486DX_Data_Sheet_Oct92 486DX Data Sheet Oct92

User Manual: 486DX_Data_Sheet_Oct92

Open the PDF directly: View PDF .
Page Count: 242

Download
Open PDF In Browser	View PDF

Intel486™ OX
MICROPROCESSOR
Binary Compatible with Large
• Software
Base

•
•

168-Pin Grid Array Package
• High
Design
• - RISCPerformance
Integer Core with Frequent

-MS-DOS*, OS/2**, Windows*
-UNIX*** System V/386
- iRMX®, iRMKTM Kernels
High Integration Enables On-Chip
- 8 Kbyte Code and Data Cache
- Floating Point Unit
- Paged, Virtual Memory Management
Easy To Use
- Built-In Self Test
- Hardware Debugging Support
- Intel Software Support
- Extensive Third Party Software
Support
IEEE 1149.1 Boundary Scan
Compatibility
- Available on 50 MHz Version Only

•
•

•
to Intel OverDrive™
• Upgradable
Processor

Instructions Executing in One Clock
- 25 MHz, 33 MHz, and 50 MHz Clock
- 80, 106, 160 Mbyte/sec Burst Bus
- CHMOS IV and CHMOS V Process
Technology
- Dynamic Bus Sizing for 8-, 16-, and
32-Bit Busses
Complete 32-Bit Architecture
- Address and Data Busses
-Registers
- 8-, 16- and 32-Bit Data Types
Multiprocessor Support
- Multiprocessor Instructions
- Cache Consistency Protocols
- Support for Second Level Cache

The Intel486 CPU offers the highest performance for DOS, OS/2, Windows, and UNIX System V/386 applications. It is 100% binary compatible with the Intel386™ CPU. Over one million transistors integrate the RISC
integer core, 8 Kbyte cache memory, floating point hardware, and memory management on-chip while retaining binary compatibility with previous members of the Inte1386/lnte1486 architectural family. The RISC integer
core executes frequently-used instructions in one cycle, providing leadership performance levels. An 8 Kbyte
unified code and data cache allow the high performance levels to be sustained. A 160 MByte/sec burst bus at
50 MHz ensures high system throughput even with inexpensive DRAMs.

Intel486™ Microprocessor Pipelined 32-Bit Microarchitecture
~i" Bit Inttrunlt Trllnsf,r Bu.

32-blt Dota Bu,

32
32-blt Dabl Bu.

~ ~

[ 1.

Segmentation
Unit

Barr.' Shlft,r

Bas./

Regltttr File

Indlx

ALU

F.P. Regllter
File

ROW

32
PCD, PWT

Unit

2
2.
Physicol

Limit and
AttrIbute
PLA

Addr...

Control and
Protection Test
Unit
Control

.u..
Poging

R~ltt.r.

micro-Instruction

L.ln..af Addr... BUI

Ducrlptor

lr
Flooting
Point
Unit

~.
Instruction
Path

Translation

Jl Jl

8k Byt.
Cach'

Lookasid,
Buffer

128lf
Di.placement Bu.

...

Instruction

"'....

Pr.,.tcher
32

C....
Stream

Bu. !nt.rfoct

Cache Unit

32 Syte Code
Queue
2

16 Bytes

Addr... Drlv, ...
Writ. Buffe...

ot x 80

----- .. -----Doto Bu.
Transceivers

Bu. Control

Request Sequenc.r

A2-A31
9[0111-8

DO-031

~
/R'" o/c'"
1.1/10'" PCO,PWT

ROY# LOCK'" PLOCK#
BOrr# A201ol'" BREQ
HOLD HLOA RESET
IHTR NIII !
GHNEIit

------------ ~I
-------------------- ....... -+------_ .. -_ .. -- ~
---_ .. _---- ...... ~
Burst BUI Control
BUI Size Control
Cache Control

BROY'" BLASTf#

BSI6fI' 8SBM
KEN'" FLUSH#
AHOLD, tAOS'"

Parity Generation
and Control
Boundary Sean
Control
(50 101Hz only)

TCK
TWS

TD!
~ TOO

240440-1
Intel Corporation assumes no responsibility for the use of any circuitry other than circuitry embodied in an Intel product. No other circuit patent
licenses are implied. Information contained herein supersedes previously published specifications on these devices from Intel.
October 1992
@ INTEL CORPORATION, 1992
Order Number: 240440-005

int:et

Intel486TM OX MICROPROCESSOR

New features enhance multiprocessing systems; new instructions speed manipulation of memory-based semaphores; and on-chip hardware ensures cache consistency and provides hooks for multilevel caches.
The built-in self-test extensively tests on-chip logic, cache memory, and the on-chip paging translation cache.
Debug features include breakpoint traps on code execution and data accesses.
The Intel OverDrive Processor provides optional overall performance upgrade capability for users who want to
increase their system performance up to 70% on DOS, Windows, OS/2 and Unix applications.

iRMX, iRMK, Inte1386, Inte1387, Inte1486, i486, OverDrive, and OverDrive Ready are trademarks of Intel Corporation.
'MS-DOSIIll and Windows are registered trademarks of Microsoft Corporation.
"OS/2TM is a trademark of International Business Machines Corporation.
"'UNIXTM is a trademark of UNIX Systems Laboratories.

Intel486™ MICROPROCESSOR
CONTENTS

CONTENTS

PAGE

2.7.8 Double Fault ................... 47

1.0 TABLE OF CONTENTS ................ 3

2.7.9 Floating Point Interrupt
Vectors ........................... 47

Pinout ................................... 7
Quick Pin Reference .................... 12
Component and Revision ID ............. 17

3.0 REAL MODE ARCHITECTURE ....... 49
3.1 Real Mode Introduction ............. 49

2.0 ARCHITECTURAL OVERViEW ....... 18
2.1 Register Set ........................ 18

3.2 Memory Addressing ................ 49
3.3 Reserved Locations ................ 50

2.1.1 Base Architecture
Registers ......................... 19

3.4 Interrupts ........................... 50
3.5 Shutdown and Halt ................. 50

2.1.2 System Level Registers ........ 23

4.0 PROTECTED MODE
ARCHITECTURE ....................... 51

2.1.3 Floating Point Registers ....... 27
2.1.4 Debug and Test Registers ..... 34

4.1 Introduction ........................ 51
4.2 Addressing Mechanism ............. 51

2.1.5 Register Accessibility .......... 34
2.1.6 Compatibility .................. 35

4.3 Segmentation ...................... 52

2.2 Instruction Set ...................... 36

4.3.1 Segmentation Introduction ..... 52
4.3.2 Terminology ................... 52

2.3 Memory Organization ............... 36
2.3.1 Address Spaces ............... 36

4.3.3 Descriptor Tables .............. 52
4.3.4 Descriptors .................... 54

2.3.2 Segment Register Usage ...... 37

2.41/0 Space .......................... 37

4.4 Protection .......................... 62

2.5 Addressing Modes ................. 38

4.4.1 Protection Concepts ........... 62

2.5.1 Addressing Modes
Overview ......................... 38

4.4.2 Rules of Privilege .............. 63
4.4.3 Privilege Levels ................ 63

2.5.2 Register and Immediate
Modes ............................ 38

4.4.4 Privilege Level Transfers ....... 64

2.5.3 32-Bit Memory Addressing
Modes ............................ 38

4.4.5 Call Gates ..................... 67
4.4.6 Task Switching ................ 67

2.5.4 Differences between 16- and
32-Bit Addresses ................. 40

4.4.7 Initialization and Transition to
Protected Mode ................... 68
4.4.8 Tools for Building Protected .
Systems .......................... 69

2.6 Data Formats ...................... 40
2.6.1 Data Types .................... 40
2.6.2 Little Endian vs Big Endian
Data Formats ..................... 44
2.7 Interrupts ........................... 44

4.5 Paging ............................. 69
4.5.1 Paging Concepts .............. 69
4.5.2 Paging Organization ........... 70

2.7.1 Interrupts and Exceptions ...... 44

4.5.3 Page Level Protection
(R/W, U/S Bits) ................... 71

2.7.2 Interrupt Processing ........... 44
2.7.3 Maskable Interrupt ............. 45

4.5.4 Page Cacheability
(PWT, PCD Bits) .................. 72

2.7.4 Non-Maskable Interrupt ........ 46

4.5.5 Translation Lookaside
Buffer ............................ 72

2.7.5 Software Interrupts ............ 46
2.7.6 Interrupt and Exception
Priorities .......................... 46

4.5.6 Paging Operation .............. 73
4.5.7 Operating System
Responsibilities ................... 74

2.7.7 Instruction Restart ............. 47
3

CONTENTS

PAGE
4.6 Virtual 8086 Environment ........... 74

PAGE

6.2.6 Bus Control .................. 88

4.6.1 Executing 8086 Programs ...... 74

Address Status Output
(ADS#) .......................... 88

4.6.2 Virtual 8086 Addressing
Mechanism ....................... 74

Non-Burst Ready Input
(RDY#) .......................... 88

4.6.3 Paging in Virtual Mode ......... 74
4.6.4 Protection and Virtual 8086
Mode to 1/0 Permission
Bitmap ........................... 75

6.2.7 Burst Control ................. 88

4.6.5 Interrupt Handling ............. 76

Burst Last Output
(BLAST#) ....................... 89

Burst Ready Input
(BRDY#) ........................ 88

4.6.6 Entering and Leaving Virtual
8086 Mode ....................... 77

6.2.8 Interrupt Signals .............. 89
Reset Input(RESET) ............. 89

5.0 ON-CHIP CACHE ..................... 80

Maskable Interrupt Request
Input (INTR) ..................... 89

5.1 Cache Organization ................ 80
5.2 Cache Control ...................... 81
5.3 Cache Line Fills .................... 81

Non-Maskable Interrupt
Request Input(NMI) .............. 89

5.4 Cache Line Invalidations ............ 82

6.2.9 Bus Arbitration Signals ....... 89

5.5 Cache Replacement ................ 82

Bus Request Output
(BREQ) .......................... 89

5.6 Page Cacheability .................. 83

Bus Hold Request Input
(HOLD) .......................... 89

5.7 Cache Flushing ..................... 84
5.8 Caching Translation Lookaside
Buffer Entries ........................ 84

Bus Hold Acknowledge
Output(HLDA) ................... 90

6.0 HARDWARE INTERFACE ............ 85

Backoff Input (BOFF#) .......... 90

6.1 Introduction ........................ 85

6.2.10 Cache Invalidation ............ 90

6.2 Signal Descriptions ................. 86
6.2.1 Clock (CLK) .................. 86

Address Hold Request Input
(AHOLD) ......................... 90

6.2.2 Address Bus
(A31-A2, BEO#-BE3#) .......... 86

External Address Valid Input
(EADS#) ........................ 90

6.2.3 Data Lines (D31-DO) ......... 87

6.2.11 Cache Control ................ 91

6.2.4 Parity ........................ 87

Cache Enable Input
(KEN#) .......................... 91

Data Parity Input/Outputs
(DPO-DP3) ...................... 87

Cache Flush Input
(FLUSH#) ....................... 91

Parity Status Output
(PCHK#) ........................ 87

6.2.12 Page Cacheability Outputs
(PWT, PCD) ...................... 91

6.2.5 Bus Cycle Definition .......... 87
M/IO#, D/C#, W/R#
Outputs .......................... 87

6.2.13 Numeric Error Reporting ...... 91
Floating Point Error Output
(FERR#) ........................ 91

Bus Lock Output
(LOCK#) ........................ 87

Ignore Numeric Error Input
(IGNNE#) ....................... 92

Pseudo-Lock Output
(PLOCK #) ....................... 88

6.2.14 Bus Size Control
(BS16#, BS8#) .................. 92

CONTENTS

PAGE
6.2.15 Address Bit 20 Mask
(A20M#) ......................... 92

PAGE

7.2.11 Special Bus Cycles .......... 125
7.2.12 Bus Cycle Restart ........... 126

6.2.16 Boundary Scan Test
Signals ........................... 92

7.2.13 Bus States .................. 127

Test Clock (TCK) ................. 92

7.2.14 Floating Point Error
Handling ......................... 128

Test Mode Select (TMS) ......... 92

7.2.15 Floating Point Error Handling
in AT Compatible Systems ....... 128

Test Data Input (TDI) ............. 93
Test Data Output (TDO) .......... 93

8.0 TESTABILITy .......................
8.1 Built-In SelfTest (BIST) ............
8.2 On-Chip Cache Testing ............
8.2.1 Cache Testing Registers TR3
TR4 and TR5 .................. :.
Cache Data Test Register:
TR3 ..........................

6.3 Write Buffers ....................... 93
6.3.1 Write Buffers and 1/0
Cycles ............................ 94
6.3.2 Write Buffers Implications on
Locked Bus Cycles ............... 94
6.4 Interrupt and Non-Maskable
Interrupt Interface .................... 94

130
130
130
131
131

Cache Status Test Register:
TR4 .......................... 131

6.4.1 Interrupt Logic ................. 94
6.4.2 NMI Logic ..................... 95
6.5 Reset and Initialization .............. 95

Cache Control Test Register:
TR5 .......................... 131

6.5.1 Pin State during Reset ......... 96

8.2.2 Cache Testability Write ....... 131

7.0 BUS OPERATION .................... 98
7.1 Data Transfer Mechanism .......... 98
7.1.1 Memory and 1/ 0 Spaces ....... 98
7.1.2 Memory and 1/0 Space
Organization ...................... 99
7.1.3 Dynamic Data Bus Sizing ..... 100
7.1.4 Interfacing with 8-, 16- and
32-bit Memories ................. 101
7.1.5 Dynamic Bus Sizing during
Cache Line Fills .................. 103
7.1.6 Operand Alignment ........... 103
7.2 Bus Functional Description ........ 104

8.2.3 Cache Testability Read ....... 133
8.2.4 Flush Cache .................. 133
8.3 Translation Lookaside Buffer (TLB)
Testing ............................. 133
8.3.1 Translation Lookaside Buffer
Organization ..................... 133
8.3.2 TLB Test Registers: TR6 and
TR7 ............................. 134
Command Test Register: TR6 ... 135
Data Test Register: TR7 ......... 135
8.3.3 TLB Write Test ............... 136
8.3.4 TLB Lookup Test ............. 136
8.4 Tristate Output Test Mode ......... 136

7.2.1 Non-Cacheable Non-Burst
Single Cycle ..................... 104

7.2.3 Cacheable Cycles ........... 109

8.5 Intel486TM Microprocessor
Boundary Scan (JTAG) ............. 136
8.5.1 Boundary Scan
Architecture ..................... 137

7.2.4 Burst Mode Details .......... 112

8.5.2 Data Registers ............... 137

7.2.5 8- and 16-Bit Cycles ......... 116
7.2.6 Locked Cycles .............. 118

8.5.3 Instruction Register ........... 138

7.2.2 Multiple and Burst Cycle Bus
Transfers ........................ 105

8.5.4 Test Access Port (TAP)
Controller ........................ 140

7.2.7 Pseudo-Locked Cycles ...... 119
7.2.8 Invalidate Cycles ............ 119

8.5.5 Boundary Scan Register
Cell .............................. 142

7.2.9 Bus Hold .................... 123

8.5.6 TAP Controller Initialization ... 143

7.2.10 Interrupt Acknowledge ...... 123

8.5.7 Boundary Scan Description
Language (BSDL) ................ 143
5

CONTENTS

PAGE

12.4 Thermal Management ............ 184
12.4.1 Thermal Calculations for
Hypothetical System ............. 184

9.0 DEBUGGING SUPPORT ............. 144
9.1 Breakpoint Instructions ............ 144
9.2 Single Step Instructions ........... 144

12.4.2 OverDrive Heat Sinks ....... 185

9.3 Debug Registers .................. 144

12.5 BIOS and Software ............... 185

9.3.1 Linear Address Breakpoint
Registers ........................ 144
9.3.2 Debug Control Register ....... 144

12.5.1 Intel OverDrive Processor
Detection ........................ 185

9.3.3 Debug Status Register ........ 147

12.6 OverDrive Processor Socket
Pinout .............................. 187

12.5.2 Timing Dependent Loops .... 186

9.3.4 Use of Resume Flag (RF) in
Flag Register .................... 147

12.7 D.C'! AC. Specifications ......... 190

10.0 INSTRUCTION SET SUMMARy .... 148

13.0 ELECTRICAL DATA ............... 191

10.1 Intel486™ Microprocessor
Instruction Encoding and Clock
Count Summary .................... 148

13.1 Power and Grounding ............ 191

10.2 Instruction Encoding ............. 167
10.2.1 Overview .................... 167

13.3 D.C. Specifications ............... 192

10.2.2 32-Bit Extensions of the
Instruction Set ................... 168

13.5 Designing for ICD-486 ............ 203

13.2 Maximum Ratings ................ 191
13.4 A.C. Specifications ............... 193

14.0 MECHANICAL DATA ............... 207

10.2.3 Encoding of Integer
Instruction Fields ................ 168
10.2.4 Encoding of Floating Point
Instruction Fields ................ 174

14.1 Package Thermal
Specifications ...................... 208
15.0 LOW POWER INTEL486™ OX
MICROPROCESSOR .................. 210

11.0 DIFFERENCES WITH THE 386TM
MICROPROCESSOR .................. 175

15.1 Introduction ...................... 210
15.2 Pinout ........................... 212

12.0 OVERDRIVE PROCESSOR
SOCKET .............................. 176

15.3 Pin Cross Reference
(Inte1486™ DX CPU) .................. 214

12.1 OverDrive Processor Overview ... 176

15.4 Pin Description ................... 214

12.1.1 Hardware Interface .......... 176

15.5 Signal Description ................ 215
15.6 Architecture Overview ............ 218

12.1.2 Testability ................... 177
12.1.3 Instruction Set Summary .... 177

15.7 Variable CPU Frequency ......... 218

12.2 Intel OverDrive Processor Circuit
Design ............................. 179

15.8 D.C'! AC. Specifications ......... 220

12.2.1 Upgrade Circuit for PGA
Intel486 DX Based Systems ...... 179
12.3 Socket Layout ................... 179

15.8.1 D.C. Specifications .......... 220

12.3.1 Physical Dimensions ........ 179

15.8.3 AC. Specifications .......... 221

12.3.2 "End User Easy"
Upgradability· .................... 184

16.0 SUGGESTED SOURCES FOR
Intel486™ ACCESSORIES ............ 224

12.3.3 ZIF and LlF Socket
Vendors ......................... 185

17.0 REVISION HiSTORy ............... 225

15.8.2 Power Supply Current vs
Frequency ....................... 221

APPENDIX A ............................ A-1

intel~

Intel486TM OX MICROPROCESSOR

A27

A26

A23

A14

vss

A12

vss

Al0

vss

A28

A25

vce

vss

A18

vce

A15

vee

vcc

vce

All

vee

A31

VSS

A17

A19

A21

A24

A22

A20

A16

A13

A29

A30

OPO

N
M
L

AOS#

BlAST#

BREQ PloeK# PCHK#

HlOA

vec

VSS

loeK# ~/IO# W/R#

vss

VCC

o/c#

vec

vss

PWT

VCC

VSS

vss

vec

014

BEO#

VCC

VSS

vce

016

VSS

OP2

Intel486™ MICROPROCESSOR
25 MHz AND 33 MHz VERSIONS

BE2#

PIN SIDE VIEW

BE1#

0
pco

BROY#

vcc

VSS

vss

vec

012

VCC

vss

OPl

015

vss

VCC

010

HOlO

vec

vss

013

017

011

018

elK

0
KEN#

0
A20~#

0
vee

vec

027

026

028

030

0
ROY#

0
BE3#

8S8# BOFF#

FERR# FLUSH# RESET BS16#

019

021

vss

VSS

025

vcc

031

vcc

vec

Nt.ll

EAOS#

020

022

023

OP3

024

VSS

029

VSS

IGNNE# INTR

0
AHOLO

240440-2

Figure 1.1

R
Q

N
M
L

K
J
H
G

F
E
D
C

intel~

Intel486TM OX MICROPROCESSOR

AOS#

vss

Al0

vss

A12

vss

A14

A23

A26

BlAST#

vee

All

vee

A15

vee

AlB

VSS

vee

A25

A2B

p
N

M
L

J
H
G

peHK# PloeK# BREQ

VSS

vee

HlOA

1
A27

A13

A16

A20

A22

A24

A21

A19

A17

VSS

A31

W/R# M/IO# loeK#

A30

A29

OPO

vss

vee

o/e#

vee

vss

vee

PWT

VSS

vss

vee

8EO#

014

vee

VSS

peo

BE1#

BE2#

vss

vee

8ROY#

Intel486™ MICROPROCESSOR

25 MHz AND 33MHz VERSIONS

016

vee

TOP SIDE VIEW

OP2

VSS

vss

vee

012

vee

vss

8E3#

ROY#

KEN#

015

OPl

vss

vee

HOLD

010

vee

vss

80fT#

0
0

8SB# A20M#

013

0
011

030

02B

026

027

vee

elK

01B

EAOS#

NMI

vee

031

vee

025

vss

VSS

021

019

AHOlO

INTR

IGNNE#

vss

029

vss

024

OP3

023

022

020

8S 16# RESET FLUSH# FERR#

0
017

1
240440-3

Figure 1.2

S
R
Q

P
N

M
L

J
H
G

F
E

C
B

inteL

Intel486TM OX MICROPROCESSOR

011

VSS

OPI

VSS

VCC

VSS

021

018

013

vec

VCC

TCK

VSS

ClK

017

010

015

012

OP2

016

014

023

VSS

OP3

020

019

022

A31

A28

A27

A29

VSS

A25

A26

OPO

A30

A17

VCC

A23

VCC

A19

VSS

VCC

A21

A18

024

025

027

A24

VCC

vss

vce

026

A22

A15

A12

029

031

028

A20

vss

vec

030

A16

VCC

50 MHz VERSION

vcc

PIN SIDE VIEW

A13

vss

vee

VCC

All

vss

TOI

Tt.lS

rERR"

vcc

VSS

IGNNE"

NMI

BREQ

INTR

TOO

RESET BS8"

0
oorr"
0

AHOLO EADS" 8516#

Intel486™ MICROPROCESSOR

FLUSH" A20t.l#

HOLD

KEN#

BEO#

PWT

VCC

BROY# BE2"

o/c# lOCK# HlOA

A14

0
vss

VCC

VSS

0
VSS

Al0

VCC PlOCK# BLAST"

ROY"

VCC

BEl"

VCC

1.1/10#

VSS

BE3#

VSS

PCO

VSS

W/R#

VSS

PCHK#

AOS#

1
2
3
4
5
6
7
8

9
10
11
12
13

14
15
16
17

S
240440-85

Figure 1.3

infel .

Intel486TM OX MICROPROCESSOR

A27

A28

A31

A26

A25

vss

A23

vee

vss

vee

vss

~Pl

vss

A29

vce

vcc

A17

A30

OPO

014

016

OP2

012

011

019

vec

013

018

021

022

015

010

017

ClK

vss

TCK

vss

A19

vee

vss

023

A14

A18

A21

vec

vss

OP3

vss

vce

A24

027

025

024

A12

A15

A22

026

vce

0
vss
0

vss

vee

A20

028

031

029

vss

vee

030

VCC

vss

vec

vss

vee

VCC

vss

All

Al0

vss

vee

FERR#

Tt.tS

TOI

BREQ

15
16
17

Intel486™ MICROPROCESSOR

A16

50 MHZ VERSION
TOP SIDE VIEW

A13

HlOA lOCK# o/c#

PWT

BEO#

KEN#

Nt.tl

IGNNE#

BE2# BROY#

HOLD A20t.t# FLUSH#

1.1/10"

VCC

BEl"

VCC

ROY"

VCC

BS8"

RESET

TOO

INTR

0
vcc
0

ADS#

PCHK#

VSS

W/R#

vss

VSS

vss

pco

vss

VSS

BE3#

VSS

BOFF#

BLAST" PLOCK"

8516# EADS# AHOLD

1
2
3
4
5
6
7
8
9

10
11
12
13
14
15
16
17

A
240440-86

Figure 1.4

intet

Intel486TM OX MICROPROCESSOR

Pin Cross Reference by Pin Name
Address

A2
A3
A4
A5
A6
A7
A8
A9
A10
A11
A12
A13
A14
A15
A16
A17
A18
A19
A20
A21
A22
A23
A24
A25
A26
A27
A28
A29
A30
A31

014
R15
816
012
815
013
R13
011
813
R12
87
010
85
R7
09
03
R5
04
08
05
07
83
06
R2
82
81
R1
P2
P3
01

Data

Do
01
02
03
04
05
06
07
08
09
010
011
012
013
014
015
016
017
018
019
020
021
022
023
024
025
026
027
028
029
030
031

Test
(50 MHz Only)

Control

P1
N2
N1
H2
M3
J2
L2
L3
F2
01
E3
C1
G3
02
K3
F3
J3
03
C2
81
A1
82
A2
A4

A6
86
C7
C6
C8
A8
C9
88

A20M#
A08#
AHOLO
8EO#
8E1#
8E2#
8E3#
8LA8T#
80FF#
8ROY#
8REO
888#
8816#
CLK
O/C#
OPO
OP1
OP2
OP3
EA08#
FERR#
FLU8H#
HLOA
HOLO
IGNNE#
INTR
KEN#
LOCK#
MIIO#
NMI
PCO
PCHK#
PWT
PLOCK#
ROY#
RE8ET
W/R#

015
817
A17
K15
J16
J15
F17
R16
017
H15
015
016
C17
C3
M15
N3
F1
H3
A5
817
C14
C15
P15
E15
A15
A16
F15
N15
N16
815
J17
017
L15
016
F16
C16
N17

NOTE:

1. These pins are no longer No-Connects on the 50 MHz version.

TCK
TOI
TOO
TM8

A3
A14
816
814

N/C

Vee

Vss

A3(1)
A10
A12
A13
A14(1)
810
812
813
814(1)
816(1)
C10
C11
C12
C13
G15
R17
84

87
89
811
C4
C5
E2
E16
G2
G16
H16
J1
K2
K16
L16
M2
M16
P16
R3
R6
R8
R9
R10
R11
R14

A7
A9
A11
83
84
85
E1
E17
G1
G17
H1
H17
K1
K17
L1
L17
M1
M17
P17
02
R4
86
88
89
810
811
812
814

int'et

Intel486™ OX MICROPROCESSOR

QUICK PIN REFERENCE
What follows is a brief pin description. For detailed signal descriptions refer to Section 6.
Symbol

Type

ClK

Name and Function
Clock provides the fundamental timing and the internal operating frequency for the
Intel486 Microprocessor. All external timing parameters are specified with respect to
the rising edge of ClK.

ADDRESS BUS
A31-A4
A2-A3

1/0

BEO-3#

A31-A2 are the address lines of the microprocessor. A31-A2, together with the byte
enables BEO # -BE3 #, define the physical area of memory or input! output space
accessed. Address lines A31-A4 are used to drive addresses into the microprocessor
to perform cache line invalidations. Input signals must meet setup and hold times t22
and t23' A31-A2 are not driven during bus or address hold.
The byte enable signals indicate active bytes during read and write cycles. Ouring the
first cycle of a cache fill, the external system should assume that all byte enables are
active. BE3# applies to 024-031, BE2# applies to 016-023, BE1 # applies to 08016 and BEO# applies to 00-07. BEO#-BE3# are active lOW and are not driven
during bus hold.

DATA BUS
031-00

1/0

These are the data lines for the Intel486 Microprocessor. Lines 00-07 define the least
significant byte of the data bus while lines 024-031 define the most significant byte of
the data bus. These signals must meet setup and hold times t22 and t23 for proper
operation on reads. These pins are driven during the second and subsequent clocks of
write cycles.

DATA PARITY
OPO-OP3

PCHK#

1/0

There is one data parity pin for each byte of the data bus. Oata parity is generated on all
write data cycles with the same timing as the data driven by the Intel486
Microprocessor. Even parity information must be driven back into the microprocessor
on the data parity pins with the same timing as read information to insure that the
correct parity check status is indicated by the Intel486 microprocessor. The signals
read on these pins do not affect program execution.
Input signals must meet setup and hold times t22 and t23' OPO-OP3 should be
connected to Vee through a pullup resistor in systems which do not use parity.
OPO-OP3 are active HIGH and are driven during the second and subsequent clocks of
write cycles.

Parity Status is driven on the PCHK # pin the clock after ready for read operations. The
parity status is for data sampled at the end of the previous clock. A parity error is
indicated by PCHK# being lOW. Parity status is only checked for enabled bytes as
indicated by the byte enable and bus size signals. PCHK# is valid only in the clock
immediately after read data is returned to the microprocessor. At all other times
PCHK# is inactive (HIGH). PCHK# is never floated.

intel"

Intel486TM OX MICROPROCESSOR

QUICK PIN REFERENCE (Continued)
Symbol

Type

Name and Function

BUS CYCLE DEFINITION
MIIO#
D/C#
W/R#

0
0
0

The memory/input-output, data/control and write/read lines are the primary bus
definition signals. These signals are driven valid as the ADS# signal is asserted.

MIIO#

D/C#

W/R#

Bus Cycle Initiated

0
0
0
0

0
0

1
1

1
1
1
1

0
0

1
1

Interrupt Acknowledge
Halt/Special Cycle
1/0 Read
1/0 Write
Code Read
Reserved
Memory Read
Memory Write

1
1
1
1

The bus definition signals are not driven during bus hold and follow the timing of the
address bus. Refer to Section 7.2.11 for a description of the special bus cycles.
LOCK#

The bus lock pin indicates that the current bus cycle is locked. The Intel486
Microprocessor will not allow a bus hold when LOCK # is asserted (but address holds
are allowed). LOCK# goes active in the first clock of the first locked bus cycle and goes
inactive after the last clock of the last locked bus cycle. The last locked cycle ends
when ready is returned. LOCK # is active LOW and is not driven during bus hold. Locked
read cycles will not be transformed into cache fill cycles if KEN # is returned active.

PLOCK#

The pseudo-lock pin indicates that the current bus transaction requires more than one
bus cycle to complete. Examples of such operations are floating point long reads and
writes (64 bits), segment table descriptor reads (64 bits), in addition to cache line fills
(128 bits). The Intel486 Microprocessor will drive PLOCK# active until the addresses for
the last bus cycle of the transaction have been driven regardless of whether RDY # or
BRDY # have been returned.
Normally PLOCK # and BLAST # are inverse of each other. However during the first bus
cycle of a 64-bit floating point write, both PLOCK # and BLAST # will be asserted.
PLOCK# is a function of the BS8#, BS16# and KEN# inputs. PLOCK# should be
sampled only in the clock ready is returned. PLOCK # is active LOW and is not driven
during bus hold.

BUS CONTROL
ADS#

The address status output indicates that a valid bus cycle definition and address are
available on the cycle definition lines and address bus. ADS# is driven active in the
same clock as the addresses are driven. ADS# is active LOW and is not driven during
bus hold.

RDY#

The non-burst ready input indicates that the current bus cycle is complete. RDY #
indicates that the external system has presented valid data on the data pins in response
to a read or that the external system has accepted data from the Intel486
Microprocessor in response to a write. RDY # is ignored when the bus is idle and at the
end of the first clock of the bus cycle.
RDY # is active during address hold. Data can be returned to the processor while
AHOLD is active.
RDY # is active LOW, and is not provided with an internal pullup resistor. RDY # must
satisfy setup and hold times t16 and t17 for proper chip operation.

intel~

Intel486TM OX MICROPROCESSOR

QUICK PIN REFERENCE (Continued)
Symbol

Type

Name and Function

BURST CONTROL
BRDY#

BLAST#

The burst ready input performs the same function during a burst cycle that RDY #
performs during a non-burst cycle. BRDY # indicates that the external system has
presented valid data in response to a read or that the external system has accepted data
in response to a write. BRDY # is ignored when the bus is idle and at the end of the first
clock in a bus cycle.
BRDY # is sampled in the second and subsequent clocks of a burst cycle. The data
presented on the data bus will be strobed into the microprocessor when BRDY # is
sampled active. If RDY # is returned simultaneously with BRDY #, BRDY # is ignored
and the burst cycle is prematurely aborted.
BRDY # is active LOW and is provided with a small pullup resistor. BRDY # must satisfy
the setup and hold times t16 and tH.
The burst last signal indicates that the next time BRDY # is returned the burst bus cycle
is complete. BLAST # is active for both burst and non-burst bus cycles. BLAST # is
active LOW and is not driven during bus hold.

INTERRUPTS
RESET

The reset input forces the Intel486 Microprocessor to begin execution at a known state.
The microprocessor cannot begin execution of instructions until at least 1 ms after Vee
and eLK have reached their proper DC and AC specifications. The RESET pin should
remain active during this time to insure proper microprocessor operation. RESET is
active HIGH. RESET is asynchronous but must meet setup and hold times t20 and t21 for
recognition in any specific clock.

INTR

The maskable interrupt indicates that an external interrupt has been generated. If the
internal interrupt flag is set in EFLAGS, active interrupt processing will be initiated. The
Intel486 Microprocessor will generate two locked interrupt acknowledge bus cycles in
response to the INTR pin going active. INTR must remain active until the interrupt
acknowledges have been performed to assure that the interrupt is recognized.
INTR is active HIGH and is not provided with an internal pulldown resistor. INTR is
asynchronous, but must meet setup and hold times t20 and t21 for recognition in any
specific clock.

NMI

The non-maskable interrupt request signal indicates that an external non-maskable
interrupt has been generated. NMI is rising edge sensitive. NMI must be held LOW for at
least four CLK periods before this rising edge. NMI is not provided with an internal
pulldown resistor. NMI is asynchronous, but must meet setup and hold times t20 and t21
for recognition in any specific clock.

BUS ARBITRATION
BREQ

HOLD

The bus hold request allows another bus master complete control of the Intel486
Microprocessor bus. In response to HOLD going active the Intel486 Microprocessor will
float most of its output and input! output pins. HLDA will be asserted after completing the
current bus cycle, burst cycle or sequence of locked cycles. The Intel486
Microprocessor will remain in this state until HOLD is deasserted. HOLD is active high
and is not provided with an internal pulldown resistor. HOLD must satisfy setup and hold
times t18 and t19 for proper operation.

HLDA

Hold acknowledge goes active in response to a hold request presented on the HOLD
pin. HLDA indicates that the Intel486 microprocessor has given the bus to another local
bus master. HLDA is driven active in the same clock that the Intel486 Microprocessor
floats its bus. HLDA is driven inactive when leaving bus hold. HLDA is active HIGH and
remains driven during bus hold.

The internal cycle pending signal indicates that the Intel486 Microprocessor has
internally generated a bus request. BREQ is generated whether or not the Intel486
Microprocessor is driving the bus. BREQ is active HIGH and is never floated.

inteL

Intel486TM OX MICROPROCESSOR

QUICK PIN REFERENCE (Continued)
Symbol

Type

Name and Function

BUS ARBITRATION (Continued)
BOFF#

The backoff input forces the Intel486 Microprocessor to float its bus in the next clock.
The microprocessor will float all pins normally floated during bus hold but HLDA will not
be asserted in response to BOFF #. BOFF # has higher priority than RDY # or BRDY #;
if both are returned in the same clock, BOFF # takes effect. The microprocessor
remains in bus hold until BOFF # is negated. If a bus cycle was in progress when
BOFF # was asserted the cycle will be restarted. BOFF # is active LOW and must meet
setup and hold times t18 and t19 for proper operation.

CACHE INVALIDATION
AHOLD

The address hold request allows another bus master access to the Intel486
Microprocessor's address bus for a cache invalidation cycle. The Intel486
Microprocessor will stop driving its address bus in the clock following AHOLD going
active. Only the address bus will be floated during address hold, the remainder of the
bus will remain active. AHOLD is active HIGH and is provided with a small internal
pulldown resistor. For proper operation AHOLD must meet setup and hold times t18 and
t19·

EADS#

This signal indicates that a valid external address has been driven onto the Intel486
Microprocessor address pins. This address will be used to perform an internal cache
invalidation cycle. EAOS# is active LOW and is provided with an internal pullup resistor.
EADS# must satisfy setup and hold times t12 and t13 for proper operation.

CACHE CONTROL
KEN#

The cache enable pin is used to determine whether the current cycle is cacheable.
When the Intel486 microprocessor generates a cycle that can be cached and KEN# is
active one clock before ROY # or BROY # during the first transfer of the cycle, the cycle
will become a cache line fill cycle. Returning KEN # active one clock before ROY #
during the last read in the cache line fill will cause the line to be placed in the on-Chip
cache. KEN # is active LOW and is provided with a small internal pullup resistor. KEN #
must satisfy setup and hold times t14 and t15 for proper operation.

FLUSH#

The cache flush input forces the Intel486 Microprocessor to flush its entire internal
cache. FLUSH # is active low and need only be asserted for one clock. FLUSH # is
asynchronous but setup and hold times t20 and t21 must be met for recognition in any
specific clock. FLUSH # being sampled low in the clock before the falling edge of
RESET causes the Intel486 Microprocessor to enter the tri-state test mode.

PAGE CACHEABILITY
PWT
PCD

0
0

The page write-through and page cache disable pins reflect the state of the page
attribute bits, PWT and PCO, in the page table entry or page directory entry. If paging is
disabled or for cycles that are not paged, PWT and PCO reflect the state of the PWT and
PCD bits in control register 3. PWT and PCO have the same timing as the cycle definition
pins (MIIO#, O/C# and W/R#). PWT and PCO are active HIGH and are not driven
during bus hold. PCD is masked by the cache disable bit (CD) in Control Register o.

