bit Taskto 16-bit TSS

16-bit Taskto 32-bit TSS

16-bit Taskto V86 Task

32-bit Taskto 16-bit TSS

32-bit Taskto 32-bit TSS

32-bit Taskto V86 Task

E8 +++

FF [mod 010 r/m]

9A [unsigned full offset,

selector]

FF [mod 011 r/m]

---------

1/3

35+2m

110

118

112

120

40+2m

114

122

100

116

124

102

b h,j,k,r

Table6.20. ST6x86 CPU Instruction Set Clock Count Summary (Continued)

INSTRUCTION OPCODE

FLAGS

REAL

MODE CLOCK

COUNT

PROTECTED

MODE CLOCK

COUNT NOTES

OF DF IF TF SF ZF AF PFCF Reg/

Cache Hit Reg/

Cache Hit Real

Mode Protected

Mode

# = immediate 8-bit data + = 8-bit signed displacement x = modified

## = immediate 16-bit data +++ = full signed displacement (16, 32 bits) -= unchanged

### = full immediate 32-bit data (8, 16, 32 bits) u = undefined

ST6x86

6-18

CBW

Convert Byte to Word

98 --------- 3 3

CDQ

Convert Doubleword to Quadword

99 --------- 2 2

CLC

Clear Carry Flag

F8 --------0 1 1

CLD Clear Direction Flag FC - 0 - - - - - - - 7 7

CLI

Clear Interrupt Flag

FA - - 0 - - - - - - 7 7 m

CLTS

Clear TaskSwitched Flag

0F06 --------- 10 10 c l

CMC

Complement the Carry Flag

F5 --------x 2 2

CMP

Compare Integers

Memory to Register

Immediate to Register/Memory

Immediate to Accumulator

3 [10dw] [11 reg r/m]

3 [101w] [mod reg r/m]

3 [100w] [mod reg r/m]

8 [00sw] [mod 111 r/m]

###

3 [110w] ###

x---xxxxx

CMPS

Compare String

A [011w] x - - - x x x x x 5 5 b h

CMPXCHG

Compare and Exchange

Register1, Register2

Memory, Register

0F B [000w] [11 reg2 reg1]

0F B [000w] [mod reg r/m]

x---xxxxx

CPUID

CPU Identification

0FA2 --------- 12 12

CWD

Convert Word to Doubleword

99 --------- 2 2

CWDE

Convert Word to Doubleword

Extended

98 --------- 2 2

DAA

Decimal Adjust AL after Add

27 - - - - x x x x x 9 9

Table6.20. ST6x86 CPU Instruction Set Clock Count Summary (Continued)

INSTRUCTION OPCODE

FLAGS

REAL

MODE CLOCK

COUNT

PROTECTED

MODE CLOCK

COUNT NOTES

OF DF IF TF SF ZF AF PFCF Reg/

Cache Hit Reg/

Cache Hit Real

Mode Protected

Mode

# = immediate 8-bit data + = 8-bit signed displacement x = modified

## = immediate 16-bit data +++ = full signed displacement (16, 32 bits) -= unchanged

### = full immediate 32-bit data (8, 16, 32 bits) u = undefined

ST6x86

6-19

DAS

Decimal Adjust AL after Subtract

2F ----xxxx

x99

DEC

Decrement by 1

F [111w][mod 001 r/m]

4 [1 reg]

x---xxxx

-1

DIV

Unsigned Divide

Accumulator by Register/Memory

Divisor: Byte

Word

Doubleword

F [011w] [mod 110 r/m] ----xxuu

13-17

13-25

13-41

13-17

13-25

13-41

b,e e,h

ENTER

Enter New Stack Frame

Level = 0

Level = 1

Level (L) > 1

C8 ##,# ---------

10+L*3

HLT Halt F4 --------

-55 l

IDIV

Integer (Signed) Divide

Accumulator by Register/Memory

Divisor: Byte

Word

Doubleword

F [011w] [mod 111r/m]

----xxuu

16-20

16-28

17-45

16-20

16-28

17-45

b,e e,h

Table6.20. ST6x86 CPU Instruction Set Clock Count Summary (Continued)

INSTRUCTION OPCODE

FLAGS

REAL

MODE CLOCK

COUNT

PROTECTED

MODE CLOCK

COUNT NOTES

OF DF IF TF SF ZF AF PFCF Reg/

Cache Hit Reg/

Cache Hit Real

Mode Protected

Mode

# = immediate 8-bit data + = 8-bit signed displacement x = modified

## = immediate 16-bit data +++ = full signed displacement (16, 32 bits) -= unchanged

### = full immediate 32-bit data (8, 16, 32 bits) u = undefined

ST6x86

6-20

IMUL

Integer (Signed) Multiply

Accumulator by Register/Memory

Multiplier: Byte

Word

Doubleword

Multiplier: Word

Doubleword

Register2

Multiplier: Word

Doubleword

F [011w] [mod 101 r/m]

0F AF [mod reg r/m]

6 [10s1] [mod reg r/m] ###

x---xxuux

Input from I/O Port

Fixed Port

Variable Port

E [010w] [#]

E [110w]

---------

14/28

INC

Increment by 1

F [111w][mod 000 r/m]

4 [0 reg]

x---xxxx-

INS

Input String from I/O Port

6 [110w] - - - - - - - - - 14 14/28 b h,m

Table6.20. ST6x86 CPU Instruction Set Clock Count Summary (Continued)

INSTRUCTION OPCODE

FLAGS

REAL

MODE CLOCK

COUNT

PROTECTED

MODE CLOCK

COUNT NOTES

OF DF IF TF SF ZF AF PFCF Reg/

Cache Hit Reg/

Cache Hit Real

Mode Protected

Mode

# = immediate 8-bit data + = 8-bit signed displacement x = modified

## = immediate 16-bit data +++ = full signed displacement (16, 32 bits) -= unchanged

### = full immediate 32-bit data (8, 16, 32 bits) u = undefined

ST6x86

6-21

INT

Software Interrupt

INT i

Protected Mode:

Interrupt or Trap to Same Privilege

Interrupt or Trap to Different Privilege

16-bit Taskto 16-bit TSS by TaskGate

16-bit Taskto 32-bit TSS by TaskGate

16-bit Taskto V86 by TaskGate

16-bit Taskto 16-bit TSS by TaskGate

32-bit Taskto 32-bit TSS by Task Gate

32-bit Taskto V86 by TaskGate

V86 to 16-bit TSS by TaskGate

V86 to 32-bit TSS by TaskGate

V86 to Privilege 0 by Trap Gate/Int Gate

INT 3

INTO

If OF==0

If OF==1 (INT 4)

CD #

--x0-----

INT

114

122

100

116

124

102

124

102

INT

15+INT

b,e g,j,k,r

INVD

Invalidate Cache

0F08 --------- 12 12 t t

INVLPG

Invalidate TLB Entry

0F 01 [mod 111r/m] - -------- 13 13

Table6.20. ST6x86 CPU Instruction Set Clock Count Summary (Continued)

INSTRUCTION OPCODE

FLAGS

REAL

MODE CLOCK

COUNT

PROTECTED

MODE CLOCK

COUNT NOTES

OF DF IF TF SF ZF AF PFCF Reg/

Cache Hit Reg/

Cache Hit Real

Mode Protected

Mode

# = immediate 8-bit data + = 8-bit signed displacement x = modified

## = immediate 16-bit data +++ = full signed displacement (16, 32 bits) -= unchanged

### = full immediate 32-bit data (8, 16, 32 bits) u = undefined

ST6x86

6-22

IRET

Interrupt Return

Real Mode

Protected Mode:

Within Task to Same Privilege

Within Task to Different Privilege

16-bit Taskto 16-bit Task

16-bit Taskto 32-bit TSS

16-bit Taskto V86 Task

32-bit Taskto 16-bit TSS

32-bit Taskto 32-bit TSS

32-bit Taskto V86 Task

CF xxxxxxxxx

117

125

103

119

127

105

g,h,j,k,r

JB/JNAE/JC

Jump on Below/Not Above or

Equal/

Carry

8-bit Displacement

Full Displacement

72 +

0F 82 +++

---------

JBE/JNA

Jump on Below or Equal/Not

Above

8-bit Displacement

Full Displacement

76 +

0F 86 +++

---------

JCXZ/JECXZ

Jump on CX/ECX Zero

E3+ --------- 1 1 r

Table6.20. ST6x86 CPU Instruction Set Clock Count Summary (Continued)

