20

The Intel 386 and 486 CPUs (and some clones too) had some test registers (TR3TR7) which were used to test features like the TLB and caches. Starting with Pentium, these were replaced with MSRs (Model Specific Registers).

I tried searching the web but there's very little information available about them. The 386 manual says that they are described in Chapter 12, which proceeds to describe the debug registers (DR, not TR).

The question is, how exactly are these test registers used (and is there any difference between the usage on the 386 and the 486)?

22

The 486 test registers are described in the i486 Processor Programmer’s Reference Manual, starting on page 10-8. The 386 test registers are a subset.

Registers TR6 and TR7 provide access to the TLB. They are defined as follows:

  • TR6:

    31-12 11 10-9 8-7 6-5 4-1 0
    Linear address Valid Dirty User/supervisor Read/write Reserved (0) Command
  • TR7:

    31-12 11 10 9-7 6-5 4 3-2 1-0
    Physical address PCD² PWT² LRU² Reserved (0) Hit¹ / PL² REP Reserved (0)

    ¹ 386 only / ² 486 only

On 386s, TLB tests require paging to be disabled. In all cases, they can only be used with supervisor privilege or in real mode.

Addresses are 4KiB page addresses, which is why they only occupy 20 bits.

The command bit determines the operation: if 0, an entry will be written to the TLB; if 1, an entry will be looked up in the TLB. The dirty, U/S and R/W bits are stored as-is and complemented; i.e. if bit 8 is set and 7 is clear, the user/supervisor bit will be set. On 486s, all-clear and all-set combinations additionally mean “no match” and “match if set or clear” during TLB lookups. The REP bits represent the set to access.

To write a TLB entry using these registers, you’d prepare TR7 with the appropriate physical address and status bits (on a 486), then write TR6 with the remaining information and the C bit clear.

To read a TLB entry, you’d write TR6 with the linear address etc. and the C bit set, then check the hit bit in TR7 to determine whether the lookup succeeded.

Registers TR3-5 provide similar access to the cache and are only present on 486s. They are defined as follows:

  • TR5:

    31-11 10-4 3-2 1-0
    Unused Set select Entry select Control
  • TR4:

    31-11 10 9-7 6-3 2-0
    Tag Valid LRU Valid (lookup) Unused
  • TR3 is used entirely for data.

Caching must be disabled before these registers are used.

TR5 is write-only, and determines the operation to perform depending on the control bits: 00 to read from or write to the cache buffer (the next operation on TR3 determines the actual operation), 01 to write to the cache, 10 to read from the cache, 11 to flush the cache.

The cache itself sits behind a buffer, which is why there are two sets of operations. To write to the cache, you first write to the buffer, then write from the buffer to the cache; to read from the cache, you first read from the cache into the buffer, then read from the buffer.

See the Intel manual for all the details. As you discovered, TR4 on 486s can shadow a pre-existing, undocumented TR4 register on the 386, which can produce surprising results.

All these instructions are encoded as 0F 24 /r (MOV from a test register to a general-purpose 32-bit register) and 0F 26 /r (MOV from a general-purpose 32-bit register to a test register).

All these registers are dedicated test registers and wouldn’t be used in normal operations. The MSRs (machine-specific registers) introduced with the Pentium architecture provide access to CPU configuration fields and are used routinely, for both system setup and in normal use; the TSC for example is a MSR.

4
  • 3
    Thank you! This is really helpful! I didn't dig the web very well it seems, because now I found this which describes a bug with TR4 on the 486. Apparently this register was somehow also present on the 386 and had completely different functionality, which created bugs in the 486, which kept that functionality for some reason.
    – DarkAtom
    Oct 12 at 11:03
  • Is it actually possible to write TLB entries via MSR on P5? At one point Andy Glew mentioned that software TLB miss handling "was a perf win" on P5 Pentium (because HW pagewalk is uncached). But I'd been assuming he actually meant "would have been faster, if it were possible", since I didn't know there were MSRs for TLB access at all. (And I don't think there's a mechanism for a TLB miss to trap to a kernel routine, like there is on MIPS). Oct 12 at 22:39
  • If it's possible to do software TLB miss handling on any x86 CPU, I'd like mention that in my answer on What happens after a L2 TLB miss?. (I might add a link to this Q&A anyway just for reading TLB state.) Oct 12 at 22:40
  • @PeterCordes I’m not aware of any P5 MSR giving access to the TLB, and I don’t think it’s possible to handle TLB misses in software on any x86. Oct 13 at 4:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.