NUMERIC ERROR REPORTING
FERR#

The floating point error pin is driven active when a floating point error occurs. FERR # is
similar to the ERROR # pin on the 387TM math coprocessor. FERR # is included for
compatibility with systems using DOS type floating point error reporting. FERR # will not
go active if FP errors are masked in FPU register. FERR # is active LOW, and is not
floated during bus hold.

intel .

Intel486™ OX MICROPROCESSOR

QUICK PIN REFERENCE (Continued)
Symbol

Type

Name and Function

NUMERIC ERROR REPORTING (Continued)

IGNNE#

When the ignore numeric error pin is asserted the Intel486 Microprocessor will ignore a
numeric error and continue executing non-control floating point instructions, but FERR #
will still be activated by the Inte1486. When IGNNE # is deasserted the Intel486
microprocessor will freeze on a non-control floating point instruction, if a previous
floating point instruction caused an error. IGNNE # has no effect when the NE bit in
control register 0 is set. IGNNE # is active LOW and is provided with a small internal
pullup resistor. IGNNE # is asynchronous but setup and hold times t20 and t21 must be
met to insure recognition on any specific clock.

BUS SIZE CONTROL

8S16#
8S8#

I
I

The bus size 16 and bus size 8 pins (bus sizing pins) cause the Intel486 Microprocessor
to run multiple bus cycles to complete a request from devices that cannot provide or
accept 32 bits of data in a single cycle. The bus sizing pins are sampled every clock. The
state of these pins in the clock before ready is used by the Intel486 microprocessor to
determine the bus size. These signals are active LOW and are provided with internal
pullup resistors. These inputs must satisfy setup and hold times t14 and t15 for proper
operation.

ADDRESS MASK

A20M#

When the address bit 20 mask pin is asserted, the Intel486 Microprocessor masks
physical address bit 20 (A20) before performing a lookup to the internal cache or driving
a memory cycle on the bus. A20M# emulates the address wraparound at one Mbyte
which occurs on the 8086. A20M # is active LOW and should be asserted only when the
processor is in real mode. This pin is asynchronous but should meet setup and hold
times t20 and t21 for recognition in any specific clock. For proper operation, A20M #
should be sampled high at the falling edge of RESET.

TEST ACCESS PORT (50 MHz Version Only)

TCK

Test Clock is an input to the Intel486 CPU and provides the clocking function required by
the JTAG boundary scan feature. TCK is used to clock state information and data into
and out of the component. State select information and data are clocked into the
component on the rising edge of TCK on TMS and TOI, respectively. Oata is clocked out
of the part on the falling edge of TCK on TOO.

TOI

Test Data Input is the serial input used to shift JTAG instructions and data into the
component. TOI is sampled on the rising edge of TCK, during the SHIFT-IR and the
SHIFT-OR TAP controller states. Ouring all other tap controller states, TOI is a "don't
care".

TOO

Test Data Output is the serial output used to shift JTAG instructions and data out of the
component. TOO is driven on the falling edge of TCK during the SHIFT-IR and
SHIFT-OR TAP controller states. At all other times TOO is driven to the high impedance
state.

TMS

Test Mode Select is decoded by the JTAG TAP (Tap Access Port) to select the
operation of the test logic. TMS is sampled on the rising edge of TCK. To guarantee
deterministic behavior of the TAP controller TMS is provided with an internal pull-up
resistor.

intel~

Intel486TM OX MICROPROCESSOR

Table 1.1. Output Pins
Name

Active
Level

BREQ
HLOA
BEO#-BE3#
PWT, PCO
W/R#, O/C#, M/IO#
LOCK#
PLOCK#
AOS#
B LAST #
PCHK#
FERR#
A2-A3

HIGH
HIGH
LOW
HIGH
HIGH
LOW
LOW
LOW
LOW
LOW
LOW
HIGH

Table 1.4. Test Pins (50 MHz Version Only)
When
Floated

Input or
Output

Name

Bus Hold
Bus Hold
Bus Hold
Bus Hold
Bus Hold
Bus Hold
Bus Hold

Sampledl
Oriven On

TCK

Input

N/A

TOI

Input

Rising Edge of TCK

TOO

Output

Falling Edge of TCK

TMS

Input

Rising Edge of TCK

Table 1.5. Component and Revision 10
Intel486™ CPU
Stepping Name

Component
10

Revision
10

Table 1.2. Input Pins

Active
Level

Synchronousl
Asynchronous

HIGH
HIGH
HIGH
LOW
LOW
LOW
LOW
LOW
LOW
LOW
LOW
HIGH
HIGH
LOW

Asynchronous
Synchronous
Synchronous
Synchronous
Synchronous
Asynchronous
Asynchronous
Synchronous
Synchronous
Synchronous
Synchronous
Asynchronous
Asynchronous
Asynchronous

Name
CLK
RESET
HOLD
AHOLO
EAOS#
BOFF#
FLUSH#
A20M#
BS16#, BSB#
KEN#
ROY#
BROY#
INTR
NMI
IGNNE#

Bus, Address Hold

Active
Level

When
Floated

00-031
OPO-OP3
A4-A31

HIGH
HIGH
HIGH

Bus Hold
Bus Hold
Bus, Address Hold

cA3

cBO

cB1

IntelOverOrive™
Processor
Stepping Name

Table 1.3. Input/Output Pins
Name

cA2

int:eL
2.0

Intel486™ OX MICROPROCESSOR

The Intel486 Microprocessor has two modes of operation: Real Address Mode (Real Mode) and Protected Mode Virtual Address Mode (Protected
Mode). In Real Mode the Intel486 Microprocessor
operates as a very fast 8086. Real Mode is required
primarily to set up the processor for Protected Mode
operation. Protected Mode provides access to the
sophisticated memory management paging and privilege capabilities of the processor.

ARCHITECTURAL OVERVIEW

The Intel486 Microprocessor is a 32-bit architecture
with on-chip memory management, floating point
and cache memory units.
The Intel486 Microprocessor contains all the features of the 386TM Microprocessor with enhancements to increase performance. The instruction set
includes the complete 386 microprocessor instruction set along with extensions to serve new applications. The on-chip memory management unit (MMU)
is completely compatible with the 386 Microprocessor MMU. The Intel486 Microprocessor brings the
387TM math coprocessor on-chip. All software written for the 386 microprocessor, 387 math coprocessor and previous members of the 86/87 architectural family will run on the Intel486 Microprocessor
without any modifications.

Within Protected Mode, software can perform a task
switch to enter into tasks designated as Virtual 8086
Mode tasks. Each virtual 8086 task behaves with
8086 semantics, allowing 8086 software (an application program or an entire operating system) to execute.
The on-chip floating point unit operates in parallel
with the arithmetic and logic unit and provides arithmetic instructions for a variety of numeric data types.
It executes numerous built-in transcendental functions (e.g., tangent, sine, cosine, and log functions).
The floating point unit fully conforms to the ANSI/
IEEE standard 754-1985 for floating point arithmetic.

Several enhancements have been added to the Intel486 Microprocessor to increase performance. Onchip cache memory allows frequently used data and
code to be stored on-chip reducing accesses to the
external bus. RISC design techniques have been
used to reduce instruction cycle times. A burst bus
feature enables fast cache fills. All of these features,
combined, lead to performance greater than twice
that of a 386 Microprocessor.

The on-chip cache is 8 Kbytes in size. It is 4-way set
associative and follows a write-through policy. The
on-chip cache includes features to provide flexibility
in external memory system design. Individual pages
can be designated as cacheable or non-cacheable
by software or hardware. The cache can also be enabled and disabled by software or hardware.

The memory management unit (MMU) consists of a
segmentation unit and a paging unit. Segmentation
allows management of the logical address space by
providing easy data and code relocatibility and efficient sharing of global resources. The paging mechanism operates beneath segmentation and is transparent to the segmentation process. Paging is
optional and can be disabled by system software.
Each segment can be divided into one or more
4 Kbyte segments. To implement a virtual memory
system, the Intel486 Microprocessor supports full restartability for all page and segment faults.

Finally the Intel486 Microprocessor has features to
facilitate high performance hardware designs. The
1X clock eases high frequency board level designs.
The burst bus feature enables fast cache fills. These
features are described beginning in Section 6.

2.1 Register Set
The Intel486 Microprocessor register set includes all
the registers contained in the 386 Microprocessor
and the 387 math coprocessor. The register set can
be split into the following categories:

Memory is organized into one or more variable
length segments, each up to four gigabytes (232
bytes) in size. A segment can have attributes associated with it which include its location, size, type (Le.,
stack, code or data), and protection characteristics.
Each task on an Intel486 Microprocessor can have a
maximum of 16,381 segments, each up to four gigabytes in size. Thus each task has a maximum of 64
terabytes (trillion bytes) of virtual memory.

Base Architecture Registers
General Purpose Registers
Instruction Pointer
Flags Register
Segment Registers

The segmentation unit provides four-levels of protection for isolating and protecting applications and
the operating system from each other. The hardware
enforced protection allows the design of systems
with a high degree of integrity.

Systems Level Registers
Control Registers
System Address Registers

intel .

Intel486TM OX MICROPROCESSOR

Floating Point Registers
Data Registers
Tag Word
Status Word
Instruction and Data Pointers
Control Word

The base architecture includes six directly accessible descriptors, each specifying a segment up to
4 Gbytes in size. The descriptors are indicated by
the selector values placed in the Intel486 Microprocessor segment registers. Various selector values
can be loaded as a program executes.
The selectors are also task-specific, so the segment
registers are automatically loaded with new context
upon a task switch operation.

Debug and Test Registers
The base architecture and floating pOint registers
are accessible by the applications program. The system level registers are only accessible at privilege
level 0 and are used by the systems level program.
The debug and test registers are also only accessible at privilege level o.

2.1.1.1 General Purpose Registers
The eight 32-bit general purpose registers are
shown in Figure 2.1. These registers hold data or
address quantities. The general purpose registers
can support data operands of 1, 8, 16 and 32 bits,
and bit fields of 1 to 32 bits. Address operands of 16
and 32 bits are supported. The 32-bit registers are
named EAX, EBX, ECX, EDX, ESI, EDI, EBP and
ESP.

2.1.1 BASE ARCHITECTURE REGISTERS
Figure 2.1 shows the Intel486 Microprocessor base
architecture registers. The contents of these registers are task-specific and are automatically loaded
with a new context upon a task switch operation.

The least significant 16 bits of the general purpose
registers can be accessed separately by using the
16-bit names of the registers AX, BX, CX, OX, SI, 01,
BP and SP. The upper 16 bits of the register are not
changed when the lower 16 bits are accessed separately.

General Purpose Registers
31

123

81 7

EAX

EBX

ECX

EDX

Finally 8-bit operations can individually access the
lowest byte (bits 0-7) and the higher byte (bits
8-15) of the general purpose registers AX, BX, CX
and OX. The lowest bytes are named AL, BL, CL and
DL respectively. The higher bytes are named AH,
BH, CH and DH respectively. The individual byte accessibility offers additional flexibility for data operations but is not used for effective address calculation.

ESI

EOI

EBP

ESP

Segment Registers
15

2.1.1.2 Instruction Pointer

Code Segment

Stack Segment

Data Segments

The instruction pointer, shown in Figure 2.1, is a
32-bit register named EIP. EIP holds the offset of the
next instruction to be executed. The offset is always
relative to the base of the code segment (CS). The
lower 16 bits (bits 0-15) of the EIP contain the 16-bit
instruction pointer named IP, which is used for 16-bit
addressing.

Instruction Pointer
31

0
IP

Flags Register

FLAGS

2.1.1.3 Flags Register

IEIP

The flags register is a 32-bit register named
EFLAGS. The defined bits and bit fields within
EFLAGS control certain operations and indicate
status of the Intel486 Microprocessor. The lower
16 bits (bits 0-15) of EFLAGS contain the 16-bit
register named FLAGS, which is most useful when
executing 8086 and 80286 code. EFLAGS is shown
in Figure 2.2.

IEFLAGS

Figure 2.1. Base Architecture Registers

Intel486TM OX MICROPROCESSOR

FLAGS

J J 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 111
1 0 9 8 7 6 5 4 J 2 1 0 9 8 7 6 5 4 J 2

1
0 9 8 7 6 5 4 J 2 1 0

EFLAGS
ALIGNt.4ENT CHE:CK·------'
- - WI.IOCT FLAG
FLAG
VIRTUAL t.401)E---------'
'------AUXIlCiAR CARRY
RESUt.4E
L..-----ZERO FLAG
NESTED TASK
' - - - - - - - - S I G N FLAG
I/O PRIVILEGE L E V E L · - - - - - - - -.....
' - - - - - - - - - T R A P FLAG
OVERFLOW--------------'
DIRECTION F L A G - - - - - - - - - - - -...
INTERRUPT E N A B L E - - - - - - - - - - - - - - '
240440-6

NOTE:
III indicates Intel .Reserved: do not define; see Section 2.1.6.

Figure 2.2. Flags Register
EFLAGS bits 1, 3, 5, 15 and 19-31 are "undefined".
When these bits are stored during interrupt processing or with a PUSHF instruction (push flags onto
stack), a one is stored in bit 1 and zeros in bits 3, 5,
15 and 19-31.

to an odd address, a dword access to an address that is not on a dword boundary, or an
8-byte reference to an address that is not on a
64-bit word boundary. See Section 7.1.6 for
more information on operand alignment.
Alignment faults are only generated by programs running at privilege level 3. The AC bit
setting is ignored at privilege levels 0, 1 and 2.
Note that references to the descriptor tables
(for selector loads), or the task state segment
(TSS), are implicitly level 0 references even if.
the instructions causing the references are
executed at level 3. Alignment faults are reported through interrupt 17, with an error code
of O. Table 2.1 gives the alignment required
for the Intel486 microprocessor data types.

The EFLAGS register in the Intel486 Microprocessor
contains a new bit not previously defined. The new
bit, AC, is defined in the upper 16 bits of the register
and it enables faults on accesses to misaligned
data.
AC

(Alignment Check, bit 18)
The AC bit enables the generation of faults if a
memory reference is to a misaligned address.
Alignment faults are enabled when AC is set
to 1. A mis-aligned address is a word access

Table 2.1. Data Type Alignment Requirements
Memory Access

Alignment (Byte Boundary)

Word
Dword
Single Precision Real
Double Precision Real
Extended Precision Real
Selector
48-Bit Segmented Pointer
32-Bit Flat Pointer
32-Bit Segmented Pointer
48-Bit "Pseudo-Descriptor"
FSTENVlFLDENV Save Area
FSAVE/FRSTOR Save Area
Bit String

2
4
4
8
8
2
4
4
2
4

4/2 (On Operand Size)
4/2 (On Operand Size)
4

intel .

Intel486TM OX MICROPROCESSOR

that the current nested task's Task State Segment (TSS) has a valid back link to the previous task's TSS. This bit is set or reset by control transfers to other tasks. The value of NT
in EFLAGS is tested by the IRET instruction to
determine whether to do an inter-task return
or an intra-task return. A POPF or an IRET
instruction will affect the setting of this bit according to the image popped, at any privilege
level.
10PL (Input/Output Privilege Level, bits 12-13)

IMPLEMENTATION NOTE:
Several instructions on the Intel486 Microprocessor
generate misaligned references, even if their memory address is aligned. For example, on the Intel486 Microprocessor, the SGDT /SIDT (store global/interrupt descriptor table) instruction reads/
writes two bytes, and then reads/writes four bytes
from a "pseudo-descriptor" at the given address.
The Intel486 Microprocessor will generate misaligned references unless the address is on a 2 mod
4 boundary. The FSAVE and FRSTOR instructions
(floating point save and restore state) will generate
misaligned references for one-half of the register
save/restore cycles. The Intel486 Microprocessor
will not cause any AC faults if the effective address
given in the instruction has the proper alignment.
VM

This two-bit field applies to Protected Mode.
10PL indicates the numerically maximum CPL
(current privilege level) value permitted to execute I/O instructions without generating an
exception 13 fault or consulting the I/O Permission Bitmap. It also indicates the maximum
CPL value allowing alteration of the IF (INTR
Enable Flag) bit when new values are popped
into the EFLAG register. POPF and IRET instruction can alter the 10PL field when executed at CPL = o. Task switches can always alter the 10PL field, when the new flag image is
loaded from the incoming task's TSS.

(Virtual 8086 Mode, bit 17)
The VM bit provides Virtual 8086 Mode within
Protected Mode. If set while the Intel486 Microprocessor is in Protected Mode, the Intel486 Microprocessor will switch to Virtual
8086 operation, handling segment loads as
the 8086 does, but generating exception 13
faults on privileged opcodes. The VM bit can
be set only in Protected Mode, by the IRET
instruction (if current privilege level = 0) and
by task switches at any privilege level. The
VM bit is unaffected by POPF. PUSHF always
pushes a 0 in this bit, even if executing in Virtual 8086 Mode. The EFLAGS image pushed
during interrupt processing or saved during
task switches will contain a 1 in this bit if the
interrupted code was executing as a Virtual
8086 Task.

OF is set if the operation resulted in a Signed
overflow. Signed overflow occurs when the
operation resulted in carry/borrow into the
sign bit (high-order bit) of the result but did not
result in a carry/borrow out of the high-order
bit, or vice-versa. For 8-, 16-, 32-bit operations, OF is set according to overflow at bit 7,
15, 31, respectively.
OF

(Resume Flag, bit 16)

(Direction Flag, bit 10)
OF defines whether ESI and/or EDI registers
postdecrement or postincrement during the
string instructions. Postincrement occurs if OF
is reset. Postdecrement occurs if OF is set.

The RF flag is used in conjunction with the
debug register breakpoints. It is checked at
instruction boundaries before breakpoint processing. When RF is set, it causes any debug
fault to be ignored on the next instruction. RF
is then automatically reset at the successful
completion of every instruction (no faults are
signalled) except the IRET instruction, the
POPF instruction, (and JMP, CALL, and INT
instructions causing a task switch). These instructions set RF to the value specified by the
memory image. For example, at the end of the
breakpoint service routine, the IRET instruction can pop an EFLAG image having the RF
bit set and resume the program's execution at
the breakpoint address without generating another breakpoint fault on the same location.
NT

(Overflow Flag, bit 11)

(INTR Enable Flag, bit 9)
The IF flag, when set, allows recognition of
external interrupts signalled on the INTR pin.
When IF is reset, external interrupts signalled
on the INTR are not recognized. 10PL indicates the maximum CPL value allowing alteration of the IF bit when new values are popped
into EFLAGS or FLAGS.

(Trap Enable Flag, bit 8)
TF controls the generation of exception 1 trap
when single-stepping through code. When TF
is set, the Intel486 Microprocessor generates
an exception 1 trap after the next instruction is
executed. When TF is reset, exception 1 traps
occur only as a function of the breakpoint addresses loaded into debug registers DRODR3.

(Nested Task, bit 14)
This flag applies to Protected Mode. NT is set
to indicate that the execution of this task is
nested within another task. If set, it indicates

infel·

Intel486TM OX MICROPROCESSOR

(Sign Flag, bit 7)

SF is set if the high-order bit of the result is
set, it is reset otherwise. For 8-, 16-, 32-bit
operations, SF reflects the state of bit 7, 15,
31 respectively.
(Zero Flag, bit 6)

. CF

2.1.1.4 Segment Registers
Six 16-bit segment registers hold segment selector
values identifying the currently addressable memory
segments. In protected mode, each segment may
range in size from one byte up to the entire linear
and physical address space of the machine, 4
Gbytes (232 bytes). In real address mode, the maximum segment size is fixed at 64 Kbytes (2 16 bytes).

ZF is set if all bits of the result are O. Otherwise it is reset.
(Auxiliary Carry Flag, bit 4)
The Auxiliary Flag is used to simplify the addition and subtraction of packed BCD quantities. AF is set if the operation resulted in a
carry out of bit 3 (addition) or a borrow into bit
3 (subtraction). Otherwise AF is reset. AF is
affected by carry out of, or borrow into bit 3
only, regardless of overall operand length: 8,
16 or 32 bits.
(Parity Flags, bit 2)
PF is set if the low-order eight bits of the operation contains an even number of "1's" (even
parity). PF is reset if the low-order eight bits
have odd parity. PF is a function of only the
low-order eight bits, regardless of operand
size.
(Carry Flag, bit 0)
CF is set if the operation resulted in a carry
out of (addition), or a borrow into (subtraction)
the high-order bit. Otherwise CF is reset. For
8-, 16- or 32-bit operations, CF is set according to carry/borrow at bit 7,15 or 31, respectively.
SEGMENT
REGISTERS

NOTE:
In these descriptions, "set" means "set to 1," and
"reset" means "reset to 0."

•

The six addressable segments are defined by the
segment registers CS, SS, DS, ES, FS and GS. The
selector in CS indicates the current code segment;
the selector. in SS indicates the current stack segment; the selectors in DS, ES, FS and GS indicate
the current data segments.

2.1.1.5 Segment Descriptor Cache Registers
The segment descriptor cache registers are not programmer visible, yet it is very useful to understand
their content. A programmer invisible descriptor
cache register is associated with each programmervisible segment register, as shown by Figure 2.3.
Each descriptor cache register holds a 32-bit base
address, a 32-bit segment limit, and the other necessary segment attributes.

DESCRIPTOR REGISTERS (LOADED AUTOMATICALLy)

•

Physical Base Address Segment Limit

Other
Segment
Attributes from Descriptor

Selector

CS-

Selector

SS-

Selector

DS-

Selector

ES-

- - - - -

Selector

FS-

Selector

GS-

- - - - -

Figure 2.3. Intel486TM Microprocessor Segment Registers and Associated Descriptor Cache Registers

intel .

Intel486TM OX MICROPROCESSOR

When a selector value is loaded into a segment register, the associated descriptor cache register is automatically updated with the correct information. In
Real Address Mode, only the base address is updated directly (by shifting the selector value four bits to
the left), since the segment maximum limit and attributes are fixed in Real Mode. In Protected Mode,
the base address, the limit, and the attributes are all
updated per the contents of the segment descriptor
indexed by the selector.

unit (FPU) and the segmentation and paging mechanisms. These registers are only accessible to programs running at privilege level 0, the highest privilege level.
The system level registers include three control registers and four segmentation base registers. The
three control registers are CRO, CR2 and CR3. CR1
is reserved for future Intel processors. The four segmentation base registers are the Global Descriptor
Table Register (GDTR), the Interrupt Descriptor Table Register (IDTR), the Local Descriptor Table Register (LDTR) and the Task State Segment Register
(TR).

Whenever a memory reference occurs, the segment
descriptor cache register associated with the segment being used is automatically involved with the
memory reference. The 32-bit segment base address becomes a component of the linear address
calculation, the 32-bit limit is used for the limit-check
operation, and the attributes are checked against
the type of memory reference requested.

2_1.2.1 Control Registers
Control Register 0 (CRO)
CRO, shown in Figure 2.5, contains 10 bits for control and status purposes. Five of the bits defined in
the Intel486 Microprocessor's CRO are newly defined. The new bits are CD, NW, AM, WP and NE.
The function of the bits in CRO can be categorized
as follows:

2.1.2 SYSTEM LEVEL REGISTERS
The system level registers, Figure 2.4, control operation of the on-chip cache, the on-chip floating point

24 123

al7

16115

0
CRO

PAGE FAULT LINEAR ADDRESS REGISTER

CR2

PAGE DIRECTORY BASE REGISTER

CR3

SYSTEM ADDRESS REGISTERS

47 32-BIT LINEAR BASE ADDRESS 16 15
GDTRI
IDTR

I
SYSTEM SEGMENT
REGISTERS

TR
LDTR

LIMIT

I
I

SELECTOR

DESCRIPTOR REGISTERS (AUTOMATICALLY LOADED)

...
SELECTOR

I
I

(

...
32-BIT LINEAR BASE ADDRESS

20-BIT SEGMENT LIMIT

ATTRIBUTES'

II II

I
Figure 2.4. System Level Registers

~~---------------v---------------')
MSW

NOTE:
;/ indicates Intel reserved: Do not define; See Section 2.1.6

Figure 2.5. Control Register 0
23

intel~

Intel486TM OX MICROPROCESSOR

The low-order 16 bits of CRO are also known as the
Machine Status Word (MSW), for compatibility with
the 80286 protected mode. LMSW and SMSW (load
and store MSW) instructions are taken as special
aliases of the load and store CRO operations, where
only the low-order 16 bits of CRO are involved. The
LMSW and SMSW instructions in the Intel486 microprocessor work in an identical fashion to the LMSW
and SMSW instructions in the 80286 (Le., they only
operate on the low-order 16 bits of CRO and ignores
the new bits). New Intel486 Microprocessor operating systems should use the MOV CRO, Reg instruction.

Intel486 Microprocessor Operating Modes: PG, PE
(Table 2.2)
On-Chip Cache Control Modes: CD, NW (Table 2.3)
On-Floating Point Unit Control: TS, EM, MP, NE
(Table 2.4)
Alignment Check Control: AM
Supervisor Write Protect: WP
Table 2.2. Processor Operating Modes

Mode
REAL Mode. Exact 8086 semantics,
with 32-bit extensions available with
prefixes.

The defined CRO bits are described below.
PG (Paging Enable, bit 31)
The PG bit is used to indicate whether paging is
enabled (PG = 1) or disabled (PG = 0). See Table 2.2.
CD (Cache Disable, bit 30)

Protected Mode. Exact 80286
semantics, plus 32-bit extensions
through both prefixes and "default"
prefix setting associated with code
segment descriptors. Also, a submode is defined to support a virtual
8086 within the context of the
extended 80286 protection model.

UNDEFINED. Loading CRO with this
combination of PG and PE bits will
raise a GP fault with error code O.

Paged Protected Mode. All the
facilities of Protected mode, with
paging enabled underneath
segmentation.

The CD bit is used to enable the on-chip cache.
When CD = 1, the cache will not be filled on
cache misses. When CD = 0, cache fills. may be
performed on misses. See Table 2.3.
The state of the CD bit, the cache enable input
pin (KEN #), and the relevant page cache disable (PCD) bit determine if a line read in response to a cache miss will be installed in the
cache. A line is installed in the cache only if
CD = 0 and KEN # and PCD are both zero. The
relevant PCD bit comes from either the page
table entry, page directory entry or control register 3. Refer to Section 5.6 for more details on
page cacheability.

Table 2.3. On-Chip Cache Control Modes
CD

Operating Mode

Cache fills disabled, write-through and
invalidates disabled.

Cache fills disabled, write-through and
invalidates enabled.

INVALID. If CRO is loaded with this
configuration of bits, a GP fault with
error code is raised.

Cache fills enabled, write-through and
invalidates enabled.

CD is set to one after RESET.
NW (Not Write-Through, bit 29)
The NW bit enables on-chip cache writethroughs and write-invalidate cycles (NW = 0).
When NW=O, all writes, including cache hits,
are sent out to the pins. Invalidate cycles are
enabled when NW = O. During an invalidate cycle a line will be removed from the cache if the
invalidate address hits in the cache. See Table
2.3.
When NW = 1, write-throughs and write-invalidate cycles are disabled. A write will not be sent
to the pins if the write hits in the cache. With
NW= 1 the only write cycles that reach the external bus are cache misses. Write hits with
NW = 1 will never update main memory. Invalidate cycles are ignored when NW = 1.

Table 2.4. On-Chip Floating Point Unit Control
CROBIT

Instruction Type

Floating-Point

Wait

0
0
0
0
1
1
1
1

0
0
1
1
0
0
1
1

0
1
0
1
0
1
0
1

Execute
Execute
Trap?
Trap?
Trap?
Trap?
Trap?
Trap?

Execute
Execute
Execute
Trap?
Execute
Execute
Execute
Trap?

AM (Alignment Mask, bit 18)
The AM bit controls whether the alignment
check (AC) bit in the flag register (EFLAGS) can
allow an alignment fault. AM = 0 disables the
AC bit. AM = 1 enables the AC bit. AM = 0 is the
386 Microprocessor compatible mode.
24

intel.,

Intel486TM OX MICROPROCESSOR

TS (Task Switched, bit 3)
The TS bit is set whenever a task switch operation is performed. Execution of a floating point
instruction with TS = 1 will cause a device not
available (DNA) fault (trap vector 7). If TS= 1
and MP = 1 (monitor coprocessor in CRO) a
WAIT instruction will cause a DNA fault. See
Table 2.4.

386 Microprocessor software may load incorrect data into the AC bit in the EFLAGS register.
Setting AM = 0 will prevent AC faults from occurring before the Intel486 Microprocessor has
created the AC interrupt service routine.
WP (Write Protect, bit 16)
WP protects read-only pages from supervisor
write access. The 386 Microprocessor allows a
read-only page to be written from privilege levels 0-2. The Intel486 Microprocessor is compatible with the 386 Microprocessor when
WP = O. WP = 1 forces a fault on a write to a
read-only page from any privilege level. Operating systems with Copy-on-Write features can be
supported with the WP bit. Refer to Section
4.5.3 for further details on use of the WP bit.
NE (Numerics Exception, bit 5)
The NE bit controls whether unmasked floating
point exceptions (UFPE) are handled through
interrupt vector 16 (NE = 1) or through an external interrupt (NE=O). NE=O (default at reset)
supports the DOS operating system error reporting scheme from the 8087, 80287 and 387
math coprocessor. In DOS systems, math coprocessor errors are reported via external interrupt vector 13. DOS uses interrupt vector 16 for
an operating system call. Refer to Sections
6.2.13 and 7.2.14 for more information on floating point error reporting.
For any UFPE the floating point error output pin
(FERR#) will be driven active.
For NE = 0, the Intel486 Microprocessor works
in conjunction with the ignore numeric error input (lGNNE#) and the FERR# output pins.
When a UFPE occurs and the IGNNE# input is
inactive, the Intel486 Microprocessor freezes
immediately before executing the next floating
point instruction. An external interrupt controller
will supply an interrupt vector when FERR# is
driven active. The UFPE is ignored if IGNNE#
is active and floating point execution continues.

EM (Emulate Coprocessor, bit 2)
The EM bit determines whether floating point
instructions are trapped (EM = 1) or executed. If
EM = 1, all floating point instructions will cause
fault 7.
NOTE:
WAIT instructions are not affected by the state
of EM. See Table 2.4.
MP (Monitor Coprocessor, bit 1)
The MP bit is used in conjunction with the TS bit
to determine if WAIT instructions should trap. If
MP=1 and TS=1, WAIT instructions cause
fault 7. Refer to Table 2.4. The TS bit is set to 1
on task switches by the Intel486 Microprocessor. Floating point instructions are not affected
by the state of the MP bit. It is recommended
that the MP bit be set to one for the normal
operation of the Intel486 Microprocessor.
PE (Protection Enable, bit 0)
The PE bit enables the segment based protection mechanism. If PE = 1 protection is enabled.
When PE = 0 the Intel486 Microprocessor operates in REAL mode, with segment based protection disabled, and addresses formed as in an
8086. Refer to Table 2.2.

All new CRO bits added to the 386 and Intel486 Microprocessors, except for ET and NE, are upward
compatible with the 80286 because they are in register bits not defined in the 80286. For strict compatibility with the 80286, the load machine status word
(LMSW) instruction is defined to not change the ET
or NE bits.

NOTE:
The freeze does not take place if the next instruction is one of the control instructions
FNCLEX,
FNINIT,
FNSAVE,
FNSTENV,
FNSTCW, FNSTSW, FNSTSW AX, FNENI,
FNDISI and FNSETPM. The freeze does occur
if the next instruction is WAIT.

Control Register 1 (CR1)

CR1 is reserved for use in future Intel microprocessors.
Control Register 2 (CR2)

For NE= 1, any UFPE will result in a software
interrupt 16, immediately before executing the
next non-control floating point or WAIT instruction. The ignore numeric error input (IGNNE#)
signal will be ignored.

CR2, shown in Figure 2.6, holds the 32-bit linear address that caused the last page fault detected. The
error code pushed onto the page fault handler's
stack when it is invoked provides additional status
information on this page fault.

intet

Intel486TM OX MICROPROCESSOR

LI____________________P_AG
__
E_FA_U_L_T_L_IN_E_A_R_A_D_D_R_E_S_S_R_E_G_IS_T_E_R__________________
4 3

~ICR2
o
CR3

PAGE DIRECTORY BASE REGISTER
NOTE:

g indicates Intel reserved: Do not define; See Section 2.1.6.
Figure 2.6. Control Registers 2 and 3
Control Register 3 (CR3)

2.1.2.2 System Address Registers

CR3, shown in Figure 2.6, contains the physical
base address of the page directory table. The Intel486 Microprocessor page directory is always page
aligned (4 Kbyte-aligned). This alignment is enforced
by only storing bits 20-31 in CR3.

Four special registers are defined to reference the
tables or segments supported by the 80286, 386
and Intel486 Microprocessor protection model.
These tables or segments are:
GDT (Global Descriptor Table)
IDT (Interrupt Descriptor Table)
LDT (Local Descriptor Table)
TSS (Task State Segment)

In the Intel486 Microprocessor CR3 contains two
new bits, page write-through (PWT) (bit 3) and page
cache disable (PCD) (bit 4)., The page table entry
(PTE) and page directory entry (PDE) also contain
PWT and PCD bits. PWT and PCD control page
cacheability. When a page is accessed in external
memory, the state of PWT and PCD are driven out
on the PWT and PCD pins. The source of PWT and
PCD can be CR3, the PTE or the PDE. PWT and
PCD are sourced from CR3 when the PDE is being
updated. When paging is disabled (PG = 0 in CRO),
PCD and PWT are assumed to be 0, regardless of
their state in CR3.

The addresses of these tables and segments are
stored in special registers, the System Address and
System Segment Registers, illustrated in Figure 2.4.
These registers are named GDTR, IDTR, LDTR and
TR respectively. Section 4, Protected Mode Architecture, describes the use of these registers.
System Address Registers: GOTR and IOTR
The GDTR and IDTR hold the 32-bit linear base address and 16-bit limit of the GDT and IDT, respectively.

A task switch through a task state segment (TSS)
which changes the values in CR3, or an explicit load
into CR3 with any value, will invalidate all cached
page table entries in the translation lookaside buffer
(TLB).

Since the GDT and IDT segments are global to all
tasks in the system, the GDT and IDT are defined by
32-bit linear addresses (subject to page translation if
paging is enabled) and 16-bit limit values.

The page directory base address in CR3 is a physical address. The page directory can be paged out
while its associated task is suspended, but the operating system must ensure that the page directory is
resident in physical memory before the task is dispatched. The entry in the TSS for CR3 has a physical address, with no provision for a present bit. This
means that the page directory for a task must be
resident in physical memory. The CR3 image in a
TSS must point to this area, before the task can be
dispatched through its TSS.

System Segment Registers: LOTR and TR
The LDTR and TR hold the 16-bit selector for the
LDT descriptor and the TSS descriptor, respectively.
Since the LDT and TSS segments are task specific
segments, the LDT and TSS are defined by selector
values stored in the system segment registers.
NOTE:
A programmer-invisible segment descriptor register
is associated with each system segment register.

Intel486TM OX MICROPROCESSOR

divided into "fields" corresponding to the FPU's extended-precision data type.

2.1.3 FLOATING POINT REGISTERS
Figure 2.7 shows the floating point register set. The
on-chip FPU contains eight data registers, a tag
word, a control register, a status register, an instruction pointer and a data pointer.

79
RO
R1
R2
R3

R4
R5

R6
R7

Sign

Tag
Field
1 0

64 63

Exponent

The FPU's register set can be accessed either as a
stack, with instructions operating on the top one or
two stack elements, or as a fixed register set, with
instructions operating on explicitly designated registers. The TOP field in the status word identifies the
current top-of-stack register. A "push" operation
decrements TOP by one and loads a value into the
new top register. A "pop" operation stores the value
from the current top register and then increments
TOP by one. Like other Intel486 microprocessor
stacks in memory, the FPU register stack grows
"down" toward lower-addressed registers.

Significand

~~----_4~--------~

r---r------+------------4
~~----_4~--------~

Instructions may address the data registers either
implicitly or explicitly. Many instructions operate on
the register at the TOP of the stack. These instructions implicitly address the register at which TOP
points. Other instructions allow the programmer to
explicitly specify which register to use. This explicit
register addressing is also relative to TOP.

r---r------+------------4
~~----_4~--------~

r---r------+------------4
L-~

____

~L-

________

Control Register

Instruction Pointer

Status Register

Data Pointer

2.1.3.2 Tag Word

The operation of the Intel486 Microprocessor's onchip floating point unit is exactly the same as the
387 math coprocessor. Software written for the 387
math coprocessor will run on the on-chip floating
point unit (FPU) without any modifications.

The tag word marks the content of each numeric
data register, as shown in Figure 2.8. Each two-bit
tag represents one of the eight data registers. The
principal function of the tag word is to optimize the
FPUs performance and stack handling by making it
possible to distinguish between empty and nonempty register locations. It also enables exception handlers to check the contents of a stack location without the need to perform complex decoding of the
actual data.