INSTRUCTION OPCODE

FLAGS

REAL

MODE CLOCK

COUNT

PROTECTED

MODE CLOCK

COUNT NOTES

OF DF IF TF SF ZF AF PFCF Reg/

Cache Hit Reg/

Cache Hit Real

Mode Protected

Mode

# = immediate 8-bit data + = 8-bit signed displacement x = modified

## = immediate 16-bit data +++ = full signed displacement (16, 32 bits) -= unchanged

### = full immediate 32-bit data (8, 16, 32 bits) u = undefined

ST6x86

6-23

JE/JZ

Jump on Equal/Zero

8-bit Displacement

Full Displacement

74 +

0F 84 +++

---------

JL/JNGE

Jump on Less/Not Greater or

Equal

8-bit Displacement

Full Displacement

7C +

0F 8C +++

---------

JLE/JNG

Jump on Less or Equal/Not

Greater

8-bit Displacement

Full Displacement

7E +

0F 8E +++

---------

Table6.20. ST6x86 CPU Instruction Set Clock Count Summary (Continued)

INSTRUCTION OPCODE

FLAGS

REAL

MODE CLOCK

COUNT

PROTECTED

MODE CLOCK

COUNT NOTES

OF DF IF TF SF ZF AF PFCF Reg/

Cache Hit Reg/

Cache Hit Real

Mode Protected

Mode

# = immediate 8-bit data + = 8-bit signed displacement x = modified

## = immediate 16-bit data +++ = full signed displacement (16, 32 bits) -= unchanged

### = full immediate 32-bit data (8, 16, 32 bits) u = undefined

ST6x86

6-24

JMP

Unconditional Jump

8-bit Displacement

Full Displacement

Direct Intersegment

Call Gate Same Privilege Level

16-bit Taskto 16-bit TSS

16-bit Taskto 32-bit TSS

16-bit Taskto V86 Task

32-bit Taskto 16-bit TSS

32-bit Taskto 32-bit TSS

32-bit Taskto V86 Task

Indirect Intersegment

Call Gate Same Privilege Level

16-bit Taskto 16-bit TSS

16-bit Taskto 32-bit TSS

16-bit Taskto V86 Task

32-bit Taskto 16-bit TSS

32-bit Taskto 32-bit TSS

32-bit Taskto V86 Task

EB +

E9 +++

FF [mod 100 r/m]

EA [unsigned full offset,

selector]

FF [mod 101 r/m]

--------- 1

1/3

110

118

112

120

113

121

115

123

101

b h,j,k,r

Table6.20. ST6x86 CPU Instruction Set Clock Count Summary (Continued)

INSTRUCTION OPCODE

FLAGS

REAL

MODE CLOCK

COUNT

PROTECTED

MODE CLOCK

COUNT NOTES

OF DF IF TF SF ZF AF PFCF Reg/

Cache Hit Reg/

Cache Hit Real

Mode Protected

Mode

# = immediate 8-bit data + = 8-bit signed displacement x = modified

## = immediate 16-bit data +++ = full signed displacement (16, 32 bits) -= unchanged

### = full immediate 32-bit data (8, 16, 32 bits) u = undefined

ST6x86

6-25

JNB/JAE/JNC

Jump on Not Below/Above or

Equal/Not Carry

8-bit Displacement

Full Displacement 73 +

0F 83 +++

---------

JNBE/JA

Jump on Not Below or

Equal/Above

8-bit Displacement

Full Displacement

77 +

0F 87 +++

---------

JNE/JNZ

Jump on Not Equal/Not Zero

8-bit Displacement

Full Displacement

75 +

0F 85 +++

---------

JNL/JGE

Jump on Not Less/Greater or

Equal

8-bit Displacement

Full Displacement

7D +

0F 8D +++

---------

JNLE/JG

Jump on Not Less or

Equal/Greater

8-bit Displacement

Full Displacement

7F +

0F 8F +++

---------

JNO

Jump on Not Overflow

8-bit Displacement

Full Displacement

71 +

0F 81 +++

---------

Table6.20. ST6x86 CPU Instruction Set Clock Count Summary (Continued)

INSTRUCTION OPCODE

FLAGS

REAL

MODE CLOCK

COUNT

PROTECTED

MODE CLOCK

COUNT NOTES

OF DF IF TF SF ZF AF PFCF Reg/

Cache Hit Reg/

Cache Hit Real

Mode Protected

Mode

# = immediate 8-bit data + = 8-bit signed displacement x = modified

## = immediate 16-bit data +++ = full signed displacement (16, 32 bits) -= unchanged

### = full immediate 32-bit data (8, 16, 32 bits) u = undefined

ST6x86

6-26

JNP/JPO

Jump on Not Parity/Parity Odd

8-bit Displacement

Full Displacement

7B +

0F 8B +++

---------

JNS

Jump on Not Sign

8-bit Displacement

Full Displacement

79 +

0F 89 +++

---------

Jump on Overflow

8-bit Displacement

Full Displacement

70 +

0F 80 +++

---------

JP/JPE

Jump on Parity/Parity Even

8-bit Displacement

Full Displacement

7A +

0F 8A +++

---------

Jump on Sign

8-bit Displacement

Full Displacement

78 +

0F 88 +++

---------

LAHF

Load AH with Flags

9F --------- 2 2

LAR

Load Access Rights

From Register/Memory 0F 02 [mod reg r/m]

-----x---

a g,h,j,p

LDS

Load Pointer to DS

C5 [mod reg r/m] - -------- 2 4 b h,i,j

LEA

Load Effective Address

No Index Register

With Index Register

8D [mod reg r/m]

---------

Table6.20. ST6x86 CPU Instruction Set Clock Count Summary (Continued)

INSTRUCTION OPCODE

FLAGS

REAL

MODE CLOCK

COUNT

PROTECTED

MODE CLOCK

COUNT NOTES

OF DF IF TF SF ZF AF PFCF Reg/

Cache Hit Reg/

Cache Hit Real

Mode Protected

Mode

# = immediate 8-bit data + = 8-bit signed displacement x = modified

## = immediate 16-bit data +++ = full signed displacement (16, 32 bits) -= unchanged

### = full immediate 32-bit data (8, 16, 32 bits) u = undefined

ST6x86

6-27

LEAVE

Leave Current Stack Frame

C9 --------- 4 4 b h

LES

Load Pointer to ES

C4 [mod reg r/m] - -------- 2 4 b h,i,j

LFS

Load Pointer to FS

0F B4 [mod reg r/m] - -------- 2 4 b h,i,j

LGDT

Load GDT Register

0F 01 [mod 010 r/m] - -------- 8 8 b,c h,l

LGS

Load Pointer to GS

0F B5 [mod reg r/m] - -------- 2 4 b h,i,j

LIDT

Load IDT Register

0F 01 [mod 011 r/m] - -------- 8 8 b,c h,l

LLDT

Load LDT Register

From Register/Memory 0F 00 [mod 010 r/m] ---------

a g,h,j,l

LMSW

Load Machine Status Word

From Register/Memory 0F 01 [mod 110 r/m] ---------

13 13

b,c h,l

LODS

Load String

A [110 w] - -------- 3 3 b h

LOOP

Offset Loop/No Loop

E2+ --------- 1 1 r

LOOPNZ/LOOPNE

Offset

E0+ --------- 1 1 r

LOOPZ/LOOPE

Offset

E1+ --------- 1 1 r

LSL

Load Segment Limit

From Register/Memory 0F 03 [mod reg r/m]

-----x---

a g,h,j,p

LSS

Load Pointer to SS

0F B2 [mod reg r/m] - -------- 2 4 a h,i,j

LTR

Load TaskRegister

From Register/Memory 0F 00 [mod 011 r/m] ---------

a g,h,j,l

Table6.20. ST6x86 CPU Instruction Set Clock Count Summary (Continued)

INSTRUCTION OPCODE

FLAGS

REAL

MODE CLOCK

COUNT

PROTECTED

MODE CLOCK

COUNT NOTES

OF DF IF TF SF ZF AF PFCF Reg/

Cache Hit Reg/

Cache Hit Real

Mode Protected

Mode

# = immediate 8-bit data + = 8-bit signed displacement x = modified

## = immediate 16-bit data +++ = full signed displacement (16, 32 bits) -= unchanged

### = full immediate 32-bit data (8, 16, 32 bits) u = undefined

ST6x86

6-28

MOV

Move Data

Immediate to Register/Memory

Immediate to Register (short form)

Memory to Accumulator (short form)

Accumulator to Memory (short form)

Segment Register to Register/Memory

8 [10dw] [11reg r/m]

8 [100w] [mod reg r/m]

8 [101w] [mod reg r/m]

C [011w] [mod 000 r/m]

