MOVE SPECIAL REGISTERS
A few of the special registers (CRn, DRn, TRn) on the Intel386
that are documented as undefined have use. CR1, CR4-CR7, TR0-TR3
all produce an invalid op code exception. DR4 and DR5 are aliases
for DR6 and DR7 respectively. DR7 has some
undocumented bits that govern ICE behavior. TR4 and TR5 are
the most interesting. It appears that these two registers (alias
to each other) and point to the next prefetch address. This
address is a 32-bit fully decoded address that would appear on
the CPU bus during the next prefetch. Using TR4 can help
determine the "low-water" point of the prefetch unit.
By monitoring the rate of change of TR4, one can determine the
granularity size of the prefetch unit. On early '386's (ID=303)
this registers changes in 12-byte granularity; ID=305 changes in
8-byte granularity (but appears to have a 16-byte prefetch
queue); ID=308 changes in 8-byte granularity (but has a 12-byte
prefetch queue).
The Intel486 processor family uses TR4 and TR5. But
internally, TR4/5 can still show it's ugly head as the next
prefetch address. How can you do this, if the Intel486 uses TR4/5
for something else? It's not easy. In fact, it was a bug, which
might have been fixed by now. Click here,
to find out more.
Back to secrets and
bugs
|