2.1.3.1 Data Registers

2.1.3.3 Status Word

Floating point computations use the Intel486 Microprocessor's FPU data registers. These eight SO·bit
registers provide the equivalent capacity of twenty
32-bit registers. Each of the eight data registers is

The 16-bit status word reflects the overall state of
the FPU. The status word is shown in Figure 2.9 and
is located in the status register.

Tag Word

Figure 2.7. Floating Point Registers

15
TAG (7)

TAG (6)

TAG (5)

TAG (4)

TAG (3)

TAG (2)

TAG (1)

TAG (0)

NOTE:
The index i of tag (i) is not top-relative. A program typically uses the "top" field of Status Word to determine which tag (i)
field refers to logical top of stack.
TAG VALUES:
00 = Valid
01 = Zero
10 = QNaN, SNaN, Infinity, Denormal and Unsupported Formats
11 = Empty

Figure 2.8. FPU Tag Word

intel~

Intel486TM OX MICROPROCESSOR

, - - - - - - - - - - - - - - - - - - - - BUSY

.----r-""T""------------- TOP
.--+--+--1--,----,--.------------

OF STACK POINTER

CONDITION CODE

ERROR SUMMARY STATUS - - - - - - - - - '
STACK FLAG - - - - - - - - '
EXCEPTION FLAGS:
PRECISION - - - - - - - - - - '
UNDERFLOW - - - - - - - - - - - '
OVERFLOW - - - - - - - - - - - - - '
ZERO DIVIDE - - - - - - - - - - - - - - '
DENORMALIZED OPERAND - - - - - - - - - - - - - - '
INVALID OPERATION - - - - - - - - - - - - - - - '
240440-7
ES is set if any unmasked exception bit is set; cleared otherwise.
See Table 2.5 for interpretation of condition code.
TOP values:
000 = Register 0 is Top of Stack
001 = Register 1 is Top of Stack

111 = Register 7 is Top of Stack
For definitions of exceptions. refer to the Section entitled
"Exception Handling".

Figure 2.9. FPU Status Word

The four numeric condition code bits, CO-C3, are
similar to the flags in EFLAGS. Instructions that perform arithmetic operations update CO-C3 to reflect
the outcome. The effects of these instructions on
the condition codes are summarized in Tables 2.5
through 2.8.

The B bit (Busy, bit 15) is included for 8087 compatibility. The B bit reflects the contents of the ES bit (bit
7 of the status word).
Bits 13-11 (TOP) point to the FPU register that is
the current top-of-stack.

int:el.,

Intel486TM OX MICROPROCESSOR

Table 2.5. FPU Condition Code Interpretation
Instruction

CO(S)

FPREM, FPREM1
(see Table 2.3)
02

FCOM, FCOMP,
FCOMPP, FTST,
FUCOM, FUCOMP,
FUCOMPP, FICOM,
FICOMP

C3(Z)

Three least significant bits
of quotient
00

C1 (A)

01
orO/U#

C2(C)
Reduction
0= complete
1 = incomplete

Zero
orO/U#

Operand is not
comparable
(Table 2.7)

Operand class
(see Table 2.8)

Sign
orO/U#

Operand class
(Table 2.8)

FCHS, FABS, FXCH,
FINCTOP, FDECTOP,
Constant loads,
FXTRACT, FLO,
FILD, FBLD,
FSTP (ext real)

UNDEFINED

Zero
orO/U#

UNDEFINED

FIST, FBSTP,
FRNDINT, FST,
FSTP, FADD, FMUL,
FDIV, FDIVR,
FSUB, FSUBR,
FSCALE, FSORT,
FPATAN, F2XM1,
FYL2X,FYL2XP1

UNDEFINED

Roundup
orO/U#

UNDEFINED

FXAM

FPTAN, FSIN
FCOS, FSINCOS

FLDENV, FRSTOR

Result of comparison
(see Table 2.7)

Roundup
orO/U#,
undefined
ifC2 = 1

UNDEFINED

Reduction
0= complete
1 = incomplete

Each bit loaded from memory

FINIT

Clears these bits

FLDCW, FSTENV,
FSTCW, FSTSW,
FCLEX, FSAVE

UNDEFINED

O/U#

When both IE and SF bits of status word are set, indicating a stack exception, this bit
distinguishes between stack overflow (C1 = 1) and underflow (C1 = 0).

Reduction

If FPREM or FPREM1 produces a remainder that is less than the modulus, reduction is
complete. When reduction is incomplete the value at the top of the stack is a partial
remainder, which can be used as input to further reduction. For FPTAN, FSIN, FCOS, and
FSINCOS, the reduction bit is set if the operand at the top of the stack is too large. In this
case the original operand remains at the top of the stack.

Roundup

When the PE bit of the status word is set, this bit indicates whether the last rounding in the
instruction was upward.

UNDEFINED Do not rely on finding any specific value in these bits.

infel .

Intel486TM OX MICROPROCESSOR

Table 2.6. Condition Code Interpretation after FPREM and FPREM1 Instructions
Condition Code

Interpretation after FPREM and FPREM1

o MOD8

0
0
1
1
0
0
1
1

0
1
0
1
0
1
0
1

0
0
0
0
1
1
1
1

0
1
2
3
4

Incomplete Reduction:
further interaction required
for complete reduction

Complete Reduction:
CO, C3, C1 contain three least
significant bits of quotient

5
6
7

Table 2.7. Condition Code Resulting from Comparison
Order

TOP> Operand
TOP < Operand
TOP = Operand
Unordered

0
0
1
1

0
0
0
1

0
1
0
1

Table 2.8. Condition Code Defining Operand Class
C3

0
0
0
0
0
0
0
0
1
1
1
1
1
1

0
0
0
0
1
1
1
1
0
0
0
0
1
1

0
0
1
1
0
0
1
1
0
0
1
1
0
1

0
1
0
1
0
1
0
1
0
1
0
1
0
0

Value at TOP
+ Unsupported
+ NaN
- Unsupported
- NaN
+ Normal
+ Infinity
- Normal
- Infinity
+0
+ Empty
-0
- Empty
+ Denormal
- Denormal

intel"

Intel486™ OX MICROPROCESSOR

register o. The exception condition must be resolved
via an interrupt service routine. The FPU saves the
address of the floating point instruction that caused
the exception and the address of any memory operand required by that instruction in the instruction and
data pointers (see Section 2.1.3.4).

Bit 7 is the error summary (ES) status bit. The ES bit
is set if any unmasked exception bit (bits 0-5 in the
status word) is set; ES is clear otherwise. The
FERR# (floating point error) signal is asserted when
ES is set.
Bit 6 is the stack flag (SF). This bit is used to distinguish invalid operations due to stack overflow or underflow. When SF is set, bit 9 (C1) distinguishes between stack overflow (C1 = 1) and underflow
(C1 =0).

Note that when a new value is loaded into the status
word by the FLDENV (load environment) or
FRSTOR (restore state) instruction, the value of ES
(bit 7) and its reflection in the B bit (bit 15) are not
derived from the values loaded from memory. The
values of ES and B are dependent upon the values
of the exception flags in the status word and their
corresponding masks in the control word. If ES is set
in such a case, the FERR # output of the Intel486
Microprocessor is activated immediately.

Table 2.9 shows the six exception flags in bits 0-5
of the status word. Bits 0-5 are set to indicate that
the FPU has detected an exception while executing
an instruction.
The six exception flags in the status word can be
individually masked by mask bits in the FPU control
word. Table 2.9 lists the exception conditions, and
their causes in order of precedence. Table 2.9 also
shows the action taken by the FPU if the corresponding exception flag is masked.

2.1.3.4 Instruction and Data Pointers
Because the FPU operates in parallel with the ALU
(in the Intel486 microprocessor the arithmetic and
logic unit (ALU) consists of the base architecture
registers), any errors detected by the FPU may be
reported after the ALU has executed the floating
point instruction that caused it. To allow identification of the failing numeric instruction, the Intel486
Microprocessor contains two pointer registers that
supply the address of the failing numeric instruction
and the address of its numeric memory operand (if
appropriate).

An exception that is not masked by the control word
will cause three things to happen: the corresponding
exception flag in the status word will be set, the ES
bit in the status word will be set and the FERR #
output signal will be asserted. When the Intel486 Microprocessor attempts to execute another floating
point or WAIT instruction, exception 16 occurs or an
external interrupt happens if the NE= 1 in control

Table 2.9. FPU Exceptions
Exception

Default Action
(if exception is masked)

Cause

Invalid
Operation

Operation on a signaling NaN, unsupported format,
indeterminate form (0' 00, 010, (+ 00) + (- 00), etc.), or
stack overflowlunderflow (SF is also set).

Result is a quiet NaN, integer
indefinite, or BCD indefinite

Denormalized
Operand

At least one of the operands is denormalized, i.e., it has
the smallest exponent but a nonzero significand.

Normal processing
continues

Zero Divisor

The divisor is zero while the dividend is a noninfinite,
nonzero number.

Result is 00

Overflow

The result is too large in magnitude to fit in the specified
format.

Result is largest finite value
or 00

Underflow

The true result is nonzero but too small to be
represented in the specified format, and, if underflow
exception is masked, denormalization causes loss of
accuracy.

Result is denormalized or
zero

Inexact
Result
(Precision)

The true result is not exactly representable in the
specified format (e.g., 1/3); the result is rounded
according to the rounding mode.

Normal processing
continues

int:eL

Intel486™ OX MICROPROCESSOR

The instruction and data pointers are provided for
user-written error handlers. These registers are accessed by the FLDENV (load environment).
FSTENV (store environment). FSAVE (save state)
and FRSTOR (restore state) instructions. Whenever
the Intel486 Microprocessor decodes a new floating
point instruction. it saves the instruction (including
any prefixes that may be present). the address of
the operand (if present) and the opcode.

operand-size attribute in effect (32-bit operand or
16-bit operand). When the Intel486 Microprocessor
is in the virtual-86 mode. the real address mode formats are used. The four formats are shown in Figures 2.10-2.13. The floating point instructions
FLDENV. FSTENV. FSAVE and FRSTOR are used
to transfer these values to and from memory. Note
that the value of the data pointer is undefined if the
prior floating point instruction did not have a memory
operand.

The instruction and data pointers appear in one of
four formats depending on the operating mode of
the Intel486 Microprocessor (protected mode or
real-address mode) and depending on the

NOTE:
The operand size attribute is the D bit in a segment
descriptor.

32-BIT PROTECTED MODE FORMAT
15

RESERVED

CONTROL WORD

RESERVED

STATUS WORD

RESERVED

TAG WORD

IPOFFSET
00000

C
CSSELECTOR

OPCODE 10.. 0

DATA OPERAND OFFSET

RESERVED

OPERAND SELECTOR

Figure 2.10. Protected Mode FPU Instruction and Data Pointer Image in Memory, 32-Bit Format

0000

32·BIT REAL-ADDRESS MODE FORMAT
15

RESERVED

CONTROL WORD

RESERVED

STATUS WORD

RESERVED

TAG WORD

RESERVED

INSTRUCTION POINTER 15.. 0

INSTRUCTION POINTER 31 .. 16

OPCODE 10.. 0

OPERAND POINTER 15.. 0

RESERVED
0000

OPERAND POINTER 31 .. 16

0000

00000000

Figure 2.11. Real Mode FPU Instruction and Data Pointer Image in Memory, 32-Bit Format

10
14
18

infel .
15

Intel486TM OX MICROPROCESSOR

16·BIT PROTECTED MODE FORMAT
7

0
15

CONTROL WORD

STATUS WORD

TAG WORD

IPOFFSET

CSSELECTOR

OPERAND OFFSET

OPERAND SELECTOR

16·BIT REAL·ADDRESS MODE AND
VIRTUAL·aOa6 MODE FORMAT
7

CONTROL WORD

STATUS WORD

TAG WORD

INSTRUCTION POINTER 15.. 0

OPCODE10.. 0

IP19.16 101

OPERAND POINTER 15..0

DP 19.161 0 10 0 0 0 0 0 0 0 o 0 0

Figure 2.13. Real Mode FPU
Instruction and Data Pointer
Image In Memory, 16-Bit Format

Figure 2.12. Protected Mode FPU
Instruction and Data Pointer
Image in Memory, 16-Blt Format
2.1.3.5 FPU Control Word

The FPU provides several processing options that are selected by loading a control word from memory into
the control register. Figure 2.14 shows the format and encoding of fields in the control word.

RESERVED
RESERVED·
ROUNDING CONTROL
PRECISION CONTROL

117

Ix;x;xlxl

+I ~C Ix;xl:I~I~I~I~I~1

RESERVED
• "0" ArTER RESET OR I'INIT;
CHANGEABLE UPON LOADING THE
CONTROL WORD (CW). PROGRAMS
MUST IGNORE THIS BIT.

EXC EPTION MASKS:
PRECISION
UNDERI'LOW
OVERFLOW
ZERO DIVIDE
DENORMALIZE D OPERAND
INVALID OPERATION

240440-8

Rounding Control

Precision Control
00-24 bits (single precision)
01-(reserved)
10-53 bits (double precision)
11-64 bits (extended precision)

Oo-Round to nearest or even
01-Round down (toward -00)
1D-Round up (toward + 00)
11-Chop (truncate toward zero)

Figure 2.14. FPU Control Word

Intel486TM OX MICROPROCESSOR

The low-order byte of the FPU control word configures the FPU error and exception masking. Bits 0-5
of the control word contain individual masks for each
of the six exceptions that the FPU recognizes.

Debug Registers
LINEAR BREAKPOINT ADDRESS 0

The high-order byte of the control word configures
the FPU operating mode, including precision and
rounding.
RC (Rounding Control, bits 10-11)
The RC bits provide for directed rounding and
true chop, as well as the unbiased round to
nearest even mode specified in the IEEE standard. Rounding control affects only those instructions that perform rounding at the end of
the operation (and thus can generate a precision exception); namely, FST, FSTP, FIST, all
arithmetic
instructions
(except
FPREM,
FPREM1, FXTRACT, FABS and FCHS), and all
transcendental instructions.
PC (Precision Control, bits 8-9)
The PC bits can be used to set the FPU internal
operating precision of the significand at less
than the default of 64 bits (extended precision).
This can be useful in providing compatibility with
early generation arithmetic processors of smaller precision. PC affects only the instructions
ADD, SUB, DIV, MUL, and SQRT. For all other
instructions, either the precision is determined
by the opcode or extended preCision is used.

DRO

LINEAR BREAKPOINT ADDRESS 1

DR1

LINEAR BREAKPOINT ADDRESS 2

DR2

LINEAR BREAKPOINT ADDRESS 3

DR3

Intel Reserved Do Not Define

DR4

Intel Reserved Do Not Define

DR5

BREAKPOINT STATUS

DR6

BREAKPOINT CONTROL

DR?

Test Registers

TLB

CACHE TEST DATA

TR3

CACHE TEST STATUS

TR4

CACHE TEST CONTROL

TR5

TLB TEST CONTROL

TR6

TLB TEST STATUS

TR?

= Translation Lookaside Buffer
Figure 2.15

2.1.4.2 Test Registers
The Intel486 Microprocessor contains five test registers. The test registers are shown in Figure 2.15.
TR6 and TR? are used to control the testing of the
translation lookaside buffer. TR3, TR4 and TR5 are
used for testing the on-chip cache. The use of the
test registers is discussed in Section 8.

2.1.4 DEBUG AND TEST REGISTERS
2.1.4.1 Debug Registers
The six programmer accessible debug registers, Figure 2.15, provide on-chip support for debugging. Debug registers DRO-3 specify the four linear breakpoints. The Debug control register DR?, is used to
set the breakpoints and the Debug Status Register,
DR6, displays the current state of the breakpoints.
The use of the Debug registers is described in Section 9.

2.1.5 REGISTER ACCESSIBILITY
There are a few differences regarding the accessibility of the registers in Real and Protected Mode. Table 2.10 summarizes these differences. See Section
4, Protected Mode Architecture, for further details.

int'eL

Intel486TM OX MICROPROCESSOR

Table 2.10. Register Usage

Use in
Protected Mode

Use in
Real Mode

Use in
Virtual 8086 Mode

Load

Store

Load

Store

Load

Store

General Registers

Yes

Segment Register

Yes

Flag Register

Yes

IOPL

IOPL"

Control Registers

Yes

PL = 0

Yes

GDTR

Yes

PL = 0

Yes

IDTR

Yes

PL = 0

Yes

LDTR

PL = 0

Yes

PL = 0

Yes

FPU Data Registers

Yes

FPU Control Registers

Yes

FPU Status Registers

Yes

FPU Instruction Pointer

Yes

FPU Data Pointer

Yes

Debug Registers

Yes

PL = 0

Test Registers

Yes

PL = 0

NOTES:
PL = 0: The registers can be accessed only when the current privilege level is zero.
*IOPL: The PUSHF and POPF instructions are made I/O Privilege Level sensitive in Virlual86 Mode.

3) Do not depend on the ability to retain information written into any undefined bits.
4) When loading registers always load the undefined bits as zeros.
5) However, registers which have been previously stored may be reloaded without masking.

2.1.6 COMPATIBILITY
VERY IMPORTANT NOTE:
COMPATIBILITY WITH FUTURE PROCESSORS
In the preceding register descriptions, note certain Intel486 Microprocessor register bits are
Intel reserved. When reserved bits are called
out, treat them as fully undefined. This is essential for your software compatibility with future
processors! Follow the guidelines below:
1) Do not depend on the states of any undefined bits when testing the values of defined
register bits. Mask them out when testing.
2) Do not depend on the states of any undefined bits when storing them to memory or
another register.

Depending upon the values of undefined register bits will make your software dependent upon
the unspecified Intel486 Microprocessor handling of these bits. Depending on undefined values risks making your software incompatible
with future processors that define usages for
the Intel486 Microprocessor-undefined bits.
AVOID ANY SOFTWARE DEPENDENCE UPON
THE STATE OF UNDEFINED Intel486 MICROPROCESSOR REGISTER BITS.

intel~

Intel486TM OX MICROPROCESSOR

byte at the high address. Dwords are stored in four
consecutive bytes in memory with the low-order byte
at the lowest address, the high-order byte at the
highest address. The address of a word or dword is
the byte address of the low-order byte.

2.2 Instruction Set
The Intel486 Microprocessor instruction set can be
divided into 11 categories of operations:
Data Transfer
Arithmetic
Shift/Rotate
String Manipulation
Bit Manipulation
Control Transfer
High Level Language Support
Operating System Support
Processor Control
Floating Point
Floating Point Control

In addition to these basic data types, the Intel486
Microprocessor supports two larger units of memory:
pages and segments. Memory can be divided up
into one or more variable length segments, which
can be swapped to disk or shared between programs. Memory can also be organized into one or
more 4 Kbyte pages. Finally, both segmentation and
paging can be combined, gaining the advantages of
both systems. The Intel486 Microprocessor supports both pages and segments in order to provide
maximum flexibility to the system designer. Segmentation and paging are complementary. Segmentation
is useful for organizing memory in logical modules,
and as such is a tool for the application programmer,
while pages are useful for the system programmer
for managing the physical memory of a system.

The Intel486 Microprocessor instructions are listed
in Section 10. Note that all floating point unit instruction mnemonics begin with an F.
All Intel486 Microprocessor instructions operate on
either 0, 1, 2 or 3 operands; where an operand resides in a register, in the instruction itself or in memory. Most zero operand instructions (e.g., CLI, STI)
take only one byte. One operand instructions generally are two bytes long. The average instruction is
3.2 bytes long. Since the Intel486 Microprocessor
has a 32-byte instruction queue, an average of 10
instructions will be prefetched. The use of two operands permits the following types of common instructions:

2.3.1 ADDRESS SPACES
The Intel486 Microprocessor has three distinct address spaces: logical, linear, and physical. A logical address (also known as a virtual address) consists of a selector and an offset. A selector is the
contents of a segment register. An offset is formed
by summing all of the addressing components
(BASE, INDEX, DISPLACEMENT) discussed in Section 2.5.3 Memory Addressing Modes into an effective address. Since each task on the Intel486 Microprocessor has a maximum of 16K (214 -1) selectors, and offsets can be 4 gigabytes, (2 32 bits)
this gives a total of 246 bits or 64 terabytes of logical address space per task. The programmer sees
this virtual address space.

Register to Register
Memory to Register
Memory to Memory
Immediate to Register
Register to Memory
Immediate to Memory
The operands can be either 8, 16, or 32 bits long. As
a general rule, when executing code written for the
Intel486 or 386 Microprocessors (32-bit code), operands are 8 or 32 bits; when executing existing 80286
or 8086 code (16-bit code), operands are 8 or 16
bits. Prefixes can be added to all instructions which
override the default length of the operands (Le., use
32-bit operands for 16-bit code, or 16-bit operands
for 32-bit code).

The segmentation unit translates the logical address space into a 32-bit linear address space. If the
paging unit is not enabled then the 32-bit linear address corresponds to the physical address. The
paging unit translates the linear address space into
the physical address space. The physical address
is what appears on the address pins.
The primary difference between Real Mode and Protected Mode is how the segmentation unit performs
the translation of the logical address into the linear
address. In Real Mode, the segmentation unit shifts
the selector left four bits and adds the result to the
offset to form the linear address. While in Protected
Mode every selector has a linear base address associated with it. The linear base address is stored in
one of two operating system tables (Le., the Local
Descriptor Table or Global Descriptor Table). The
selector's linear base address is added to the offset
to form the final linear address.

2.3 Memory Organization
Introduction
Memory on the Intel486 Microprocessor is divided
up into 8-bit quantities (bytes), 16-bit quantities
(words), and 32-bit quantities (dwords). Words are
stored in two consecutive bytes in memory with the
low-order byte at the lowest address, the high order
36

intel~

Intel486TM OX MICROPROCESSOR

EFFECTIVE ADDRESS CALCULATION

l
J
~ I",,,u'~rn' I
INDEX

SCALE
1,2,4,8

PHYSICAL
MEMORY

~
[32
15

3 20

II L

SELECTOR

R
P
L

BE3# - BEO#
A31 -A2
EFFECTIVE

ADDRESS
LOGICAL OR

13 VIRTUAL ADDRESS

SEGMENTATION
UNIT

LINEAR
ADDRESS

PAGING UNIT
(OPTIONAL USE)

PHYSICAL
ADDRESS

DESCRIPTOR
INDEX

SEGMENT
REGISTER

240440-4

Figure 2,16, Address Translation

Figure 2.16 shows the relationship between the various address spaces.

and create a system with a four gigabyte linear address space. This creates a system where the virtual
address space is the same as the linear address
space. Further details of segmentation are discussed in Section 4.1.

2,3,2 SEGMENT REGISTER USAGE
The main data structure used to organize memory is
the segment. On the Intel486 Microprocessor, segments are variable sized blocks of linear addresses
which have certain attributes associated with them.
There are two main types of segments: code and
data, the segments are of variable size and can be
as small as 1 byte or as large as 4 gigabytes (2 32
bytes).

2.4 1/0 Space
The Intel486 Microprocessor has two distinct physical address spaces: Memory and 1/0. Generally, peripherals are placed in 1/0 space although the Intel486 Microprocessor also supports memorymapped peripherals. The 1/0 space consists of
64 Kbytes, it can be divided into 64K 8-bit port.s, 3.2K
16-bit ports, or 16K 32-bit ports, or any combination
of ports which add up to less than 64 Kbytes. The
64K 1/0 address space refers to physical memory
rather than linear address since 1/0 instructions do
not go through the segmentation or paging hardware. The M/IO# pin acts as an additional address
line thus allowing the system designer to easily determine which address space the processor is accessing.

In order to provide compact instruction encoding,
and increase processor performance, instructions
do not need to explicitly specify which segment register is used. A default segment register is automatically chosen according to the rules of Table 2.11
(Segment Register Selection Rules). In general, data
references use the selector contained in the DS register; Stack references use the SS register and Instruction fetches use the CS register. The contents
of the Instruction Pointer provide the offset. Special
segment override prefixes allow the ~xplicit u~e o! ~
given segment register, and overnde the ImpliCit
rules listed in Table 2.11. The override prefixes also
allow the use of the ES, FS and GS segment registers.

The 1/0 ports are accessed via the IN and OUT 1/0
instructions, with the port address supplied as an
immediate 8-bit constant in the instruction or in the
DX register. All 8- and 16-bit port addresses are zero
extended on the upper address lines. The 1/0 instructions cause the MIIO# pin to be driven low.

There are no restrictions regarding the overlapping
of the base addresses of any segments. Thus, all 6
segments could have the base address set to zero

1/0 port addresses OOF8H through OOFFH are reserved for use by Intel.

Intel486™ OX MICROPROCESSOR

Table 2.11. Segment Register Selection Rules
Type of
Memory Reference

Implied (Default)
Segment Use

Segment Override
Prefixes Possible

Code Fetch

None

Destination of PUSH, PUSHF, INT,
CALL, PUSHA Instructions

None

Source of POP, POPA, POPF,
IRET, RET instructions

None

Destination of STOS, MOVS, REP
STOS, REP MOVS Instructions
(DI is Base Register)

None

DS
DS
DS
DS
DS
DS
SS
SS

All

Other Data References, with
Effective Address Using Base
Register of:
[EAX]
[EBX]
[ECX]
[EDX]
[ESI]
[EDI]
[EBP]
[ESP]

2.5 Addressing Modes

2.5.3 32-BIT MEMORY ADDRESSING MODES
The remaining 9 modes provide a mechanism for
specifying the effective address of an operand. The
linear address consists of two components: the segment base address and an effective address. The
effective address is calculated by using combinations of the following four address elements:

2.5.1 ADDRESSING MODES OVERVIEW
The Intel486 Microprocessor provides a total of 11
addressing modes for instructions to specify operands. The addressing modes are optimized to allow
the efficient execution of high level languages such
as C and FORTRAN, and they cover the vast majority of data references needed by high-level languages.

DISPLACEMENT: An 8-, or 32-bit immediate value,
following the instruction.
BASE: The contents of any general purpose register. The base registers are generally used by compilers to point to the start of the local variable area.

2.5.2 REGISTER AND IMMEDIATE MODES
Two of the addressing modes provide for instructions that operate on register or immediate operands:

INDEX: The contents of any general purpose register except for ESP. The index registers are used to
access the elements of an array, or a string of characters.

SCALE: The index register's value can be multiplied
by a scale factor, either 1, 2, 4 or 8. Scaled index

Immediate Operand Mode: The operand is included in the instruction as part of the opcode.

int:eL

Intel486TM OX MICROPROCESSOR

mode is especially useful for accessing arrays or
structures.

Based Mode: A BASE register's contents is added
to a DISPLACEMENT to form the operand's offset.
EXAMPLE: MOV ECX, [EAX + 24)

Combinations of these 4 components make up the 9
additional addressing modes. There is no performance penalty for using any of these addressing combinations, since the effective address calculation is
pipelined with the execution of other instructions.
The one exception is the simultaneous use of Base
and Index components which requires one additional clock.

Index Mode: An INDEX register's contents is added
to a DISPLACEMENT to form the operand's offset.
EXAMPLE: ADD EAX, TABLE[ESI)
Scaled Index Mode: An INDEX register's contents is
multiplied by a scaling factor which is added to a
DISPLACEMENT to form the operand's offset.
EXAMPLE: IMUL EBX, TABLE[ESI·4],7

As shown in Figure 2.17, the effective address (EA)
of an operand is calculated according to the following formula.

Based Index Mode: The contents of a BASE register
is added to the contents of an INDEX register to
form the effective address of an operand.
EXAMPLE: MOV EAX, [ESI) [EBX)

EA= Base Reg + (Index Reg' Scaling) + Displacement

Direct Mode: The operand's offset is contained as
part of the instruction as an 8-, 16- or 32-bit displacement.
EXAMPLE: INC Word PTR [500]

Based Scaled Index Mode: The contents of an INDEX register is multiplied by a SCALING factor and
the result is added to the contents of a BASE register to obtain the operand's offset.
EXAMPLE: MOV ECX, [EDX·S] [EAX]

SEGMENT REGISTER

55
GS
FS
ES
OS

-cs

EFFECTIVE
ADOREss

/
DESCRIPTOR REGISTERS

LINEAR
ADDRESS

SEGMENT
LIMIT

•

TARGET ADDRESS

GS
FS
ES

SELECTED
SEGMENT

os
ACCESS RIGHTS CS
LIMIT
BASE ADDRESS

------~
SEGMENT BASE ADDRESS

240440-5

Figure 2.17. Addressing Mode Calculations

infel~

Intel486TM OX MICROPROCESSOR

Based Index Mode with Displacement: The contents
of an INDEX Register and a BASE register's contents and a DISPLACEMENT are all summed together to form the operand offset.
EXAMPLE: ADD EDX, [ESII [EBP + OOFFFFFOH]

Address Length Prefix since, with D = 0, the default
addressing mode is 16-bits.
Example: The D bit is 1, and the program wants to
store a 16-bit quantity. The Operand Length Prefix is
used to specify only a 16-bit value; MOV MEM16,
DX.

Based Scaled Index Mode with Displacement: The
contents of an INDEX register are multiplied by a
SCALING factor, the result is added to the contents
of a BASE register and a DISPLACEMENT to form
the operand's offset.
EXAMPLE: MOV EAX, LOCALTABLE[EDI*4]
[EBP+80]

The OPERAND LENGTH and Address Length Prefixes can be applied separately or in combination to
any instruction. The Address Length Prefix does not
allow addresses over 64 Kbytes to be accessed in
Real Mode. A memory address which exceeds
FFFFH will result in a General Protection Fault. An
Address Length Prefix only allows the use of the additional Intel486 Microprocessor addressing modes.

2.5.4 DIFFERENCES BETWEEN 16- AND 32-BIT
ADDRESSES

When executing 32-bit code, the Intel486 Microprocessor uses either 8-, or 32-bit displacements, and
any register can be used as base or index registers.
When executing 16-bit code, the displacements are
either 8, or 16 bits, and the base and index register
conform to the 80286 model. Table 2.12 illustrates
the differences.

In order to provide software compatibility with the
80286 and the 8086, the Intel486 Microprocessor
can execute f6-bit instructions in Real and Protected Modes. The processor determines the size of the
instructions it is executing by examining the D bit in
the CS segment Descriptor. If the D bit is 0 then all
operand lengths and effective addresses are assumed to be 16 bits long. If the D bit is 1 then the
default length for operands and addresses is 32 bits.
In Real Mode the default size for operands and addresses is 16-bits.

2.6 Data Formats
2.6.1 DATA TYPES

Regardless of the default precision of the operands
or addresses, the Intel486 Microprocessor is able to
execute either 16- or 32-bit instructions. This is
specified via the use of override prefixes. Two prefixes, the Operand Size Prefix and the Address
Length Prefix, override the value of the D bit on an
individual instruction basis. These prefixes are automatically added by Intel assemblers.

The Intel486 Microprocessor can support a wide variety of data types. In the following descriptions, the
on-chip floating point unit (FPU) consists of the floating point registers. The central processing unit
(CPU) consists of the base architecture registers.
2.6.1.1 Unsigned Data Types

Example: The processor is executing in Real Mode
and the programmer needs to access the EAX registers. The assembler code for this might be MOV
EAX, 32-bit MEMORYOP, ASM486 Macro Assembler automatically determines that an Operand Size
Prefix is needed and generates it.

The FPU does not support unsigned data types. Refer to Table 2.13.
Byte:
UnSigned 8-bit quantity
Word: Unsigned 16-bit quantity
Dword: Unsigned 32-bit quantity

Example: The D bit is 0, and the programmer wishes
to use Scaled Index addressing mode to access an
array. The Address Length Prefix allows the use of
MOV DX, TABLE[ESI*2]. The assembler uses an

The least significant bit (LSB) in a byte is bit 0, and
the most significant bit is 7.

Table 2.12. BASE and INDEX Registers for 16- and 32-Bit Addresses
16-Bit Addressing
BASE REGISTER
INDEX REGISTER

BX,BP
SI,DI

SCALE FACTOR
DISPLACEMENT

none
0,8,16 bits

32-Bit Addressing
Any 32-bit GP Register
Any 32-bit GP Register
Except ESP
1,2,4,8
0,8,32 bits

int'el..

Intel486TM OX MICROPROCESSOR

2.6.1.2 Signed Data Types

2.6.1.4 BCD Data Types

All signed data types assume 2's complement notation. The signed data types contain two fields, a sign
bit and a magnitude. The sign bit is the most significant bit (MSB). The number is negative if the sign bit
is 1. If the sign bit is 0, the number is positive. The
magnitude field consists of the remaining bits in the
number. Refer to Table 2.13.

The Intel486 Microprocessor supports packed and
unpacked binary coded decimal (BCD) data types. A
packed BCD data type contains two digits per byte,
the lower digit is in bits 0-3 and the upper digit in
bits 4-7. An unpacked BCD data type contains 1
digit per byte stored in bits 0-3.

8-bit Integer:

The CPU supports 8-bit packed and unpacked BCD
data types. The FPU only supports 80-bit packed
BCD data types. Refer to Table 2.13.

Signed 8-bit quantity

16-bit Integer: Signed 16-bit quantity
32-bit Integer: Signed 32-bit quantity
64-bit Integer: Signed 64-bit quantity

2.6.1.5 String Data Types

The FPU only supports 16-, 32- and 64-bit integers.
The CPU only supports 8-, 16- and 32-bit integers.

A string data type is a contiguous sequence of bits,
bytes, words or dwords. A string may contain between 1 byte and 4 Gbytes. Refer to Table 2.14.

2.6.1.3 Floating Point Data Types

String data types are only supported by the CPU.

Floating point data type in the Intel486 Microprocessor contain three fields, sign, significand and exponent. The sign field is one bit and is the MSB of the
floating point number. The number is negative if the
sign bit is 1. If the sign bit is 0, the number is positive. The significand gives the significant bits of the
number. The exponent field contains the power of 2
needed to scale the significand. Refer to Table 2.13.

Byte String: Contiguous sequence of bytes.
Word String: Contiguous sequence of words.
Dword String: Contiguous sequence of dwords.
Bit String: A set of contiguous bits. In the Intel486
Microprocessor bit strings can be up to 4 gigabits
long.

Only the FPU supports floating pOint data types.
Single Precision Real:

23-bit significand and 8bit exponent. 32 bits total.

Double Precision Real:

52-bit significand and 11bit exponent. 64 bits total.

2.6.1.6 ASCII Data Types
The Intel486 Microprocessor supports ASCII (American Standard Code for Information Interchange)
strings and can perform arithmetic operations (such
as addition and division) on ASCII data. Refer to Table 2.14.

Extended Precision Real: 64-bit significand and 15bit exponent. 80 bits total. .

intel·

Intel486TM OX MICROPROCESSOR

Table 2.13. Intel486TM Microprocessor Data Types
Supported by SUpported by

B••e Reglate,. FPU

Le••, Slgnlllcanl Byte

J. J.

Data Format

Byte

J.
Range

Precision 7

0-255

8 bits

01 7

C
15

Word

0-64K

16 bits

Dword

0-4G

32 bits

102

8-Bit Integer

8 bits

104

Two's

16 bits

Complement

SignBII

32-Bit Integer

X X

Two's

32 bits

Complement

t
0

II
t

SlgnBII
63

64-Bit Integer

1019

Two's

64 bits

Complemant
SlgnB~

8-Bit Unpacked BCD

0-9

1 Digit

8-Bit Packed BCD

0-9

2 Digits

80-Bit Packed BCD

Two BCD Digits per Byte

I Ignored
SlgnBII

±10±18 18 Digits

±10±38 24 Bits

IIB~I

X ±10±308 53 Bits
SlgnB"
79

Significend

SlgnB~

0
Significand

Biased
EJcp.

IB~dl

X ±10±4932 64 Bits

Extended Precision Real

SignBII

Double Precision Real

One BCO Dig" per Bytel

Single Precision Real

109

Two's
Complement

Sign B~

16-Bit Integer

Slgnlflcand

infel .

Intel486TM OX MICROPROCESSOR

Table 2.14. String and ASCII Data Types
String Data Types
Address

LJ ...
A+N

Byte String

A+2N+I

A+2N

Word String

115

A+4N+3 A+4N+2 A+4N+I
i

Dwordl
String 31

A+4N
i

...

A+7

A+6

A+5

...

131

017

A+l

115

A+4

A+3

I
7

0115

A+2

A+I

A
i

0131

A- 268,435,456

,I.

A+3
017

I
1

A + 266,435,455

Bit
String

A
0

A+2

A+3

A+I
I

011117

A+2
017

017

017 ... 1 017

+2,147,463,647

A-I

A+l

017

,I.

A-3

A-2
017

017

011117

f f

-2,147,463,648

+10

ASCII Data Types

ASCII Character

Table 2_15. Pointer Data Types

2.6.1.7 Pointer Data Types

Lea.t Sig Byte

A pointer data type contains a value that gives the
address of a piece of data. The Intel486 Microprocessor supports two types of pointers. Refer to Table
2.15.

,I.

Data Format

1 l JI I II J J
I I
47

48-Bit Pointer

48-bit Pointer: 16-bit selector and 32-bit offset
32-bit Pointer: 32-bit offset

32-Bit Pointer

Ollset

Selector

0
Offset

infel .

Intel486TM OX MICROPROCESSOR

Hardware interrupts occur as the result of an external event and are classified into two types: maskable
or non-maskable. Interrupts are serviced after the
execution of the current instruction. After the interrupt handler is finished servicing the interrupt, execution proceeds with the instruction immediately af·
ter the interrupted instruction. Sections 2.7.3 and
2.7.4 discuss the differences between Maskable and
Non-Maskable interrupts.

