Unit V - Initialization of

80386DX, Debugging and

Virtual 8086 Mode

Processor State After Reset

The contents of EAX depend upon the results of the power-up self test (POST). The self-test may be requested externally by assertion of BUSY# at the end of RESET.

EAX = 00 : if the 80386 passed the test.

EAX ≠ 00 : indicates that the particular 80386 unit is faulty.

If the self-test is not requested, the contents of EAX after RESET is undefined.

DX holds a component identifier and revision number after RESET. DH contains 3, which indicates an 80386 component. DL contains a unique identifier of the revision level.

The ET bit of CR0 is set if an 80387 is present in the configuration (according to the state of the ERROR# pin after RESET). If ET is reset, the configuration either contains an 80287 or does not contain a coprocessor. A software test is required to distinguish between these latter two possibilities.

The remaining registers and flags are set as follows:

EFLAGS =00000002H ,IP =0000FFF0H CS selector =000H DS selector =0000H ES selector =0000H SS selector =0000H FS selector =0000H GS selector =0000H IDTR: base =0 limit =03FFH All registers not mentioned above are undefined. These settings imply that the processor begins in real-address mode with interrupts disabled

Software Initialization for Real-Address

Mode

In real-address mode a few structures must be initialized before a program can take advantage of all the features available in this mode.

1. Stack

No instructions that use the stack can be used until the stack-segment register (SS) has been loaded. SS must point to an area in RAM.

2. Interrupt Table

The initial state of the 80386 leaves interrupts disabled; however, the processor will still attempt to access the interrupt table if an exception or nonmaskable interrupt (NMI) occurs.

Initialization software should take one of the following actions:

◦ Change the limit value in the IDTR to zero. This will cause a shutdown if an exception or nonmaskable interrupt occurs.

◦ Put pointers to valid interrupt handlers in all positions of the interrupt table that might be used by exceptions or interrupts.

Change the IDTR to point to a valid interrupt table.

3. First Instructions

After RESET, address lines A{31-20} are automatically asserted for instruction fetches.

The initial values of CS:IP, causes instruction execution to begin at physical address FFFFFFF0H.

Near (intrasegment) forms of control transfer instructions may be used to pass control to other addresses in the upper 64K bytes of the address space.

The first far (intersegment) JMP or CALL instruction causes A{31-20} to drop low, and the 80386 continues executing instructions in the lower one megabyte of physical memory.

This automatic assertion of address lines A{31-20} allows systems designers to use a ROM at the high end of the address space to initialize the system.

Switching to Protected Mode

• Setting the PE bit of the MSW in CR0 causes the 80386 to

begin executing in protected mode.

• The current privilege level (CPL) starts at zero. The

segment registers continue to point to the same linear

addresses as in real address mode (in real address mode,

linear addresses are the same physical addresses).

• Immediately after setting the PE flag, the initialization code

must flush the processor's instruction prefetch queue by

executing a JMP instruction.

• The 80386 fetches and decodes instructions and addresses

before they are used; however, after a change into

protected mode, the prefetched instruction information

(which pertains to real-address mode) is no longer valid. A

JMP forces the processor to discard the invalid information.

Switching to PM Atleast 1 GDT with 1 CS ,1DS,1SS

1 IDT with 256 bytes long

CR0 – PE bit =1 using LMSW

1. Prepare GDT , null descr. 1 CS ,1DS,1SS

2. Initialize IDT for atleast 32 int.

3. Load the base addr. and limit of GDT to GDTR using LGDT

4. Set PE bit with mov CR0,… or LMSW

5. Execute intersegment far jmp and flush IQ

Alternate approach

1. Prepare GDT , 2 TSS,1 CS ,1 DS

2. Initialize IDT for atleast 32 int.

3. Load the base addr. And limit of GDT to

GDTR using LGDT

4. Initialize TR to point to TSS dscr.

5. Execute intersegment far jmp and flush IQ

6. This JMP inst. Will take Task switch i.e. PM.

Software Initialization for Protected

Mode

Most of the initialization needed for protected mode can be done either before or after

switching to protected mode. If done in protected mode, however, the initialization

procedures must not use protected-mode features that are not yet initialized.

