The 486 test registers are described in the i486 Processor Programmer’s Reference Manual, starting on page 10-8. The 386 test registers are a subset.
Registers TR6 and TR7 provide access to the TLB. They are defined as follows:
||Hit¹ / PL²
¹ 386 only / ² 486 only
On 386s, TLB tests require paging to be disabled. In all cases, they can only be used with supervisor privilege or in real mode.
Addresses are 4KiB page addresses, which is why they only occupy 20 bits.
The command bit determines the operation: if 0, an entry will be written to the TLB; if 1, an entry will be looked up in the TLB. The dirty, U/S and R/W bits are stored as-is and complemented; i.e. if bit 8 is set and 7 is clear, the user/supervisor bit will be set. On 486s, all-clear and all-set combinations additionally mean “no match” and “match if set or clear” during TLB lookups. The REP bits represent the set to access.
To write a TLB entry using these registers, you’d prepare TR7 with the appropriate physical address and status bits (on a 486), then write TR6 with the remaining information and the C bit clear.
To read a TLB entry, you’d write TR6 with the linear address etc. and the C bit set, then check the hit bit in TR7 to determine whether the lookup succeeded.
Registers TR3-5 provide similar access to the cache and are only present on 486s. They are defined as follows:
Caching must be disabled before these registers are used.
TR5 is write-only, and determines the operation to perform depending on the control bits: 00 to read from or write to the cache buffer (the next operation on TR3 determines the actual operation), 01 to write to the cache, 10 to read from the cache, 11 to flush the cache.
The cache itself sits behind a buffer, which is why there are two sets of operations. To write to the cache, you first write to the buffer, then write from the buffer to the cache; to read from the cache, you first read from the cache into the buffer, then read from the buffer.
See the Intel manual for all the details. As you discovered, TR4 on 486s can shadow a pre-existing, undocumented TR4 register on the 386, which can produce surprising results.
All these instructions are encoded as
0F 24 /r (
MOV from a test register to a general-purpose 32-bit register) and
0F 26 /r (
MOV from a general-purpose 32-bit register to a test register).
All these registers are dedicated test registers and wouldn’t be used in normal operations. The MSRs (machine-specific registers) introduced with the Pentium architecture provide access to CPU configuration fields and are used routinely, for both system setup and in normal use; the TSC for example is a MSR.