x86 Instruction Set Architecture - MindShare

1 X86 Instruction Set ArchitectureComprehensive 32/64-bit CoverageFirst EditionAlso by Tom ShanleyHEAVEN S FAVORITE A Novel of Genghis Khan Book 1, ASCENT: THE RISE OF CHINGGIS KHANBook 2, DOMINION: DAWN OF THE MONGOL EMPIREMINDSHARE TECHNICAL TRAININGP lease visit for a complete description of Mind-Share s technical offerings: Books eBooks eLearning modules Public courses On-site course On-line coursesIntel Core 2 Processor (Penryn)Intel Nehalem ProcessorIntel Atom ProcessorAMD Opteron Processor (Barcelona)Intel 32/64-bit x86 Software ArchitectureAMD 32/64-bit x86 Software Architecturex86 Assembly Language ProgrammingProtected Mode ProgrammingPC VirtualizationIO Virtualization (IOV)Computer Architectures with Intel ChipsetsIntel QuickPath Interconnect (QPI)PCI Express USB WorkshopPCIPCI-XModern DRAM ArchitectureSASS erial ATAHigh Speed DesignEMI / EMCB luetooth Wireless Product DevelopmentSMT ManufacturingSMT Testingx86 Instruction Set ArchitectureComprehensive 32/64-bit CoverageFirst EditionMINDSHARE, SHANLEYMindShare PressColorado Springs, USAR efer to Trademarks on page 5 for trademark author and publisher have taken care in preparation of this book but make no expressed or implied warranty of any kind and assume no responsibility for errors or omissions.

2 No liability is assumed for incidental or consequential damages in connec-tion with or arising out of the use of the information or programs contained : 0-9770878-5-3 Copyright 2009 by MindShare , rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopy-ing, recording, or otherwise, without the prior written permission of the publisher. Printed in the United States of America. Cover Design: Michelle PetrieSet in 10 point Palatino by MindShare , Printing, December 2009 MindShare Press books are available for bulk purchases by corporations, institutions, and other organizations. For more information please contact the Special Sales Depart-ment at (575) MindShare Press on the World Wide Web at: Nancy, the strongest person I Love,To mP.

3 S. It s done. I m of ContentsPart 1: Introduction, intended as a back-drop to the detailed discussions thatfollow, consists of the following chapters: Chapter 1, "Basic Terms and Concepts," on page 11. Chapter 2, "Mode/SubMode Introduction," on page 21. Chapter 3, "A (very) Brief History," on page 41. Chapter 4, "State After Reset," on page 2: IA-32 Mode provides a detailed description of two IA-32 Mode sub-modes Real Mode and Protected Mode and consists of the following chap-ters: Chapter 5, "Intro to the IA-32 Ecosystem," on page 79. Chapter 6, " Instruction Set Expansion," on page 109. Chapter 7, "32-bit Machine Language Instruction Format," on page 155. Chapter 8, "Real Mode (8086 Emulation)," on page 227. Chapter 9, "Legacy x87 FP Support," on page 339. Chapter 10, "Introduction to Multitasking," on page 361.

4 Chapter 11, "Multitasking-Related Issues," on page 367. Chapter 12, "Summary of the Protection Mechanisms," on page 377. Chapter 13, "Protected Mode Memory Addressing," on page 383. Chapter 14, "Code, Calls and Privilege Checks," on page 415. Chapter 15, "Data and Stack Segments," on page 479. Chapter 16, "IA-32 Address Translation Mechanisms," on page 493. Chapter 17, "Memory Type Configuration," on page 599. Chapter 18, "Task Switching," on page 629. Chapter 19, "Protected Mode Interrupts and Exceptions," on page 681. Chapter 20, "Virtual 8086 Mode," on page 783. Chapter 21, "The MMX Facilities," on page 835. Chapter 22, "The SSE Facilities," on page 3: IA-32e OS Kernel Environment provides a detailed description of theIA-32e OS kernel environment and consists of the following chapters: Chapter 23, "IA-32e OS Environment," on page 913.

5 Chapter 24, "IA-32e Address Translation," on page 4: Compatibility Mode provides a detailed description of the Compatibil-ity submode of IA-32e Mode and consist of the following chapter: Chapter 25, "Compatibility Mode," on page 5: 64-bit Mode provides a detailed description of the 64-bit submode of IA-32e Mode and consists of the following chapters: Chapter 26, "64-bit Register Overview," on page 1023. Chapter 27, "64-bit Operands and Addressing," on page 1041. Chapter 28, "64-bit Odds and Ends," on page 6: Mode Switching Detail provides a detailed description of: Switching from Real Mode to Protected Mode. This topic is covered inChapter 29, "Transitioning to Protected Mode," on page 1113. Switching from Protected Mode to IA-32e Mode. This topic is covered inChapter 30, "Transitioning to IA-32e Mode," on page 7: Other Topics provides detailed descriptions of the following topics: Chapter 31, "Introduction to Virtualization Technology," on page 1147.