2.6.2 LITTLE ENDIAN vs BIG END IAN
DATA FORMATS
The Intel486 Microprocessor, as well as all other
members of the 86 architecture use the "little-end ian" method for storing data types that are larger
than one byte. Words are stored in two consecutive
bytes in memory with the low-order byte at the lowest address and the high order byte at the high address. Dwords are stored in four consecutive bytes
in memory with the low-order byte at the lowest address and the high order byte at the highest address.
The address of a word or dword data item is the byte
address of the low-order byte.

Exceptions are classified as faults, traps, or aborts
depending on the way they are reported, and whether or not restart of the instruction causing the exception is supported. Faults are exceptions that are detected and serviced before the execution of the
faulting instruction. A fault would occur in a virtual
memory system, when the processor referenced a
page or a segment which was not present. The operating system would fetch the page or segment from
disk, and then the Intel486 Microprocessor would restart the instruction. Traps are exceptions that are
reported immediately after the execution of the instruction which caused the problem. User defined
interrupts are examples of traps. Aborts are exceptions which do not permit the precise location of the
instruction causing the exception to be determined.
Aborts are used to report severe errors, such as a
hardware error, or illegal values in system tables.

Figure 2.18 illustrates the differences between the
big-end ian and little-endian formats for dwords. The
32 bits of data are shown with the low order bit numbered bit 0 and the high order bit numbered 32. Bigendian data is stored with the high-order bits at the
lowest addressed byte. Little-endian data is stored
with the high-order bits in the highest addressed
byte.
The Intel486 Microprocessor has two instructions
which can convert 16- or 32-bit data between the
two byte orderings. BSWAP (byte swap) handles
four byte values and XCHG (exchange) handles two
byte values.

m+3
31

m+2
24

m+1
16

Thus, when an interrupt service routine has been
completed, execution proceeds from the instruction
immediately following the interrupted instruction. On
the other hand, the return address from an exception fault routine will always point at the instruction
causing the exception and include any leading instruction prefixes. Table 2.16 summarizes the possible interrupts for the Intel486 Microprocessor and
shows where the return address points.

Dword In Lltlle·Endlan Memory Format
m+1

m
31

m+2
16

m+3

The Intel486 Microprocessor has the ability to handle up to 256 different interrupts/exceptions. In order to service the interrupts, a table with up to 256
interrupt vectors must be defined. The interrupt vectors are simply pointers to the appropriate interrupt
service routine. In Real Mode (see Section 3.1), the
vectors are 4 byte quantities, a Code Segment plus
a 16-bit offset; in Protected Mode, the interrupt vectors are 8 byte quantities, which are put in an Interrupt Descriptor Table (see Section 4.3.3.4). Of the
256 possible interrupts, 32 are reserved for use by
Intel, the remaining 224 are free to be used by the
system designer.

Dword In Blg·Endlan Memory Format

Figure 2.18. Big vs Little Endian Memory Format

2.7 Interrupts
2.7.1 INTERRUPTS AND EXCEPTIONS
Interrupts and exceptions alter the normal program
flow, in order to handle external events, to report
errors or exceptional conditions. The difference between interrupts and exceptions is that interrupts are
used to handle asynchronous external events while
exceptions handle instruction faults. Although a program can generate a software interrupt via an INT N
instruction, the processor treats software interrupts
as exceptions.

2.7.2 INTERRUPT PROCESSING
When an interrupt occurs the following actions happen. First, the current program address and the
Flags are saved on the stack to allow resumption of
the interrupted program. Next, an 8-bit vector is sup-

infel"

Intel486TM OX MICROPROCESSOR

plied to the Intel486 Microprocessor which identifies
the appropriate entry in the interrupt table. The table
contains the starting address of the interrupt service
routine. Then, the user supplied interrupt service
routine is executed. Finally, when an IRET instruction is executed the old processor state is restored
and program execution resumes at the appropriate
instruction.

2.7.3 MASKABLE INTERRUPT
Maskable interrupts are the most common way used
by the Intel486 Microprocessor to respond to asynchronous external hardware events. A hardware interrupt occurs when the INTR is pulled high and
the Interrupt Flag bit (IF) is enabled. The processor
only responds to interrupts between instructions,
(REPeat String instructions, have an "interrupt window", between memory moves, which allows interrupts during long string moves). When an interrupt
occurs the processor reads an 8-bit vector supplied
by the hardware which identifies the source of the
interrupt, (one of 224 user defined interrupts). The
exact nature of the interrupt sequence is discussed
in Section 7.2.10.

The 8-bit interrupt vector is supplied to the Intel486
Microprocessor in several different ways: exceptions
supply the interrupt vector internally; software INT
instructions contain or imply the vector; maskable
hardware interrupts supply the 8-bit vector via the
interrupt acknowledge bus sequence. Non-Maskable hardware interrupts are assigned to interrupt
vector 2.

Table 2.16. Interrupt Vector Assignments

Function

Instruction Which

Interrupt
Number

Can Cause

Exception

Return Address
Points to
Faulting
Instruction

Type

Divide Error

DIV,IDIV

YES

FAULT

Debug Exception

Any Instruction

YES

TRAp·

NMllnterrupt

INT20rNMI

NMI

One Byte Interrupt

INT

TRAP

Interrupt on Overflow

INTO

TRAP

Array Bounds Check

BOUND

YES

FAULT

Invalid OP-Code

Any Illegal Instruction

YES

FAULT

Device Not Available

ESC,WAIT

YES

FAULT

Double Fault

Any Instruction That Can
Generate an Exception

ABORT

Intel Reserved

InvalidTSS

JMP, CALL, IRET, INT

YES

FAULT

Segment Not Present

Segment Register Instructions

YES

FAULT

Stack Fault

Stack References

YES

FAULT

General Protection Fault

Any Memory Reference

YES

FAULT

Page Fault

Any Memory Access or Code Fetch

YES

FAULT

Intel Reserved

Floating Point Error

Floating Point, WAIT

YES

FAULT

Unaligned Memory Access

YES

FAULT

INTn

TRAP

Alignment Check Interrupt
Intel Reserved

18-31

Two Byte Interrupt

0-255

·Some debug ,exceptions may report both traps on the previous instruction, and faults on the next instruction.

Intel486TM OX MICROPROCESSOR

The IF bit in the EFLAG registers is reset when an
interrupt is being serviced. This effectively disables
servicing additional interrupts during an interrupt
service routine. However, the IF may be set explicitly
by the interrupt handler, to allow the nesting of interrupts. When an IRET instruction is executed the
original state of the IF is restored.

2.7.6 INTERRUPT AND EXCEPTION
PRIORITIES
Interrupts are externally-generated events. Maskable Interrupts (on the INTR input) and Non-Maskable
Interrupts (on the NMI input) are recognizee! at instruction boundaries. When NMI and maskable
INTR are both recognized at the same instruction
boundary, the Intel486 Microprocessor invokes the
NMI service routine first. If, after the NMI service
routine has been invoked, maskable interrupts are
still enabled, then the Intel486 Microprocessor will
invoke the appropriate interrupt service routine.

2.7.4 NON-MASKABLE INTERRUPT
Non-maskable interrupts provide a method of servicing very high priority interrupts. A common example
of the use of a non-maskable interrupt (NMI) would
be to activate a power failure routine. When the NMI
input is pulled high it causes an interrupt with an
internally supplied vector value of 2. Unlike a normal
hardware interrupt, no interrupt acknowledgment sequence is performed for an NMI.

Table 2.17a. Intel486TM Microprocessor Priority
for Invoking Service Routines In Case
of Simultaneous External Interrupts
1.NMI
2.INTR

While executing the NMI servicing procedure, the Intel486 Microprocessor will not service further NMI
requests until an interrupt return (IRET) instruction is
executed or the processor is reset. If NMI occurs
while currently servicing an NMI, its presence will be
saved for servicing after executing the first IRET instruction. The IF bit is cleared at the beginning of an
NMI interrupt to inhibit further INTR interrupts.

Exceptions are internally-generated events. Exceptions are detected by the Intel486 Microprocessor if,
in the course of executing an instruction, the Intel486 Microprocessor detects a problematic condition. The Intel486 Microprocessor then immediately
invokes the appropriate exception service routine.
The state of the Intel486 Microprocessor is such
that the instruction causing the exception can be restarted. If the exception service routine has taken
care of the problematic condition, the instruction will
execute without causing the same exception.

2.7.5 SOFTWARE INTERRUPTS
A third type of interrupt/exception for the Intel486
Microprocessor is the software interrupt. An INT n
instruction causes the processor to execute the interrupt service routine pointed to by the nth vector in
the interrupt table.

It is possible for a single instruction to generate several exceptions (for example, transferring a single
operand could generate two page faults if the oper- .
and location spans two "not present" pages). However, only one exception is generated upon each attempt to execute the instruction. Each exception
service routine should correct its corresponding exception, and restart the instruction. In this manner,
exceptions are serviced until the instruction exe.
cutes successfully.

A special case of the two byte software interrupt INT
n is the one byte INT 3, or breakpoint interrupt. By
inserting this one byte instruction in a program, the
user can set breakpoints in his program as a debugging tool.
A final type of software interrupt is the single step
interrupt. It is discussed in Section 9.2.

As the Intel486 Microprocessor executes instructions, it follows a consistent cycle in checking for
exceptions, as shown in Table 2.17b. This cycle is
repeated as each instruction is executed, and occurs in parallel with instruction decoding and execution.

intel..

Intel486TM OX MICROPROCESSOR

Table 2.17b. Sequence of Exception Checking

2.7.7 INSTRUCTION RESTART

Consider the case of the Intel486 Microprocessor having just completed an instruction. It then
performs the following checks before reaching
the point where the next instruction is completed:

The Intel486 Microprocessor fully supports restarting all instructions after faults. If an exception is detected in the instruction to be executed (exception
categories 4 through 10 in Table 2.17b), the Intel486
Microprocessor invokes the appropriate exception
service routine. The Intel486 Microprocessor is in a
state that permits restart of the instruction, for all
cases but those in Table 2.17c. Note that all such
cases are easily avoided by proper design of the
operating system.

1. Check for Exception 1 Traps from the instruction just completed (single-step via Trap Flag,
or Data Breakpoints set in the Debug Registers).
2. Check for Exception 1 Faults in the next instruction (Instruction Execution Breakpoint
set in the Debug Registers for the next instruction).
3. Check for external NMI and INTR.
4. Check for Segmentation Faults that prevented fetching the entire next instruction (exceptions 11 or 13).
5. Check for Page Faults that prevented fetching
the entire next instruction (exception 14).
6. Check for Faults decoding the next instruction
(exception 6 if illegal opcode; exception 6 if in
Real Mode or in Virtual 8086 Mode and attempting to execute an instruction for Protected Mode only (see Section 4.6.4); or exception 13 if instruction is longer than 15 bytes, or
privilege violation in Protected Mode (i.e., not
at IOPL or at CPL=O).
7. If WAIT opcode, check if TS=1 and MP=1
(exception 7 if both are 1).
8. If opcode for Floating Point Unit, check if
EM = 1 or TS = 1 (exception 7 if either are 1).
9. If opcode for Floating Point Unit (FPU), check
FPU error status (exception 16 if error status
is asserted).
10. Check in the following order for each memory reference required by the instruction:
a. Check for Segmentation Faults that prevent transferring the entire memory quantity (exceptions 11, 12, 13).
b. Check for Page Faults that prevent transferring the entire memory quantity (exception 14).

Table 2.17c. Conditions Preventing
Instruction Restart
An instruction causes a task switch to a task
whose Task State Segment is partially "not
present". (An entirely "not present" TSS is restartable.) Partially present TSS's can be avoided either by keeping the TSS's of such tasks
present in memory, or by aligning TSS segments
to reside entirely within a single 4K page (for TSS
segments of 4 Kbytes or less).
NOTE:
These conditions are avoided by using the operating system designs mentioned in this table.

2.7.8 DOUBLE FAULT
A Double Fault (exception 8) results when the processor attempts to invoke an exception service routine for the segment exceptions (10,11, 12 or 13),
but in the process of doing so, detects an exception
other than a Page Fault (exception 14).
A Double Fault (exception 8) will also be generated
when the processor attempts to invoke the Page
Fault (exception 14) service routine, and detects an
exception other than a second Page Fault. In any
functional system, the entire Page Fault service routine must remain "present" in memory.
When a Double Fault occurs, the Intel486 Microprocessor invokes the exception service routine for
exception 8.

NOTE:
The order stated supports the concept of the
paging mechanism being "underneath" the segmentation mechanism. Therefore, for any given
code or data reference in memory, segmentation exceptions are generated before paging exceptions are generated.

2.7.9 FLOATING POINT INTERRUPT VECTORS
Several interrupt vectors of the Intel486 Microprocessor are used to report exceptional conditions
while executing numeric programs in either real or
protected mode. Table 2.18 shows these interrupts
and their causes.

infel .

Intel486TM OX MICROPROCESSOR

Table 2.18. Interrupt Vectors Used by FPU
Interrupt
Number

Cause of Interrupt

A Floating Point instruction was encountered when EM or TS of the Intel486TM Processor
control register zero (CRO) was set. EM = 1 indicates that software emulation of the
instruction is required. When TS is set, either a Floating Point or WAIT instruction causes
interrupt 7. This indicates that the current FPU context may not belong to the current task.

The first word or doubleword of a numeric operand is not entirely within the limit of its
segment. The return address pushed onto the stack of the exception handler points at the
Floating Point instruction that caused the exception, including any prefixes. The FPU has
not executed this instruction; the instruction pointer and data pointer register refer to a
previous, correctly executed instruction.

The previous numerics instruction caused an unmasked exception. The address of the
faulty instruction and the address of its operand are stored in the instruction pointer and
data pointer registers. Only Floating Point and WAIT instructions can cause this interrupt.
The Intel486TM Processor return address pushed onto the stack of the exception handler
points to a WAIT or Floating Point instruction (including prefixes). This instruction can be
restarted after clearing the exception condition in the FPU. The FNINIT, FNCLEX,
FNSTSW, FNSTENV, and FNSAVE instructions cannot cause this interrupt.

intel"
3.0

Intel486TM OX MICROPROCESSOR

These are the only instruction forms where the
LOCK prefix is legal on the Intel486 Microprocessor:

REAL MODE ARCHITECTURE

3.1 Real Mode Introduction

BIT Test and
SET IRESETICOMPLEMENT
XCHG
XCHG
ADD, OR, ADC, SBB,
AND, SUB, XOR
NOT, NEG, INC, DEC
CMPXCHG, XADD

All of the Intel486 Microprocessor instructions are
available in Real Mode (except those instructions
listed in Section 4.6.4). The default operand size in
Real Mode is 16 bits, just like the 8086. In order to
use the 32-bit registers and addressing modes, override prefixes must be used. In addition, the segment
size on the Intel486 Microprocessor in Real Mode is
64 Kbytes so 32-bit effective addresses must have a
value less the OOOOFFFFH. The primary purpose of
Real Mode is to set up the processor for Protected
Mode Operation.

Mem, Reg/immed
Reg, Mem
Mem, Reg
Mem, Reg/immed
Mem
Mem, Reg

An exception 6 will be generated if a LOCK prefix is
placed before any instruction form or opcode not
listed above. The LOCK prefix allows indivisible
read/modify/write operations on memory operands
using the instructions above. For example, even the
ADD Reg, Mem is not LOCKable, because the Mem
operand is not the destination (and therefore no
memory read/modify/operation is being performed).

The LOCK prefix on the Intel486 Microprocessor,
even in Real Mode, is more restrictive than on the
80286. This is due to the addition of paging on the
Intel486 Microprocessor in Protected Mode and Virtual 8086 Mode. Paging makes it impossible to guarantee that repeated string instructions can be
LOCKed. The Intel486 Microprocessor can't require
that all pages holding the string be physically present in memory. Hence, a Page Fault (exception 14)
might have to be taken during the repeated string
instruction. Therefore the LOCK prefix can't be supported during repeated string instructions.

Operands
(Dest, Source)

Opcode

When the processor is reset or powered up it is initialized in Real Mode. Real Mode has the same base
architecture as the 8086, but allows access to the
32-bit register set of the Intel486 Microprocessor.
The addressing mechanism, memory size, interrupt
handling, are all identical to the Real Mode on the
80286.

Since, on the Intel486 Microprocessor, repeated
string instructions are not LOCKable, it is not possible to LOCK the bus for a long period of time. Therefore, the LOCK prefix is not IOPL-sensitive on the
Intel486 Microprocessor. The LOCK prefix can be
used at any privilege level, but only on the instruction forms listed above.

3.2 Memory Addressing
In Real Mode the maximum memory size is limited to
1 megabyte. Thus, only address lines A2-A19 are
active. (Exception, after RESET address lines A20A31 are high during CS-relative memory cycles until
an intersegment jump or call is executed (see Section 6.5)).

MAX LIMIT
FIXED AT 64K IN
REAL MODE

SELECTED
SEGMENT

'-----' ---

-~~----t-SEGMENT BASE

240440-9

Figure 3.1. Real Address Mode Addressing
49

intel"

Intel486TM OX MICROPROCESSOR

3.4 Interrupts

Since paging is not allowed in Real Mode the linear
addresses are the same as physical addresses.
Physical addresses are formed in Real Mode by
adding the contents of the appropriate segment register which is shifted left by four bits to an effective
address. This addition results in a physical address
from OOOOOOOOH to 0010FFEFH. This is compatible
with 80286 Real Mode. Since segment registers are
shifted left by 4 bits, Real Mode segments always
start on 16 byte boundaries.

Many of the exceptions shown in Table 2.16 and
discussed in Section 2.7 are not applicable to Real
Mode operation, in particular exceptions 10, 11, 14,
17, will not happen in Real Mode. Other exceptions
have slightly different meanings in Real Mode; Table
3.1 identifies these exceptions.

All segments in Real Mode are exactly 64 Kbytes
long, and may be read, written, or executed. The
Intel486 Microprocessor will generate an exception
13 if a data operand or instruction fetch occurs past
the end of a segment (Le., if an operand has an
offset greater than FFFFH, for example a word with
a low byte at FFFFH and the high byte at OOOOH).

The HLT instruction stops program execution and
prevents the processor from using the local bus until
restarted. Either NMI, INTR with interrupts enabled
(IF= 1), or RESET will force the Intel486 Microprocessor out of halt. If interrupted, the saved CS:IP will
point to the next instruction after the HLT.

3.5 Shutdown and Halt

As in the case in protected mode, the shutdown will
occur when a severe error is detected that prevents
further processing. In Real Mode, shutdown can occur under two conditions:

Segments may be overlapped in Real Mode. Thus, if
a particular segment does not use all 64 Kbytes another segment can be overlayed on top of the unused portion of the previous segment. This allows
the programmer to minimize the amount of physical
memory needed for a program.

An interrupt or an exception occur (exceptions 8 or
13) and the interrupt vector is larger than the Interrupt Descriptor Table (Le., there is not an interrupt
handler for the interrupt).

3.3 Reserved Locations

A CALL, INT or PUSH instruction attempts to wrap
around the stack segment when SP is not even (Le.,
pushing a value on the stack when SP = 0001 resulting in a stack segment greater than FFFFH).

There are two fixed areas in memory which are reserved in Real address mode: system initialization
area and the interrupt table area. Locations OOOOOH
through 003FFH are reserved for interrupt vectors.
Each one of the 256 possible interrupts has a 4-byte
jump vector reserved for it. Locations FFFFFFFOH
through FFFFFFFFH are reserved for system initialization.

An NMI input can bring the processor out of shutdown if the Interrupt Descriptor Table limit is large
enough to contain the NMI interrupt vector (at least
0017H) and the stack has enough room to contain
the vector and flag information (Le., SP is greater
than 0005H). If these conditions are not met, the
Intel486 CPU is unable to execute the NMI and executes another shutdown cycle. In this case, the processor remains in the shutdown and can only exit via
the RESET input.

Table 3.1. Exceptions with Different Meanings in Real Mode (see Table 2.16)
Function

Interrupt
Number

Related
Instructions

Return
Address Location

Interrupt table limit too small

INT Vector is not
within table limit

Before
Instruction

CS, OS, ES, FS, GS
Segment overrun exception

Word memory reference
beyond offset = FFFFH.
An attempt to execute
past the end of CS segment.

Before
Instruction

SS Segment overrun exception

Stack Reference
beyond offset = FFFFH

Before
Instruction

infel .
4.0

Intel486TM OX MICROPROCESSOR

PROTECTED MODE
ARCHITECTURE

4.2 Addressing Mechanism
Like Real Mode, Protected Mode uses two components to form the logical address, a 16-bit selector is
used to determine the linear base address of a segment, the base address is added to a 32-bit effective
address to form a 32-bit linear address. The linear
address is then either used as the 32-bit physical
address, or if paging is enabled the paging mechanism maps the 32-bit linear address into a 32-bit
physical address.

4.1 Introduction
The complete capabilities of the Intel486 Microprocessor are unlocked when the processor operates in
Protected Virtual Address Mode (Protected Mode).
Protected Mode vastly increases the linear address
space to four gigabytes (232 bytes) and allows the
running of virtual memory programs of almost unlimited size (64 terabytes or 246 bytes). In addition Protected Mode allows the Intel486 Microprocessor to
run all of the existing 8086, 80286 and 386 microprocessor software, while providing a sophisticated
memory management and a hardware-assisted protection mechanism. Protected Mode allows the use
of additional instructions especially optimized for
supporting multitasking operating systems. The base
architecture of the Intel486 Microprocessor remains
the same, the registers, instructions, and addreSSing
modes described in the previous sections are retained. The main difference between Protected
Mode, and Real Mode from a programmer's view is
the increased address space, and a different addressing mechanism.

The difference between the two modes lies in calculating the base address. In Protected Mode the selector is used to specify an index into an operating
system defined table (see Figure 4.1). The table
contains the 32-bit base address of a given segment. The physical address is formed by adding the
base address obtained from the table to the offset.
Paging provides an additional memory management
mechanism which operates only in Protected Mode.
Paging provides a means of managing the very large
segments of the Intel486 Microprocessor. As such,
paging operates beneath segmentation. The paging
mechanism translates the protected linear address
which comes from the segmentation unit into a
physical address. Figure 4.2 shows the complete Intel486 Microprocessor addressing mechanism with
paging enabled.

48/32 BIT POINTER
SEGMENT LIMIT

@----.

MEMORY OPERAND
SELECTED
SEGMENT

ACCESS RIGHTS
LIMIT
BASE ADDRESS
SEGMENT
DESCRIPTOR

SEGMENT BASE
ADDRESS
240440-10

Figure 4.1. Protected Mode Addressing

Intel486TM DX MICROPROCESSOR

48 BIT POINTER

SEGMENT

I
31

OFFSET

PHYSICAL ADDRESS
4KBYTES

0
4KBYTES

ACCESS RIGHTS

LIMIT
BASE ADDRESS
SEGMENT
DESCRIPTOR

Intal486TN CPU
PAGING
MECHANISM

LINEAR
ADDRESS

4KBYTES
PHYSICAL
ADDRESS

MEMORY OPERAND

PAGE FRAME
ADDRESS

PHYSICAL PAGE:
4KBYTES
4KBYTES
4KBYTES

4KBYTES

240440-11

Figure 4.2. Paging and Segmentation
DPL: Descriptor Privilege Level-This is the least
privileged level at which a task may access that descriptor (and the segment associated with that descriptor). Descriptor Privilege Level is determined by
bits 6:5 in the Access Right Byte of a descriptor.

4.3 Segmentation
4.3.1 SEGMENTATION INTRODUCTION
Segmentation is one method of memory management. Segmentation provides the basis for protection. Segments are used to encapsulate regions of
memory which have common attributes. For example, all of the code of a given program could be contained in a segment, or an operating system table
may reside in a segment. All information about a
segment is stored in an 8 byte data structure called
a descriptor. All of the descriptors in a system are
contained in tables recognized by hardware.

CPL: Current Privilege Level-The privilege level at
which a task is currently executing, which equals the
privilege level of the code segment being executed.
CPL can also be determined by examining the lowest 2 bits of the CS register, except for conforming
code segments.
EPL: Effective Privilege Level-The effective privilege level is the least privileged of the RPL and DPL.
Since smaller privilege level values indicate greater
privilege, EPL is the numerical maximum of RPL and
DPL.

4.3.2 TERMINOLOGY
The following terms are used throughout the discussion of descriptors, privilege levels and protection:

Task: One instance of the execution of a program.
Tasks are also referred to as processes.

PL: Privilege Level-One of the four hierarchical
privilege levels. Level 0 is the most privileged level
and level 3 is the least privileged. More privileged
levels are numerically smaller than less privileged
levels.

4.3.3.1 Descriptor Tables Introduction

RPL: Requestor Privilege Level-The privilege level
of the original supplier of the selector. RPL is determined by the least two significant bits of a selector.

The descriptor tables define all of the segments
which are used in an Intel486 Microprocessor system. There are three types of tables on the Intel486

4.3.3 DESCRIPTOR TABLES

intel·

Intel486™ OX MICROPROCESSOR

Microprocessor which hold descriptors: the Global
Descriptor Table, Local Descriptor Table, and the Interrupt Descriptor Table. All of the tables are variable length memory arrays. They can range in size
between 8 bytes and 64 Kbytes. Each table can hold
up to 8192 8-byte descriptors. The upper 13 bits of a
selector are used as an index into the descriptor table. The tables have registers associated with them
which hold the 32-bit linear base address, and the
16-bit limit of each table.

4.3.3.3 Local Descriptor Table
LOTs contain descriptors which are associated with
a given task. Generally, operating systems are designed so that each task has a separate LOT. The
LOT may contain only code, data, stack, task gate,
and call gate descriptors. LOTs provide a mechanism for isolating a given task's code and data segments from the rest of the operating system, while
the GOT contains descriptors for segments which
are common to all tasks. A segment cannot be accessed by a task if its segment descriptor does not
exist in either the current LOT or the GOT. This provides both isolation and protection for a task's segments, while still allowing global data to be shared
among tasks.

Each of the tables has a register associated with it,
the GOTR, LOTR, and the 10TR (see Figure 4.3).
The LGOT, LLOT, and L10T instructions, load the
base and limit of the Global, Local, and Interrupt Descriptor Tables, respectively, into the appropriate
register. The SGOT, SLOT, and SlOT store the base
and limit values. These tables are manipulated by
the operating system. Therefore, the load descriptor
table instructions are privileged instructions.

LDTR

Unlike the 6 byte GOT or lOT registers which contain
a base address and limit, the visible portion of the
LOT register contains only a 16-bit selector. This selector refers to a Local Descriptor Table descriptor in
the GOT.
4.3.3.4 Interrupt Descriptor Table

LOT LIMIT

The third table needed for Intel486 Microprocessor
systems is the Interrupt Descriptor Table. (See Figure 4.4.) The lOT contains the descriptors which
point to the location of up to 256 interrupt service
routines. The lOT may contain only task gates, interrupt gates, and trap gates. The lOT should be at
least 256 bytes in size in order to hold the descriptors for the 32 Intel Reserved Interrupts. Every interrupt used by a system must have an entry in the lOT.
The lOT entries are referenced via INT instructions,
external interrupt vectors, and exceptions. (See Section 2.7 Interrupts).

32
PROGRAM INVISIBLE
AUTOMATICALLY LOADED
rROM LOT DESCRIPTOR
IDTR

GDTR

240440-12

Figure 4.3. Descriptor Table Registers

MEMORV

GATE fOR
INTERRUPT #n

4.3.3.2 Global Descriptor Table
The Global Descriptor Table (GOT) contains descriptors which are possibly available to all of the
tasks in a system. The GOT can contain any type of
segment descriptor except for descripfors which are
used for servicing interrupts (Le., interrupt and trap
descriptors). Every Intel486 Microprocessor system
contains a GOT. Generally the GOT contains code
and data segments used by the operating systems
and task state segments, and descriptors for the
LOTs in a system.

CPU

I
31

GATE FOR
INTERRUPT IIn-'

··

INTERRUPT
DESCRIPTOR

TABLE
(lOT)

GATE FOR
INTERRUPT #1

GATE FOR
INTERRUPT #0

lOT BASE
0

~
240440-13

Figure 4.4. Interrupt Descriptor
Table Register Use

The first slot of the Global Descriptor Table corresponds to the null selector and is not used. The null
selector defines a null pointer value.

intel .

Intel486TM OX MICROPROCESSOR

segment causes a not present exception (exception
11). The Descriptor Privilege Level DPL is a two-bit
field which specifies the protection level 0-3 associated with a segment.

4.3.4 DESCRIPTORS
4.3.4.1 Descriptor Attribute Bits
The object to which the segment selector points to
is called a descriptor. Descriptors are eight byte
quantities which contain attributes about a given reo
gion of linear address space (i.e., a segment). These
attributes include the 32-bit base linear address of
the segment, the 20-bit length and granularity of the
segment, the protection level, read, write or execute
privileges, the default size of the operands (16-bit or
32-bit), and the type of segment. All of the attribute
information about a segment is contained in 12 bits
in the segment descriptor. Figure 4.5 shows the general format of a descriptor. All segments on the Intel486 Microprocessor have three attribute fields in
common: the P bit, the DPL bit, and the S bit. The
Present P bit is 1 if the segment is loaded in physical
memory, if p=o then any attempt to access this

The Intel486 Microprocessor has two main categories of segments: system segments and non-system
segments (for code and data). The segment S bit in
the segment descriptor determines if a given segment is a system segment or a code or data segment. If the S bit is 1 then the segment is either a
code or data segment, if it is 0 then the segment is a
system segment.
4.3.4.2 Intel486™ CPU Code, Data Descriptors
(S= 1)
Figure 4.6 shows the general format of a code and
data descriptor and Table 4.1 illustrates how the bits
in the Access Rights Byte are interpreted.

31
0
BYTE
~~--------------------------~----------------------------~, ADDRESS
SEGMENT BASE 15 ... 0
SEGMENT LIMIT 15 ... 0

BASE
23 ... 16

BASE 31 ... 24
BASE
LIMIT
P
DPL
S
TYPE
A
G
D

o
AVL

Base Address of the segment
The length of the segment
Present Bit 1= Present 0 = Not Present
Descriptor Privilege Level 0-3
Segment Descriptor 0 = System Descriptor 1 = Code or Data Segment Descriptor
Type of Segment
Accessed Bit
Granularity Bit 1= Segment length is page granular 0 = Segment length is byte granular
Default Operation Size (recognized in code segment descriptors only)
1 = 32-bit segment 0 = 16-bit segment
Bit must be zero (0) for compatibility with future processors
Available field for user or OS

NOTE:
In a maximum-size segment (i.e., a segment with G=1 and segment limit 19...0=FFFFFH), the lowest 12 bits of the
segment base should be zero (i.e., segment base 11 ...000=000H).
Figure 4.5. Segment Descriptors
0

31
SEGMENT BASE 15 ... 0
BASE 31 •.. 24

DIB
AVL
G
0

SEGMENT LIMIT 15 ... 0
0

AVL

ACCESS
RIGHTS
BYTE

LIMIT
19 ... 16

1 = Default Instruction Attributes are 32-Bits
0= Default Instruction Attributes are 16-Bits
Available field for user or OS
Granularity Bit 1= Segment length is page granular
0= Segment length is byte granular
Bit must be zero (0) for compatibility with future processors
Figure 4.6. Segment Descriptors
54

0
BASE
23 ... 16

intel .

Intel486TM OX MICROPROCESSOR

Table 4.1. Access Rights Byte Definition for Code and Data Descriptions
Bit
Position

Function

Present (P)

6-5

Descriptor Privilege
Level (DPL)
Segment Descrip- S=1
S=O
tor (S)

Executable (E)
Expansion Direction (ED)
Write able (W)

3
2

Executable (E)
Conforming (C)

Readable (R)

Accessed (A)

3
2

Type
Field
Definition

Name

P= 1
p=o

Segment is mapped into physical memory.
No mapping to physical memory exits, base and limit are
not used.
Segment privilege attribute used in privilege tests.

E ~ 0 D"''oto, type ;, data
ED = 0
ED = 1
W= 0
W = 1

,,.m'"t

Expand up segment, offsets must be :::: limit.
Expand down segment, offsets must be > limit.
Data segment may not be written into.
Data segment may be written into.

E = 1 Descriptor type is code segment:
C=1 Code segment may only be executed
when CPL ~ DPL and CPL
remains unchanged.
R=O Code segment may not be read.
R=1 Code segment may be read.
A=O
A=1

r
r

Code or Data (includes stacks) segment descriptor.
System Segment Descriptor or Gate Descriptor.

Data
Segment
(S = 1,
E = 0)
Code
Segment
(S = 1,
E = 1)

Segment has not been accessed.
Segment selector has been loaded into segment register
or used by selector test instructions.

Code and data segments have several descriptor
fields in common. The accessed A bit is set whenever the processor accesses a descriptor. The A bit is
used by operating systems to keep usage statistics
on a given segment. The G bit, or granularity bit,
specifies if a segment length is byte-granular or
page-granular. Intel486 Microprocessor segments
can be one megabyte long with byte granularity
(G = 0) or four gigabytes with page granularity
(G = 1), (i.e., 220 pages each page is 4 Kbytes in
length). The granularity is totally unrelated to paging.
A Intel486 Microprocessor system can consist of
segments with byte granularity, and page granularity,
whether or not paging is enabled.

The 0 bit indicates the default length for operands
and effective addresses. If 0 = 1 then 32-bit operands and 32-bit addressing modes are assumed. If
0=0 then 16-bit operands and 16-bit addressing
modes are assumed. Therefore all existing 80286
code segments will execute on the Intel486 Microprocessor assuming the 0 bit is set O.
Another attribute of code segments is determined by
the conforming C bit. Conforming segments, C = 1,
can be executed and shared by programs at different privilege levels. (See Section 4.4 Protection.)
Segments identified as data segments (E = 0, S = 1)
are used for two types of Intel486 Microprocessor
segments: stack and data segments. The expansion
direction (ED) bit specifies if a segment expands
downward (stack) or upward (data). If a segment is a
stack segment all offsets must be greater than the
segment limit. On a data segment all offsets must be
less than or equal to the limit. In other words, stack
segments start at the base linear address plus the
maximum segment limit and grow down to the base
linear address plus the limit. On the other hand, data
segments start at the base linear address and expand to the base linear address plus limit.

The executable E bit tells if a segment is a code or
data segment. A code segment (E = 1, S = 1) may be
execute-only or execute/read as determined by the
Read R bit. Code segments are execute only if
R = 0, and execute/read if R = 1. Code segments
may never be written into.
NOTE:
Code segments may be modified via aliases. Aliases are write able data segments which occupy the
same range of linear address space as the code
segment.

Intel486™ OX MICROPROCESSOR

The write W bit controls the ability to write into a
segment. Data segments are read-only if W = O. The
stack segment must have W = 1.

4.3.4.5 TSS Descriptors (S = 0,
TYPE= 1,3,9, B)
A Task State Segment (TSS) descriptor contains information about the location, size, and privilege level
of a Task State Segment (TSS). A TSS in turn is a
special fixed format segment which contains all the
state information for a task and a linkage field to
permit nesting tasks. The TYPE field is used to indicate whether the task is currently BUSY (Le., on a
chain of active tasks) or the TSS is available. The
TYPE field also indicates if the segment contains a
80286 or an Intel486 Microprocessor TSS. The Task
Register (TR) contains the selector which points to
the current Task State Segment.

The B bit controls the size of the stack pointer register. If B = 1, then PUSHes, POPs, and CALLs all use
the 32-bit ESP register for stack references and assume an upper limit of FFFFFFFFH. If B = 0, stack
instructions all use the 16-bit SP register and assume an upper limit of FFFFH.
4.3.4.3 System Descriptor Formats
System segments describe information about operating system tables, tasks, and gates. Figure 4.7
shows the general format of system segment descriptors, and the various types of system segments.
Intel486 Microprocessor system descriptors contain
a 32-bit base linear address and a 20-bit segment
limit. 80286 system descriptors have a 24-bit base
address and a 16-bit segment limit. 80286 system
descriptors are identified by the upper 16 bits being
all zero.

4.3.4.6 Gate Descriptors (S = 0,
TYPE=4-7, C, F)
Gates are used to control access to entry points
within the target code segment. The various types of
gate descriptors are call gates, task gates, interrupt gates, and trap gates. Gates provide a level of
indirection between the source and destination of
the control transfer. This indirection allows the processor to automatically perform protection checks. It
also allows system designers to control entry points
to the operating system. Call gates are used to
change privilege levels (see Section 4.4 Protection), task gates are used to perform a task switch,
and interrupt and trap gates are used to specify interrupt service routines.