###

B [w reg] ###

A [000w] +++

A [001w] +++

8E [mod sreg3 r/m]

8C [mod sreg3 r/m]

---------

1/3

b h,i,j

MOV

Move to/from Control/Debug/Test

Regs

CR0/CR2/CR3 to Register

DR0-DR3 to Register

DR6-DR7 to Register

TR3-5 to Register

TR6-TR7 to Register

0F 22 [11eee reg]

0F 20 [11eee reg]

0F 23 [11eee reg]

0F 21 [11eee reg]

0F 23 [11eee reg]

0F 21 [11eee reg]

0F 26 [11eee reg]

0F 24 [11eee reg]

0F 26 [11eee reg]

0F 24 [11eee reg]

---------

20/5/5

Table6.20. ST6x86 CPU Instruction Set Clock Count Summary (Continued)

INSTRUCTION OPCODE

FLAGS

REAL

MODE CLOCK

COUNT

PROTECTED

MODE CLOCK

COUNT NOTES

OF DF IF TF SF ZF AF PFCF Reg/

Cache Hit Reg/

Cache Hit Real

Mode Protected

Mode

# = immediate 8-bit data + = 8-bit signed displacement x = modified

## = immediate 16-bit data +++ = full signed displacement (16, 32 bits) -= unchanged

### = full immediate 32-bit data (8, 16, 32 bits) u = undefined

ST6x86

6-29

MOVS

Move String

A [010w] - -------- 4 4 b h

MOVSX

Move with Sign Extension

---------

MOVZX

Move with Zero Extension

---------

MUL

Unsigned Multiply

Accumulator with Register/Memory

Multiplier: Byte

Word

Doubleword

F [011w] [mod 100 r/m]

x---xxuux

NEG

Negate Integer

F [011w] [mod 011r/m] x ---xxxxx 1 1 b h

NOP

No Operation

90 --------- 1 1

NOT

Boolean Complement

F [011w] [mod 010 r/m] - -------- 1 1 b h

OIO

Official Invalid OpCode

0FFF --x0----- 1 8-125

Boolean OR

Memory to Register

Immediate to Register/Memory

Immediate to Accumulator

0 [10dw] [11reg r/m]

0 [100w] [mod reg r/m]

0 [101w] [mod reg r/m]

8 [00sw] [mod 001 r/m]

###

0 [110w] ###

0---xxux0

Table6.20. ST6x86 CPU Instruction Set Clock Count Summary (Continued)

INSTRUCTION OPCODE

FLAGS

REAL

MODE CLOCK

COUNT

PROTECTED

MODE CLOCK

COUNT NOTES

OF DF IF TF SF ZF AF PFCF Reg/

Cache Hit Reg/

Cache Hit Real

Mode Protected

Mode

# = immediate 8-bit data + = 8-bit signed displacement x = modified

## = immediate 16-bit data +++ = full signed displacement (16, 32 bits) -= unchanged

### = full immediate 32-bit data (8, 16, 32 bits) u = undefined

ST6x86

6-30

OUT

Output to Port

Fixed Port

Variable Port

E [011w] #

E [111w]

---------

14/28

OUTS

Output String

6 [111w] - -------- 14 14/28 b h,m

POP

Pop Value off Stack

Segment Register (ES, SS, DS)

Segment Register (FS, GS)

8F [mod 000 r/m]

5 [1 reg]

[000 sreg2 111]

0F [10 sreg3 001]

---------

b h,i,j

POPA

Pop All General Registers

61 --------- 6 6 b h

POPF

Pop Stack into FLAGS

9D xxxxxxxxx 9 9 b h,n

PREFIX BYTES

Assert Hardware LOCK Prefix

Address Size Prefix

Operand Size Prefix

Segment Override Prefix

--------- m

Table6.20. ST6x86 CPU Instruction Set Clock Count Summary (Continued)

INSTRUCTION OPCODE

FLAGS

REAL

MODE CLOCK

COUNT

PROTECTED

MODE CLOCK

COUNT NOTES

OF DF IF TF SF ZF AF PFCF Reg/

Cache Hit Reg/

Cache Hit Real

Mode Protected

Mode

# = immediate 8-bit data + = 8-bit signed displacement x = modified

## = immediate 16-bit data +++ = full signed displacement (16, 32 bits) -= unchanged

### = full immediate 32-bit data (8, 16, 32 bits) u = undefined

ST6x86

6-31

PUSH

Push Value onto Stack

Segment Register (ES, CS, SS, DS)

Segment Register (FS, GS)

Immediate

FF [mod 110r/m]

5 [0 reg]

[000 sreg2 110]

0F [10 sreg3 000]

6 [10s0] ###

---------

PUSHA

Push All General Registers

60 --------- 6 6 b h

PUSHF

Push FLAGS Register

9C --------- 2 2 b h

RCL

Rotate Through Carry Left

D [000w] [mod 010 r/m]

D [001w] [mod 010 r/m]

C [000w] [mod 010 r/m] #

x-------x

u-------x

RCR

Rotate Through Carry Right

D [000w] [mod 011 r/m]

D [001w] [mod 011 r/m]

C [000w] [mod 011 r/m] #

x-------x

u-------x

REP INS

Input String

F3 6[110w] - -------- 12+5n 12+5n\

28+5n

b h,m

REP LODS

Load String

F3 A[110w] - -------- 10+n 10+n b h

REP MOVS

Move String

F3 A[010w] - -------- 9+n 9+n b h

REP OUTS

Output String

F3 6[111w] - -------- 12+5n 12+5n\

28+5n

b h,m

Table6.20. ST6x86 CPU Instruction Set Clock Count Summary (Continued)

INSTRUCTION OPCODE

FLAGS

REAL

MODE CLOCK

COUNT

PROTECTED

MODE CLOCK

COUNT NOTES

OF DF IF TF SF ZF AF PFCF Reg/

Cache Hit Reg/

Cache Hit Real

Mode Protected

Mode

# = immediate 8-bit data + = 8-bit signed displacement x = modified

## = immediate 16-bit data +++ = full signed displacement (16, 32 bits) -= unchanged

### = full immediate 32-bit data (8, 16, 32 bits) u = undefined

ST6x86

6-32

REP STOS

Store String

F3 A[101w] - -------- 10+n 10+n b h

REPE CMPS

Compare String

(Find non-match) F3 A[011w] x ---xxxxx 10+2n 10+2n bh

REPE SCAS

Scan String

(Find non-AL/AX/EAX)

F3 A[111w] x ---xxxxx

10+2n 10+2n

REPNE CMPS

Compare String

(Find match)

F2 A[011w] x - - - x x x x x 10+2n 10+2n b h

REPNE SCAS

Scan String

(Find AL/AX/EAX)

F2 A[111w] x - - - x x x x x 10+2n 10+2n b h

RET

Return from Subroutine

Within Segment

Within Segment Adding Immediate to SP

Intersegment

Intersegment Adding Immediate to SP

Protected Mode: Different Privilege Level

Intersegment

Intersegment Adding Immediate to SP

C2 ##

CA ##

---------

b g,h,j,k,r

ROL

Rotate Left

D[000w] [mod 000 r/m]

D[001w] [mod 000 r/m]

C[000w] [mod 000 r/m] #

x-------x

u-------x

Table6.20. ST6x86 CPU Instruction Set Clock Count Summary (Continued)

INSTRUCTION OPCODE

FLAGS

REAL

MODE CLOCK

COUNT

PROTECTED

MODE CLOCK

COUNT NOTES

OF DF IF TF SF ZF AF PFCF Reg/

Cache Hit Reg/

Cache Hit Real

Mode Protected

Mode

# = immediate 8-bit data + = 8-bit signed displacement x = modified

## = immediate 16-bit data +++ = full signed displacement (16, 32 bits) -= unchanged

### = full immediate 32-bit data (8, 16, 32 bits) u = undefined

ST6x86

6-33

ROR

Rotate Right

D[000w] [mod 001 r/m]

D[001w] [mod 001 r/m]

C[000w] [mod 001 r/m] #

x-------x

u-------x

RSDC

Restore Segment Register and

Descriptor

0F 79 [mod sreg3 r/m] - -------- 6 6 s s

RSLDT

Restore LDTR and Descriptor

0F 7B [mod 000 r/m] - -------- 6 6 s s

RSM

Resume from SMM Mode

0FAA xxxxxxxxx 40 40 s s

RSTS

Restore TSR and Descriptor

0F 7D [mod 000 r/m] - -------- 6 6 s s

SAHF

Store AH in FLAGS

9E ----xxxxx 1 1

SAL

Shift Left Arithmetic

D[000w] [mod 100 r/m]

D[001w] [mod 100 r/m]