1. Interrupt Descriptor Table

The IDTR may be loaded in either real-address or protected mode.

However, the format of the interrupt table for protected mode is different than that for real-

address mode.

It is not possible to change to protected mode and change interrupt table formats at the

same time; therefore, it is inevitable that, if IDTR selects an interrupt table, it will have the

wrong format at some time.

An interrupt or exception that occurs at this time will have unpredictable results. To avoid

this unpredictability, interrupts should remain disabled until interrupt handlers are in

place and a valid IDT has been created in protected mode.

2 Stack

The SS register may be loaded in either real-address mode or protected mode. If loaded in

real-address mode, SS continues to point to the same linear base-address after the switch to

protected mode.

3 Global Descriptor Table

Before any segment register is changed in protected mode, the GDTR must point to a valid

GDT. Initialization of the GDT and GDTR may be done in real-address mode. The GDT (as

well as LDTs) should reside in RAM, because the processor modifies the accessed bit of

descriptors.

4 Page Tables

Page tables and the PDBR in CR3 can be initialized in either real-address mode or in

protected mode; however, the paging enabled (PG) bit of CR0 cannot be set until the

processor is in protected mode.

PG may be set simultaneously with PE, or later. When PG is set, the PDBR in CR3 should

already be initialized with a physical address that points to a valid page directory.

The initialization procedure should adopt one of the following strategies to ensure

consistent addressing before and after paging is enabled:

The page that is currently being executed should map to the same physical addresses both

before and after PG is set.

A JMP instruction should immediately follow the setting of PG.

5. First Task

The initialization procedure can run awhile in protected mode without initializing the task register; however, before the first task switch, the following conditions must prevail:

There must be a valid task state segment (TSS) for the new task. The stack pointers in the TSS for privilege levels numerically less than or equal to the initial CPL must point to valid stack segments.

The task register must point to an area in which to save the current task state. After the first task switch, the information dumped in this area is not needed, and the area can be used for other purposes

Back to RM If paging enabled

◦ Transfer control to linear addresses – identity mapping

◦ Clear PG bit

◦ Load zeros in CR3

◦ Transfer control to seg. That has limit field = 64K

◦ Clear int. flag- CLI

◦ Reset PE bit in CR0

◦ execute far JMP, Flush IQ

◦ Initialize IVT, enable int.

TLB Testing The 80386 provides a mechanism for testing the Translation

Lookaside Buffer (TLB), the cache used for translating linear addresses to physical addresses. Although failure of the TLB hardware is extremely unlikely, users may wish to include TLB confidence tests among other power-up confidence tests for the 80386.

When testing the TLB it is recommended that paging be turned off (PG=0 in CR0) to avoid interference with the test data being written to the TLB.

Structure of the TLB

The TLB is a four-way set-associative memory. Figure 10-3 illustrates the structure of the TLB. There are four sets of eight entries each. Each entry consists of a tag and data. Tags are 24-bits wide. They contain the high-order 20 bits of the linear address, the valid bit, and three attribute bits. The data portion of each entry contains the high-order 20 bits of the physical address.

Debugging

The 80386 brings to Intel's line of microprocessors significant advances in debugging power.

The single-step exception and breakpoint exception of previous processors are still available in the 80386, but the principal debugging support takes the form of debug registers.

The debug registers support both instruction breakpoints and data breakpoints.

Data breakpoints are an important innovation that can save hours of debugging time by pinpointing, for example, exactly when a data structure is being overwritten.

The breakpoint registers also eliminate the complexities associated with writing a breakpoint instruction into a code segment (requires a data-segment alias for the code segment) or a code segment shared by multiple tasks (the breakpoint exception can occur in the context of any of the tasks). Breakpoints can even be set in code contained in ROM.

Debugging Features of the Architecture

The features of the 80386 architecture that support debugging include:

Reserved debug interrupt vector

Permits processor to automatically invoke a debugger task or procedure

when an event occurs that is of interest to the debugger.