4.3.4.4 LDT Descriptors (S = 0, TYPE = 2)
LDT descriptors (S = 0, TYPE = 2) contain information about Local Descriptor Tables. LDTs contain a
table of segment descriptors, unique to a particular
task. Since the instruction to load the LDTR is only
available at privilege level 0, the DPL field is ignored.
LDT descriptors are only allowed in the Global Descriptor Table (GDT).
31

SEGMENT BASE 15 ... 0
BASE31 ... 241 GI 01 0

SEGMENT LIMIT 15 ... 0

J 11i~~~~6
0

DPL

I0 I

TYPE

I 23BASE
... 16

Type

Defines

Type

Defines

Invalid
Available 80286 TSS
LDT
Busy 80286 TSS
80286 Cali Gate
Task Gate (for 80286 or Intel486TM CPU Task)
80286 Interrupt Gate
80286 Trap Gate

8
9
A

Invalid
Available Intel486TM CPU TSS
Undefined (Intel Reserved)
Busy Intel486TM CPU TSS
Intel486TM CPU Cali Gate
Undefined (Intel Reserved)
Intel486™ CPU Interrupt Gate
Intel486TM CPU Trap Gate

1
2
3
4

5
6
7

B
C
D

E
F

Figure 4.7. System Segment Descriptors

Intel486TM OX MICROPROCESSOR

Figure 4.8 shows the format of the four types of gate
descriptors. Call gates are primarily used to transfer
program control to a more privileged level. The call
gate descriptor consists of three fields: the access
byte, a long pointer (selector and offset) which
points to the start of a routine and a word count
which specifies how many parameters are to be copied from the caller's stack to the stack of the called
routine. The word count field is only used by call
gates when there is a change in the privilege level,
other types of gates ignore the word count field.

The access byte format is the same for all gate descriptors. P = 1 indicates that the gate contents are
valid. P = 0 indicates the contents are not valid and
causes exception 11 if referenced. DPL is the descriptor privilege level and specifies when this descriptor may be used by a task (see Section 4.4 Protection). The S field, bit 4 of the access rights byte,
must be 0 to indicate a system control descriptor.
The type field specifies the descriptor type as indicated in Figure 4.8.

Interrupt and trap gates use the destination selector
and destination offset fields of the gate descriptor as
a pointer to the start of the interrupt or trap handler
routines. The difference between interrupt gates and
trap gates is that the interrupt gate disables interrupts (resets the IF bit) while the trap gate does not.

4.3.4.7 Differences Between Intel486TM
Microprocessor and 80286 Descriptors
In order to provide operating system compatibility
between the 80286 and Intel486 Microprocessor,
the Intel486 Microprocessor supports all of the
80286 segment descriptors. Figure 4.9 shows the
general format of an 80286 system segment descriptor. The only differences between 80286 and
Intel486 Microprocessor descriptor formats are that
the values of the type fields, and the limit and base
address fields have been expanded for the Intel486
Microprocessor. The 80286 system segment descriptors contained a 24-bit base address and 16-bit
limit, while the Intel486 Microprocessor system segment descriptors have a 32-bit base address, a 20bit limit field, and a granularity bit.

Task gates are used to switch tasks. Task gates
may only refer to a task state segment (see Section
4.4.6 Task Switching) therefore only the destination
selector portion of a task gate descriptor is used,
and the destination offset is ignored.
Exception 13 is generated when a destination selector does not refer to a correct descriptor type, i.e., a
code segment for an interrupt, trap or call gate, a
TSS for a task gate.
31

SELECTOR

OFFSET 15 ... 0

OFFSET 31 ... 16

DPL

TYPE

WORD
COUNT +4
4 ... 0

Gate Descriptor Fields
Name
Type

Value

4
5
6
7
C
E
F

o
I

Description
80286 call gate
Task gate (for 80286 or Intel486™ CPU task)
8028S interrupt gate
8028S trap gate
tntel48STM CPU call gate
tntel48S™ CPU interrupt gate
Intel48S™ CPU trap gate
Descriptor contents are not valid
Descriptor contents are valid

DPL-Ieast privileged level at which a task may access the gate. WORD COUNT 0-31-the number of parameters to copy from caller's stack
to the called procedure's stack. The parameters are 32·bit quantities for Intel48STM CPU gates, and IS-bit quantities for 8028S gates.
DESTINATION
SELECTOR

IS-bit
selector

Selector to the target code segment
or
Selector to the target task state segment for task gate

DESTINATION
OFFSET

offset
Entry point within the target code segment
IS·bit 80286
32·bi\ Intel48STM CPU

Figure 4.8. Gate Descriptor Formats

int'eL

Intel486TM OX MICROPROCESSOR

By supporting 80286 system segments the Intel486
Microprocessor is able to execute 80286 application
programs on an Intel486 Microprocessor operating
system. This is possible because the processor automatically understands which descriptors are
80286-style descriptors and which descriptors are
Intel486 Microprocessor-style descriptors. In particular, if the upper word of a descriptor is zero, then
that descriptor is a 80286-style descriptor.

Entry Index (Index), and Requestor (the selector's)
Privilege Level (RPL) as shown in Figure 4.10. The
TI bits select one of two memory-based tables of
descriptors (the Global Descriptor Table or the Local
Descriptor Table). The Index selects one of 8K descriptors in the appropriate descriptor table. The
RPL bits allow high speed testing of the selector's
privilege attributes.

The only other differences between 80286-style descriptors and Intel486 Microprocessor descriptors is
the interpretation of the word count field of call gates
and the B bit. The word count field specifies the
number of 16-bit quantities to copy for 80286 call
gates and 32-bit quantities for Intel486 Microprocessor call gates. The B bit controls the size of PUSHes
when using a call gate; if B = 0 PUSHes are 16 bits,
if B = 1 PUSHes are 32 bits.

4.3.4.9 Segment Descriptor Cache
In addition to the selector value, every segment register has a segment descriptor cache register associated with it. Whenever a segment register's contents are changed, the 8-byte descriptor associated
with that selector is automatically loaded (cached)
on the chip. Once loaded, all references to that segment use the cached descriptor information instead
of reaccessing the descriptor. The contents of the
descriptor cache are not visible to the programmer.
Since descriptor caches only change when a segment register is changed, programs which modify
the descriptor tables must reload the appropriate
segment registers after changing a descriptor's value.

4.3.4.8 Selector Fields
A selector in Protected Mode has three fields: Local
or Global Descriptor Table Indicator (TI), Descriptor

SEGMENT BASE 15 ... 0
Intel Reserved
Set to 0
BASE
LIMIT
P

SEGMENT LIMIT 15 ... 0
P

Base Address of the segment
The length of the segment
Present Bit 1 = Present 0= Not Present

DPL

DPL
S
TYPE

lsi

0
TYPE

Descriptor Privilege Level 0-3
System Descriptor O=System
Type of Segment

Figure 4.9. 80286 Code and Data Segment Descriptors

I 23BASE
... 16
1 = User

intel~

Intel486™ OX MICROPROCESSOR

SELECTOR
15
SEGMENT
REGISTER

4 3 2 1 0

I. I

0 0 ---- 0 0

1111~11 R~L

. TABLE

INDEX

INDICATOR
TI=l

TI=O
N

•

DESCRIPTOR
NUMBER
6

4
~

4
....

p¢$¢RiBWf

0
LOCAL
DESCRIPTOR
TABLE

NULL
GLOBAL
DESCRIPTOR
TABLE

240440-14

Figure 4.10. Example Descriptor Selection
architecture, the base is set to sixteen times the current selector value, the limit is fixed at OOOOFFFFH,
and the attributes are fixed so as to indicate the segment is present and fully usable. In Real Address
Mode, the internal "privilege level" is always fixed to
the highest level, level 0, so liD and other privileged
opcodes may be executed.

4.3.4.10 Segment Descriptor Register Settings
The contents of the segment descriptor cache vary
depending on the mode the Intel486 Microprocessor
is operating in. When operating in Real Address
Mode, the segment base, limit, and other attributes
within the segment cache registers are defined as
shown in Figure 4.11. For compatibility with the 8086

intel.,

Intel486™ OX MICROPROCESSOR

SEGMENT

DESCRIPTOR CACHE REGISTER CONTENTS

32- BIT BASE

32 - BIT LIMIT

OTHER ATTRIBUTES

(UPDATED DURING SELECTOR
LOAD INTO SEGMENT REGISTER)

(FIXED)

CONFORMING PRIVILEGE - - - - - - - - - - - - - - - - - - - - - - ,
STACK S I Z E - - - - - - - - - - - - - - - - - - - - - - - ,
EXECUTABLE-----------------------.
WRITEABLE---------------------,
READABLE--------------------,
EXPANSION DIRECTION

1
1
!
t_ __ _ __

GRANULARITY
ACCESSED
PRIVILEGE LEVEL

~R~~E~~ _______ ~A~~ ___________ ~1!:4~ ___ ~

CS
SS
OS
ES
FS
GS

16X
16X
16X
16X
16X
16X

CURRENT
CURRENT
CURRENT
CU RRENT
CU RRENT
CURRENT

CS
SS
OS
ES
FS
GS

SELECTOR"
SELECTOR
SELECTOR
SELECTOR
SELECTOR
SELECTOR

OOOOFFFFH
OOOOFFFFH
OOOOFFFFH
OOOOFFFFH
OOOOFFFFH
OOOOFFFFH

Y
Y
Y
Y
Y
Y

0
0
0
0
0
0

Y
Y
Y
Y
Y
Y

B
B
B
B
B
B

U
U
U
U
U
U

Y
Y
Y
Y
Y
Y

Y - N
N W N
N
N
N

----240440-15

'Except the 32-bit CS base is initialized to FFFFFOOOH after reset until first intersegment control transfer (I.e., intersegment CALL, or
intersegment JMP, or INT). (See Figure 4.13 Example.)
D ~ expand down
Key: Y ~ yes
N ~ no
B ~ byte granularity
o ~ privilege level 0
P = page granularity
W ~ push/pop IS-bit words
1 ~ privilege level 1
F ~ push/pop 32-bit dwords
2 ~ privilege level 2
3 ~ privilege level 3
- ~ does not apply to that segment cache register
U ~ expand up

Figure 4.11. Segment Descriptor Caches for Real Address Mode
(Segment Limit and Attributes are Fixed)
When operating in Protected Mode, the segment
base, limit, and other attributes within the segment
cache registers are defined as shown in Figure 4.12.
In Protected Mode, each of these fields are defined

according to the contents of the segment descriptor
indexed by the selector value loaded into the segment register.

intel .

Intel486TM OX MICROPROCESSOR

SEGMENT

DESCRIPTOR CACHE REGISTER CONTENTS

32- BIT BASE

32 - BIT LIMIT

OTHER ATIRIBUTES

(UPDATED DURING
SELECTOR LOAD INTO
SEGMENT REGISTER)

CONFORMING PRIVILEGE - - - - - - - - - - - - - - - - - - - - - - .
STACK S I Z E - - - - - - - - - - - - - - - - - - - - - - - ,
EXECUTABLE----------------------,
WRITEABLE - - - - - - - - - - - - - - - - - - - - - ,
READABLE-------------------...,
EXPANSION DIRECTION

~R~~E~~ ____ ~~s~ ___________ ~I~I~ ______

1
1
1
t_i _____

CS
SS
OS
ES
FS
GS

P
P
P
P
P
P

GRANULARITY
ACCESSED
PRIVILEGE LEVEL

BASE
BASE
BASE
BASE
BASE
BASE

PER
PER
PER
PER
PER
PER

SEG
SEG
SEG
SEG
SEG
SEG

DESCR
DESCR
DESCR
DESCR
DESCR
DESCR

LIMIT PER SEG DESCR
LIMIT PER SEG DESCR
LIMIT
LIMIT
LIMIT
LIMIT

PER
PER
PER
PER

SEG
SEG
SEG
SEG

DESCR
DESCR
DESCR
DESCR

d
d
d
d
d

d
r
d
d
d

Y-

- - -

w N d
d N
d N d N

d d d d d d N -

240440-16

Key:

Y ~
N~
d~
p~

fixed yes
fixed no
per segment descriptor
per segment descriptor; descriptor must indicate "present" to avoid exception 11
(exception 12 in case of SS)
r ~ per segment descriptor. but descriptor must indicate "readable" to avoid exception 13
(special case for SS)
w ~ per segment descriptor. but descriptor must indicate "writable" to avoid exception 13
(special case for SS)
- ~ does not apply to that segment cache register

Figure 4.12. Segment Descriptor Caches for Protected Mode (Loaded per Descriptor)

When operating in a Virtual 8086 Mode within the
Protected Mode, the segment base, limit, and other
attributes within the segment cache registers are defined as shown in Figure 4.13. For compatibility with
the 8086 architecture, the base is set to sixteen
times the current selector value, the limit is fixed at

OOOOFFFFH, and the attributes are fixed so as to
indicate the segment is present and fully usable. The
virtual program executes at lowest privilege level,
level 3, to allow trapping of all IOPL-sensitive instructions and level-a-only instructions.

int'et

Intel486TM OX MICROPROCESSOR

SEGMENT

DESCRIPTOR CACHE REGISTER CONTENTS

32- BIT BASE

32 - BIT LIMIT

OTHER ATTRIBUTES

(UPDATED DURING SELECTOR
LOAD INTO SEGMENT REGISTER)

(FIXED)

CONFORMING PRIVILEGE - - - - - - - - - - - - - - - - - - - - - ,
STACK S I Z E - - - - - - - - - - - - - - - - - - - - - - . . . . . ,
EXECUTABLE---------------------.....,
WRITEABLE---------------------,

1
1
!
t i _____

R~DABLE---------------------~

EXPANSION DIRECTION
GRANULARITY
ACCESSED
PRIVILEGE LEVEL

~R~~E~~ _______B~~E____________ ~I~I~ ___

CS
SS
OS

16X CURRENT CS SELECTOR
16X CURRENT SS SELECTOR
1 6X CURRENT OS SELECTOR

ES
FS

1 6X CURRENT ES SELECTOR
16X CURRENT FS SELECTOR

OOOOFFFFH
OOOOFFFFH
OOOOFFFFH
OOOOFFFFH
OOOOFFFFH

16X CURRENT GS SELECTOR

OOOOFFFFH

Y 3 Y B
Y 3 y B
y 3 y B
Y 3 y B
y 3 Y B
y 3 y B

U Y Y Y - N
U y y N W U y y N
U y y N U y y N
U y y N

- - -

-240440-17

Key:

Y
N

o
1
2
3
U

=
=
=
=
=
=

yes
no
privilege level
privilege level
privilege level
privilege level
expand up

D = expand down
B = byte granularity
P = page granularity
W = push/pop 16-bit words
F = push/pop 32-bit dwords
= does not apply to that segment cache register

0
1
2
3

Figure 4.13. Segment Descriptor Caches for Virtual 8086 Mode within Protected Mode
(Segment Limit and Attributes are Fixed)
The Intel486 Microprocessor has four levels of protection which are optimized to support the needs of
a multi-tasking operating system to isolate and protect user programs from each other and the operating system. The privilege levels control the use of
privileged instructions, I/O instructions, and access
to segments and segment descriptors. Unlike traditional microprocessor-based systems where this
protection is achieved only through the use of complex external hardware and software the Intel486 Microprocessor provides the protection as part of its
integrated Memory Management Unit. The Intel486
Microprocessor offers an additional type of protection on a page basis, when paging is enabled (See
Section 4.5.3 Page Level Protection).

4.4 Protection
4.4.1 PROTECTION CONCEPTS

CPU
ENFORCED

SOFTWARE

INTERFACES

HIGH SPEED

OPERATING
SYSTEM

INTERFACE

The four-level hierarchical privilege system is illustrated in Figure 4-14. It is an extension of the user/
supervisor privilege mode commonly used by minicomputers and, in fact, the user/supervisor mode is
fully supported by the Intel486 Microprocessor pag-

240440-18

Figure 4.14. Four-Level Hierarchical Protection

intel~

Intel486™ OX MICROPROCESSOR

ing mechanism. The privilege levels (PL) are numbered 0 through 3. Level 0 is the most privileged or
trusted level.

3 regardless of the task's CPL. The RPL is most
commonly used to verify that pointers passed to an
operating system procedure do not access data that
is of higher privilege than the procedure that originated the pointer. Since the originator of a selector
can specify any RPL value, the Adjust RPL (ARPL)
instruction is provided to force the RPL bits to the
originator's CPL.

4.4.2 RULES OF PRIVILEGE
The Intel486 Microprocessor controls access to
both data and procedures between levels of a task,
according to the following rules.
• Data stored in a segment with privilege level p
can be accessed only by code executing at a
privilege level at least as privileged as p.
• A code segment/procedure with privilege level p
can only be called by a task executing at the
same or a lesser privilege level than p.

4.4.3.3 1/0 Privilege and 1/0 Permission Bitmap
The I/O privilege level (IOPL, a 2-bit field in the
EFLAG register) defines the least privileged level at
which I/O instructions can be unconditionally performed. I/O instructions can be unconditionally performed when CPL :0: 10PL. (The I/O instructions are
IN, OUT, INS, OUTS, REP INS, and REP OUTS.)
When CPL > 10PL, and the current task is associated with a 286 TSS, attempted I/O instructions cause
an exception 13 fault. When CPL > 10PL, and the
current task is associated with an Intel486 Microprocessor TSS, the I/O Permission Bitmap (part of
an Intel486 Microprocessor TSS) is consulted on
whether I/O to the port is allowed, or an exception
13 fault is to be generated instead. For diagrams of
the I/O Permission Bitmap, refer to Figures 4.15a
and 4.15b. For further information on how the I/O
Permission Bitmap is used in Protected Mode or in
Virtual 8086 Mode, refer to Section 4.6.4 Protection
and I/O Permission Bitmap.

4.4.3 PRIVILEGE LEVELS
4.4.3.1 Task Privilege
At any point in time, a task on the Intel486 Microprocessor always executes at one of the four privilege levels. The Current Privilege Level (CPL) specifies the task's privilege level. A task's CPL may only
be changed by control transfers through gate descriptors to a code segment with a different privilege
level. (See Section 4.4.4 Privilege Level Transfers)
Thus, an application program running at PL = 3 may
call an operating system routine at PL = 1 (via a
gate) which would cause the task's CPL to be set to
1 until the operating system routine was finished.

The I/O privilege level (IOPL) also affects whether
several other instructions can be executed or cause
an exception 13 fault instead. These instructions are
called "IOPL-sensitive" instructions and they are
CLI and STI. (Note that the LOCK prefix is not 10PLsensitive on the Intel486 Microprocessor.)

4.4.3.2 Selector Privilege (RPL)
The privilege level of a selector is specified by the
RPL field. The RPL is the two least significant bits of
the selector. The selector's RPL is only used to establish a less trusted privilege level than the current
privilege level for the use of a segment. This level is
called the task's effective privilege level (EPL). The
EPL is defined as being the least privileged (I.e. numerically larger) level of a task's CPL and a selector's RPL. Thus, if selector's RPL = 0 then the CPL
always specifies the privilege level for making an access using the selector. On the other hand if RPL =
3 then a selector can only access segments at level

The 10PL also affects whether the IF (interrupts enable flag) bit can be changed by loading a value into
the EFLAGS register. When CPL :0: 10PL, then the
IF bit can be changed by loading a new value into
the EFLAGS register. When CPL > 10PL, the IF bit
cannot be changed by a new value POP'ed into (or
otherwise loaded into) the EFLAGS register; the IF
bit merely remains unchanged and no exception is
generated.

int:et

Intel486TM OX MICROPROCESSOR

tion to ensure that the RPL of the selector has no
greater privilege than that of the caller, then this
problem can be avoided.

Table 4.2. Pointer Test Instructions
Function

Instruction Operands
ARPL

VERR

Selector,
Register

Selector

Adjust Requested Privilege Level: adjusts the
RPL of the selector to the
numeric maximum of
current selector RPL value
and the RPL value in the
register. Set zero flag if
selector RPL was
changed.

Selector

VERify for Write: sets the
zero flag if the segment
referred to by the selector
can be written.

LSL

Load Segment Limit: reads
the segment limit into the
register if privilege rules
and descriptor type allow.
Set zero flag if successful.

There are basically two types of segment accesses:
those involving code segments such as control
transfers, and those involving data accesses. Determining the ability of a task to access a segment involves the type of segment to be accessed, the instruction used, the type of descriptor used and CPL,
RPL, and DPL as described above.

VERify for Read: sets the
zero flag if the segment
referred to by the selector
can be read.

VERW

LAR

4.4.3.5 Descriptor Access

Any time an instruction loads data segment registers
(OS, ES, FS, GS) the Intel486 Microprocessor
makes protection validation checks. Selectors loaded in the OS, ES, FS, GS registers must refer only to
data segments or readable code segments. The
data access rules are specified in Section 4.4.2
Rules of Privilege. The only exception to those
rules is readable conforming code segments which
can be accessed at any privilege level.
Finally the privilege validation checks are performed.
The CPL is compared to the EPL and if the EPL is
more privileged than the CPL an exception 13 (general protection fault) is generated.

Load Access Rights: reads
the descriptor access
rights byte into the register
if privilege rules allow. Set
zero flag if successful.

The rules regarding the stack segment are slightly
different than those involving data segments. Instructions that load selectors into SS must refer to
data segment descriptors for writeable data segments. The DPL and RPL must equal the CPL. All
other descriptor types or a privilege level violation
will cause exception 13. A stack not present fault
causes exception 12. Note that an exception 11 is
used for a not-present code or data segment.

4.4.3.4 Privilege Validation
The Intel486 Microprocessor provides several instructions to speed pointer testing and help maintain
system integrity by verifying that the selector value
refers to an appropriate segment. Table 4.2 summarizes the selector validation procedures available for
the Intel486 Microprocessor.

4.4.4 PRIVILEGE LEVEL TRANSFERS
Inter-segment control transfers occur when a selector is loaded in the CS register. For a typical system
most of these transfers are simply the result of a call
or a jump to another routine. There are five types of
control transfers which are summarized in Table 4.3.
Many of these transfers result in a privilege level
transfer. Changing privilege levels is done only via
control transfers, by using gates, task switches, and
interrupt or trap gates.

This pointer verification prevents the common problem of an application at PL = 3 calling a operating
systems routine at PL = 0 and passing the operating system routine a "bad" pointer which corrupts a
data structure belonging to the operating system. If
the operating system routine uses the ARPL instruc-

intel~

Intel486TM OX MICROPROCESSOR

Table 4.3. Descriptor Types Used for Control Transfer
Control Transfer Types

Operation Types

Descriptor
Referenced

Descriptor
Table

Intersegment within the same privilege level

JMP, CALL, RET, IREP

Code Segment

GOT/LOT

Intersegment to the same or higher privilege level
Interrupt within task may change CPL

CALL

Call Gate

GOT/LOT

Interrupt Instruction,
Exception, External
Interrupt

Trap or
Interrupt
Gate

lOT

Intersegment to a lower privilege level
(changes task CPL)

RET,IRET'

Code Segment

GOT/LOT

CALL, JMP

Task State
Segment

GOT

CALL, JMP

Task Gate

GOT/LOT

IREP'
Interrupt Instruction,
Exception, External
Interrupt

Task Gate

lOT

Task Switch

'NT (Nested Task bit of flag register) = 0
"NT (Nested Task bit of flag register) = 1

Control transfers can only occur if the operation
which loaded the selector references the correct descriptor type. Any violation of these descriptor usage
rules will cause an exception 13 (e.g. JMP through a
call gate, or IRET from a normal subroutine call).

In order to provide further system security, all control
transfers are also subject to the privilege rules.

Any control transfer that changes CPL within a task
causes a change of stacks as a result of the privilege level change. The initial values of SS:ESP for
privilege levels 0, 1, and 2 are retained in the task
state segment (see Section 4.4.6 Task Switching).
During a JMP or CALL control transfer, the new
stack pointer is loaded into the SS and ESP registers and the previous stack painter is pushed onto
the new stack.

The privilege rules require that:
-

Return instructions that do not switch tasks can
only return control to a code segment with same
or less privilege.
Task switches can be performed by a CALL,
JMP, or INT which references either a task gate
or task state segment who's DPL is less privileged or the same privilege as the old task's CPL.

Privilege level transitions can only occur via
gates.
JMPs can be made to a non-conforming code
segment with the same privilege or to a conforming code segment with greater or equal privilege.
CALLs can be made to a non-conforming code
segment with the same privilege or via a gate to
a more privileged level.
Interrupts handled within the task obey the same
privilege rules as CALLs.
Conforming Code segments are accessible by
privilege levels which are the same or less privileged than the conforming-code segment's OPL.

When RETurning to the original privilege level, use
of the lower-privileged stack is restored as part of
the RET or IRET instruction operation. For subroutine calls that pass parameters on the stack and
cross privilege levels, a fixed number of words (as
specified in the gate's word count field) are copied
from the previous stack to the current stack. The
inter-segment RET instruction with a stack adjustment value will correctly restore the previous stack
pointer upon return.

Both the requested privilege level (RPL) in the
selector pointing to the gate and the task's CPL
must be of equal or greater privilege than the
gate's OPL.
The code segment selected in the gate must be
the same or more privileged than the task's CPL.

int:eL

Intel486TM OX MICROPROCESSOR

15
o 0

0000000000000000

BACK LINK

SSO

ESPI
0000000000000000

SSI

SS2

I
CR5

EIP

EFLAGS

EAX

Eex

EOX

EBX

ESP

EBP

ESI

EDI

44
ES

0000000000000000

LOT

BIT_MAP _OFFSET( 15:0)

0000000000000000

)

SYSTEM STATUS, ETC.
IN Int.'486™ CPU TSS

r
51

72 71

ACCESS
RIGHTS

'31

1
1

1
1
1
1
1

TSS
LIMIT

BASE

of1

PROGRAM
INVISIBLE

0 '
1

I/o PERMISSION BITMAP
65407

OFFSET

1FEC

OFFSET

1Fro

OFFSET

lFF4

65472

OFFSET

1FF8

65504

OFFSET

1FFC

OFFSET

2000

(ONE BIT PER BYTE I/o
PORT. BITMAP MAY BE
TRUNCATED USING TSS LIMIT.)

65503

65555

65471

TASK REGISTER

OFFSET

._------------.
SELECTOR

BILMAP _OFFSET

OFFSET + 10

I-

65459

DEBUG
TRAP BIT

.-------------.

1
1
1
1
1
1
1
1

----

AVAILABLE

CURRENT
TASK
STATE

0000000000000000

STACKS
FOR
CPL 0, I, 2

ESP2
0000000000000000

BIT_MAP_OFFSET
must be ,;; DFFFH

TSS BASE

ESPO
0000000000000000

NOTE:

"FFH"

t
51

TSS LIMIT = OFFSET

Int.'486™ CPU TSS DESCRIPTOR (IN GOT)
SEGMENT BASE 15 ... 0

BASE 51 .. 24

2000H

SEGMENT LIMIT 15 .. 0

H'1+1 ;~~\T6

1D~L!oI ,TyE,

BASH
25 .. 16
240440-19

Type
Type

=
=

9: Available Intel486TM CPU TSS,
B: Busy Intel486™ CPU TSS

Figure 4.15a. Intel486™ Microprocessor TSS and TSS Registers

intel~

Intel486TM OX MICROPROCESSOR

31302928272625242322212019181716151413121110987 6 5
1 1 1 1 0 1 1 0 o 0 o 0 1 1 1 1 0 1 0 0 1 1 o 0 0 0 0
0 0 1 0 0 0 1 1 1 1 0 0 1 0 1 0 1 1 1 1 1 1 o 0 1 1 1
1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1
o 0 0 0 0 0 0 0 0 0 0 000 o 0 o 0 0 0 0 0 0 0 0 o 0
1 1 1
ete.
't'1/0 Ports Accessible: 2 --+ 9, 12, 13, 15,20 --+ 24,27,33,34,40,41,48,50,52,53,58 --+ 60,62,63,96
31
63
95
127

4 3 2 10
0 0 1 1
1 1 o 0 1
1 1 1 1 1
0 000 0
1 1 1 1 1

'l"

--+ 127

240440-20

Figure 4.15b. Sample 1/0 Permission Bit Map

address space, and a link to the previous task),
loads a new execution state, performs protection
checks, and commences execution in the new task,
in about 10 microseconds, Like transfer of control
via gates, the task switch operation is invoked by
executing an inter·segment JMP or CALL instruction
which refers to a Task State Segment (TSS), or a
task gate descriptor in the GOT or LOT. An INT n
instruction, exception, trap, or external interrupt may
also invoke the task switch operation if there is a
task gate descriptor in the associated lOT descriptor
slot.

4.4.5 CALL GATES

Gates provide protected, indirect CALLs. One of the
major uses of gates is to provide a secure method of
privilege transfers within a task. Since the operating
system defines all of the gates in a system, it can
ensure that all gates only allow entry into a few trusted procedures (such as those which allocate memory, or perform I/O).
Gate descriptors follow the data access rules of privilege; that is, gates can be accessed by a task if the
EPL, is equal to or more privileged than the gate
descriptor's OPL. Gates follow the control transfer
rules of privilege and therefore may only transfer
control to a more privileged level.

The TSS descriptor points to a segment (see Figure
4.15) containing the entire Intel486 Microprocessor
execution state while a task gate descriptor contains
a TSS selector. The Intel486 Microprocessor supports both 80286 and Intel486 Microprocessor style
TSSs. Figure 4.16 shows a 80286 TSS. The limit of
an Intel486 Microprocessor TSS must be greater
than 0064H (002BH for a 80286 TSS), and can be
as large as 4 Gigabytes. In the additional TSS
space, the operating system is free to store additional information such as the reason the task is inactive, time the task has spent running, and open files
belong to the task.

Call Gates are accessed via a CALL instruction and
are syntactically identical to calling a normal subroutine. When an inter-level Intel486 Microprocessor
call gate is activated, the following actions occur.
1. Load CS:EIP from gate check for validity
2. SS is pushed zero-extended to 32 bits
3. ESP is pushed
4. Copy Word Count 32-bit parameters from the
old stack to the new stack
5. Push Return address on stack

Each task must have a TSS associated with it. The
current TSS is identified by a special register in the
Intel486 Microprocessor called the Task State Segment Register (TR). This register contains a selector
referring to the task state segment descriptor that
defines the current TSS. A hidden base and limit
register associated with TR are loaded whenever TR
is loaded with a new selector. Returning from a task
is accomplished by the IRET instruction. When IRET
is executed, control is returned to the task which
was interrupted. The current executing task's state
is saved in the TSS and the old task state is restored
from its TSS.

The procedure is identical for 80286 Call gates, except that 16-bit parameters are copied and 16-bit
registers are pushed.
Interrupt Gates and Trap gates work in a similar
fashion as the call gates, except there is no copying
of parameters. The only difference between Trap
and Interrupt gates is that control transfers through
an Interrupt gate disable further interrupts (Le. the IF
bit is set to 0), and Trap gates leave the interrupt
status unchanged.

Several bits in the flag register and machine status
word (CRO) give information about the state of a
task which are useful to the operating system. The
Nested Task (NT) (bit 14 in EFLAGS) controls the
function of the IRET instruction. If NT = 0, the IRET
instruction performs the regular return; when NT =
1, IRET performs a task switch operation back to the
previous task. The NT bit is set or reset in the following fashion:

4.4.6 TASK SWITCHING

A very important attribute of any multi-tasking/multiuser operating systems is its ability to rapidly switch
between tasks or processes. The Intel486 Microprocessor directly supports this operation by providing a task switch instruction in hardware. The Intel486 Microprocessor task switch operation saves
the entire state of the machine (all of the registers,

Intel486TM OX MICROPROCESSOR

processor switches tasks, it sets the TS bit. The Intel486 Microprocessor detects the first use of a
processor extension instruction after a task switch
and causes the processor extension not available
exception 7. The exception handler for exception 7
may then decide whether to save the state of the
FPU. A processor extension not present exception
(7) will occur when attempting to execute a Floating
Point or WAIT instruction if the Task Switched and
Monitor coprocessor extension bits are both set (I.e.
TS = 1 and MP = 1).

BACK LINK SELECTOR TO TSS

SP"FOR CPL 0

SP FOR CPL 1

SS FOR CPL 1

SS FOR CPL

SP FOR CPL 2

SS FOR CPL 2

IP (ENTRY POINT)

FLAGS

ES SELECTOR

CS SELECTOR

SS SELECTOR

OS SELECTOR

TASK'S LOT SELECTOR
." AVAILABLE

INITIAL
STACKS
FOR CPL 0,1,2

The T bit in the Intel486 Microprocessor TSS indicates that the processor should generate a debug
exception when switching to a task. If T = 1 then
upon entry to a new task a debug exception 1 will be
generated.

CURRENT
TASK
STATE

4.4.7 INITIALIZATION AND TRANSITION TO
PROTECTED MODE

Since the Intel486 Microprocessor begins executing
in Real Mode immediately after RESET it is necessary to initialize the system tables and registers with
the appropriate values.

The GOT and lOT registers must refer to a valid GOT
and lOT. The lOT should be at least 256 bytes long,
and GOT must contain descriptors for the initial
code, and data segments. Figure 4.17 shows the tables and Figure 4.18 the descriptors needed for a
simple Protected Mode Intel486 Microprocessor
system. It has a single code and single data/stack
segment each four gigabytes long and a single privilege level PL = O.

240440-21

Figure 4.16. 80286 TSS

When a CALL or INT instruction initiates a task
switch, the new TSS will be marked busy and the
back link field of the new TSS set to the old TSS
selector. The NT bit of the new task is set by CALL
or INT initiated task switches. An interrupt that does
not cause a task switch will clear NT. (The NT bit will
be restored after execution of the interrupt handler)
NT may also be set or cleared by POPF or IRET
instructions.

The actual method of enabling Protected Mode is to
load CRO with the PE bit set, via the MOV CRO, R/M
instruction. This puts the Intel486 Microprocessor in
Protected Mode.
After enabling Protected Mode, the next instruction
should execute an intersegment JMP to load the CS
register and flush the instruction decode queue. The
final step is to load all of the data segment registers
with the initial selector values.

The Intel486 Microprocessor task state segment is
marked busy by changing the descriptor type field
from TYPE 9H to TYPE BH. An 80286 TSS is
marked busy by changing the descriptor type field
from TYPE 1 to TYPE 3. Use of a selector that references a busy task state segment causes an exception 13.

An alternate approach to entering Protected Mode
which is especially appropriate for multi-tasking operating systems, is to use the built in task-switch to
load all of the registers. In this case the GOT would
contain two TSS descriptors in addition to the code
and data descriptors needed for the first task. The
first JMP instruction in Protected Mode would jump
to the TSS causing a task switch and loading all of
the registers with the values stored in the TSS. The
Task State Segment Register should be initialized to
point to a valid TSS descriptor since a task switch
saves the state of the current task in a task state
segment.

The Virtual Mode (VM) bit 17 is used to indicate if a
task, is a virtual 8086 task. If VM = 1, then the tasks
will use the Real Mode addressing mechanism. The
virtual 8086 environment is only entered and exited
via a task switch (see Section 4.6 Virtual Mode).
The FPU's state is not automatically saved when a
task switch occurs, because the incoming task may
not use the FPU. The Task Switched (TS) Bit (bit 3 in
the CRO) helps deal with the FPU's state in a multitasking environment. Whenever the Intel486 Micro68

intel·

Intel486TM OX MICROPROCESSOR

3,.1~=~~~...;O FFFFFFFF
RESET ROUTINES
FFFFFFFO
INITIALIZATION
ROUTINES

[§I]
GS [§I]

00000116

~~~;';';';;';";';;,;;...j 00000110

~~~~~~

00000106

"---I-...;.....;..=.~~

00000100

NULL SELECTOR

1
GOT

INTERRUPT
DESCRIPTORS (32)

lOT

'--''-------100000000

240440-22

Figure 4.17. Simple Protected System

BASE 31 ... 24 G D 0
0
00 (H)
1 1

LIMIT
19.16
F (H)

DATA
SEGMENT BASE 15 ... 0
DESCRIPTOR
0118 (H)
1

BASE 31 ... 24 G D 0
0
00 (H)
1 1

001

BASE 23 ... 16
00 (H)

SEGMENT LIMIT 15 ... 0
FFFF (H)
LIMIT
19.16
F (H)

CODE
SEGMENT BASE 15 ... 0
DESCRIPTOR
0118 (H)

0 1 1 0 1

BASE 23 ... 16
00 (H)

SEGMENT LIMIT 15 ... 0
FFFF (H)
NULL DESCRIPTOR

0
31

16 15

Figure 4.18. GDT Descriptors for Simple System
4.4.8 TOOLS FOR BUILDING PROTECTED
SYSTEMS

4.5 Paging

In order to simplify the design of a protected multitasking system, Intel provides a tool which allows
the system designer an easy method of constructing
the data structures needed for a Protected Mode
Intel486 Microprocessor system. This tool is the
builder BLD-386™. BLD-386 lets the operating system writer specify all of the segment descriptors discussed in the previous sections (LDTs, IDTs, GDTs,
Gates, and TSSs) in a high-level language.

4.5.1 PAGING CONCEPTS

Paging is another type of memory management
useful for virtual memory multitasking operating systems. Unlike segmentation which modularizes programs and data into variable length segments, paging divides programs into multiple uniform size
pages. Pages bear no direct relation to the logical

int'et

Intel486TM OX MICROPROCESSOR

structure of a program. While segment selectors can
be considered the logical "name" of a program
module or data structure, a page most likely corresponds to only a portion of a module or data structure.

4.5.2.2 Page Descriptor Base Register

CR2 is the Page Fault Linear Address register. It
holds the 32-bit linear address which caused the last
page fault detected.

By taking advantage of the locality of reference displayed by most programs, only a small number of
pages from each active task need be in memory at
anyone moment.