C[000w] [mod 100 r/m] #

x---xxuxx

u---xxuxx

SAR

Shift Right Arithmetic

D[000w] [mod 111r/m]

D[001w] [mod 111r/m]

C[000w] [mod 111r/m] #

x---xxuxx

u---xxuxx

Table6.20. ST6x86 CPU Instruction Set Clock Count Summary (Continued)

INSTRUCTION OPCODE

FLAGS

REAL

MODE CLOCK

COUNT

PROTECTED

MODE CLOCK

COUNT NOTES

OF DF IF TF SF ZF AF PFCF Reg/

Cache Hit Reg/

Cache Hit Real

Mode Protected

Mode

# = immediate 8-bit data + = 8-bit signed displacement x = modified

## = immediate 16-bit data +++ = full signed displacement (16, 32 bits) -= unchanged

### = full immediate 32-bit data (8, 16, 32 bits) u = undefined

ST6x86

6-34

SBB

Integer Subtract with Borrow

Memory to Register

Immediate to Register/Memory

Immediate to Accumulator (short form)

1[10dw] [11 reg r/m]

1[100w] [mod reg r/m]

1[101w] [mod reg r/m]

8[00sw] [mod 011 r/m] ###

1[110w] ###

x---xxxxx

SCAS

Scan String

A [111w] x ---xxxxx 2 2 b h

SETB/SETNAE/SETC

Set Byte on

Below/Not

Above or Equal/Carry

ToRegister/Memory 0F 92 [mod 000 r/m]

---------

SETBE/SETNA

Set Byte on Below or

Equal/Not Above

ToRegister/Memory 0F 96 [mod 000 r/m]

---------

SETE/SETZ

Set Byte on Equal/Zero

ToRegister/Memory 0F 94 [mod 000 r/m]

---------

SETL/SETNGE

Set Byte on Less/Not

Greater

or Equal

ToRegister/Memory 0F 9C [mod 000 r/m]

---------

Table6.20. ST6x86 CPU Instruction Set Clock Count Summary (Continued)

INSTRUCTION OPCODE

FLAGS

REAL

MODE CLOCK

COUNT

PROTECTED

MODE CLOCK

COUNT NOTES

OF DF IF TF SF ZF AF PFCF Reg/

Cache Hit Reg/

Cache Hit Real

Mode Protected

Mode

# = immediate 8-bit data + = 8-bit signed displacement x = modified

## = immediate 16-bit data +++ = full signed displacement (16, 32 bits) -= unchanged

### = full immediate 32-bit data (8, 16, 32 bits) u = undefined

ST6x86

6-35

SETLE/SETNG

Set Byte on Less or

Equal/Not

Greater

ToRegister/Memory 0F 9E [mod 000 r/m]

---------

SETNB/SETAE/SETNC

Set Byte on Not

Below/

Above or Equal/Not Carry

ToRegister/Memory 0F 93 [mod 000 r/m]

---------

SETNBE/SETA

Set Byte on Not Below or

Equal/Above

ToRegister/Memory 0F 97 [mod 000 r/m]

---------

SETNE/SETNZ

Set Byte on Not Equal/Not

Zero

ToRegister/Memory 0F 95 [mod 000 r/m]

---------

SETNL/SETGE

Set Byte on Not

Less/Greater

or Equal

ToRegister/Memory 0F 9D [mod 000 r/m]

---------

SETNLE/SETG

Set Byte on Not Less or

Equal/Greater

ToRegister/Memory 0F 9F [mod 000 r/m]

---------

SETNO

Set Byte on Not Overflow

ToRegister/Memory 0F 91 [mod 000 r/m]

---------

Table6.20. ST6x86 CPU Instruction Set Clock Count Summary (Continued)

INSTRUCTION OPCODE

FLAGS

REAL

MODE CLOCK

COUNT

PROTECTED

MODE CLOCK

COUNT NOTES

OF DF IF TF SF ZF AF PFCF Reg/

Cache Hit Reg/

Cache Hit Real

Mode Protected

Mode

# = immediate 8-bit data + = 8-bit signed displacement x = modified

## = immediate 16-bit data +++ = full signed displacement (16, 32 bits) -= unchanged

### = full immediate 32-bit data (8, 16, 32 bits) u = undefined

ST6x86

6-36

SETNP/SETPO

Set Byte on Not

Parity/Parity Odd

ToRegister/Memory 0F 9B [mod 000 r/m]

---------

SETNS

Set Byte on Not Sign

ToRegister/Memory 0F 99 [mod 000 r/m]

---------

SETO

Set Byte on Overflow

ToRegister/Memory 0F 90 [mod 000 r/m]

---------

SETP/SETPE

Set Byte on Parity/Parity

Even

ToRegister/Memory 0F 9A [mod 000 r/m]

---------

SETS

Set Byte on Sign

ToRegister/Memory 0F 98 [mod 000 r/m]

---------

SGDT

Store GDT Register

ToRegister/Memory 0F 01 [mod 000 r/m]

--------- 4 4 b,c h

SHL

Shift Left Logical

D [000w] [mod 100 r/m]

D [001w] [mod 100 r/m]

C [000w] [mod 100 r/m] #

x---xxuxx

u---xxuxx

SHLD

Shift Left Double

0F A4 [mod reg r/m] #

0F A5 [mod reg r/m]

u---xxuxx

Table6.20. ST6x86 CPU Instruction Set Clock Count Summary (Continued)

INSTRUCTION OPCODE

FLAGS

REAL

MODE CLOCK

COUNT

PROTECTED

MODE CLOCK

COUNT NOTES

OF DF IF TF SF ZF AF PFCF Reg/

Cache Hit Reg/

Cache Hit Real

Mode Protected

Mode

# = immediate 8-bit data + = 8-bit signed displacement x = modified

## = immediate 16-bit data +++ = full signed displacement (16, 32 bits) -= unchanged

### = full immediate 32-bit data (8, 16, 32 bits) u = undefined

ST6x86

6-37

SHR

Shift Right Logical

D [000w] [mod 101 r/m]

D [001w] [mod 101 r/m]

C [000w] [mod 101 r/m] #

x---xxuxx

u---xxuxx

SHRD

Shift Right Double

0F AC [mod reg r/m] #

0F AD [mod reg r/m]

u---xxuxx

SIDT

Store IDT Register

ToRegister/Memory 0F 01 [mod 001 r/m]

---------

b,c h

SLDT

Store LDT Register

ToRegister/Memory 0F 00 [mod 000 r/m]

---------

SMINT

Software SMM Entry

0F7E --------- 55 55 s s

SMSW

Store Machine Status Word

0F 01 [mod 100 r/m] - -------- 6 6 b,c h

STC

Set Carry Flag

F9 --------1 1 1

STD

Set Direction Flag

FD -1------- 7 7

STI

Set Interrupt Flag

FB --1------ 7 7 m

STOS

Store String

A [101w] - -------- 2 2 b h

STR

Store Task Register

ToRegister/Memory 0F 00 [mod 001 r/m]

---------

Table6.20. ST6x86 CPU Instruction Set Clock Count Summary (Continued)

INSTRUCTION OPCODE

FLAGS

REAL

MODE CLOCK

COUNT

PROTECTED

MODE CLOCK

COUNT NOTES

OF DF IF TF SF ZF AF PFCF Reg/

Cache Hit Reg/

Cache Hit Real

Mode Protected

Mode

# = immediate 8-bit data + = 8-bit signed displacement x = modified

## = immediate 16-bit data +++ = full signed displacement (16, 32 bits) -= unchanged

### = full immediate 32-bit data (8, 16, 32 bits) u = undefined

ST6x86

6-38

SUB

Integer Subtract

Memory to Register

Immediate to Register/Memory

Immediate to Accumulator (short form)

2 [10dw] [11reg r/m]

2 [100w] [mod reg r/m]

2 [101w] [mod reg r/m]

8 [00sw] [mod 101 r/m]

###

2 [110w] ###

x---xxxxx

SVDC

Save Segment Register and Descrip-

tor

0F 78 [mod sreg3 r/m] - -------- 12 12 s s

SVLDT

Save LDTR and Descriptor

0F 7A [mod 000 r/m] - -------- 12 12 s s

SVTS

Save TSR and Descriptor

0F 7C [mod 000 r/m] - -------- 14 14 s s

TEST

TestBits

Immediate Data and Register/Memory

Immediate Data and Accumulator

8 [010w] [mod reg r/m]

F [011w] [mod 000 r/m]

###

A [100w] ###

0---xxux0

VERR

Verify Read Access

ToRegister/Memory 0F 00 [mod 100 r/m]

