How were the test registers used on the i386 and the i486?

Question

The Intel 386 and 486 CPUs (and some clones too) had some test registers (TR3–TR7) which were used to test features like the TLB and caches. Starting with Pentium, these were replaced with MSRs (Model Specific Registers).

I tried searching the web but there's very little information available about them. The 386 manual says that they are described in Chapter 12, which proceeds to describe the debug registers (DR, not TR).

The question is, how exactly are these test registers used (and is there any difference between the usage on the 386 and the 486)?

Answer 1

The 486 test registers are described in the i486 Processor Programmer’s Reference Manual, starting on page 10-8. The 386 test registers are a subset.

Registers TR6 and TR7 provide access to the TLB. They are defined as follows:

• TR6:

  31-12	11	10-9	8-7	6-5	4-1	0
  Linear address	Valid	Dirty	User/supervisor	Read/write	Reserved (0)	Command

• TR7:

  31-12	11	10	9-7	6-5	4	3-2	1-0
  Physical address	PCD²	PWT²	LRU²	Reserved (0)	Hit¹ / PL²	REP	Reserved (0)

  ¹ 386 only / ² 486 only

On 386s, TLB tests require paging to be disabled. In all cases, they can only be used with supervisor privilege or in real mode.

Addresses are 4KiB page addresses, which is why they only occupy 20 bits.

The command bit determines the operation: if 0, an entry will be written to the TLB; if 1, an entry will be looked up in the TLB. The dirty, U/S and R/W bits are stored as-is and complemented; i.e. if bit 8 is set and 7 is clear, the user/supervisor bit will be set. On 486s, all-clear and all-set combinations additionally mean “no match” and “match if set or clear” during TLB lookups. The REP bits represent the set to access.

To write a TLB entry using these registers, you’d prepare TR7 with the appropriate physical address and status bits (on a 486), then write TR6 with the remaining information and the C bit clear.

To read a TLB entry, you’d write TR6 with the linear address etc. and the C bit set, then check the hit bit in TR7 to determine whether the lookup succeeded.

Registers TR3-5 provide similar access to the cache and are only present on 486s. They are defined as follows:

• TR5:

  31-11	10-4	3-2	1-0
  Unused	Set select	Entry select	Control

• TR4:

  31-11	10	9-7	6-3	2-0
  Tag	Valid	LRU	Valid (lookup)	Unused

• TR3 is used entirely for data.

Caching must be disabled before these registers are used.

TR5 is write-only, and determines the operation to perform depending on the control bits: 00 to read from or write to the cache buffer (the next operation on TR3 determines the actual operation), 01 to write to the cache, 10 to read from the cache, 11 to flush the cache.

The cache itself sits behind a buffer, which is why there are two sets of operations. To write to the cache, you first write to the buffer, then write from the buffer to the cache; to read from the cache, you first read from the cache into the buffer, then read from the buffer.

See the Intel manual for all the details. As you discovered, TR4 on 486s can shadow a pre-existing, undocumented TR4 register on the 386, which can produce surprising results.

All these instructions are encoded as 0F 24 /r (MOV from a test register to a general-purpose 32-bit register) and 0F 26 /r (MOV from a general-purpose 32-bit register to a test register).

All these registers are dedicated test registers and wouldn’t be used in normal operations. The MSRs (machine-specific registers) introduced with the Pentium architecture provide access to CPU configuration fields and are used routinely, for both system setup and in normal use; the TSC for example is a MSR.