CR3 is the Page Directory Physical Base Address
Register. It contains the physical starting address of
the Page Directory. The lower 12 bits of CR3 are
always zero to ensure that the Page Directory is always page aligned. Loading it via a MOV CR3, reg
instruction causes the Page Table Entry cache to be
flushed, as will a task switch through a TSS which
changes the value of CRO. (See 4.5.5 Translation
Lookaside Buffer).

4.5.2 PAGING ORGANIZATION
4.5.2.1 Page Mechanism

The Intel486 Microprocessor uses two levels of tables to translate the linear address (from the segmentation unit) into a physical address. There are
three components to the paging mechanism of the
Intel486 Microprocessor: the page directory, the
page tables, and the page itself (page frame). All
memory-resident elements of the Intel486 Microprocessor paging mechanism are the same size,
namely, 4 Kbytes. A uniform size for all of the elements simplifies memory allocation and reallocation
schemes, since there is no problem with memory
fragmentation. Figure 4.19 shows how the paging
mechanism works.

4.5.2.3 Page Directory

The Page Directory is 4 Kbytes long and allows up to
1024 Page Directory Entries. Each Page Directory
Entry contains the address of the next level of tables, the Page Tables and information about the
page table. The contents of a Page Directory Entry
are shown in Figure 4.20. The upper 10 bits of the
linear address (A22-A31) are used as an index to
select the correct Page Directory Entry.

TWO LEVEL PAGING SCHEME
31

LINEAR
ADDRESS

22
DIRECTORY

I TABLE I OFFSET I
I

10}

USER
MEMORY
12

or
or
31

48S™ CPU
31
CRO

CRl
CR2
CR3

ROOT

ADDRESS

PAGE TABLE

DIRECTORY

CONTROL REGISTERS
240440-23

Figure 4.19. Paging Mechanism
31

PAGE TABLE ADDRESS 31 .. 12

OS
RESERVED

8
0

7
0

6
D

P
C
D

Figure 4.20. Page Directory Entry (Points to Page Table)

W
T

Intel486TM OX MICROPROCESSOR

PAGE FRAME ADDRESS 31 .. 12

OS
RESERVED

8
0

7
0

6
D

P
W
T

P
C
D

0
P

Figure 4.21. Page Table Entry (Points to Page)
The (User/Supervisor) U/S bit 2 and the (Read/
Write) R/W bit 1 are used to provide protection attributes for individual pages.

4.5.2.4 Page Tables
Each Page Table is 4 Kbytes and holds up to 1024
Page Table Entries. Page Table Entries contain the
starting address of the page frame and statistical
information about the page (see Figure 4.21). Address bits A12-A21 are used as an index to select
one of the 1024 Page Table Entries. The 20 upperbit page frame address is concatenated with the
lower 12 bits of the linear address to form the physical address. Page tables can be shared between
tasks and swapped to disks.

4.5.3 PAGE LEVEL PROTECTION
(R/W, U/S BITS)
The Intel486 Microprocessor provides a set of protection attributes for paging systems. The paging
mechanism distinguishes between two levels of protection: User which corresponds to level 3 of the
segmentation based protection, and supervisor
which encompasses all of the other protection levels
(0,1,2).

4.5.2.5 Page Directory/Table Entries

The R/W and U/S bits are used in conjunction with
the WP bit in the flags register (EFLAGS). The 386
Microprocessor does not contain the WP bit. The
WP bit has been added to the Intel486 Microprocessor to protect read-only pages from supervisor write
accesses. The 386 Microprocessor allows a readonly page to be written from protection levels 0, 1 or
2. WP = 0 is the 386 Microprocessor compatible
mode. When WP = 0 the supervisor can write to a
read-only page as defined by the U/S and R/W bits.
When WP = 1 supervisor access to a read-only page
(R/W=O) will cause a page fault (exception 14).

The lower 12 bits of the Page Table Entries and
Page Directory Entries contain statistical information
about pages and page tables respectively. The P
(Present) bit 0 indicates if a Page Directory or Page
Table entry can be used in address translation. If
P = 1 the entry can be used for address translation
if P = 0 the entry can not be used for translation,
and all of the other bits are available for use by the
software. For example the remaining 31 bits could
be used to indicate where on the disk the page is
stored.
The A (Accessed) bit 5, is set by the Intel486 Microprocessor for both types of entries before a read or
write access occurs to an address covered by the
entry. The D (Dirty) bit 6 is set to 1 before a write to
an address covered by that page table entry occurs.
The D bit is undefined for Page Directory Entries.
When the P, A and D bits are updated by the Intel486 Microprocessor, the processor generates a
Read-Modify-Write cycle which locks the bus and
prevents conflicts with other processors or perpherials. Software which modifies these bits should use
the LOCK prefix to ensure the integrity of the page
tables in mUlti-master systems.

Table 4.4 shows the affect of the WP, U/S and R/W
bits on accessing memory. When WP = 0, the supervisor can write to pages regardless of the state of
the R/W bit. When WP = 1 and R/W = 0 the supervisor cannot write to a read-only page. A user attempt
to access a supervisor only page (U/S=O), or write
to a read only page will cause a page fault (exception 14).
The R/W and U/S bits provide protection from user
access on a page by page basis since the bits are
contained in the Page Table Entry and the Page Directory Table. The U/S and R/W bits in the first level
Page Directory Table apply to all entries in the page
table pointed to by that directory entry. The U/S and
R/W bits in the second level Page Table Entry apply
only to the page described by that entry. The most
restrictive of the U/S and R/W bits from the Page
Directory Table and the Page Table Entry are used
to address a page.

The 3 bits marked OS Reserved in Figure 4.20 and
Figure 4.21 (bits 9-11) are software definable. OSs
are free to use these bits for whatever purpose they
wish. An example use of the OS Reserved bits
would be to store information about page aging. By
keeping track of how long a page has been in memory since being accessed, an operating system can
implement a page replacement algorithm like Least
Recently Used.

Example: If the U/S and R/W bits for the Page Directory entry were 10 (user read/execute) and the

intel .

Intel486TM OX MICROPROCESSOR

UlS and R/W bits for the Page Table Entry were 01
(no user access at a"), the access rights for the
page would be 01, the numerically smaller of the
two.

When paging is enabled (PG = 1 in CRO), the bits
from the page table entry are cached in the translation lookaside buffer (TLB), and are driven any time
the page mapped by the TLB entry is referenced.
For normal memory cycles run with paging enabled,
the PWT and PCD bits are taken from the Page Table Entry. During TLB refresh cycles when the Page
Directory and Page Table entries are read, the PWT
and PCD bits must be obtained elsewhere. The bits
are taken from CR3 when a Page Directory Entry is
being read. The bits are taken from the Page Directory Entry when the Page Table Entry is being updated.

Note that a given segment can be easily made readonly for level 0, 1 or 2 via use of segmented protection mechanisms. (Section 4.4 Protection).
4.5.4 PAGE CACHEABILITY
(PWT AND PCD BITS)
PWT (page write through) and PCD (page cache disable) are two new bits defined in entries in both levels of the page table structure, the Page Directory
Table and the Page Table Entry. PCD and PWT control page cacheability and write policy.

The PCD or PWT bits in CR3 are initialized to zero at
reset, but can be set to any value by level 0 software.

PWT controls write policy. PWT= 1 defines a writethrough policy for the current page. PWT=O allows
the possibility of write-back. PWT is ignored internally because the Intel486 microprocessor has a writethrough cache. PWT can be used to control the write
policy ofa second level cache.

4.5.5 TRANSLATION LOOKASIDE BUFFER
The Intel486 Microprocessor paging hardware is designed to support demand paged virtual memory
systems. However, performance would degrade
substantially if the processor was required to access
two levels of tables for every memory reference. To
solve this problem, the Intel486 Microprocessor
keeps a cache of the most recently accessed pages,
this cache is called the Translation Lookaside Buffer
(TLB). The TLB is a four-way set associative 32-entry page table cache. It automatically keeps the most
commonly used Page Table Entries in the processor. The 32-entry TLB coupled with a 4K page size,
results in coverage of 128 Kbytes of memory addresses. For many common multi-tasking systems,
the TLB will have a hit rate of about 98%. This
means that the processor will only have to access
the two-level page structure on 2% of a" memory
references. Figure 4.22 illustrates how the TLB complements the Intel486 Microprocessor's paging
mechanism.

PCD controls cacheability. PCD = 0 enables caching
in the on-chip cache. PCD alone does not enable
caching, it must be conditioned by the KEN # (cache
enable) input signal and the state of the CD (cache
disable bit) and NW (no write-through) bits in control
register 0 (CRO). When PCD = 1, caching is disabled
regardless of the state of KEN#, CD and NW. (See
Section 5.0, On-Chip Cache).
The state of the PCD and PWT bits are driven out on
the PCD and PWT pins during a memory access.
The PWT and PCD bits for a bus cycle are obtained
either from control register 3 (CR3), the Page Direc~
tory Entry or the Page Table Entry, depending on the
type of cycle run. However, when paging is disabled
(PG = 0 in CRO) or for cycles which bypass paging
(Le., I/O (input/output) references, INTR (interrupt
request) and HALT cycles), the PCD and PWT bits
of CR3 are ignored. The Intel486 CPU assumes PCD
= 0 and PWT = 0 and drives these values on the
PCD and PWT pins.

Reading a new entry into the TLB (TLB refresh) is a
two step process handled by the Intel486 microprocessor hardware. The sequence of data cycles to perform a TLB refresh are:

Table 4.4. Page Level Protection Attributes
U/S

R/W

User Access

Supervisor Access

0
0

0
1
0
1
0
1
0

0
0
0
0
1
1

None
None
Read/Execute
Read/Write/Execute
None
None
Read/Execute
Read/Write/Execute

Read/Write/Execute
Read/Write/Execute
Read/Write/ Execute
Read/Write/Execute
Read/Execute
Read/Write/Execute
Read/Execute
Read/Write/Execute

1
0
0

intel"

Intel486™ OX MICROPROCESSOR

Read the correct Page Directory Entry, as pointed to by the page base register and the upper
10 bits of the linear address. The page base
register is in control register 3.
1a. Optionally perform a locked read/write to set
the accessed bit in the directory entry. The directory entry will actually get read twice if the
Intel486 Microprocessor needs to set any of the
bits in the entry. If the page directory entry
changes between the first and second reads,
the data returned for the second read will be
used.
2. Read the correct entry in the Page Table and
place the entry in the TLB.

However, if the page table entry is not in the TLB,
the Intel486 Microprocessor will read the appropriate Page Directory Entry. If P = 1 on the Page Directory Entry indicating that the page table is in
memory, then the Intel486 Microprocessor will read
the appropriate Page Table Entry and set the Access bit. If P = 1 on the Page Table Entry indicating
that the page is in memory, the Intel486 Microprocessor will update the Access and Dirty bits as needed and fetch the operand. The upper 20 bits of the
linear address, read from the page table, will be
stored in the TLB for future accesses. However, if
P = 0 for either the Page Directory Entry or the
Page Table Entry, then the processor will generate a
page fault, an Exception 14.

2a. Optionally perform a locked read/write to set
the accessed and/or dirty bit in the page table
entry. Again, note that the page table entry will
actually get read twice if the Intel486 Microprocessor needs to set any of the bits in the entry.
Like the directory entry, if the data changes between the first and second read the data returned for the second read will be used.

The processor will also generate an exception 14
page fault, if the memory reference violated the
page protection attributes (Le., U/S or R/W) (e.g.,
trying to write to a read-only page). CR2 will hold the
linear address which caused the page fault. If a second page fault occurs, while the processor is attempting to enter the service routine for the first,
then the processor will invoke the page fault (exception 14) handler a second time, rather than the double fault (exception 8) handler. Since Exception 14 is
classified as a fault, CS: EIP will point to the instruction causing the page fault. The 16-bit error code
pushed as part of the page fault handler will contain
status bits which indicate the cause of the page
fault.

Note that the directory entry must always be read
into the processor, since directory entries are never
placed in the paging TLB. Page faults can be signaled from either the page directory read or the
page table read. Page directory and page table entries may be placed in the Intel486 on-chip cache
just like normal data.
4.5.6 PAGING OPERATION

The 16-bit error code is used by the operating system to determine how to handle the page fault. Figure 4.23a shows the format of the page-fault error
code and the interpretation of the bits.

32 ENTRIES
PHYSICAL
~EMORY

A~~~~S --+-

TRANSLATION
LOQKASIDE
BUFFER

HIT

NOTE:
Even though the bits in the error code (U/S, W/R,
and P) have similar names as the bits in the Page
Directory/Table Entries, the interpretation of the error code bits is different. Figure 4.23b indicates
what type of access caused the page fault.

MISS
0

-+
PAGE
DIRECTORY

I-

3 2 1 0

PAGE
TABLE

.98% HIT RATE

Figure 4.23a. Page Fault Error Code Format

240440-24

Figure 4.22. Translation Lookaside Buffer

U/S: The U/S bit indicates whether the access
causing the fault occurred when the processor was
executing in User Mode (U/S = 1) or in Supervisor
mode (U/S = 0).

The paging hardware operates in the following fashion. The paging unit hardware receives a 32-bit linear address from the segmentation unit. The upper
20 linear address bits are compared with all 32 entries in the TLB to determine if there is a match. If
there is a match (Le., a TLB hit), then the 32-bit
physical address is calculated and will be placed on
the address bus.

W/R: The W/R bit indicates whether the access
causing the fault was a Read (W/R = 0) or a Write
(W/R = 1).

Intel486TM OX MICROPROCESSOR

P: The P bit indicates whether a page fault was
caused by a not-present page (P = 0), or by a page
level protection violation (P = 1).

nism. In particular, the Intel486 Microprocessor allows the simultaneous execution of 8086 operating
systems and its applications, and an Intel486 Microprocessor operating system and both 80286 and Intel486 Microprocessor applications. Thus, in a multiuser Intel486 Microprocessor computer, one person
could be ~unning an MS-DOS s~readsheet, another
person uSing MS-DOS, and a third person could be
running multiple Unix utilities and applications. Each
person in this scenario would believe that he had the
computer completely to himself. Figure 4.24 illustrates this concept.

U: UNDEFINED

U/S

W/R

Access Type

0
0
1
1

0
1
0
1

Supervisor' Read
Supervisor Write
User Read
User Write

. Desc"p~or table access will fault with U/S = 0, even if the program
IS executing at level 3.

4.6.2 VIRTUAL 8086 MODE ADDRESSING
MECHANISM

Figure 4.23b. Type of Access
Causing Page Fault

One of the major differences between Intel486 Microprocessor Real and Protected modes is how the
segment selectors are interpreted. When the process.or is executing in Virtual 8086 Mode the segment
registers are used in an identical fashion to Real
Mode. The contents of the segment register is shifted left 4 bits and added to the offset to form the
segment base linear address.

4.5.7 OPERATING SYSTEM RESPONSIBILITIES
The Intel486 Microprocessor takes care of the page
address translation process, relieving the burden
from an operating system in a demand-paged system. Th~ ?perating system is responsible for setting
up the Initial page tables, and handling any page
faults. The operating system also is required to invalidate (i.e., flush) the TLB when any changes are
made to any of the page table entries. The operating
system must reload CR3 to cause the TLB to be
flushed.

The Intel486 Microprocessor allows the operating
system to specify which programs use the 8086
style address mechanism, and which programs use
Protected Mode addressing, on a per task basis.
Through the use of paging, the one megabyte address space of the Virtual Mode task can be mapped
to anywhere in the 4 gigabyte linear address space
of the Intel486 Microprocessor. Like Real Mode, Virtual Mode effective addresses (i.e., segment offsets)
that exceed 64 Kbyte will cause an exception 13.
However, these restrictions should not prove to be
important, because most tasks running in Virtual
8086 Mode will simply be existing 8086 application
programs.

Setting. up the tables is simply a matter of loading
CR3 with the address of the Page Directory and
allocating space for the Page Directory and the
Page Tables. The primary responsibility of the operating system is to implement a swapping policy and
handle all of the page faults.
A final concern of the operating system is to ensure
that the TLB cache matches the information in the
paging tables. In particular, any time the operating
system sets the P present bit of page table entry to
zero, the TLB must be flushed. Operating systems
may want to take advantage of the fact that CR3 is
stored as part of a TSS, to give every task or group
of tasks its own set of page tables.

4.6.3 PAGING IN VIRTUAL MODE
The pa.ging ~ardware allows the concurrent running
of multiple Virtual Mode tasks, and provides protection a~d operating system isolation. Although it is
not strictly necessary to have the paging hardware
enabled to run Virtual Mode tasks, it is needed in
order to run multiple Virtual Mode tasks or to relocate the address space of a Virtual Mode task to
physical address space greater than one megabyte.

4.6 Virtual 8086 Environment
4.6.1 EXECUTING 8086 PROGRAMS

The paging hardware allows the 20-bit linear address produced by a Virtual Mode program to be
divided into up to 256 pages. Each one of the pages
can be located anywhere within the maximum 4 gigabyte physical address space of the Intel486 Microprocessor. In addition, since CR3 (the Page Directory Base Register) is loaded by a task switch each
Virtual Mode task can use a different m~pPing
scheme to map pages to different physical locations.

The Intel486 Microprocessor allows the execution of
8086 application programs in both Real Mode and in
the Virtual 8086 Mode (Virtual Mode). Of the two
methods, Virtual 8086 Mode offers the system designer the most flexibility. The Virtual 8086 Mode allows the execution of 8086 applications, while still
allowing the system designer to take'full advantage
of the Intel486 Microprocessor protection mecha74

intet

Intel486TM OX MICROPROCESSOR

Finally, the paging hardware allows the sharing of
the 8086 operating system code between multiple
8086 applications. Figure 4.24 shows how the Intel486 Microprocessor paging hardware enables
multiple 8086 programs to run under a virtual memory demand paged system.

LIDT;
LGDT;
LMSW;
CLTS;
HLT;

MOV DRn,reg;
MOV TRn,reg;
MOV CRn, reg;

MOV reg,DRn;
MOV reg, TRn;
MOV reg,CRn.

Several instructions, particularly those applying to
the multitasking model and protection model, are
available only in Protected Mode. Therefore, attempting to execute the following instructions in
Real Mode or in Virtual 8086 Mode generates an
exception 6 fault:

4.6.4 PROTECTION AND 1/0 PERMISSION
BITMAP

All Virtual 8086 Mode programs execute at privilege
level 3, the level of least privilege. As such, Virtual
8086 Mode programs are subject to all of the protection checks defined in Protected Mode. (This is different from Real Mode which implicitly is executing
at privilege level 0, the level of greatest privilege.)
Thus, an attempt to execute a privileged instruction
when in Virtual 8086 Mode will cause an exception
13 fault.

LTR;
LLDT;
LAR;
LSL;
ARPL.

STR;
SLDT;
VERR;
VERW;

The instructions which are IOPL-sensitive in Protected Mode are:

The following are privileged instructions, which may
be executed only at Privilege Level O. Therefore, attempting to execute these instructions in Virtual
8086 Mode (or anytime CPL > 0) causes an exception 13 fault:

IN;
STI;
OUT;
CLI
INS;
OUTS;
REP INS;
REP OUTS;
PHYSICAL
~E~ORY

~~~~ 02DOOOOD(H)

VIRTUAL ~ODE
8086 TASK

OOOODOOD(H)
PAGE DIRECTORY
ROOT
VIRTUAL ~ODE
8086 TASK

•

TASK I
~E~ORY

I77Jl TASK 2

PAGE DIRECTORY
TASK I

f(ll.iI ~E~ORY

•

8086 OS
~E~ORY

~ 386™ CPU OS
~ ~E~ORY

240440-25

Figure 4.24. Virtual 8086 Environment Memory Management

intel·

Intel486TM OX MICROPROCESSOR

EXAMPLE OF BITMAP FOR lID PORTS 0-255:
Setting the TSS limit to {biLMap_Offset + 31
+ 1"1 [ •• see note belowl will allow a 32-byte bitmap for the 110 ports #0-255, plus a terminator
byte of all 1's [** see note belowl. This allows the
110 bitmap to control 110 Permission to 110 port 0255 while causing an exception 13 fault on attempted 110 to any 110 port 80256 through 65,565.

In Virtual 8086 Mode, a slightly different set of iriare made 10PL-sensitive. The following instructions are 10PL-sensitive in Virtual 8086 Mode:
struct~ons

INT n;
PUSHF;
POPF;

STI;
eLI;
IRET

The PUSHF, POPF, and IRET instructions are 10PLsensitive in Virtual 8086 Mode only. This provision
allows the IF flag (interrupt enable flag) to be virtualized to the Virtual 8086 Mode program. The INT n
software interrupt instruction is also 10PL-sensitive
in Virtual 8086 Mode. Note, however, that the INT 3
(opcode OCCH), INTO, and BOUND instructions are
not 10PL-sensitive in Virtual 8086 mode (they aren't
10PL sensitive in Protected Mode either).

"IMPORTANT IMPLEMENTATION NOTE: Beyond
the last byte of 110 mapping information in the lID
Permission Bitmap must be a byte containing all 1'so
The byte of all 1's must be within the limit of the
Intel486 Microprocessor TSS segment (see Figure
4.15a).
4.6.5 INTERRUPT HANDLING

Note that the lID instructions (IN, OUT, INS, OUTS,
REP INS, and REP OUTS) are not 10PL-sensitive in
Virtual 8086 mode. Rather, the lID instructions become automatically sensitive to the 1/0 Permission
Bitmap contained in the Intel486 Microprocessor
Task St~te Segment. The 110 Permission Bitmap,
automatically used by the Intel486 Microprocessor
in Virtual 8086 Mode, is illustrated by Figures 4.15a
and 4.15b.

In order to fully support the emulation of an 8086
machine, interrupts in Virtual 8086 Mode are handled in a unique fashion. When running in Virtual
Mode all interrupts and exceptions involve a privilege change back to the host Intel486 Microprocessor operating system. The Intel486 Microprocessor
operating system determines if the interrupt comes
from a Protected Mode application or from a Virtual
Mode program by examining the VM bit in the
EFLAGS image stored on the stack.

The 110 Permission Bitmap can be viewed as a 064 Kbit bit string, which begins in memory at offset
BiLMap_Offset in the current TSS. BiLMap_
Offset must be ::;; DFFFH so the entire bit map and
the byte FFH which follows the bit map are all at
offsets ::;; FFFFH from the TSS base. The 16-bit
pointer BiLMap_Offset (15:0) is found in the word
beginning at offset 66H (102 decimal) from the TSS
base, as shown in Figure 4.15a.

When a Virtual Mode program is interrupted and execution passes to the interrupt routine at level 0 the
VM bit is cleared. However, the VM bit is still s~t in
the EFLAG image on the stack.
The Intel486 Microprocessor operating system in
turn handles the exception or interrupt and then returns control to the 8086 program. The Intel486 Microprocessor operating system may choose to let
the 8086 operating system handle the interrupt or it
may emUlate the function of the interrupt handler.
For example, many 8086 operating system calls are
accessed by PUSHing parameters on the stack, and
then executing an INT n instruction. If the 10PL is set
to 0 then all INT n instructions will be intercepted by
the Intel486 Microprocessor operating system. The
Intel486 Microprocessoroperating system could emulate the 8086 operating system's call. Figure 4.25
shows how the Intel486 Microprocessor operating
system could intercept an 8086 operating system's
call to "Open a File".

Each bit in the 110 Permission Bitmap corresponds
to a single byte-wide 110 port, as illustrated in Figure
4 ..15a. If a bit is 0, 110 to the corresponding byte~Ide port can occur without generating an except!on. Otherwis~ the 110 instruction causes an exception 13 fault. Since every byte-wide 110 port must be
protectable, all bits corresponding to a word-wide or
dword-wide port must be 0 for the word-wide or
dword-wide 110 to be permitted. If all the referenced
b~ts are 0, the 110 will be allowed. If any referenced
bits are 1, the attempted lID will cause an exception
13 fault.
Due to the use of a pointer to the base of the 110
Permission Bitmap, the bitmap may be located anywhere within the TSS, or may be ignored completely
by pointing the BiLMap_Offset (15:0) beyond the
limit of the ~SS segment. In the same manner, only
a small portion of the 64K lID space need have an
associated map bit, by adjusting the TSS limit to
truncate the bitmap. This eliminates the commitment
of 8K of memory when a complete bitmap is not
required, while allowing the fully general case if desired.

An Intel486 Microprocessor operating system can
provide a Virtual 8086 Environment which is totally
transparent to the application software via intercepting and then emulating 8086 operating system's
calls, and intercepting IN and OUT instructions.

int'eL

Intel486TM OX MICROPROCESSOR

4.6.6 ENTERING AND LEAVING VIRTUAL
8086 MODE

The segment registers in the TSS will contain 8086
segment base values rather than selectors.

Virtual 8086 mode is entered by executing an IRET
instruction (at CPL=O), or Task Switch (at any CPL)
to an Intel486 Microprocessor task whose Intel486
Microprocessor TSS has a FLAGS image containing
a 1 in the VM bit position while the processor is executing in Protected Mode. That is, one way to enter
Virtual 8086 mode is to switch to a task with an Intel486 Microprocessor TSS that has a 1 in the VM
bit in the EFLAGS image. The other way is to execute a 32-bit IRET instruction at privilege level 0,
where the stack has a 1 in the VM bit in the EFLAGS
image. POPF does not affect the VM bit, even if the
processor is in Protected Mode or level 0, and so
cannot be used to enter Virtual 8086 Mode. PUSHF
always pushes a 0 in the VM bit, even if the processor is in Virtual 8086 Mode, so that a program cannot tell if it is executing in REAL mode, or in Virtual
8086 mode.

A task switch into a task described by an Intel486
Microprocessor TSS will have an additional check to
determine if the incoming task should be resumed in
virtual 8086 mode. Tasks described by 80286 format
TSSs cannot be resumed in virtual 8086 mode, so
no check is required there (the FLAGS image in
80286 format TSS has only the low order 16 FLAGS
bits). Before loading the segment register images
from an Intel486 Microprocessor TSS, the FLAGS
image is loaded, so that the segment registers are
loaded from the TSS image as 8086 segment base
values. The task is now ready to resume in virtual
8086 execution mode.
4.6.6.2 Transitions Through Trap and Interrupt
Gates, and IRET
A task switch is one way to enter or exit virtual 8086
mode. The other method is to exit through a Trap or
Interrupt gate, as part of handling an interrupt, and
to enter as part of executing an IRET instruction.
The transition out must use an Intel486 Microprocessor Trap Gate (Type 14), or Intel486 Microprocessor Interrupt Gate (Type 15), which must point to a
non-conforming level 0 segment (DPL = 0) in order
to permit the trap handler to IRET back to the Virtual
8086 program. The Gate must point to a non-conforming level 0 segment to perform a level switch to
level 0 so that the matching IRET can change the
VM bit. Intel486 Microprocessor gates must be used,
since 80286 gates save only the low 16 bits of the
FLAGS register, so that the VM bit will not be saved
on transitions through the 80286 gates. Also, the
16-bit IRET (presumably) used to terminate the
80286 interrupt handler will pop only the lower 16
bits from FLAGS, and will not affect the VM bit. The
action taken for an Intel486 Microprocessor Trap or
Interrupt gate if an interrupt occurs while the task is
executing in virtual 8086 mode is given by the following sequence.
(1) Save the FLAGS register in a temp to push later.
Turn off the VM and TF bits, and if the interrupt
is serviced by an Interrupt Gate, turn off IF also.

The VM bit can be set by executing an IRET instruction only at privilege level 0, or by any instruction or
Interrupt which causes a task switch in Protected
Mode (with VM = 1 in the new FLAGS image), and
can be cleared only by an interrupt OJ exception in
Virtual 8086 Mode. IRET and POPF instructions executed in REAL mode or Virtual 8086 mode will not
change the value in the VM bit.
The transition out of virtual 8086 mode to Intel486
Microprocessor protected mode occurs only on receipt of an interrupt or exception (such as due to a
sensitive instruction). In Virtual 8086 mode, all interrupts and exceptions vector through the protected
mode lOT, and enter an interrupt handler in protected Intel486 Microprocessor mode. That is, as part of
interrupt processing, the VM bit is cleared.
Because the matching IRET must occur from level 0,
if an Interrupt or Trap Gate is used to field an interrupt or exception out of Virtual 8086 mode, the Gate
must perform an inter-level interrupt only to level O.
Interrupt or Trap Gates through conforming segments, or through segments with DPL> 0, will raise a
GP fault with the CS selector as the error code.

(2) Interrupt and Trap gates must perform a level
switch from 3 (where the VM86 program executes) to level 0 (so IRET can return). This process involves a stack switch to the stack given
in the TSS for privilege level o. Save the Virtual
8086 Mode SS and ESP registers to push in a
later step. The segment register load of SS will
be done as a Protected Mode segment load,
since the VM bit was turned off above.

4.6.6.1 Task Switches To/From Virtual
8086 Mode
Tasks which can execute in virtual 8086 mode must
be described by a TSS with the new Intel486 Microprocessor format (TYPE 9 or 11 descriptor).
A task switch out of virtual 8086 mode will operate
exactly the same as any other task switch out of a
task with an Intel486 Microprocessor TSS. All of the
programmer visible state, including the FLAGS register with the VM bit set to 1, is stored in the TSS.

infel .

Intel486TM DX MICROPROCESSOR

240440-26
SOS6 Application makes "Open File Call" -+ causes
General Protection Fault (Arrow # 1)
Virtual SOS6 Monitor intercepts call. Calls Intel4S6TM CPU OS (Arrow # 2)
Intel4S6TM CPU OS opens file returns control to SOS6 OS (Arrow # 3)
SOS6 OS returns control to application. (Arrow #4)
Transparent to Application

Figure 4.25. Virtual 8086 Environment Interrupt and Call Handling
(3) Push the 8086 segment register values onto the
new stack, in the order: GS, FS, OS, ES. These
are pushed as 32-bit quantities, with undefined
values in the upper 16 bits. Then load these 4
registers with null selectors (0).

ing back to protected mode. In addition, all of the
8086 segment register i'mages are stored on the
stack (behind the SS:ESP image), and then loaded
with null (0) selectors before entering the interrupt
handler. This will permit the handler to safely save
and restore the OS, ES, FS, and GS registers as
80286 selectors. This is needed so that interrupt
handlers which don't care about the mode of the
interrupted program can use the same prolog and
epilog code for state saving (Le., push all registers in
prolog, pop all in epilog) regardless of whether or not
a "native" mode or Virtual 8086 mode program was
interrupted. Restoring null selectors to these registers before executing the IRET will not cause a trap
in the interrupt handler. Interrupt routines which expect values in the segment registers, or return valuesin segment registers will have to obtain/return
values from the 8086 register images pushed onto
the new stack. They will need to know the mode of
the interrupted program in order to know where to
find/return segment registers, and also to know how
to interpret segment register values.

(4) Push the old 8086 stack pointer onto the new
stack by pushing the SS register (as 32-bits, high
bits undefined), then pushing the 32-bit ESP register saved above.
(5) Push the 32-bit FLAGS register saved in step 1.
(6) Push the old 8086 instruction pointer onto the
new stack by pushing the CS register (as 32-bits,
high bits undefined), then pushing the 32-bit EIP
register.
(7) Load up the new CS:EIP value from the interrupt
gate, and begin execution of the interrupt routine
in protected Intel486 Microprocessor mode.
The transition out of virtual 8086 mode performs a
level change and stack switch, in addition to chang-

infel .

Intel486TM OX MICROPROCESSOR

(4) Increment the ESP register by 4 to bypass the
FLAGS image which was "popped" in step 1.

The IRET instruction will perform the inverse of the
above sequence. Only the extended Intel486 Microprocessors IRET instruction (operand size = 32) can
be used, and must be executed at level 0 to change
the VM bit to 1.
(1) If the NT bit in the FLAGs register is on, an intertask return is performed. The current state is
stored in the current TSS, and the link field in the
current TSS is used to locate the TSS for the
interrupted task which is to be resumed.
Otherwise, continue with the following sequence.

(5) If VM = 1, load segment registers ES, OS, FS,
and GS from memory locations SS:[ESP+8],
SS:[ESP+ 121,
SS:[ESP+ 16],
and
SS:[ESP+20], respectively, where the new value of ESP stored in step 4 is used. Since VM = 1,
these are done as 8086 segment register loads.
Else if VM = 0, check that the selectors in ES,
OS, FS, and GS are valid in the interrupted routine. Null out invalid selectors to trap if an attempt is made to access through them.
(6) If (RPL(CS) > CPL), pop the stack pointer
SS:ESP from the stack. The ESP register is
popped first, followed by 32-bits containing SS in
the lower 16 bits. If VM = 0, 5S is loaded as a
protected mode segment register load. If VM = 1,
an 8086 segment register load is used.
(7) Resume execution of the interrupted routine. The
VM bit in the FLAGS register (restored from the
interrupt routine's stack image in step 1) determines whether the processor resumes the interrupted routine in Protected mode of Virtual 8086
mode.

(2) Read the FLAGS image from SS:8[ESP1 into the
FLAGS register. This will set VM to the value
active in the interrupted routine.
(3) Pop off the instruction pointer CS:EIP. EIP is
popped first, then a 32-bit word is popped which
contains the CS value in the lower 16 bits. If
VM = 0, this CS load is done as a protected
mode segment load. If VM = 1, this will be done
as an 8086 segment load.

intel .

Intel486TM OX MICROPROCESSOR

5.0 ON-CHIP CACHE

5.1 Cache Organization

To meet its performance goals the Intel486 Microprocessor contains an eight Kbyte cache. The cache
is software transparent to maintain binary compatibility with previous generations of the InteI386TM/lntel486TM Architecture.

The on-chip cache is a unified code and data cache.
The cache is used for both instruction and data accesses and acts on physical addresses.
The cache organization is 4-way set associative and
each line is 16 bytes wide. The eight Kbytes of
cache memory are logically organized as 128 sets,
each containing four lines.

The on-chip cache has been designed for maximum
flexibility and performance. The cache has several
operating modes offering flexibility during program
execution and debugging. Memory areas can be defined as non-cacheable by software and external
hardware. Protocols for cache line invalidations and
replacement are implemented in hardware, easing
system design.

The cache memory is physically split into four
2-Kbyte blocks each containing 128 lines (see Figure 5.1). Associated with each 2-Kbyte block are
128 21-bit tags. There is a valid bit for each line in
the cache. Each line in the cache is either valid or
not valid. There are no provisions for partially valid
lines.

...J21 Bit I-

16-Byte Line Slze-1

c::J Js
D c::J
D c::J
D c::J

··1 Tag 1

l~ED

k Bytes

Sets

r- 3 LRU - + j - 4 Valid ---!

Bits

----'11

1 0 - -_ _

Figure 5.1. On-Chip Cache Physical Organization

240440-27

intet

Intel486TM OX MICROPROCESSOR

The write strategy of on-chip cache is write-through.
All writes will drive an external write bus cycle in
addition to writing the information to the internal
cache if the write was a cache hit. A write to an
address not contained in the internal cache will only
be written to external memory. Cache allocations
are not made on write misses.

CD=1, NW=O
Cache fills are disabled but write-throughs
and invalidates are enabled. This mode is
the same as if the KEN # pin was strapped
HIGH disabling cache fills. Write-throughs
and invalidates may still occur to keep the
cache valid. This mode is useful if the software must disable the cache for a short period of time, and then re-enable it without
flushing the original contents.

5.2 Cache Control

CD=O, NW=1
INVALID. If CRO is loaded with this bit configuration, a General Protection fault with
error code of 0 is raised. Note that this
mode would imply a non-transparent writeback cache. A future processor may define
this combination of bits to implement a
write-back cache.
CD=O, NW=O
This is the normal operating mode.

Control of the cache is provided by the CD and NW
bits in CRO. CD enables and disables the cache. NW
controls memory write-through and invalidates.
The CD and NW bits define four operating modes of
the on-Chip cache as given in Table 5.1. These
modes provide flexibility in how the on-Chip cache is
used.
Table 5.1. Cache Operating Modes
CD

Operating Mode

Cache fills disabled, write-through and
invalidates disabled
Cache fills disabled, write-through and
invalidates enabled
INVALID. IF CRO is loaded with this
configuration of bits, a GP fault with
error code of 0 is raised.
Cache fills enabled, write-through and
invalidates enabled

Completely disabling the cache is a two step process. First CD and NW must be set to 1 and then the
cache must be flushed. If the cache is not flushed,
cache hits on reads will still occur and data will be
read from the cache.

5.3 Cache Line Fills
Any area of memory can be cached in the Intel486
Microprocessor. Non-cacheable portions of memory
can be defined by the external system or by software. The external system can inform the Intel486
Microprocessor that a memory address is noncacheable by returning the KEN # pin inactive during
a memory access (refer to Section 7.2.3). Software
can prevent certain pages from being cached by setting the PCD bit in the page table entry.

CD=1, NW=1
The cache is completely disabled by setting
CD = 1 and NW = 1 and then flushing the
cache. This mode may be useful for debugging programs where it is important to see
all memory cycles at the pins. Writes which
hit in the cache will not appear on the external bus.
It is possible to use the on-chip cache as
fast static RAM by "pre-loading" certain
memory areas into the cache and then setting CD = 1 and NW = 1. Pre-loading can be
done by careful choice of memory references with the cache turned on or by use of
the testability functions (see Section 8.2).
When the cache is turned off the memory
mapped by the cache is "frozen" into 'he
cache since fills and invalidates are OISabled.

A read request can be generated from program operation or by an instruction pre-fetch. The data will
be supplied from the on-Chip cache if a cache hit
occurs on the read address. If the address is not in
the cache, a read request for the data is generated
on the external bus.
If the read request is to a cacheable portion of memory, the Intel486 Microprocessor initiates a cache
line fill. During a line fill a 16-byte line is read into the
Intel486 Microprocessor.
Cache fills will only be generated for read misses.
Write misses will never cause a line in the internal
cache to be allocated. If a cache hit occurs on a
write, the line will be updated.

infel .

Intel486TM OX MICROPROCESSOR

Cache line fills can be performed over 8- and 16-bit
busses using the dynamic bus sizing feature. Refer
to Section 7.1.3 for a description of dynamic bus
sizing.

valid bits are checked to see if there is a non-valid
line that can be replaced. If a non-valid line is found,
that line is marked for replacement.
The four lines in the set are labeled 10, 11, 12, and 13.
The order in which the valid bits are checked during
an invalidation is 10, 11, 12 and 13. All valid bits are
cleared when the processor is reset or when the
cache is flushed.

Refer to Section 7.2.3 for further information on
cacheable cycles.

5.4 Cache Line Invalidations

Replacement in the cache is handled by a pseudo
least recently used (LRU) mechanism when all four
lines in a set are valid. Three bits, 80, B1 and B2,
are defined for each of the 128 sets in the cache.
These bits are called the LRU bits. The LRU bits are
updated for every hit or replace in the cache.

The Intel486 Microprocessor contains both a hardware and software mechanism for invalidating lines
in its internal cache. Cache line invalidations are
needed to keep the Intel486 Microprocessor's
cache contents consistent with external memory.
Refer to Section 7.2.8 for further information on
cache line invalidations.

If the most recent access to the set was to 10 or 11,
80 is set to 1. BO is set to O.if the most recent access was to 12 or 13. If the most recent access to
10:11 was to 10, B1 is set to 1, else B1 is set to O. If
the most recent access to 12:13 was to 12, B2 is set to
1, else B2 is set to O.

5.5 Cache Replacement
When a line needs to be placed in its internal cache
the Intel486 Microprocessor first checks to see if
there is a non-valid line in the set that can be replaced. If all four lines in the set are valid, a pseudo
least-recently-used mechanism is used to determine
which line should be replaced.

The pseudo LRU mechanism works in the following
manner. When a line must be replaced, the cache
will first select which of 10:11 and 12:13 was least recently used. Then the cache will determine which of
the two lines was least recently used and mark it for
replacement. This decision tree is shown in Figure
5.2. When the processor is reset or when the cache
is flushed all 128 sets of three LRU bits are set to O.

A valid bit is associated with each line in the cache.
When a line needs to be placed in a set, the four

All four lines In the set valid?

Replace non-valid line

Yes!
BO=O?
Yes: 10 or 11 least recently used
No: 12 or 13 least recently used

Bl =O?

Replace
10

Replace
11

B2=0?

Replace
12

Replace
13

Figure 5.2. On·Chip Cache Replacement Strategy

240440-28

intel~

Intel486TM OX MICROPROCESSOR

The PCD bit controls cacheability on a page by page
basis. The PCD bit is internally ANDed with the
KEN # signal to control cacheability on a cycle by
cycle basis (see Figure 5.3). PCD = 0 enables caching while PCD = 1 forbids it. Note that cache fills are
enabled when PCD = 0 AND KEN # = O. This logical
AND is implemented physically with a NOR gate.

5.6 Page Cacheability
Two bits for cache control, PWT and PCD, are defined in the page table and page directory entries.
The state of these bits are driven out on the PWT
and PCD pins during memory access cycles.
The PWT bit controls write policy for second level
caches used with the Intel486 Microprocessor. Setting PWT = 1 defines a write-through policy for the
current page while PWT = 0 allows the possibility of
write-back. The state of PWT is ignored internally by
the Intel486 Microprocessor since the on-chip cache
is write through.

The state of the PCD bit in the page table entry is
driven on the PCD pin when a page in external memory is accessed. The state of the PCD pin informs
the external system of the cacheability of the requested information. The external system then returns KEN # telling the Intel486 Microprocessor if
the area is cacheable. The Intel486 Microprocessor
initiates a cache line fill if PCD and KEN # indicate
that the requested information is cacheable.

CRO

fLUSH#

CACHE CONTROL LOGIC

KEN#

CACHE MEMORY

r---------------------------,
31
22
12
0
DIRECTORY I TABLE I OffSET I
LINEAR
ADDRESS

PCD

PWT
31

CRO

CR1
CR2

cR3

PCD, PWT

PAGE TABLE
DIRECTORY

I
I

(from eRO)

CONTROL REGISTERS

~--------------------------240440-29

Figure 5.3. Page Cacheability

inteL

Intel486TM OX MICROPROCESSOR

The PCD bit is masked with the CD (cache disable)
bit in control register 0 to determine the state of the
PCD pin. If CD= 1 the Intel486 Microprocessor
forces the PCD pin HIGH. If CD=O the PCD pin is
driven with the value for the page table entry/directory. See Figure 5.3.

6.2.5 for the bus cycle definition pins and Section
7.2.11 for special bus cycles). Refer to the Intel486
Microprocessor programmers reference manual for
detailed instruction definitions.
The results of the INVD and WBINVD instructions
are identical for the operation of the Intel486 Microprocessor's on-chip cache since the cache is writethrough. Note that the INVD and WBINVD instructions are machine dependent. Future members of
the Intel486 Microprocessor family may change the
definition of this instruction.

The PWT and PCD bits for a bus cycle are obtained
from either CR3, the page directory or page table
entry. These bits are assumed to be zero during real
mode, whenever paging is disabled, or for cycles
that bypass paging, (I/O references, interrupt acknowledge and Halt cycles), the PWT and PCD bits
are taken from CR3. These bits are initialized to 0 on
reset, but can be set to any value by level 0 software.

5.8 Caching Translation Lookaside
Buffer Entries

When paging is enabled, the bits from the page table
entry are cached in the TLB, and are driven any time
the page mapped by the TLB entry is referenced.
For normal memory cycles, PWT and PCD are taken
from the page table entry. During TLB refresh cycles
where the page table and directory entries are read,
the PWT and PCD bits must be obtained elsewhere.
During page table updates the bits are obtained from
the page directory. When the page directory is updated the bits are obtained from CR3.

The Intel486 Microprocessor contains an integrated
paging unit with a translation lookaside buffer (TLB).
The TLB contains 32 entries. The TLB has been enhanced over the 386 Microprocessor's TLB by upgrading the replacement strategy to a pseudo-LRU
(least recently used) algorithm. The pseudo-LRU replacement algorithm is the same as that used in the
on-chip cache.
The paging TLB operation is automatic whenever
paging is enabled. The TLB contains the most recently used page table entries. A page table entry
translates the linear address pointing to a particular
page to the physical address where the page is
stored in memory (refer to Section 4.5, Paging).

5.7 Cache Flushing
The on-chip cache can be flushed by external hardware or by software instructions. Flushing the cache
clears all valid bits for all lines in the cache. The
cache is flushed when external hardware asserts the
FLUSH# pin.

The paging unit will look up the linear address in the
TLB in response to an internal bus request. The corresponding physical address is passed on to the onchip cache or the external bus (in the event of a
cache miss) when the linear address is present in
the TLB.

The flush pin needs to be asserted for one clock if
driven synchronously or for two clocks if driven
asynchronously. The flush input is asynchronous but
setup and hold times must be met. The flush pin
should be deasserted after the cache flush is complete. Failure to de assert the pin will cause execution to stop as the processor will be repeatedly flushing the cache. If external hardware activates flush in
response to an I/O write, flush must be asserted for
at least two clocks prior to ready being returned for
the I/O write. This ensures that the flush completes
before the CPU begins execution of the instruction
following the OUT instruction.

The paging unit will access the page tables in external memory if the linear address is not in the TLB.
The required page table entry will be read into the
TLB and then the cache or bus cycle for the actual
data will take place. The process of reading a new
page table entry into the TLB is called a TLB refresh.
A TLB refresh is a two step process. The paging unit
must first read the page directory entry which points
to the appropriate page table. The page table entry
to be stored in the TLB is then read from the page
table. Control register 3 (CR3) points to the base of
the page directory table.

Flush is recognized during HOLD just like EADS#.
The instructions INVD and WBINVD cause the oncache to be flushed. External caches connected to
the Intel486 microprocessor are Signalled to flush
their contents when these instructions are executed.

The Intel486 Microprocessor will allow page directory and page table entries (returned during TLB refreshes) to be stored in the on-chip cache. Setting
the PCD bits in CR3 and the page directory entry to
1 will prevent the page directory and page table entries from being stored in the on-chip cache (see
Section 5.6, Page Cacheability).

WBINVD will cause an external write-back cache to
write back dirty lines before flushing its contents.
The external cache is signalled using the bus cycle
definition pins and the byte enables (refer to Section
84

Intel486™ OX MICROPROCESSOR

6.0

HARDWARE INTERFACE

6.1

Introduction

Like the 386 Microprocessor, the Intel486 Microprocessor has separate parallel busses for data and
addresses. The bidirectonal data bus is 32 bits in
width. The address bus consists of two components:
30 address lines (A2-A31) and 4 byte enable lines
(BEO#-BE3#). The address bus addresses external memory in the same manner as the 386 Microprocessor: The address lines form the upper 30 bits
of the address and the byte enables select individual
bytes within a 4 byte location. The address lines are
bidirectional for use in cache line invalidations.

The Intel486 Microprocessor bus has been designed
to be similar to the 386 Microprocessor bus whenever possible. Several new features have been added
to the Intel486 Microprocessor bus resulting in increased performance and functionality. New features include a 1X clock, a burst bus mechanism for
high-speed internal cache fills, a cache line invalidation mechanism, enhanced bus arbitration capabilities, a BS8 # bus sizing mechanism and parity support.

The Intel486 Microprocessor's burst bus mechanism
enables high-speed cache fills from external memory. Burst cycles can strobe data into the processor at
a rate of one item every clock. Non-burst cycles
have a maximum rate of one item every two clocks.
Burst cycles are not limited to cache fills: all bus
cycles requiring more than a single data cycle can
be bursted.

The Intel486 Microprocessor is driven by a 1X clock
as opposed to a 2X clock in the 386 Microprocessor.
A 25 MHz Intel486 Microprocessor uses a 25 MHz
clock in contrast to a 25 MHz 386 Microprocessor
which requires a 50 MHz clock. A 1X clock allows
simpler system design by cutting in half the clock
speed required in the external system.

ClK

)

A2-A31

)
32-Blt

DATA 8US
32-8it {DO-D3 1
Data

Intol486 HI
~Icroprocessor

Address

BE3#
8E2#
8E1#
8EO#

),-"'-

Bus

Byte

ADS#

8us

Control

Interrupt

Signals

Cache

Invalidation

{

RDY#

{
{

M/IO#
D/C#

INTR

W/R#

RESET

lOCK#

NMI

PlOCK#

AHOlD

HOLD

EADS#

HlDA
BOFF#

Cache
Control

Page
Caching
Control
Numeric

Error
Reporting
Address Bit
20 Mask

{
{
{

8us Cycle
) Dofinition

)

Bus
Arbitration

8REQ

KEN#
FlUSH#

8RDY#
BlAST#

PWT

}

Burst

Control

PCD
BS8#
FERR#

BSI6#

Bus Size
} Control

IGNNE#
DP3
A20M#

DP2
DP1
DPO
PCHK#

240440-30

Figure 6.1. Functional Signal Groupings

Intel486TM OX MICROPROCESSOR

The Intel486 Microprocessor has a bus hold feature
similar to that of the 386 Microprocessor. During bus
hold, the Intel486 Microprocessor relinquishes control of the local bus by floating its address, data and
control busses.

The Intel486 Microprocessor can operate over a
wide frequency range but elK's frequency cannot
change rapidly while RESET is inactive. elK's frequency must be stable for proper chip operation
since a single edge of elK is used internally to generate two phases. elK only needs TIL levels for
proper operation. Figure 6.2 illustrates the elK
waveform.

The Intel486 Microprocessor has an address hold
feature in addition to bus hold. During address hold
only the address bus is floated, the data and control
busses can remain active. Address hold is used for
cache line invalidations.

6.2.2 ADDRESS BUS (A31-A2, BEO#-BE3#)
A31-A2 and BEO#-BE3# form the address bus
and provide physical memory and I/O port addresses. The Intel486 Microprocessor is capable of addressing 4 gigabytes of physical memory space
(OOOOOOOOH through FFFFFFFFH), and 64 Kbytes
of 1/0 address space (OOOOOOOOH through
OOOOFFFFH). A31-A2 identify addresses to a 4-byte
location. BEO#-BE3# identify which bytes within
the 4-byte location are involved in the current transfer.

Ahead is a brief description of the Intel486 Microprocessor input and output signals arranged by functional groups. Before beginning the signal descriptions a few terms need to be defined. The # symbol
at the end of a signal name indicates the active, or
asserted, state occurs when the signal is at a low
Voltage. When a # is not present after the signal
name, the signal is active at the high voltage level.
The term "ready" is used to indicate that the cycle is
terminated with ROY # or BROY #.

Addresses are driven back into the Intel486 Microprocessor over A31-A4 during cache line invalidations. The address lines are active HIGH. When
used as inputs into the processor, A31-A4 must
meet the setup and hold times, t22 and t23. A31-A2
are not driven during bus or address hold.

Section 6 and 7 will discuss bus cycles and data
cycles. A bus cycle is at least two clocks long and
begins with AOS# active in the first clock and ready
active in the last clock. Data is transferred to or from
the Intel486 Microprocessor during a data cycle. A
bus cycle contains one or more data cycles.

The byte enable outputs, BEO#-BE3#, determine
which bytes must be driven valid for read and write
cycles to external memory.

6.2 Signal Descriptions

BE3#
BE2#
BE1 #
BEO#

6.2.1 CLOCK (ClK)
elK provides the fundamental timing and the internal operating frequency for the Intel486 Microprocessor. All external timing parameters are specified
with respect to the rising edge of elK.

applies
applies
applies
applies

tx = input setup times
ty = input hold times, output float, valid and hold times

to
to
to
to

024-031
016-023
08-015
00-07

240440-31

Figure 6.2. ClK waveform

intel .

Intel486TM OX MICROPROCESSOR

BEO#-BE3# can be decoded to generate AO, A1
and BHE# signals used in 8- and 16-bit systems
(see Table 7.5). BEO#-BE3# are active LOW and
are not driven during bus hold.

Oriving PCHK# is the only effect that bad input parity has oli the Intel486 Microprocessor. The Intel486
Microprocessor will not vector to a bus error interrupt when bad data parity is returned. In systems
that will not employ parity, PCHK# can be ignored.
In systems not using parity, OPO-OP3 should be
connected to Vee through a pullup resistor.

6.2.3 DATA LINES (D31-DO)
The bidirectional lines, 031-00, form the data bus
for the Intel486 Microprocessor. 00-07 define the
least significant byte and 024-031 the most significant byte. Oata transfers to 8- or 16-bit devices is
possible using the data bus sizing feature controlled
by the BS8# or BS16# input pins.

6.2.5 BUS CYCLE DEFINITION
M/IO#, D/C#, W/R# Outputs
M/IO#, O/C# and W/R# are the primary bus cycle
definition signals. They are driven valid as the AOS#
Signal is asserted. MIIO# distinguishes between
memory and 1/0 cycles, O/C# distinguishes between data and control cycles and W/R# distin·
guishes between write and read cycles.

031-00 are active HIGH. For reads, 031-00 must
meet the setup and hold times, t22 and t23' 031-00
are not driven during read cycles and bus hold.
6.2.4 PARITY

Bus cycle definitions as a function of MilO #, O/C#
and W/R# are given in Table 6.1. Note there is a
difference between the Intel486 Microprocessor and
386 Microprocessor bus cycle definitions. The halt
bus cycle type has been moved to location 001 in
the Intel486 Microprocessor from location 101 in the
386 Microprocessor. Location 101 is now reserved
and will never be generated by the Intel486 Microprocessor.

Data Parity Input/Outputs (DPO-DP3)
OPO-OP3 are the data parity pins for the processor.
There is one pin for each byte of the data bus. Even
parity is generated or checked by the parity generatorsi checkers. Even parity means that there are an
even number of HIGH inputs on the eight corresponding data bus pins and parity pin.

Table 6.1. ADS# Initiated Bus Cycle Definitions

Oata parity is generated on all write data cycles with
the same timing as the data driven by the Intel486
Microprocessor. Even parity information must be
driven back to the Intel486 Microprocessor on these
pins with the same timing as read information to insure that the correct parity check status is indicated
by the Intel486 Microprocessor.
The values read on these pins do not affect program
execution. It is the responsibility of the system to
take appropriate actions if a parity error occurs.

M/IO#

D/C#

W/R#

Bus Cycle Initiated

0
0
0
0
1

0
0
1
1
0
0

Interrupt Acknowledge
Halt/Special Cycle
ilO Read
1/0 Write
Code Read
Reserved
Memory Read
Memory Write

0
1
0
0

Input signals on OPO-OP3 must meet setup and
hold times t22 and t23 for proper operation.

Special bus cycles are discussed in Section 7.2.11.

Parity Status Output (PCHK#)

Bus Lock Output (LOCK#)

Parity status is driven on the PCHK# pin, and a parity error is indicated by this pin being LOW. PCHK#
is driven the clock after ready for read operations to
indicate the parity status for the data sampled at the
end of the previous clock. Parity is checked during
code reads, memory reads and 1/0 reads. Parity is
not checked during interrupt acknowledge cycles.
PCHK# only checks the parity status for enabled
bytes as indicated by the byte enable and bus size
signals. It is valid only in the clock immediately after
read data is returned to the Intel486 microprocessor.
At all other times it is inactive (HIGH). PCHK# is
never floated.

LOCK# indicates that the Intel486 Microprocessor
is running a read-modify-write cycle where the external bus must not be relinquished between the read
and write cycles. Read-modify-write cycles are used
to implement memory-based semaphores. Multiple
reads or writes can be locked.
When LOCK# is asserted, the current bus cycle is
locked and the Intel486 Microprocessor should be
allowed exclusive access to the system bus.
LOCK # goes active in the first clock of the first
locked bus cycle and goes inactive after ready is
returned indicating the last locked bus cycle.
87

intel®

Intel486TM OX MICROPROCESSOR

The Intel486 Microprocessor will not acknowledge
bus hold when LOCK # is asserted (though it will
allow an address hold). LOCK # is active LOW and
is floated during bus hold. Locked read cycles will
not be transformed into cache fill cycles if KEN # is
returned active. Refer to Section 7.2.6 for a detailed
discussion of Locked bus cycles.

go active in the first clock of a bus cycle and go
inactive in the second and subsequent clocks of the
cycle. ADS# is also inactive when the bus is idle.
ADS# is used by external bus circuitry as the indication that the processor has started a bus cycle. The
external circuit must sample the bus cycle definition
pins on the next rising edge of the clock after ADS#
is driven active.

Pseudo-Lock Output (PLOCK #)

ADS# is active LOW and is not driven during bus
hold.

The pseudo-lock feature allows atomic reads and
writes of memory operands greater than 32 bits.
These operands require more than one cycle to
transfer. The Intel486 Microprocessor asserts
PLOCK # during floating point long reads and writes
(64 bits), segment table descriptor reads (64 bits)
and cache line fills (128 bits).

Non-burst Ready Input (ROY #)
ROY # indicates that the current bus cycle is complete. In response to a read, RDY# indicates that
the external system has presented valid data on the
data pins. In response to a write request, ROY # indicates that the external system has accepted the Intel486 microprocessor data. ROY # is ignored when
the bus is idle and at the end of the first clock of the
bus cycle. Since ROY # is sampled during address
hold, data can be returned to the processor when
AHOLD is active.

When PLOCK # is asserted no other master will be
given control of the bus between cycles. A bus hold
request (HOLD) is not acknowledged during pseudolocked reads and writes, with one exception. During
non-cacheable non-bursted code prefetches, HOLD
is recognized on memory cycle boundaries even
though PLOCK# is asserted. The Intel486 Microprocessor will drive PLOCK # active until the addresses for the last bus cycle of the transaction
have been driven regardless of whether BRDY # or
ROY # are returned.

ROY # is active LOW, and is not provided with an
internal pull up resistor. This input must satisfy setup
and hold times t16 and t17 for proper chip operation.

A pseudo-locked transfer is meaningful only if the
memory operand is aligned and if its completely contained within a single cache line. A 64-bit floating
point number must be aligned to an 8-byte boundary
to guarantee an atomic access.

6.2.7 BURST CONTROL
Burst Ready Input (BROY#)
BRDY # performs the same function during a burst
cycle that ROY # performs during a non-burst cycle.
BRDY # indicates that the external system has presented valid data on the data pins in response to a
read or that the external system has accepted the
Intel486 Microprocessor data in response to a write.
BRDY # is ignored when the bus is idle and at the
end of the first clock in a bus cycle.

Normally PLOCK# and BLAST# are inverse of
each other. However during the first cycle of a 64-bit
floating point write, both PLOCK # and BLAST # will
be asserted.
Since PLOCK # is a function of the bus size and
KEN # inputs, PLOCK # should be sampled only in
the clock ready is returned. This pin is active LOW
and is not driven during bus hold. Refer to Section
7.2.7 for a detailed discussion of pseudo-locked bus
cycles.

During a burst cycle, BRDY # will be sampled each
clock, and if active, the data presented on the data
bus pins will be strobed into the Intel486 Microprocessor. ADS# is negated during the second through
last data cycles in the burst, but address lines A2A3 and byte enables will change to reflect the next
data item expected by the Intel486 Microprocessor.

6.2.6 BUS CONTROL
The bus control signals allow the processor to indicate when a bus cycle has begun, and allow other
system hardware to control burst cycles, data bus
width and bus cycle termination.

If ROY # is returned simultaneously with BRDY #,
BRDY# is ignored and the burst cycle is prematurely aborted. An additional complete bus cycle will be
initiated after an aborted burst cycle if the cache line
fill was not complete. BRDY # is treated as a normal
ready for the last data cycle in a burst transfer or for
non-burstable cycles. Refer to Section 7.2.2 for
burst cycle timing.

Address Status Output (AOS#)
The ADS# output indicates that the address and
bus cycle definition signals are valid. This signal will

intel·

Intel486TM DX MICROPROCESSOR

BRDY # is active LOW and is provided with a small
internal pullup resistor. BRDY # must satisfy the setup and hold times t16 and t17'

supplied vector value of 2. External interrupt acknowledge cycles are not generated since the NMI
interrupt vector is internally generated. When NMI
processing begins, the NMI signal will be masked
internally until the IRET instruction is executed.

Burst Last Output (BLAST#)
BLAST # indicates that the next time BRDY # is returned it will be treated as a normal ROY #, terminating the line fill or other multiple-data-cycle transfer.
BLAST # is active for all bus cycles regardless of
whether they are cacheable or not. This pin is active
LOW and is not driven during bus hold.

NMI is rising edge sensitive after internal synchronization. NMI must be held LOW for at least four CLK
periods before this rising edge for proper operation.
NMI is not provided with an internal pulldown resistor. NMI is asynchronous but setup and hold times,
t20 and t21 must be met to assure recognition on any
specific clock.

6.2.8 INTERRUPT SIGNALS (RESET, INTR,
NMI)

6.2.9 BUS ARBITRATION SIGNALS

The interrupt signals can interrupt or suspend execution of the processor's current instruction stream.

This section describes the mechanism by which the
processor relinquishes control of its local bus when
requested by another bus master.

Reset Input (RESET)

Bus Request Output (BREQ)

RESET forces the Intel486 Microprocessor to begin
execution at a known state. For a power-up (cold
start) reset, Vee and CLK must reach their proper
DC and AC specifications for at least 1 ms before
the Intel486 Microprocessor begins instruction execution. The RESET pin should remain active during
this time to ensure proper Intel486 Microprocessor
operation. However, for a warm boot-up case,
RESET is required to remain active for a minimum of
15 clocks. The testability operating modes are programmed by the falling (inactive going) edge of
RESET. (Refer to Section 8.0 for a description of the
test modes during reset.)

The Intel486 Microprocessor asserts BREQ whenever a bus cycle is pending internally. Thus, BREQ is
always asserted in the first clock of a bus cycle,
along with ADS#. Furthermore, if the Intel486 Microprocessor is currently not driving the bus (due to
HOLD, AHOLD, or BOFF#), BREQ is asserted in
the same clock that ADS# would have been asserted if the processor were driving the bus. After the
first clock of the bus cycle, BREQ may change state.
It will be asserted if additional cycles are necessary
to complete a transfer (via BS8#, BS16#, KEN#),
or if more cycles are pending internally. However, if
no additional cycles are necessary to complete the
current transfer, BREQ can be negated before ready
comes back for the current cycle. External logic can
use the BREQ signal to arbitrate among multiple
processors. This pin is driven regardless of the state
of bus hold or address hold. BREQ is active HIGH
and is never floated. During a hold state, internal
events may cause BREQ to be deasserted prior to
any bus cycles.

Maskable Interrupt Request Input (INTR)
INTR indicates that an external interrupt has been
generated. Interrupt processing is initiated if the IF
flag is active in the EFLAGS register.
The Intel486 Microprocessor will generate two
locked interrupt acknowledge bus cycles in response to asserting the INTR pin. An 8-bit interrupt
number will be latched from an external interrupt
controller at the end of the second interrupt acknowledge cycle. INTR must remain active until the
interrupt acknowledges have been performed to assure program interruption. Refer to Section 7.2.10
for a detailed discussion of interrupt acknowledge
cycles.

Bus Hold Request Input (HOLD)
HOLD allows another bus master complete control
of the Intel486 Microprocessor bus. The Intel486 Microprocessor will respond to an active HOLD signal
by asserting HLDA and placing most of its output
and input/output pins in a high impedance state
(floated) after completing its current bus cycle, burst
cycle, or sequence of locked cycles. In addition, if
the Intel486 CPU receives a HOLD request while
performing a non-cacheable, non-bursted code prefetch and that cycle is backed off (BOFF#), the Intel486 CPU will recognize HOLD before restarting
the cycle. The BREQ, HLDA, PCHK# and FERR#
pins are not floated during bus hold. The Intel486

The INTR pin is active HIGH and is not provided with
an internal pulldown resistor. INTR is asynchronous,
but the INTR setup and hold times, t20 and t21, must
be met to assure recognition on any specific clock.
Non-maskable Interrupt Request Input (NMI)
NMI is the non-maskable interrupt request signal.
Asserting NMI causes an interrupt with an internally
89

int:eL

Intel486™ OX MICROPROCESSOR

Microprocessor will maln.ain its bus in this state until
the HOLD is deasserted. Refer to Section 7.2.9 for
timing diagrams for a bus hold cycle.

tel486 Microprocessors address lines, A4-A31, to
accept an address input. EADS# indicates that an
external address is actually valid on the address inputs. Activating EADS# will cause the Intel486 Microprocessor to read the external address bus and
perform an internal cache invalidation cycle to the
address indicated. Refer to Section 7.2.8 for cache
invalidation cycle timing.

Unlike the 386 Microprocessor, the Intel486 Microprocessor will recognize HOLD during reset. Pullup
resistors are not provided for the outputs that are
floated in response to HOLD. HOLD is active HIGH
and is not provided with an internal pulldown resistor. HOLD must satisfy setup and hold times t18 and
t19 for proper chip operation.

Address Hold Request Input (AHOLD)
AHOLD is the address hold request. It allows another bus master access to the Intel486 Microprocessor address bus for performing an internal cache invalidation cycle. Asserting AHOLD will force the
Intel486 Microprocessor to stop driving its address
bus in the next clock. While AHOLD is active only
the address bus will be floated, the remainder of the
bus can remain active. For example, data can be
returned for a previously specified bus cycle when
AHOLD is active. The Intel486 Microprocessor will
not initiate another bus cycle during address hold.
Since the Intel486 Microprocessor floats its bus immediately in response to AHOLD, an address hold
acknowledge is not required. If AHOLD is asserted
while a bus cycle is in progress, and no readies are
returned during the time AHOLD is asserted, the Intel486 will redrive the same address (that it originally
sent out) once AHOLD is negated.

Bus Hold Acknowledge Output (HLDA)
HLDA indicates that the Intel486 Microprocessor
has given the bus to another local bus master. HLDA
goes active in response to a hold request presented
on the HOLD pin. HLDA is driven active in the same
clock that the Intel486 Microprocessor floats its bus.
HLDA will be driven inactive when leaving bus hold
and the Intel486 Microprocessor will resume driving
the bus. The Intel486 Microprocessor will not cease
internal activity during bus hold since the internal
cache will satisfy the majority of bus requests. HLDA
is active HIGH and remains driven during bus hold.
Backott Input (BOFF #)
Asserting the BOFF# input forces the Intel486 Microprocessor to release control of its bus in the next
clock. The pins floated are exactly the same as in
response to HOLD. The response to BOFF # differs
from the response to HOLD in two ways: First, the
bus is floated immediately in response to BOFF #
while the Intel486 Microprocessor completes the
current bus cycle before floating its bus in response
to HOLD. Second the Intel486 does not assert
HLDA in response to BOFF # .

AHOLD is recognized during reset. Since the entire
cache is invalidated by reset, any invalidation cycles
run during reset will be unnecessary. AHOLD is active HIGH and is provided with a small internal pulldown resistor. It must satisfy the setup and hold
times t18 and t19 for proper chip operation. This pin
determines whether or not the built in self test features of the Intel486 Microprocessor will be exercised on assertion of RESET.

The processor remains in bus hold until BOFF# is
negated. Upon negation, the Intel486 Microprocessor restarts the bus cycle aborted when BOFF # was
asserted. To the internal execution engine the effect
of BOFF # is the same as inserting a few wait states
to the original cycle. Refer to Section 7.2.12 for a
description of bus cycle restart.

External Address Valid Input (EADS#)
EADS# indicates that a valid external address has
been driven onto the Intel486 address pins. This address will be used to perform an internal cache invalidation cycle. The external address will be checked
with the current cache contents. If the address specified matches any areas in the cache, that area will
immediately be invalidated.

Any data returned to the processor while BOFF # is
asserted is ignored. BOFF # has higher priority than
RDY# or BRDY#. If both BOFF# and ready are
returned in the same clock, BOFF # takes effect. If
BOFF # is asserted while the bus is idle, the Intel486
Microprocessor will float its bus in the next clock.
BOFF # is active LOW and must meet setup and
hold times t18 and t19 for proper chip operation.

An invalidation cycle may be run by asserting
EADS# regardless of the state of AHOLD, HOLD
and BOFF#. EADS# is active LOW and is provided
with an internal pullup resistor. EADS# must satisfy
the setup and hold times t12 and t13 for proper chip
operation.

6.2.10 CACHE INVALIDATION
The AHOLD and EADS# inputs are used during
cache invalidation cycles. AHOLD conditions the In90

int:eL

Intel486TM OX MICROPROCESSOR

Intel486 will not perform a cache fill to any page in
which bit 4 of the page table entry is set. PWT corresponds to the write-back bit and can be used by an
external cache to provide this functionality. PCD and
PWT bits are assigned to be zero during real mode
or whenever paging is disabled. Refer to Sections
4.5.4 and 5.6 for a discussion of non-cacheable
pages.

6.2.11 CACHE CONTROL
Cache Enable Input (KEN#)
KEN# is the cache enable pin. KEN# is used to
determine whether the data being returned by the
current cycle is cacheable. When KEN # is active
and the Intel486 Microprocessor generates a cycle
that can be cached (most any memory read cycle),
the cycle will be transformed into a cache line fill
cycle.

PCD and PWT have the same timing as the cycle
definition pins (M/IO#, D/C#, W/R#). PCD and
PWT are active HIGH and are not driven during bus
hold.

A cache line is 16 bytes long. During the first cycle of
a cache line fill the byte-enable pins should be ignored and data should be returned as if all four byte
enables were asserted. The Intel486 Microprocessor will run between 4 and 16 contiguous bus cycles
to fill the line depending on the bus data width selected by BS8# and BS16#. Refer to Section 7.2.3
for a description of cache line fill cycles.

6.2.13 NUMERIC ERROR REPORTING
(FERR #, IGNNE #)
To allow PC-type floating point error reporting, the
Intel486 Microprocessor provides two pins, FERR#
and IGNNE#.

The KEN # input is active LOW and is provided with
a small internal pullup resistor. It must satisfy the
setup and hold times t14 and t15 for proper chip operation.

Floating Point Error Output (FERR#)
The Intel486 Microprocessor asserts FERR # whenever an unmasked floating point error is encountered. FERR # is similar to the ERROR # pin on the
387 Math Coprocessor. FERR # can be used by external logic for PC-type floating point error reporting
in Intel486 Microprocessor systems. FERR# is active LOW, and is not floated during bus hold.

Cache Flush Input (FLUSH#)
The FLUSH# input forces the Intel486 Microprocessor to flush its entire internal cache. FLUSH # is active LOW and need only be asserted for one clock.
FLUSH # is asynchronous but setup and hold times
t20 and t21 must be met for recognition on any specific clock.

In some cases, FERR# is asserted when the next
floating point instruction is encountered and in other
cases it is asserted before the next floating point
instruction is encountered depending upon the execution state of the instruction causing the exception.

FLUSH # also determines whether or not the tristate
test mode of the Intel486 Microprocessor will be invoked on assertion of RESET.

The following class of floating point exceptions drive
FERR # at the time the exception occurs (i.e., before
encountering the next floating point instruction).
1. The stack fault, invalid operation, and denormal
exceptions on all transcendental instructions, integer arithmetic instructions, FSQRT, FSCALE,
FPREM(1), FXTRACT, FBLD, and FBSTP.
2. Any exceptions on store instructions (including
integer store instructions).

6.2.12 PAGE CACHEABILITY (PWT, PC D)
The PWT and PCD output signals correspond to two
user attribute bits in the page table entry. When paging is enabled, PWT and PCD correspond to bits 3
and 4 of the page table entry respectively. For cycles that are not paged when paging is enabled (for
example I/O cycles) PWT and PCD correspond to
bits 3 and 4 in control register 3. When paging is
disabled, the Intel486 CPU ignores the PCD and
PWT bits and assumes they are zero for the purpose
of caching and driving PCD and PWT.

The following class of floating point exceptions drive
FERR # only after encountering the next floating
point instruction.
1. Exceptions other than on all transcendental instructions,
integer arithmetic
instructions,
FSQRT, FSCALE, FPREM(1), FXTRACT, FBLD,
and FBSTP.
2. Any exception on all basic arithmetic, load, compare, and control instructions (i.e., all other instructions).

PCD is masked by the CD (cache disable) bit in control register 0 (CRO). When CD= 1 (cache line fills
disabled) the Intel486 Microprocessor forces PCD
HIGH. When CD=O, PCD is driven with the value of
the page table entry/directory.
The purpose of PCD is to provide a cacheable/noncacheable indication on a page by page basis. The

intet

Intel486TM DX MICROPROCESSOR

Ignore Numeric Error Input (IGNNE#)

of 2 clocks prior to RDY being returned for the I/O
write. This insures recognition of the address mask
before the i486 SX Microprocessor/Intel OverDrive
Processor begins execution of the instruction following OUT. If A20M # is asserted after the ADS# of a
data cycle, the A20 address signal is not masked
during this cycle but is masked in the next cycle.
During a prefetch (cacheable or not), if A20M # is
asserted after the first ADS #, A20 is not masked for
the duration of the prefetch; even if 8S16# or 8S8#
is asserted.

The Intel486 Microprocessor will ignore a numeric
error and continue executing non-control floating
point instructions when IGNNE# is asserted, but
FERR# will still be activated. When deasserted, the
Intel486 Microprocessor will freeze on a non-control
floating point instruction if a previous instruction
caused an error. IGNNE# has no effect when the
NE bit in control register 0 is set.
The IGNNE# input is active LOW and is provided
with a small internal pullup resistor. This input is
asynchronous, but must meet setup and hold times
t20 and t21 to insure recognition on any specific
clock.

6.2.16 BOUNDARY SCAN TEST SIGNALS
The following boundary scan test signals are only
available on the 50 MHz version of the Intel486
CPU.

6.2.14 BUS SIZE CONTROL (BS16#, BS8#)
The 8S 16 # and 8S8 # inputs allow external 16- and
8-bit busses to be supported with a small number of
external components. The Intel486 CPU samples
these pins every clock. The value sampled in the
clock before ready determines the bus size. When
asserting 8S16# or 8S8# only 16 or 8 bits of the
data bus need be valid. If both 8S16# and 8S8#
are asserted, an 8-bit bus width is selected.

Test Clock (TCK)
TCK is an input to the Intel486 CPU and provides
the clocking function required by the JTAG boundary
scan feature. TCK is used to clock state information
and data into and out of the component. State select
information and data are clocked into the component on the rising edge of TCK on TMS and TDI,
respectively. Data is clocked out of the part on the
falling edge of TCK on TDO.

When 8S16# or 8S8# are asserted the Intel486
Microprocessor will convert a larger data request to
the appropriate number of smaller transfers. The
byte enables will also be modified appropriately for
the bus size selected.

In addition to using TCK as a free running clock, it
may be stopped in a low, 0, state, indefinitely as
described in IEEE 1149.1. While TCK'is stopped in
the low state, the boundary scan latches retain their
state.

8S16# and 8S8# are active LOW and are provided
with small internal pullup resistors. 8S16# and
858# must satisfy the setup and hold times t14 and
t15 for proper chip operation.

When boundary scan is not used, TCK should be
tied high or left as a NC (This is important during
power up to avoid the possibility of glitches on the
TCK which could prematurely initiate boundary scan
operations). TCK is supplied with an internal pullup
resistor.

6.2.15 ADDRESS BIT 20 MASK (A20M#)
Asserting the A20M # input causes the Intel486 Microprocessor to mask physical address bit 20 before
performing a lookup in the internal cache and before
driving a memory cycle to the outside world. When
A20M# is asserted, the Intel486 Microprocessor
emulates the 1 Mbyte address wraparound that occurs on the 8086. A20M # is active LOW and must
be asserted only when the processor is in real
mode. The A20M # is not defined in Protected
Mode. A20M # is asynchronous but should meet
setup and hold times t20 and t21 for recognition in
any specific clock. For correct operation of the chip,
A20M # should be sampled high 2 clocks before and
2 clocks after RESET goes low. When A20M # is
asserted synchronously, A20M # should be high
(non-active) at the clock prior to the falling edge of
RESET. A20M# exhibits a minimum 4 clock latency,
from time of assertion to masking of the A20 bit.
A20M # is ignored during cache invalidation cycles.
I/O writes require A20M# to be asserted a minimum

TCK is a clock Signal and is used as a reference for
sampling other JTAG signals. On the rising edge of
TCK, TMS and TDI are sampled. On the falling edge
of TCK, TDO is driven.

Test Mode Select (TMS)
TMS is decoded by the JTAG TAP (Tap Access
Port) to select the operation of the test logic, as described in Section 8.5.4.
To guarantee deterministic behavior of the TAP controller, TMS is provided with an internal pull-up resistor. If boundary scan is not used, TMS may be tied
high or left unconnected. TMS is sampled on the
rising edge of TCK. TMS is used to select the internal TAP states required to load boundary scan in92

intel~

Intel486TM OX MICROPROCESSOR

structions to data on TOL For proper initialization of
the JTAG logic, TMS should be driven high, "1", for
at least four TCK cycles following the rising edge of
RESET.

go onto the external bus before the memory writes
pending in the buffer even though the writes occurred earlier in the program execution.
A memory read will only be reordered in front of all
writes in the buffers under the following conditions: If
all writes pending in the buffers are cache hits and
the read is a cache miss. Under these conditions the
Intel486 Microprocessor will not read from an external memory location that needs to be updated by
one of the pending writes.

Test Data Input (TOI)
TOI is the serial input used to shift JTAG instructions
and data into the component. The shifting of instructions and data occurs during the SHIFT-IR and
SHIFT-DR controller states, respectively. These
states are selected using the TMS signal as described in Section 8.5.4.

Reordering of a read with the writes pending in the
buffers can only occur once before all the buffers
are emptied. Reordering read once only maintains
cache consistency. Consider the following example:

An internal pull-up resistor is provided on TOI to ensure a known logic state if an open circuit occurs on
the TOI path. Note that when "1" is continuously
shifted into the instruction register, the BYPASS
instruction is selected. TOI is sampled on the
rising edge of TCK, during the SHIFT-IR and the
SHIFT-DR states. During all other TAP controller
states, TOI is a "don't care".

The CPU writes to location X. Location X is in the
internal cache, so it is updated there immediately.
However, the bus is busy so the write out to main
memory is buffered (see Figure 6.3(a)). At this point,
any reads to location X would be cache hits and
most up-to-date data would be read.

Test Data Output (TOO)
i486 cpu Cache

TOO is the serial output used to shift JTAG instructions and data out of the component. The shifting of
instructions and data occurs during the SHIFT-IR
and SHIFT-DR TAP controller states, respectively.
These states are selected using the TMS signal as
described in Section 8.5.4. When not in SHIFT-IR or
SHIFT-DR state, TOO is driven to a high impedance
state to allow connecting TOO of different devices in
parallel.

Write Buffer

Main Memory

{3 {3 ~'-_~:_::_~_-'
Figure 6.3(a)
The next instruction causes a read to location Y.
Location Y is not in the cache (a cache miss). Since
the write in the write buffer is a cache hit, the read is
reordered. When location Y is read, it is put into the
cache. The possibility exists that location Y will replace location X in the cache. If this is true, location
X would no longer be cached (see Figure 6.3(b)).

TOO is driven on the falling edge of TCK during the
SHIFT-IR and SHIFT-DR TAP controller states. At
all other times TOO is driven to the high impedance
state.

6.3 Write Buffers
i486 cpu Cache

The Intel486 Microprocessor contains four write
buffers to enhance the performance of consecutive
writes to memory. The buffers can be filled at a rate
of one write per clock until all four buffers are filled.

Write Buffer

Main Memory

{-:~ '1_ '1 ~c:J
000

When all four buffers are empty and the bus is idle, a
write request will propagate directly to the external
bus bypassing the write buffers. If the bus is not
available at the time the write is generated internally,
the write will be placed in the write buffers and propagate to the bus as soon as the bus becomes available. The write is stored in the on-chip cache immediately if the write is a cache hit.

Figure 6.3(b)
Cache consistency has been maintained up to this
point. If a subsequent read is to location X (now a
cache miss) and it was reordered in front of the buffered write to location X, stale data would be read.
This is why only 1 read is allowed to be reordered.
Once a read is reordered, all the writes in the write
buffer are flagged as cache misses to ensure that no
more reads are reordered. Since one of the condi-

Writes will be driven onto the external bus in the
same order in which they are received by the write
buffers. Under certain conditions a memory read will

infel~

Intel486TM OX MICROPROCESSOR

tions to reorder a read is that all writes in the write
buffer must be cache hits, no more reordering is allowed until all of those flagged writes propogate to
the bus. Similarly, if an invalidation cycle is run all
entries in the write buffer are flagged as cache misses.

other bus masters or by the Intel486 Microprocessor
itself, be allowed on the external bus between the
read and write portion of the locked sequence.
During a locked read cycle the Intel486 Microprocessor will always access external memory, it will
never look for the location in the on-chip cache, but
for write cycles, data is written in the internal cache
(if cache hit) and in the external memory. All data
pending in the Intel486 Microprocessor's write buffers will be written to memory before a locked cycle is
allowed to proceed to the external bus.

For multiple processor systems and/or systems using DMA techniques, such as bus snooping, locked
semaphores should be used to maintain cache consistency.

6.3.1 WRITE BUFFERS AND I/O CYCLES

The Intel486 Microprocessor will assert the LOCK#
pin after the write buffers are emptied during a
locked bus cycle. With the LOCK# pin asserted, the
microprocessor will read the data, operate on the
data and place the results in a write buffer. The contents of the write buffer will then be written to external memory. LOCK # will become inactive after the
write part of the locked cycle.

Input/Output (I/O) cycles must be handled in a different manner by the write buffers.
I/O reads are never reordered in front of buffered
memory writes. This insures that the Intel486 Microprocessor will update all memory locations before
reading status from an I/O device.

6.4 Interrupt and Non-Maskable
Interrupt Interface

The Intel486 Microprocessor never buffers single
I/O writes. When processing an OUT instruction, internal execution stops until the I/O write actually
completes on the external bus. This allows time for
the external system to drive an invalidate into the
Intel486 Microprocessor or to mask interrupts before
the processor progresses to the instruction following
OUT. REP OUTS instructions will be buffered.

The Intel486 Microprocessor provides two asynchronous interrupt inputs, INTR (interrupt request)
and NMI (non-maskable interrupt input). This section
describes the hardware interface between the instruction execution unit and the pins. For a description of the algorithmic response to interrupts refer to
Section 2.7. For interrupt timings refer to Section
7.2.10.

I/O device recovery time must be handled slightly
differently by the Intel486 Microprocessor than with
the 386 Microprocessor. I/O device back-to-back
write recovery times could be guaranteed by the 386
Microprocessor by inserting a jump to the next instruction in the code that writes to the device. The
jump forces the 386 Microprocessor to generate a
prefetch bus cycle which can't begin until the I/O
write completes.

6.4.1 INTERRUPT LOGIC
The Intel486 Microprocessor contains a two-clock
synchronizer on the interrupt line. An interrupt request will reach the internal instruction execution
unit two clocks after the INTR pin is asserted, if
proper setup is provided to the first stage of the synchronizer.

Inserting a jump to the next write will not work with
the Intel486 Microprocessor because the prefetch
could be satisfied by the on-chip cache. A read cycle
must be explicitly generated to a non-cacheable location in memory to guarantee that a read bus cycle
is performed. This read will not be allowed to proceed to the bus until after the I/O write has completed because I/O writes are not buffered. The I/O device will have time to recover to accept another write
during the read cycle.

There is no special logic in the interrupt path other
than the synchronizer. The INTR Signal is level sensitive and must remain active for the instruction execution unit to recognize it: The interrupt will not be
serviced by the Intel486 Microprocessor if the INTR
signal does not remain active.
The instruction execution unit will look at the state of
the synchronized interrupt signal at specific clocks
during the execution of instructions (if interrupts are
enabled). These specific clocks are at instruction
boundaries, or iteration boundaries in the case of
string move instructions. Interrupts will only be accepted at these boundaries.

6.3.2 WRITE BUFFERS IMPLICATIONS ON
LOCKED BUS CYCLES

Locked bus cycles are used for read-modify-write
accesses to memory. During a read-modify-write access, a memory base variable is read, modified and
then written back to the same memory location. It is
important that no other bus cycles, generated by

An interrupt must be presented to the Intel486 Microprocessor INTR pin three clocks before the end
of an instruction for the interrupt to be acknowl-

int:eL

Intel486TM OX MICROPROCESSOR

edged. Presenting the interrupt 3 clocks before the
end of an instruction allows the interrupt to pass
through the two clock synchronizer leaving one
clock to prevent the initiation of the next sequential
instruction and to begin interrupt service. If the interrupt is not received in time to prevent the next instruction, it will be accepted at the end of next instruction, assuming INTR is still held active. The interrupt service microcode will start after two dead
clocks.

The Intel486 Microprocessor registers have the values shown in Table 6.2 after RESET is performed.
The EAX register contains information on the success or failure of the 81ST if the self test is executed.
The OX register always contains a component identifier at the conclusion of RESET. The upper byte of
OX (OH) will contain 04 and the lower byte (OL) will
contain a stepping identifier (see Table 6-3). The
floating point registers are initialized as if the FINIT /
FNINIT (initialize processor) instruction was executed if the 81ST was performed. If the 81ST is not executed, the floating point registers are unchanged.

The longest latency between when an interrupt request is presented on the INTR pin and when the
interrupt service begins is: longest instruction used
+ the two clocks for synchronization + one clock
required to vector into the interrupt service microcode.

Table 6.2. Register Values after Reset
Register

6.4.2 NMI LOGIC
The NMI pin has a synchronizer like that used on the
INTR line. Other than the synchronizer, the NMI logic is different from that of the maskable interrupt.
NMI is edge triggered as opposed to the level triggered INTR signal. The rising edge of the NMI signal
is used to generate the interrupt request. The NMI
input need not remain active until the interrupt is actually serviced. The NMI pin only needs to remain
active for a single clock if the required setup and
hold times are met. NMI will operate properly if it is
held active for an arbitrary number of clocks.
The NMI input must be held inactive for at least four
clocks after it is asserted to reset the edge triggered
logic. A subsequent NMI may not be generated if the
NMI is not held inactive for at least two clocks after
being asserted.
The NMI input is internally masked whenever the
NMI routine is entered. The NMI input will remain
masked until an IRET (return from interrupt) instruction is executed. Masking the NMI signal prevents
recursive NMI calls. If another NMI occurs while the
NMI is masked off, the pending NMI will be executed
after the current NMI is done. Only one NMI can be
pending while NMI is masked.

Zero (Pass)
Undefined
Undefined
Undefined
0400 + Revision 10
0400 + Revision 10
Undefined
Undefined
Undefined
Undefined
Undefined
Undefined
Undefined
Undefined
Undefined
Undefined
000OOO02h
00000002h
OFFFOh
OFFFOh
OOOOh
OOOOh
FOOOh*
FOOOh*
OOOOh
OOOOh
OOOOh
OOOOh
OOOOh
OOOOh
OOOOh
OOOOh
Base=O, Limit=3FFh Base=O, Limit=3FFh
60000010h
60000010h
OOOOOOOOh
OOOOOOOOh

CW
SW

037Fh
OOOOh
FFFFh
OOOOOOOOh
OOOOOOOOh
OOOOh
OOOOh
OOOh
Undefined

FIP
FEA
FCS
FOS
FOP
FSTACK

The Intel486 Microprocessor has a built in self test
(8IST) that can be run during reset. The 81ST is invoked if the AHOLO pin is asserted in the clock prior
to RESET going from High to Low. RESET must be
active for 15 clocks with or with no 81ST being enabled. Refer to Section 8.0 for information on Intel486 Microprocessor testability.

Initial Value
(No Blst)

EAX
ECX
EOX
EBX
ESP
EBP
ESI
EOI
EFLAGS
EIP
ES
CS
SS
OS
FS
GS
10TR
CRO
OR7

6.5 Reset and Initialization

Initial Value
(BIST)

Unchanged
Unchanged
Unchanged
Unchanged
Unchanged
Unchanged
Unchanged
Unchanged
Unchanged

infel .

Intel486TM OX MICROPROCESSOR

Table 6-3. Intel486™ CPU Revision ID
Intel486TM CPU
Stepping Name

Component
ID

Revision
ID

cA2

cA3

cBO

cB1

6.5.1 PIN STATE DURING RESET
The Intel486 Microprocessor recognizes and can respond to HOLD, AHOLD, and BOFF # requests regardless of the state of RESET. Thus, even though
the processor is in reset, it can still float its bus in
response to any of these requests.
While in reset, the Intel486 Microprocessor bus is in
the state shown in Figure 6.4 if the HOLD, AHOLD
and BOFF # requests are inactive. Note that the address (A31-A2, BE3#-BEO#) and cycle definition
(MIIO#, D/C#, W/R#) pins are undefined from the
time reset is asserted up to the start of the first bus
cycle. All undefined pins (except FERR#) assume
known values at the beginning of the first bus cycle.
The first bus cycle is always a code fetch to address
FFFFFFFOH.
FERR # reflects the state of the ES (Error Summary
status) bit in the floating point unit status word. The
ES bit is initialized whenever the floating point unit
state is initialized. The floating point unit's status
word register can be initialized by BIST or by executing FINIT/FNINIT instruction. Thus, after reset and
before executing the first FINIT or FNINIT instructon,
the values of the FERR # and the numeric status
word register bits 0-7 depends on whether or not
BIST is performed. Table 6-4 shows the state of
FERR# signal after reset and before the execution
of the FINITIFNINIT instruction.

Intel OverDrive™
Processor
Stepping Name
A2

The Intel486 Microprocessor will start executing instructions at location FFFFFFFOH after RESET.
When the first InterSegment Jump or Call is executed, address lines A20-A31 will drop LOW for CS-relative memory cycles, and the Intel486 Microprocessor will only execute instructions in the lower one
Mbyte of physical memory. This allows the system
designer to use a ROM at the top of physical memory to initialize the system and take care of RESETs.

Table 6-4
BIST
Performed
YES

RESET forces the Intel486 Microprocessor to terminate all execution and local bus activity. No instruction or bus activity will occur as long as RESET is
active.

FERR#
Pin

FPU Status
Word Register
Bits 0-7

Inactive
(High)
Undefined
(Low or High)

Inactive
(Low)
Undefined
(Low or High)

After the first FINIT or FNINIT instruction, FERR#
pin and the FPU status word register bits (0-7) will
be inactive irrrespective of the Built-In Self-Test
(BIST).

All entries in the cache are invalidated by RESET.

ClK

RESET _ _'-4..<.Jj
AHOlD _ _ _ _ _ _ _ _ _ _ _ _---'';J.J
FLUSH" - - - - - - - - - - - - . . . . . ,.........
h1nd

flUSH"
(..,",)

--------"(""1:"'

~.l.....

@ _ _ _ _ _ _ _ _ _ _-I...LJ
_ _ _ _...;;;...

A20U#
(I.,nc) _ _ _ _ _ _ _ _.1..<..1

ADS" _ _ _ _ _ _ _ _ _ _---'~(.J

9Roo _ _ _ _ _ _ _ _ _ _ _