-----x---

a g,h,j,p

VERW

Verify Write Access

ToRegister/Memory 0F 00 [mod 101 r/m]

-----x---

a g,h,j,p

WAIT

Wait Until FPU Not Busy

9B --------- 5 5

WBINVD

Write-Back and Invalidate Cache

0F 09 --------- 15 15 t t

Table6.20. ST6x86 CPU Instruction Set Clock Count Summary (Continued)

INSTRUCTION OPCODE

FLAGS

REAL

MODE CLOCK

COUNT

PROTECTED

MODE CLOCK

COUNT NOTES

OF DF IF TF SF ZF AF PFCF Reg/

Cache Hit Reg/

Cache Hit Real

Mode Protected

Mode

# = immediate 8-bit data + = 8-bit signed displacement x = modified

## = immediate 16-bit data +++ = full signed displacement (16, 32 bits) -= unchanged

### = full immediate 32-bit data (8, 16, 32 bits) u = undefined

ST6x86

6-39

Instruction Notes for Instruction Set Summary

Notes a through c apply to Real Address Mode only:

a. This is a Protected Mode instruction. Attempted execution in Real Mode will result in exception 6 (invalid op-code).

b. Exception 13 fault (general protection) will occur in Real Mode if an operand reference is made that partially or fully extends beyond the maximum CS, DS, ES, FS,

or GS segment limit (FFFFH). Exception 12 fault (stack segment limit violation or not present) will occur in Real Mode if an operand reference is made that partially or

fully extends beyond the maximum SS limit.

c. This instruction may be executed in Real Mode. In Real Mode, its purpose is primarily to initialize the CPU for Protected Mode.

Continued on next page...

XADD

Exchange and Add

Register1, Register2

Memory, Register

0F C[000w] [11 reg2 reg1]

0F C[000w] [mod reg r/m]

x---xxxxx

XCHG

Exchange

8[011w] [mod reg r/m]

9[0 reg]

---------

b,f f,h

XLAT

Translate Byte

D7 --------- 4 4 h

XOR

Boolean Exclusive OR

Memory to Register

Immediate to Register/Memory

Immediate to Accumulator (short form)

3 [00dw] [11reg r/m]

3 [000w] [mod reg r/m]

3 [001w] [mod reg r/m]

8 [00sw] [mod 110 r/m]

###

3 [010w] ###

0---xxux0

Table6.20. ST6x86 CPU Instruction Set Clock Count Summary (Continued)

INSTRUCTION OPCODE

FLAGS

REAL

MODE CLOCK

COUNT

PROTECTED

MODE CLOCK

COUNT NOTES

OF DF IF TF SF ZF AF PFCF Reg/

Cache Hit Reg/

Cache Hit Real

Mode Protected

Mode

# = immediate 8-bit data + = 8-bit signed displacement x = modified

## = immediate 16-bit data +++ = full signed displacement (16, 32 bits) -= unchanged

### = full immediate 32-bit data (8, 16, 32 bits) u = undefined

ST6x86

6-40

.Instruction Notes for Instruction Set Summary

Notes e through g apply to Real Address Mode and Protected Virtual Address Mode:

e. An exception may occur, depending on the value of the operand.

f. LOCK# is automatically asserted, regardless of the presence or absence of the LOCK prefix.

g. LOCK# is asserted during descriptor table accesses.

Continued on next page...

ST6x86

6-41

Notes h through r apply to Protected Virtual Address Mode only:

h. Exception 13 fault will occur if the memory operand in CS, DS, ES, FS, or GS cannot be used due to either a segment limit violation or an access rights violation. If

a stack limit is violated, an exception 12 occurs.

i. For segment load operations, the CPL, RPL, and DPL must agree with the privilege rules to avoid an exception 13 fault. The segment’s descriptor must indicate

“present” or exception 11 (CS, DS, ES, FS, GS not present). If the SS register is loaded and a stack segment not present is detected, an exception 12 occurs.

j. All segment descriptor accesses in the GDT or LDT made by this instruction will automatically assert LOCK# to maintain descriptor integrity in multiprocessor sys-

tems.

k. JMP,CALL, INT,RET, and IRET instructions referring to another code segment will cause an exception 13, if an applicable privilege rule is violated.

l. An exception 13 fault occurs if CPL is greater than 0 (0 is the most privileged level).

m.An exception 13 fault occurs if CPL is greater than IOPL.

n. The IF bit of the flag register is not updated if CPL is greater than IOPL. The IOPL and VM fields of the flag register are updated only if CPL = 0.

o. The PE bit of the MSW (CR0) cannot be reset by this instruction. Use MOV into CRO if desiring to reset the PE bit.

p. Any violation of privilege rules as apply to the selector operand does not cause a Protection exception, rather, the zero flag is cleared.

q. If the coprocessor’s memory operand violates a segment limit or segment access rights, an exception 13 fault will occur before the ESC instruction is executed. An

exception 12 fault will occur if the stack limit is violated by the operand’s starting address.

r. The destination of a JMP,CALL, INT, RET,or IRET must be in the defined limit of a code segment or an exception 13 fault will occur.

Note s applies to SGS-Thomson specific SMM instructions:

s. All memory accesses to SMM space are non-cacheable. An invalid opcode exception 6 occurs unless SMI is enabled and ARR3 size > 0, and CPL = 0 and [SMAC

is set or if in an SMI handler].

Note t applies to cache invalidation instructions with the cache operating in write-back mode:

t. The total clock count is the clock count shown plus the number of clocks required to write all “modified” cache lines to external memory.

ST6x86

6-42

ST6x86

6-43

6.5 FPU Clock Counts

The CPU is functionally divided into the FPU, and

the integer unit. The FPU processes floating point

instructions only and does so in parallel with the

integer unit.

For example, when the integer unit detects a float-

ing point instruction without memory operands,

after two clock cycles the instruction passes to the

FPU for execution. The integer unit continues to

execute instructions while the FPU executes the

floating point instruction. If another FPU instruc-

tion is encountered, the second FPU instruction is

placed in the FPU queue. Up to four FPU instruc-

tions can be queued. In the event of an FPU

exception, while other FPU instructions are

queued, the state of the CPU is saved to ensure

recovery.

6.5.1 FPU Clock Count Table

The clock counts for the FPU instructions are

listed in Table 6.21. The abbreviations used in this

table are listed in FPU Clock Count Table Abbre-

viations

Table 6.21 FPU Clock Count TableAbbreviations

ABBREVIATION MEANING

n Stack register number

TOS Top of stack register pointed to by SSS in the status register.

ST(1) FPU register next to TOS

ST(n) A specific FPU register,relative to TOS

M.WI 16-bit integer operand from memory

M.SI 32-bit integer operand from memory

M.LI 64-bit integer operand from memory

M.SR 32-bit real operand from memory

M.DR 64-bit real operand from memory

M.XR 80-bit real operand from memory

M.BCD 18-digit BCD integer operand from memory

CC FPU condition code

Env Regs Status, Mode Control and Tag Registers, Instruction Pointer and Operand Pointer

ST6x86

6-44

Table6.22 6x86 FPU Instruction Set Summary

FPU INSTRUCTION OP CODE OPERATION CLOCK

COUNT NOTES

F2XM1

Function Evaluation 2

-1

FABS

Floating Absolute Value

D9 F0

D9 E1 TOS

TOS <-------------

<-------------- 2TOS-1

| TOS| 92-108

2SeeNote2

FADD

Floating Point Add

Topof Stack

80-bit Register

64-bit Real

32-bit Real

FADDP

Floating Point Add, Pop

FIADD

Floating Point Integer Add

32-bit integer

16-bit integer

DC [1100 0 n]

D8 [1100 0 n]

DC [mod 000 r/m]

D8 [mod 000 r/m]

DE [1100 0 n]

DA [mod 000 r/m]

DE [mod 000 r/m]

ST(n)

TOS

ST(n)

TOS

<-------------

ST(n)+TOS

TOS+ST(n)

TOS+M.DR

TOS+M.SR

ST(n) + TOS; then Pop

TOS

TOS+M.SI

TOS+M.WI

4-9

8-14

FCHS

Floating Change Sign

D 9 E 0 T O S <------------- - T O S 2

FCLEX

Clear Exceptions

FNCLEX

Clear Exceptions

(9B)DB E2

DB E2 Wait then Clear Exceptions

Clear Exceptions 5

FCOM

Floating Point Compare

80-bit Register

64-bit Real

32-bit Real

FCOMP

Floating Point Compare, Pop

80-bit Register

64-bit Real

32-bit Real

FCOMPP

Floating Point Compare, Pop

Two Stack Elements

FICOM

Floating Point Compare

32-bit integer

16-bit integer

FICOMP

Floating Point Compare

32-bit integer

16-bit integer

D8 [1101 0 n]