6 Chapter 32, "System Management Mode (SMM)," on page 1167. Chapter 33, "Machine Check Architecture (MCA)," on page 1207. Chapter 34, "The Local and IO APICs," on page This BookIs This the Book for You? .. 1A Moving Target .. 1x86 Instruction Set Architecture (ISA) .. 1 Glossary of Terms .. 232-/64-bit x86 Instruction Set Architecture Specification .. 2 The Specification Is the Final Word .. 2 Book Organization .. 3 Topics Outside the Scope of This 4 The CPUID 4 Detailed Description of Hyper-Threading .. 4 Detailed Description of Performance 5 Documentation Conventions .. 5 Visit Our Web Site .. 6We Want Your 1: IntroductionChapter 1: Basic Terms and ConceptsISA Definition .. 11 This Book Focuses on the Common Intel/AMD ISA .. 11 For Simplicity, Intel Terminology Is Used Throughout .. 11 Some Terms in This Chapter May Be New To the Reader.

7 12 Two x86 ISA Architectures .. 12 Processors, Cores and Logical 13 Fundamental Processing Engine: Logical Processor .. 14IA Instructions vs. Micro-ops .. 15 RISC Instructions Sets Are 15x86 Instruction Set Is 15 But You Can t Leave It 16 Complexity vs. Speed Dictated a Break With the Past .. 16 Why Not Publish a Micro-Op ISA? .. 16 Some Important Definitions .. 17 Virtual vs. Physical Memory .. 17 Other Important Terms .. 18 Chapter 2: Mode/SubMode IntroductionBasic Execution 21 ContentsxiiIA-32 SubModes .. 25IA-32e SubModes .. 28 Mode Switching Basics ..30 Initial Switch from IA-32 to IA-32e Mode .. 30IA-32e SubMode Selection .. 33 Protected/Compatibility 16-/32-bit SubModes .. 38 Chapter 3: A (very) Brief HistoryMajor Evolutionary Developments .. 4216-bit Mode Background .. 468086 and Real 46286 Introduced 16-bit Protected 48386 Supported Both 16- and 32-bit Protected Mode.

8 51 The Intel Microarchitecture Families .. 55A Brief Timeline .. 57 Chapter 4: State After ResetState After Reset .. 64 Soft Reset .. 73 Boot Strap Processor (BSP) Selection .. 73AP Discovery and 74 Initial Memory 74 Part 2: IA-32 ModeChapter 5: Intro to the IA-32 EcosystemThe Pre-386 Register 808086 Register 80286 Register 82IA-32 Register Set 84 Control 85 Status/Control Register (Eflags) .. 88 Instruction Fetch Facilities .. 89 Branch Prediction Logic .. 90 General Purpose Data 90 Defining Memory 92 MTRRs .. 92 Segment Registers ..92 Address Translation Facilities .. 93 ContentsxiiiInterrupt/Exception Facilities .. 93 Kernel Facilities .. 94 Real Mode Has No Memory Protection .. 95 Memory Protection in Protected Mode .. 95 Introduction .. 95 Segment Selection in Protected Mode .. 95 Access Rights Check.

9 96 The Descriptor Tables .. 96 Descriptor Table 96 Task Data Structure .. 97 Address Translation Facilities .. 97 Effective/Virtual/Linear/Physical 97 Introduction to Address Translation (Paging).. 98 RAM Is Finite and Can t Hold Everything .. 98 RAM and Mass Storage Are Managed on a Page Basis .. 99 This Requires a Series of 99 Malloc Request .. 99 Problem: Non-Contiguous Memory 100 Malloc Returns a Virtual Address to the Application .. 100IA-32 Applications Have a 4GB Virtual Address Space .. 101 Legacy FP Facilities .. 101In the Beginning, FPU Was External and Optional .. 101It Was .. 102486DX Integrated 102x87 Register 102x87 FP Instruction Set .. 102 General Purpose Instruction Set .. 102 MMX 102 Introduction .. 103 SIMD Programming Model .. 103 SSE Facilities .. 104 Introduction .. 104 Motivation.

10 104 Instruction 105 Model-Specific Registers .. 105 Accessing the MSRs .. 106 Debug Facilities .. 106 Automatic Task Switching 107 Chapter 6: Instruction Set ExpansionWhy a Comprehensive Instruction Set Listing Isn t 110 Contentsxiv386 Instruction 111 Instruction Set (as of March, 2009).. 117 Chapter 7: 32-bit Machine Language Instruction Format64-bit Machine Language Instruction Format .. 156A Complex Instruction Set with Roots in the Past .. 156 Effective Operand Size ..157 Introduction .. 157 Operand Size in 16- and 32-bit Code Segments .. 157 Operand Size in 64-bit Code 158 Instruction 160 Instruction Format Basics .. 162 Opcode ( Instruction Identification) .. 168In the Beginning ..1681-byte Opcodes ..1692-byte Opcodes Use 2-Level Lookup .. 1722nd-Level Opcode Map Introduced in 286 .. 172 Instructions with 2-byte Opcodes: Five Possible Forms.