x86 Instruction Set Architecture - MindShare

1 X86 Instruction Set ArchitectureComprehensive 32/64-bit CoverageFirst EditionAlso by Tom ShanleyHEAVEN S FAVORITE A Novel of Genghis Khan Book 1, ASCENT: THE RISE OF CHINGGIS KHANBook 2, DOMINION: DAWN OF THE MONGOL EMPIREMINDSHARE TECHNICAL TRAININGP lease visit for a complete description of Mind-Share s technical offerings: Books eBooks eLearning modules Public courses On-site course On-line coursesIntel Core 2 Processor (Penryn)Intel Nehalem ProcessorIntel Atom ProcessorAMD Opteron Processor (Barcelona)Intel 32/64-bit x86 Software ArchitectureAMD 32/64-bit x86 Software Architecturex86 Assembly Language ProgrammingProtected Mode ProgrammingPC VirtualizationIO Virtualization (IOV)Computer Architectures with Intel ChipsetsIntel QuickPath Interconnect (QPI)

2 PCI Express USB WorkshopPCIPCI-XModern DRAM ArchitectureSASS erial ATAHigh Speed DesignEMI / EMCB luetooth Wireless Product DevelopmentSMT ManufacturingSMT Testingx86 Instruction Set ArchitectureComprehensive 32/64-bit CoverageFirst EditionMINDSHARE, SHANLEYMindShare PressColorado Springs, USAR efer to Trademarks on page 5 for trademark author and publisher have taken care in preparation of this book but make no expressed or implied warranty of any kind and assume no responsibility for errors or omissions. No liability is assumed for incidental or consequential damages in connec-tion with or arising out of the use of the information or programs contained : 0-9770878-5-3 Copyright 2009 by MindShare , rights reserved.

3 No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopy-ing, recording, or otherwise, without the prior written permission of the publisher. Printed in the United States of America. Cover Design: Michelle PetrieSet in 10 point Palatino by MindShare , Printing, December 2009 MindShare Press books are available for bulk purchases by corporations, institutions, and other organizations. For more information please contact the Special Sales Depart-ment at (575) MindShare Press on the World Wide Web at: Nancy, the strongest person I Love,To mP. S. It s done. I m of ContentsPart 1: Introduction, intended as a back-drop to the detailed discussions thatfollow, consists of the following chapters: Chapter 1, "Basic Terms and Concepts," on page 11.

4 Chapter 2, "Mode/SubMode Introduction," on page 21. Chapter 3, "A (very) Brief History," on page 41. Chapter 4, "State After Reset," on page 2: IA-32 Mode provides a detailed description of two IA-32 Mode sub-modes Real Mode and Protected Mode and consists of the following chap-ters: Chapter 5, "Intro to the IA-32 Ecosystem," on page 79. Chapter 6, " Instruction Set Expansion," on page 109. Chapter 7, "32-bit Machine Language Instruction Format," on page 155. Chapter 8, "Real Mode (8086 Emulation)," on page 227. Chapter 9, "Legacy x87 FP Support," on page 339. Chapter 10, "Introduction to Multitasking," on page 361. Chapter 11, "Multitasking-Related Issues," on page 367.

5 Chapter 12, "Summary of the Protection Mechanisms," on page 377. Chapter 13, "Protected Mode Memory Addressing," on page 383. Chapter 14, "Code, Calls and Privilege Checks," on page 415. Chapter 15, "Data and Stack Segments," on page 479. Chapter 16, "IA-32 Address Translation Mechanisms," on page 493. Chapter 17, "Memory Type Configuration," on page 599. Chapter 18, "Task Switching," on page 629. Chapter 19, "Protected Mode Interrupts and Exceptions," on page 681. Chapter 20, "Virtual 8086 Mode," on page 783. Chapter 21, "The MMX Facilities," on page 835. Chapter 22, "The SSE Facilities," on page 3: IA-32e OS Kernel Environment provides a detailed description of theIA-32e OS kernel environment and consists of the following chapters: Chapter 23, "IA-32e OS Environment," on page 913.