DC [mod 010 r/m]

D8 [mod 010 r/m]

D8 [1101 1 n]

DC [mod 011 r/m]

D8 [mod 011 r/m]

DE D9

DA [mod 010 r/m]

DE [mod 010 r/m]

DA [mod 011 r/m]

DE [mod 011 r/m]

CCsetbyTOS-ST(n)

CCsetbyTOS-M.DR

CCsetbyTOS-M.SR

CCsetbyTOS-ST(n);then PopTOS

CCsetbyTOS-M.DR;then PopTOS

CCsetbyTOS-M.SR; then PopTOS

CCsetbyTOS-ST(1);then PopTOS

andST(1)

CCsetbyTOS-M.WI

CCsetbyTOS-M.SI

CCsetbyTOS-M.WI;then PopTOS

CCsetbyTOS-M.SI;then PopTOS

9-10

FCOS

Function Evaluation: Cos(x)

D 9 F F T O S <------------- COS(TOS) 92-141 SeeNote1

FDECSTP

Decrement Stack Pointer

D9 F6 Decrementtop of stackpointer 4

ST6x86

6-45

FDIV

Floating Point Divide

Topof Stack

80-bit Register

64-bit Real

32-bit Real

FDIVP

Floating Point Divide, Pop

FDIVR

Floating Point Divide Reversed

Topof Stack

80-bit Register

64-bit Real

32-bit Real

DC [11111 n]

D8 [11110 n]

DC [mod 110 r/m]

D8 [mod 110 r/m]

DE [11111 n]

DC [11110 n]

D8 [11111 n]

DC [mod 111r/m]

D8 [mod 111r/m]

ST(n)

TOS

ST(n)

TOS

ST(n)

TOS

<-------------

ST(n)/TOS

TOS/ST(n)

TOS/M.DR

TOS/M.SR

ST(n)/TOS;then PopTOS

ST(n)/TOS

TOS/ST(n)

M.DR/TOS

M.SR/TOS

24-34

FDIVRP

Floating Point Divide Reversed

, Pop

FIDIV

Floating Point Integer Divide

32-bit Integer

16-bit Integer

FIDIVR

Floating Point Integer Divide

Reversed

32-bit Integer

16-bit Integer

DE [11110 n]

DA [mod 110 r/m]

DE [mod 110 r/m]

DA [mod 111r/m]

DE [mod 111r/m]

ST(n)

TOS

<-------------

TOS / ST(n); then Pop

TOS

TOS/M.SI

TOS/M.WI

M.SI/TOS

M.WI/TOS

24-34

34-38

33-38

34-38

33-38

FFREE

Free Floating Point Register

DD [1100 0 n] TAG(n) <------------- Empty 3

FINCSTP

Increment Stack Pointer

FINIT

Initialize FPU

FNINIT

Initialize FPU

D9 F7

(9B)DB E3

DB E3

Incrementtop of stackpointer

Wait then initialize

Initialize

FLD

Load Data to FPU Reg.

Topof Stack

64-bit Real

32-bit Real

FBLD

Load Packed BCD Data to FPU Reg.

FILD

Load Integer Data to FPU Reg.

64-bit Integer

32-bit Integer

16-bit Integer

D9 [1100 0 n]

DD [mod 000 r/m]

D9 [mod 000 r/m]

DF [mod 100 r/m]

DF [mod 101 r/m]

DB [mod 000 r/m]

DF [mod 000 r/m]

Push ST(n) onto stack

Push M.DR onto stack

Push M.SR onto stack

Push M.BCD onto stack

Push M.LI onto stack

Push M.SI onto stack

Push M.WI onto stack

41-45

4-8

4-6

3-6

FLD1

Load Floating Const.= 1.0

D9 E8 Push 1.0 onto stack 4

FLDCW

Load FPU Mode Control Register

FLDENV

Load FPU Environment

D9 [mod 101 r/m]

D9 [mod 100 r/m] Ctl Word

Env Regs <-------------

<------------- Memory

Memory 4

Table6.22 6x86 FPU Instruction Set Summary

FPU INSTRUCTION OP CODE OPERATION CLOCK

COUNT NOTES

ST6x86

6-46

FLDL2E Load Floating Const.= Log2(e)

FLDL2T Load Floating Const.= Log2(10)

FLDLG2 Load Floating Const.= Log10(2)

FLDLN2 Load Floating Const.= Ln(2)

FLDPI Load Floating Const.= p

FLDZ Load Floating Const.= 0.0

D9 EA

D9 E9

D9 EC

D9 ED

D9 EB

D9 EE

Push Log2(e) onto stack

Push Log2(10) onto stack

Push Log10(2) onto stack

Push Loge(2) onto stack

Push

onto stack

Push 0.0 onto stack

FMUL

Floating Point Multiply

Topof Stack

80-bit Register

64-bit Real

32-bit Real

FMULP

Floating Point Multi

ply & Pop

FIMUL

Floating Point Integer Multiply

32-bit Integer

16-bit Integer

DC[1100 1 n]

D8[1100 1 n]

DC[mod 001 r/m]

D8[mod 001 r/m]

DE[1100 1 n]

DA[mod 001 r/m]

DE[mod 001 r/m]

ST(n)

TOS

ST(n)

TOS

<-------------

ST(n)×TOS

TOS×ST(n)

TOS ×M.DR

TOS×M.SR

ST(n)×TOS;then

PopTOS

TOS×M.SI

TOS×M.WI

4-9

4-8

4-6

4-9

9-11

8-10

FNOP

No Operation

D9 D0 NoOperation 2

FPATAN

Function Eval: Tan

-1

(y/x)

FPREM

Floating Point Remainder

FPREM1

Floating Point Remainder IEEE

FPTAN

Function Eval: Tan(x)

FRNDINT

Round to Integer

D9F3

D9F8

D9F5

D9F2

D9FC

ST(1)

TOS

<-------------

ATAN[ST(1)/ TOS]; then

PopTOS

Rem[TOS/ST(1)]

TAN(TOS);thenPush1.0

Round(TOS)

97-161

82-91

117-129

10-20

SeeNote3

SeeNote1

FRSTOR

Load FPU Environment and Reg.

FSAVE

Save FPU Environment and Reg

FNSAVE

Save FPU Environment and Reg

DD [mod 100 r/m]

(9B)DD[mod 110 r/m]

DD [mod 110 r/m]

Restorestate.

Wait thensave state.

Save state.

56-72

57-67

55-65

FSCALE

Floating Multiply by 2

FSIN

Function Evaluation: Sin(x)

D9 FD

D9 FE TOS

TOS <-------------

<------------- TOS×2(ST(1))

SIN(TOS) 7-14

76-140 SeeNote1

FSINCOS

Function Eval.: Sin(x)& Cos(x)

D9 FB temp

TOS <-------------

<------------- TOS;

SIN(temp);then 145-161 SeeNote1

Push COS(temp)onto stack

FSQRT

Floating Point Square Root

D 9 F A T O S <------------- SquareRoot of TOS 59-60

Table6.22 6x86 FPU Instruction Set Summary

FPU INSTRUCTION OP CODE OPERATION CLOCK

COUNT NOTES

ST6x86

6-47

FST

Store FPU Register

Topof Stack

80-bit Real

64-bit Real

32-bit Real

FSTP

Store FPU Register, Pop

Topof Stack

80-bit Real

64-bit Real

32-bit Real

FBSTP

Store BCD Data, Pop

FIST

Store Integer FPU Register

32-bit Integer

16-bit Integer

FISTP

Store Integer FPU Register

Pop

64-bit Integer

32-bit Integer

16-bit Integer

DD[1101 0 n]

DB[mod 111 r/m]

DD[mod 010 r/m]

D9[mod 010 r/m]

DB[1101 1 n]

DB[mod 111 r/m]

DD[mod 011 r/m]

D9[mod 011 r/m]

DF[mod 110 r/m]

DB[mod 010 r/m]

DF[mod 010 r/m]

DF[mod 111r/m]

DB[mod 011 r/m]

DF[mod 011 r/m]

ST(n)

M.XR

M.DR

M.SR

ST(n)

M.XR

M.DR

M.SR

M.BCD

M.SI

M.WI

M.LI

M.SI

M.WI

<-------------

TOS

TOS; then PopTOS

TOS

TOS; then PopTOS

57-63

8-13

7-10

10-13

8-13

7-10

FSTCW

Store FPU Mode Control Register

FNSTCW

Store FPU Mode Control Register

FSTENV

Store FPU Environment

FNSTENV

Store FPU Environment

FSTSW

Store FPU Status Register

FNSTSW

Store FPU Status Register

FSTSW AX

Store FPU Status Register to AX

FNSTSW AX

Store FPU Status Register to AX

(9B)D9[mod 111r/m]