Four debug address registers

Permit programmers to specify up to four addresses that the CPU will

automatically monitor.

Debug control register

Allows programmers to selectively enable various debug conditions

associated with the four debug addresses.

Debug status register

Helps debugger identify condition that caused debug exception.

Trap bit of TSS (T-bit)

Permits monitoring of task switches.

Resume flag (RF) of flags register

Allows an instruction to be restarted after a debug exception without immediately causing another debug exception due to the same condition.

Single-step flag (TF)

Allows complete monitoring of program flow by specifying whether the CPU should cause a debug exception with the execution of every instruction.

Breakpoint instruction

Permits debugger intervention at any point in program execution and aids debugging of debugger programs.

Reserved interrupt vector for breakpoint exception

Permits processor to automatically invoke a handler task or procedure upon encountering a breakpoint instruction.

Debug registers Intel has provide a set of 8 debug registers for

hardware debugging. Out of these eight registers DR0 to DR7, two registers DR4 and DR5 are Intel reserved.

The initial four registers DR0 to DR3 store four program controllable breakpoint addresses, while DR6 and DR7 respectively hold breakpoint status and breakpoint control information.

Breakpoint address may locate an instruction or datum.

Each of these registers contains the linear address

associated with one of four breakpoint conditions. Each

breakpoint condition is further defined by bits in DR7.

The debug address registers are effective whether or

not paging is enabled. The addresses in these registers

are linear addresses.

Debug Address Register (DR0-DR3)

Virtual 8086 Mode • In its protected mode of operation, 80386DX provides a virtual 8086 operating environment to execute the 8086 programs.

• The real mode can also used to execute the 8086 programs

along with the capabilities of 80386, like protection and a few

additional instructions.

• Once the 80386 enters the protected mode from the real mode,it cannot return back to the real mode without a reset

operation.

• Thus, the virtual 8086 mode of operation of 80386, offers an

advantage of executing 8086 programs while in protected

mode.

The address forming mechanism in virtual 8086 mode is

exactly identical with that of 8086 real mode.

• In virtual mode, 8086 can address 1Mbytes of physical

memory that may be anywhere in the 4Gbytes address space of the protected mode of 80386.

• Like 80386 real mode, the addresses in virtual 8086 mode lie within 1Mbytes of memory.

• In virtual mode, the paging mechanism and protection

capabilities are available at the service of the programmers.

• The 80386 supports multiprogramming, hence more than one programmer may be use the CPU at a time

Paging unit may not be necessarily enable in virtual mode, but may be needed to run the 8086 programs which require more than 1Mbyts of memory for memory management function.

• In virtual mode, the paging unit allows only 256 pages, each of 4Kbytes size.

• Each of the pages may be located anywhere in the maximum 4Gbytes physical memory. The virtual mode allows the multiprogramming of 8086 applications.

• The virtual 8086 mode executes all the programs at privilege level 3.Any of the other programmes may deny access to the virtual mode programs or data

However, the real mode programs are executed at the highest privilege level, i.e. level 0

The virtual mode may be entered using an IRET instruction at CPL=0 or a task switch at any CPL, executing any task whose TSS is having a flag image with VM flag set to 1.

The IRET instruction may be used to set the VM flag and consequently enter the virtual mode.

The PUSHF and POPF instructions are unable to read or set the VM bit, as they do not access it.

Even in the virtual mode, all the interrupts and exceptions are handled by the protected mode interrupt handler.

Entering and Leaving Virtual 8086 Mode.

To return to the protected mode from

the virtual mode, any interrupt or

execution may be used.

As a part of interrupt service routine, the

VM bit may be reset to zero to pull back

the 80386 into protected mode.

Registers

◦ All regi. Defined for 8086 + new set of reg.

• Instructions

PUSH ALL , POP ALL, BOUND,LSS,LFS,LGS

,PUSH imm. data

◦ Address generation in VM is same as 8086

Base + offset =P.A.

END