6 Chapter 24, "IA-32e Address Translation," on page 4: Compatibility Mode provides a detailed description of the Compatibil-ity submode of IA-32e Mode and consist of the following chapter: Chapter 25, "Compatibility Mode," on page 5: 64-bit Mode provides a detailed description of the 64-bit submode of IA-32e Mode and consists of the following chapters: Chapter 26, "64-bit Register Overview," on page 1023. Chapter 27, "64-bit Operands and Addressing," on page 1041. Chapter 28, "64-bit Odds and Ends," on page 6: Mode Switching Detail provides a detailed description of: Switching from Real Mode to Protected Mode. This topic is covered inChapter 29, "Transitioning to Protected Mode," on page 1113.

7 Switching from Protected Mode to IA-32e Mode. This topic is covered inChapter 30, "Transitioning to IA-32e Mode," on page 7: Other Topics provides detailed descriptions of the following topics: Chapter 31, "Introduction to Virtualization Technology," on page 1147. Chapter 32, "System Management Mode (SMM)," on page 1167. Chapter 33, "Machine Check Architecture (MCA)," on page 1207. Chapter 34, "The Local and IO APICs," on page This BookIs This the Book for You? .. 1A Moving Target .. 1x86 Instruction Set Architecture (ISA) .. 1 Glossary of Terms .. 232-/64-bit x86 Instruction Set Architecture Specification .. 2 The Specification Is the Final Word .. 2 Book Organization .. 3 Topics Outside the Scope of This 4 The CPUID 4 Detailed Description of Hyper-Threading.

8 4 Detailed Description of Performance 5 Documentation Conventions .. 5 Visit Our Web Site .. 6We Want Your 1: IntroductionChapter 1: Basic Terms and ConceptsISA Definition .. 11 This Book Focuses on the Common Intel/AMD ISA .. 11 For Simplicity, Intel Terminology Is Used Throughout .. 11 Some Terms in This Chapter May Be New To the Reader .. 12 Two x86 ISA Architectures .. 12 Processors, Cores and Logical 13 Fundamental Processing Engine: Logical Processor .. 14IA Instructions vs. Micro-ops .. 15 RISC Instructions Sets Are 15x86 Instruction Set Is 15 But You Can t Leave It 16 Complexity vs. Speed Dictated a Break With the Past .. 16 Why Not Publish a Micro-Op ISA? .. 16 Some Important Definitions.

9 17 Virtual vs. Physical Memory .. 17 Other Important Terms .. 18 Chapter 2: Mode/SubMode IntroductionBasic Execution 21 ContentsxiiIA-32 SubModes .. 25IA-32e SubModes .. 28 Mode Switching Basics ..30 Initial Switch from IA-32 to IA-32e Mode .. 30IA-32e SubMode Selection .. 33 Protected/Compatibility 16-/32-bit SubModes .. 38 Chapter 3: A (very) Brief HistoryMajor Evolutionary Developments .. 4216-bit Mode Background .. 468086 and Real 46286 Introduced 16-bit Protected 48386 Supported Both 16- and 32-bit Protected Mode .. 51 The Intel Microarchitecture Families .. 55A Brief Timeline .. 57 Chapter 4: State After ResetState After Reset .. 64 Soft Reset .. 73 Boot Strap Processor (BSP) Selection.

10 73AP Discovery and 74 Initial Memory 74 Part 2: IA-32 ModeChapter 5: Intro to the IA-32 EcosystemThe Pre-386 Register 808086 Register 80286 Register 82IA-32 Register Set 84 Control 85 Status/Control Register (Eflags) .. 88 Instruction Fetch Facilities .. 89 Branch Prediction Logic .. 90 General Purpose Data 90 Defining Memory 92 MTRRs .. 92 Segment Registers ..92 Address Translation Facilities .. 93 ContentsxiiiInterrupt/Exception Facilities .. 93 Kernel Facilities .. 94 Real Mode Has No Memory Protection .. 95 Memory Protection in Protected Mode .. 95 Introduction .. 95 Segment Selection in Protected Mode .. 95 Access Rights Check .. 96 The Descriptor Tables .. 96 Descriptor Table 96 Task Data Structure.