D9 [mod 111r/m]

(9B)D9[mod 110 r/m]

D9 [mod 110 r/m]

(9B)DD[mod 111r/m]

DD [mod 111r/m]

(9B)DF E0

DF E0

Wait Memory

Memory

Wait Memory

Memory

Wait Memory

Memory

Wait AX

<-------------

ControlMode Register

Env. Registers

StatusRegister

14-24

12-22

FSUB

Floating Point Subtract

Topof Stack

80-bit Register

64-bit Real

32-bit Real

FSUBP

Floating Point Subtract, Pop

DC [11101 n]

D8 [11100 n]

DC [mod 100 r/m]

D8 [mod 100 r/m]

DE [11101 n]

ST(n)

TOS

ST(n)

<-------------

ST(n)-TOS

TOS-ST(n)

TOS-M.DR

TOS-M.SR

ST(n)-TOS;thenPopTOS

4-9

Table6.22 6x86 FPU Instruction Set Summary

FPU INSTRUCTION OP CODE OPERATION CLOCK

COUNT NOTES

ST6x86

6-48

FSUBR

Floating Point Subtract Reverse

Topof Stack

80-bit Register

64-bit Real

32-bit Real

FSUBRP

Floating Point Subtract

Reverse

Pop

FISUB

Floating Point Integer Subtract

32-bit Integer

16-bit Integer

FISUBR

Floating Point Integer Subtract

Reverse

32-bit Integer Reversed

16-bit Integer Reversed

DC [11100 n]

D8 [11101 n]

DC [mod 101 r/m]

D8 [mod 101 r/m]

DE [11100 n]

DA [mod 100 r/m]

DE [mod 100 r/m]

DA [mod 101 r/m]

DE [mod 101 r/m]

TOS

ST(n)

TOS

ST(n)

TOS

<-------------

<---------------

ST(n)-TOS

TOS-ST(n)

M.DR-TOS

M.SR-TOS

TOS-ST(n);then PopTOS

TOS-M.SI

TOS-M.WI

M.SI-TOS

M.WI-TOS

4-9

14-29

14-27

14-29

14-27

FTST

TestTop of Stack

FUCOM

Unordered Compare

FUCOMP

Unordered Compare, Pop

FUCOMPP

Unordered Compare,

Pop two elements

D9 E4

DD [11100 n]

DD [11101 n]

DA E9

CCsetbyTOS-0.0

CCsetbyTOS-ST(n)

CCsetbyTOS-ST(n);then Pop TOS

CC set by TOS - ST(I); then Pop TOS

and ST(1)

FWAIT

Wait

9B Waitfor FPU notbusy 2

FXAM

Report Class of Operand

D 9 E 5 C C <--------------- Class of TOS 4

FXCH

Exchange Register with TOS

D9 [1100 1 n] TOS <-------------> ST(n) Exchange 3

FXTRACT

Extract Exponent

D9 F4 temp

TOS <-------------

<------------- TOS;

exponent(temp); then

Push significant (temp)

ontostack

11-16

FLY2X

Function Eval. y

Log2(x)

FLY2XP1

Function Eval. y

Log2(x+1)

D9F1

D9F9

ST(1)

<-------------

ST(1) ×Log2(TOS);

then Pop TOS

ST(1) ×Log2(1+TOS);

then Pop TOS

145-154

131-133 SeeNote4

Table6.22 6x86 FPU Instruction Set Summary

FPU INSTRUCTION OP CODE OPERATION CLOCK

COUNT NOTES

ST6x86

6-49

FPU Instruction Summary Notes

All references to TOS and ST(n) refer to stack layout prior to execution.

Values Popped off the stack are discarded.

A Pop from the stack increments the top of stack pointer.

A Push to the stack decrements the top of stack pointer.

Note 1:

For FCOS, FSIN, FSINCOS and FPTAN, time shown is for absolute value of TOS < 3π/4.

Add 90 clock counts for argument reduction if outside this range.

For FCOS, clock count is 141 if TOS < π/4 and clock count is 92 if π/4 < TOS > π/2.

For FSIN, clock count is 81 to 82 if absolute value of TOS < π/4.

Note 2:

For F2XM1, clock count is 92 if absolute value of TOS < 0.5.

Note 3:

For FPATAN,clock count is 97 if ST(1)/TOS < π/32.

Note 4:

For FYL2XP1, clock count is 170 if TOS is out of range and regular FYL2X is called.

Note 5:

The following opcodes are reserved by Cyrix:

D9D7, D9E2, D9E7, DDFC, DED8, DEDA, DEDC, DEDD, DEDE, DFFC.

If a reserved opcode is executed, and unpredictable results may occur (exceptions are not generated).

ST6x86

6-50

ST6x86

A-1

OrderingInformation

(3.52 V Commercial

Speed Equalizer Package Type

H = CPGA Package

B = BGA Package

P = PPGA Package

S= Supply Voltage

P120+

6X86

Please contact your nearest SGS-THOMSON sales office to confirm availability of specific valid

combinations and to check on newly released combinations.

Example: ST

SGS Thomson

Prefix Device

Name Grade Temperature)P120+=100MHz(internal)

P133+=110MHz(internal)

P150+=120Mhz(internal)

P166+=133MHz(internal)

P200+=150MHz(internal)

ST6x86

A-2

The ST6x86 CPU part numbers are listed below.

ST6x86 Part Numbers

PART NUMBER NOM

Vcc (V)

FREQUENCY

(MHz)

BUS INTERNAL

ST6X86P120+HS 3.52 50 100

ST6X86P133+HS 3.52 55 110

ST6X86P150+HS 3.52 60 120

ST6X86P166+HS 3.52 66 133

ST6x86

A-3

I-1

INDEX

Numerics

296-Pin SPGA Package ................................. 5-1

6x86 Configuration Registers ....................... 2-23

Abort Exception ............................................ 2-57

Absolute Maximum Ratings ............................ 4-2

AC Characteristics .......................................... 4-5

Address Bus ................................................... 3-8

Address Parity ............................ .................... 3-9

Address Space ............................................. 2-40

Application Register Set ................................. 2-4

Architecture Overview .................................... 1-1

Back-Off Timing ............................................ 3-48

Base Field .................................................... 6-10

Branch Control ............................ .................. 1-11

Branch Prediction ......................................... 1-11

Burst Cycle Address Sequence .................... 3-33

Burst Write Cycles ........................................ 3-36

Bus Arbitration ............................ .........3-15,3-45

Bus Cycle Control ......................................... 3-12

Bus Cycle Definitions .................................... 3-10

Bus Interface .................................................. 3-1

Bus InterfaceUnit ......................................... 1-15

Bus State Definition ...................................... 3-25

Cache Coherency ......................................... 3-17

Cache Control ............................................... 3-13

Cache Control Timing ................................... 3-42

Cache Inquiry Cycles .................................... 3-49

Cache Units .................................................. 1-12

Clock Control .................................................. 3-6

Configuration Control Registers ................... 2-23

Confirmation Registers ................................. 2-11

Control Register ............................................ 2-13

Control Registers .......................................... 2-11

CPU InstructionSet Summary Table Abbreviations

...................................................... 6-12

CPU Instruction Set Summary Table Flags Table

6-13

CPUID Instruction ......................................... 6-11

Current Priviledge Level (CPL) ..................... 2-71

d Field ............................................................. 6-4

Data Bus ......................................................... 3-9

Data Bypassing ............................................ 1-10

Data Dependency Solutions .......................... 1-4

Data Forwarding ............................................ 1-7

Data Parity ..................................................... 3-9

Data Registers ............................................... 2-5

DC Characteristics .........................................4-4

Debug Registers .................................2-11,2-37

Descriptor Priviledge Level (DPL) ................ 2-71

Descriptor Table Registers .................2-11,2-15

Descriptors ...................................................2-16

eee Field ........................................................ 6-5

Electrical Connections ................................... 4-1

Entering and Leaving V86 Mode ..................2-75

Error Codes ..................................................2-62

EWBE# Timing ............................................. 3-44

Exceptions

Abort .................................................... 2-57

Fault .....................................................2-57

Trap .....................................................2-56

Exceptions in Real Mode .............................2-61

Exclusive Instructions .................................... 1-4

Fault Exception ............................................2-57

Fields

Base .....................................................6-10

d ............................................................. 6-4

eee ......................................................... 6-5

index ...................................................... 6-9

mod and r/m ........................................... 6-6

sreg2 ...................................................... 6-8

sreg3 ...................................................... 6-8

ss ...........................................................6-9

w ............................................................ 6-4

Flag Register .................................................. 2-4

Flags ..................... .......................................6-13

Flags Register ................................................2-9

Floating Point Unit ........................................1-15

Floating Point Unit Operations .....................2-75

FPU Control and Status Registers ...............2-75

FPU Error Interface ...................................... 3-18

FPU Parallel Execution ................................1-15

FPU Tag Word Register ............................... 2-75

Functional Blocks ........................................... 1-1

Functional Timing ......................................... 3-24

Gate Descriptors .......................................... 2-19

Gates ........................................................... 2-73

I-2

INDEX

General Instruction Fields ............................... 6-2

General Purpose Register .............................. 2-5

General Purpose Registers ............................ 2-4

GlobalDescriptor Table Register ................. 2-15

HALT Initiated Suspend Mode ...................... 3-61

Hold and HLDA ............................................. 3-45

I/O Address Space ..................... .................. 2-41

I/O Privilege Levels ..................... .................. 2-72

index Field ...................................................... 6-9

IndexRegister ............................ .................... 2-6

Initialization and Transition to Protected Mode ....

2-73

Inquiry Cycles Using AHOLD ....................... 3-52

Inquiry Cycles Using BOFF .......................... 3-51

Inquiry Cycles Using HOLD/HLDA ............... 3-50

Instrucion Line Cache ................................... 1-13

Instruction Clock Count

Assumptions made in determining .......6-12

Instruction Pointer Register .....................2-4,2-9

Instruction Set Formats .................................. 6-1

Instruction Set Overview ................................. 2-3

Instruction Set Summary ................................ 6-1

Instruction Set Tables ................................... 6-12

InstuctionPrefix Summary ............................ 6-43

Integer Unit ..................................................... 1-2

Interrups

SMM ................................... .................. 2-56

Interrupt Acknowledge Cycles ...................... 3-40

Interrupt and Exception Priorities ................. 2-59

Interrupt Control ............................................ 3-12

Interrupt Descriptor Table ............................. 2-59

Interrupt Descriptor Table Register .............. 2-15

Interrupt Handling

V86 Mode ............................................. 2-74

Interrupt Vector Assignments ....................... 2-57

Interrupts ...................................................... 2-55

INTR ................................... .................. 2-56

NMI ....................................................... 2-55

Vectors ................................................. 2-57

INTR Interrupt ............................................... 2-56

Invalidating the Cache Using FLUSH# .........3-42

JTAG Interface ............................................. 3-23

Local Descriptor Table Register ...................2-15

Lock Prefix ..................................................... 2-3

Memory Address Space ............................... 2-40

Memory Addressing

Protected Mode ................................... 2-43

Real Mode ...........................................2-43

V86Mode ............................................2-74

Memory Addressing Methods ......................2-41

Memory Management Unit ........................... 1-14

mod and r/m Byte ........................................... 6-6

Modes

System Management ........................... 2-63

NC and Reserved Pins ..................................4-2

NMI Interrupt ................................................ 2-55

Non-Pipelined Bus Cycles ........................... 3-28

Non-Pipelined Single Transfer Cycles ......... 3-28

Non-Piplined Burst Read Cycles ..................3-31

Offset Address Calculation ..........................2-42

Offset Mechanism ........................................2-42

Operand forwarding ....................................... 1-7

Opicode Byte ................................................. 6-4

Optional Prefix Byte ....................................... 6-2

Out-of-Order Processing ................................ 1-3

Pins NC and Reserved ..................................4-2

Unused Input ......................................... 4-2

Pipeline Selection .......................................... 1-4

Pipeline Stages

Execute .................................................. 1-3

InstructionFetch .................................... 1-3

Write-Back .............................................1-3

Pipelined Back-to-Back Read/Write Cycles . 3-39

Pipelined Bus Cycles ................................... 3-37

Pipleine Stages

Address Calculation ............................... 1-3

Pointer Register .............................................2-6

Power and Ground Connections and Decoupling

4-1

Power Management Interface .............3-21,3-60

Priviledge Levels

Current ................................................. 2-71

I-3

INDEX

Descriptor ............................................. 2-71

Requested ............................................ 2-71

Privilege Level Transfers .............................. 2-72

Processor Initialization .................................... 2-1

Programming Interface ................................... 2-1

Protected Mode Memory Addressing ...........2-43

Protection ................................... .................. 2-71

V86 Mode ............................................. 2-74

Pull-Up/Pull-Down Resisters .......................... 4-1

RAW Dependency Example ........................... 1-8

Real Mode Memory Addressing ................... 2-43

Recommended Operating Conditions ............4-3

Registers

6x86 Configuration ............................... 2-23

Configuration Control ........................... 2-23

Confirmation ......................................... 2-11

Control .........................................2-11,2-13

Data ........................................................ 2-5

Debug ..........................................2-11,2-37

Descriptor Table .......................... 2-11,2-15

Flag ........................................................ 2-4

Flags ................................... .................... 2-9

General Purpose .............................2-4,2-5

Global Descriptor Table ........................ 2-15

Index ................................... .................... 2-6

Instruction Pointer ...........................2-4,2-9

Interrupt DescriptorTable ..................... 2-15

Local Descriptor Table Register ...........2-15

Pointer .................................................... 2-6

Segment ..........................................2-4,2-7

Task .............................................2-11,2-20

Test .............................................2-11,2-39

Requested Priviledge Level (RPL) ............... 2-71

Requested Privilege Level (RPL) ................... 2-8

Reset Control .................................................. 3-6

Reset Timing ................................................ 3-24

Result Forwarding .......................................... 1-7

s Field ............................................................. 6-5

Scatter/Gather Buffer Interface ............3-18,3-55

Section 2.6.4 (Page 45) .................................. 2-7

Segment Register ........................................... 2-7

Segment Registers ..................... .................... 2-4

Segment Selector ........................................... 2-7

Selector Mechanism ..................................... 2-44

Shutdown and Halt .......................................2-69

Signal Description Table ................................ 3-2

Signal Descriptions ........................................ 3-6

Signals

INTR .................................................... 2-56

NMI ......................................................2-55

SMM .................................................... 2-56

SMI Service Routine Execution ...................2-68

SMI# Interrupt Timing .................................. 3-41

SMM Interrupt ..............................................2-56

SMM Memory Space ................................... 2-68

SMM Memory Space Header ....................... 2-65

SMM Operation ............................................2-64

Speculative Execution .................................. 1-12

sreg2 Field ..................................................... 6-8

sreg3 Field ..................................................... 6-8

ss Field ...........................................................6-9

Stopping the Input Clock .............................. 3-62

SUSP# Initiated Suspend Mode ..................3-60

System Management Mode .........................2-63

System Register Set ....................................2-11

Table Indicator (TI) .........................................2-8

Task Register ......................................2-11,2-20

Test Registers ..................................... 2-11,2-39

Thermal Characteristics ................................. 5-6

Traditional Paging Mechanism .....................1-15

Trap Exception ............................................. 2-56

Unified Cache ..............................................1-12

Unused Input Pins .......................................... 4-2

V86 Interrupt Handling .................................2-74

V86 Memory Addressing .............................. 2-74

V86 Protection ............................................. 2-74

Variable-Size Paging Mechanism ................ 1-14

Vector Interrupt ............................................2-57

Virtual 8086 Mode ........................................2-74

w Field ............................................................ 6-4

WAR Dependency Example .......................... 1-5

WAW Dependency Example .......................... 1-6

WAW Dependency Example 1-6

ST6x86

I-4

ST6x86

Information furnished isbelieved to be accurate and reliable. However, SGS-THOMSON Microelectronics assumes no responsibility for the

consequences of use of such information nor for any infringement of patents or other rights of third parties which may result from its use. No

license is granted by implication or otherwise under any patent or patent rights of SGS-THOMSON Microelectronics. Specifications men-

tioned in this publication are subject to change without notice. This publication supersedes andreplaces all information previously supplied.

SGS-THOMSON Microelectronics products are not authorized for use as critical components in life support devices or systems without

express written approval of SGS-THOMSON Microelectronics.

SGS-THOMSON Microelectronics GROUP OF COMPANIES

Australia – Brazil – Canada – China – France – Germany – Hong Kong – Italy – Japan – Korea – Malaysia – Malta – Morocco

The Netherlands – Singapore – Spain – Sweden – Switzerland – Taiwan – Thailand – United Kingdom – U.S.A.