~~~

____________________

A31 -A". MIO#, BLAST _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _U;;;;N;;.;;DEF;;;IN;;;;ED;...._ _ _ _ _ _ _ _ _ _ _ _

--II~(.J

9EO-9E3", PWT, PCD _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _-1,-..........
A3 • A2 • PLOCK# _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _U;;;ND;;.;;EF;;;'N;;;;ED_ _ _ _ _ _ _ _ _ _ _ _ _ _~....,'___

D/C", W/R"
~HK",--------------------ITITITl~----------------------------------------------lOCK" _ _ _ _ _ _ _ _ _ _---'_'-'_'..J.J_,

HlDA

~~~;-------------------~>~)~)~)}----------------------------------------------------______________________________________

240440-32
NOTES:
1. RESET is an asynchronous input. t20 must be met only to guarantee recognition on a specific clock edge.
2a. When A20M is driven synchronously, it must be driven high (inactive) for the eLK edge prior to the falling edge of RESET to ensure proper operation. A20M #
setup and hold times must be met.
2b. When A20M# is driven asynchronously, it must be driven high (inactive) for two eLKs prior to and two eLKs after the falling edge of RESET to ensure proper
operation.
3a. When FLUSH*, is driven synchronously, it should be driven low (active) for the eLK edge prior to the falling edge of RESET to invoke the Tri-State Output Test
Mode. All outputs are guaranteed tri-stated within 10 eLKs of RESET being deasserted. FLUSH*, setup and hold times must be met.
3b. When FLUSH# is driven asynchronously, it must be driven low (active) for two eLKs prior to and two eLKs after the falling edge of RESET to invoke the TriState Output Test Mode. All outputs are guaranteed tri-stated within 10 eLKs of RESET being deasserted.
3c. FLUSH# must be driven high (inactive) during BUild-in-Self-Test (BISn.
4. AHOLD should be driven high (active) for the eLK edge prior to the falling edge of RESET to invoke the Built-In-Self-Test (BISn. AHOLD setup and hold times
must be met.
5. Hold is recognized normally during RESET.
6. 15 eLKs RESET pulse width for warm resets. Power-up resets require RESET to be asserted for at least 1 ms after Vee and eLK are stable.

intel .
7.0

Intel486TM OX MICROPROCESSOR

Address bits AO and A1 of the physical operand's
base address can be created when necessary. Use
of the byte enables to create AO and A 1 is shown in
Table 7.2. The byte enables can also be decoded to
generate BLE# (byte low enable) and BHE# (byte
high enable). These signals are needed to address
16-bit memory systems (see Section 7.1.4 Interfacing with 8- and 16-bit memories).

BUS OPERATION

7.1 Data Transfer Mechanism
All data transfers occur as a result of one or more
bus cycles. Logical data operands of byte, word and
dword lengths may be transferred without restrictions on physical address alignment. Data may be
accessed at any byte boundary but two or three cycles may be required for unaligned data transfers.
See Section 7.1.3 Dynamic Bus Sizing and 7.1.6 Operand Alignment.

Table 7.2. Generating AO-A31 from
BEO#-BE3# and A2-A31
Intel486TM CPU Address Signals
A31

The Intel486 Microprocessor address signals are
split into two components. High-order address bits
are provided by the address lines, A2-A31. The byte
enables, BEO#-BE3#, form the low-order address
and provide linear selects for the four bytes of the
32-bit address bus.

Physical Base
Address
A31
A31
. A31

The byte enable outputs are asserted when their associated data bus bytes are involved with the present bus cycle, as listed in Table 7.1. Byte enable
patterns which have a negated byte enable separating two or three asserted byte enables will never
occur (see Table 7.5). All other byte enable patterns
. are possible.

A31
A31

00-07

(byte O-Ieast significant)

BE1#

08-015

(byte 1)

BE2#

016-023

(byte 2)

BE3#

024-031

(byte 3-most significant)

A2 A1 AO
A2 0

Low

A2 0

Low

High

A2 1

Low

High

A2 1

Low

High

Bus cycles may access physical memory space or
1/0 space. Peripheral devices in the system may either be memory-mapped, or I/O-mapped, or both.
Physical memory addresses range from OOOOOOOOH
to FFFFFFFFH (4 gigabytes). 1/0 addresses range
from OOOOOOOOH to OOOOFFFFH (64 Kbytes) for programmed 1/0. See Figure 7.1.

Associated Data Bus Signals

BEO#

.........
.........
.........
.........
.........

7.1.1 MEMORY AND 1/0 SPACES

Table 7.1. Byte Enables and Associated
Data and Operand Bytes
Byte
Enable
Signal

BE3# BE2# BE1# BEO#

......... A2

int:el..

Intel486™ OX MICROPROCESSOR

rrrrrrrrH

r----,

~
0{!~

PHYSICAL
MEMORY
4GBYTE

/NOT/).

ooOOrrrrH

W
B }
./~
64kBYTE

OOOOOOOOH .....- -..... OOOOOOOOH
Physical Memory Space

ACCESSIBLE
PROGRAMMED
I/O SPACE

240440-33

1/0 Space

Figure 7.1. Physical Memory and 1/0 Spaces
7.1.2 MEMORY AND 1/0 SPACE
ORGANIZATION

I I I I I"""~"

32·Bit Wide Organization

'''''''~

The Intel486 Microprocessor datapath to memory
and inputloutput (1/0) spaces can be 32-, 16- or
8-bits wide. The byte enable signals, 8EO#-8E3#,
allow byte granularity when addressing any memory
or 1/0 structure whether 8, 16 or 32 bits wide.

00000003H ~

•

--.J

oOOOOOOOH

BE3# BE2# BE1# BEO#
240440-34

The Intel486 Microprocessor includes bus control
pins, 8516# and 858#, which allow direct connection to 16- and 8-bit memories and 1/0 devices. Cycles to 32-, 16- and 8-bit may occur in any sequence, since the 858# and 8516# signals are
sampled during each bus cycle.

""'' '"I]""'' '"
16·Bit Wide Organization

32-bit wide memory and 1/0 spaces are organized
as arrays of physical 4-byte words. Each memory or
1/0 4-byte word has four individually addressable
bytes at consecutive byte addresses (see Figure
7.2). The lowest addressed byte is associated with
data signals 00-07; the highest-addressed byte
with 024-031. Physical 4-byte words begin at addresses divisible by four.

00000001 H ' -

•

.,....-J

OOOOOOOOH

BHE# BLE#
240440-35

Figure 7.2. Physical Memory
and 1/0 Space Organization

intel~

Intel486™ OX MICROPROCESSOR

16-bit memories are organized as arrays of physical
2-byte words. Physical 2-byte words begin at addresses divisible by two. The byte enables 8EO#8E3#, must be decoded to A1, 8LE# and 8HE# to
address 16-bit memories (see Section 7.1.4).

The Intel486 Microprocessor will drive the byte enables appropriately during extra cycles forced by
858# and 8516#. A2-A31 will not change if accesses are to a 32-bit aligned area. Table 7.3 shows
the set of byte enables that will be generated on the
next cycle for each of the valid possibilities of the
byte enables on the current cycle.

To address 8-bit memories, the two low order address bits AO and A 1, must be decoded from 8EO #8E3 #. The same logic can be used for 8- and 16-bit
memories since the decoding logic for 8LE # and AO
are the same (see Section 7.1.4).

The dynamic bus sizing feature of the Intel486 Microprocessor is significantly different than that of the
386 Microprocessor. Unlike the 386 Microprocessor,
the Intel486 Microprocessor requires that data bytes
be driven on the addressed data pins. The simplest
example of this function is a 32-bit aligned, 8516#
read. When the Intel486 Microprocessor reads the
two high order bytes, they must be driven on the
data bus pins 016-031. The Intel486 Microprocessor expects the two low order bytes on 00-015.
The 386 Microprocessor expects both the high and
low order bytes on 00-015. The 386 Microprocessor always reads or writes data on the lower 16 bits
of the data bus when 8S16# is asserted.

7.1.3 DYNAMIC DATA BUS SIZING
Dynamic data bus sizing is a feature allowing processor connection to 32-, 16- or 8-bit buses for memory or 1/0. A processor may connect to all three bus
sizes. Transfers to or from 32-, 16- or 8-bit devices
are supported by dynamically determining the bus
width during each bus cycle. Address decoding circuitry may assert 8S16# for 16-bit devices, or
858# for 8-bit devices during each bus cycle. 8S8#
and 8516# must be negated when addressing 32bit devices. An 8-bit bus width is selected if both
8516# and 8S8# are asserted.

The external system must contain buffers to enable
the Intel486 Microprocessor to read and write data
on the appropriate data bus pins. Table 7.4 shows
the data bus lines where the Intel486 Microprocessor expects data to be returned for each valid combination of byte enables and bus sizing options.

8516# and 858# force the Intel486 Microprocessor to run additional bus cycles to complete requests larger than 16- or 8 bits. A 32-bit transfer will
be converted into two 16-bit transfers (or 3 transfers
if the data is misaligned) when 8516# is asserted.
Asserting 858# will convert a 32-bit transfer into
four 8-bit transfers.

Valid data will only be driven onto data bus pins corresponding to active byte enables during write cycles. Other pins in the data bus will be driven but
they will not contain valid data. Unlike the 386 Microprocessor, the Intel486 Microprocessor will not duplicate write data onto parts of the data bus for
which the corresponding byte enable is negated.

Extra cycles forced by 8516# or 858# should be
viewed as independent bus cycles. 8S16# or 858#
must be driven active during each of the extra cycles
unless the addressed device has the ability to
change the number of bytes it can return between
cycles.

Table 7.3. Next Byte Enable Values for BSn# Cycles
BE3#
1
1
1
0
1
1
0
1
0
0

Current
BE2# BE1#
1
1
0
0
1
0
0
0
0
1

1
0
0
0
0
0
0
1
1
1

BEO#

BE3#

0
0
0
0
1
1
1
1
1
1

n
1
1
0
n
1
0
n
0
n

Next with BS8#
BE2# BE1#
n
1
0
0
n
0
0
n
1
n

n
0
0
0
n
1
1
n
1
n

BEO#

BE3#

n
1
1
1
n
1
1
n
1
n

n
n
1
0
n
1
0
n
n
n

"n" means that another bus cycle will not be required to satiSfy the request.

100

Next with BS16#
BE2# BE1# BEO#
n
n
0
0
n
0
0
n
n
n

n
n
1
1
n
1
1
n
n
n

intel~

Intel486TM OX MICROPROCESSOR

Table 7.4. Data Pins Read with Different Bus Sizes
BE3#

BE2#

BE1#

BEO#

w/o BS8#/BS16#

wBS8#

WBS16#

1
1
1
0
1
1
0
1
0
0

1
1
0
0
1
0
0
0
0
1

1
0
0
0
0
0
0
1
1
1

0
0
0
0
1
1
1
1
1
1

07-00
015-00
023-00
031-00
015-08
023-08
031-08
023-016
031-016
031-024

07-00
07-00
07-00
07-00
015-08
015-08
015-08
023-016
023-016
031-024

07-00
015-00
015-00
015-00
015-08
015-08
015-08
023-016
031-016
031-024

16- and 8-bit memories require external byte swapping logic for routing data to the appropriate data
lines and logic for generating BHE#, BLE# and A1.
In systems where mixed memory widths are used,
extra address decoding logic is necessary to assert
B816# or B88#.

7.1.4 INTERFACING WITH 8-, 16- AND 32-BIT
MEMORIES
In 32-bit physical memories such as Figure 7.3, each
4-byte word begins at a byte address that is a multiple of four. A2-A31 are used as a 4-byte word select. BEO#-BE3# select individual bytes within the
4-byte word. B88# and B816# are negated for all
bus cycles involving the 32-bit array.

Figure 7.4 shows the Intel486 microprocessor address bus interface to 32-, 16- and 8-bit memories.
To address 16-bit memories the byte enables must
be decoded to produce A1, BHE# and BLE# (AO).
For 8-bit wide memories the byte enables must be
decoded to produce AO and A 1. The same byte select logiC can be used in 16- and 8-bit systems since
BLE# is exactly the same as AO (see Table 7.5).

DATA BUS (DO-D31)

Inte1486n.1
ADDRESS BUS (BEO#-BE3#,A2-A31)
CPU

32-BIT
MEMORY

TBS8# IBS 16#

BEO#-BE3# can be decoded as shown in Table
7.5 to generate A 1, BHE # and BLE #. The byte select logic necessary to generate BHE # and BLE # is
shown in Figure 7.5.

"HIGH" "HIGH"

240440-36

Figure 7.3. Intel486™ Microprocessor
with 32-Bit Memory

Address Bus (A31-A2 BEO#-BE3#)

InteI486 T1.t

32-Bit
Memory

Microprocessor

B58#

1 1

B516#

Address
Decode

A31-A2

BHE#, BLE#, AI
BEO#-BE3#

16-Bit
Memory

Byte
Select Logic
AO(BLE#), AI
A31-A2

8-Bit
Memory

240440-37

Figure 7.4. Addressing 16- and 8-Bit Memories

101

int:et

Intel486TM OX MICROPROCESSOR

Table 7.5. Generating A1, BHE# and BLE# for Addressing 16-Bit Devices
Intel486TM CPU Signals

8, 16-Blt Bus Signals

BE3#

BE2#

BE1#

BEO#

BHE#

BLE# (AO)

H*
H
H
H
H
H*
H
H
L
L*
L*
L*
L
L*
L
L

H*
H
H
H
L
L*
L
L
H
H*
H*
H*
L
L*
L
L

H*
H
L
L
H
H*
L
L
H
H*
L*
L*
H
H*
L
L

H*
L
H
L
H
L*
H
L
H
L*
H*
L*
H
L*
H
L

x
L
L
L
H
x
L
L
H
x
x
x
H
x
L
L

x
H
L
L
H
x
L
L
L
x
x
x
L
x
L
L

x
L
H
L
L
x
H
L
H
x
x
x
L
x
H
L

Comments
x-no active bytes

x-not contiguous bytes

x-not contiguous bytes
x-not contiguous bytes
x-not contiguous bytes
x-not contiguous bytes

BLE# asserted when 00-07 of 16-bit bus is active.
BHE# asserted when 08-015 of 16-bit bus is active.
A1 low for all even words; A 1 high for all odd words.
Key:
x = don't care
H = high voltage level
L = low voltage level
* = a non-occurring pattern of Byte Enables; either none are asserted,
or the pattern has Byte Enables asserted for non-contiguous bytes

BE1D

BEO#

_BE_3_#-L[....J~

_BE_l_#-L[_~

240440-39

240440-38

240440-40

Figure 7.5. Logic to Generate A1, BHE# and BLE# for 16-Bit Busses
Combinations of BEO#-BE3# which never occur
are those in which two or three asserted byte enables are separated by one or more negated byte
enables. These combinations are "don't care" conditions in the decoder. A decoder can use the nonoccurring BEO#-BE3# combinations to its best advantage.

Figure 7.6 shows an Intel486 Microprocessor data
bus interface to 16- and 8-bit wide memories. External byte swapping logic is needed on the data lines
so that data is supplied to, and received from the
Intel486 Microprocessor on the correct data pins
(see Table 7.4).

102

intel~

Intel486TM OX MICROPROCESSOR

00-07
08-015
016-023
024-031

Inlel486™
tvticroprocessor

4
4
4
4

32-8il
Memory

858 #
8516#

(A2-A31,8EO#-8E3#)
8ylo
Swap

16-8il

Memory

Logic

Address

8yte

Decode

Swap

;

8-8it

( 8

Memory

·1

Logic

1
240440-74

Figure 7.6. Data Bus Interface to 16· and 8·bit Memories
7.1.5 DYNAMIC BUS SIZING DURING CACHE
LINE FILLS

7.1.6 OPERAND ALIGNMENT

Physical 4-byte words begin at addresses that are
multiples of four. It is possible to transfer a logical
operand that spans more than one physical 4-byte
word of memory or 1/0 at the expense of extra cycles. Examples are 4-byte operands beginning at addresses that are not evenly divisible by 4, or 2-byte
words split between two physical 4-byte words.
These are referred to as unaligned transfers.

BS8# and BS16# can be driven during cache line
fills. The Intel486 Microprocessor will generate
enough 8- or 16-bit cycles to fill the cache line. This
can be up to 16 8-bit cycles.
The external system should assume that all byte enables are active for the first cycle of a cache line fill.
The Intel486 Microprocessor will generate proper
byte enables for subsequent cycles in the line fill.
Table 7.6 shows the appropriate AO (BLE#), A1 and
BHE# for the various combinations of the Intel486
Microprocessor byte enables on both the first and
subsequent cycles of the cache line fill. The "."
marks all combinations of byte enables that will be
generated by the Intel486 Microprocessor during a
cache line fill.

Operand alignment and data bus size dictate when
multiple bus cycles are required. Table 7.7 describes
the transfer cycles generated for all combinations of
logical operand lengths, alignment, and data bus sizing. When multiple cycles are required to transfer a
multi-byte logical operand, the highest-order bytes
are transferred first. For example, when the processor does a 4-byte unaligned read beginning at location x11 in the 4-byte aligned space, the three high
order bytes are read in the first bus cycle. The low
byte is read in a subsequent bus cycle.

Table 7.6. Generating AD, A1 and BHE# from the Intel486TM Microprocessor Byte Enables
BE3#

1
1
1

'0
1
1

'0
1
'0
'0

BE2#

1
1
0
0
1

0
0
0
0
1

BE1#

BED#

0
0
0
0

0
0
0
0
0
0
1
1
1

1
1
1
1
1
1

First Cache Fill Cycle
A1
BHE#
AD

0
0
0
0
0
0
0
0
0
0
103

0
0
0
0
0
0
0
0
0
0

0
0
0
0
1
1
1
0
0
1

Any Other Cycle
BHE#
A1

0
0
0
0
0
0
0
1
1
1

1
0
0
0
0
0
0
1
0
0

intel®

Intel486TM OX MICROPROCESSOR

Table 7.7. Transfer Bus Cycles for Bytes, Words and Dwords
Byte-Length of Logical Operand

2
Physical Byte Address in
Memory (Low Order Bits)

Transfer Cycles
over 32-Bit Bus

Transfer Cycles over
16-Bit Data Bus
,;: = BS16# Asserted
Transfer Cycles over
8-Bit Data Bus
• 'h = BS8 # Asserted

KEY:
b = byte transfer
w = 2-byte transfer
3 = 3-byte transfer
d = 4-byte transfer

h = high-order portion
I = low-order portion
m = mid-order portion

4-Byte Operand

mlb

t
byte with
lowest
address

The function of unaligned transfers with dynamic
bus sizing is not obvious. When the external systems
asserts BS16# or BS8# forcing extra cycles, loworder bytes or words are transferred first (opposite
to the example above). When the Intel486 Microprocessor requests a 4-byte read and the external
system asserts BS16#, the lower 2 bytes are read
first followed by the upper 2 bytes.

I mhb I

t
byte with
highest
address

This section begins with basic non-cacheable nonburst single cycle transfers. It moves on to multiple
cycle transfers and introduces the burst mode.
Cacheability is introduced in Section 7.2.3. The remaining sections describe locked, pseudo-locked,
invalidate, bus hold and interrupt cycles.
Bus cycles and data cycles are discussed in this
section. A bus cycle is at least two clocks long and
begins with ADS# active in the first clock and ready
active in the last clock. Data is transferred to or from
the Intel486 Microprocessor during a data cycle. A
bus cycle contains one or more data cycles.

In the unaligned transfer described above, the processor requested three bytes on the first cycle. If the
external system asserted BS16# during this 3-byte
transfer, the lower word is transferred first followed
by the upper byte. In the final cycle the lower byte of
the 4-byte operand is transferred as in the 32-bit example above.

Refer to Section 7.2.13 for a description of the bus
states shown in the timing diagrams.
7.2.1 NON·CACHEABLE NON·BURST SINGLE
CYCLE

7.2 Bus Functional Description
The Intel486 Microprocessor supports a wide variety
of bus transfers to meet the needs of high performance systems. Bus transfers can be single cycle or
multiple cycle, burst or non-burst, cacheable or noncacheable, 8-, 16- or 32-bit, and pseudo-locked. To
support multiprocessing systems there are cache invalidation cycles and locked cycles.

7.2.1.1 No Wait States
The fastest non-burst bus cycle that the Intel486 Microprocessor supports is two clocks long. These cycles are called 2-2 cycles because reads and writes
take two cycles each. The first 2 refers to reads and

104

intel~

Intel486TM OX MICROPROCESSOR

the second to writes. For example, if a wait state
needs to be added to a write, the cycle would be
called 2-3.

7.2.2 MULTIPLE AND BURST CYCLE BUS
TRANSFERS

Multiple cycle bus transfers can be caused by internal requests from the Intel486 Microprocessor or by
the external memory system. An internal request for
a 64-bit floating point load or a 128-bit pre-fetch
must take more than one cycle. Internal requests for
unaligned data may also require multiple bus cycles.
A cache line fill requires multiple cycles to complete.
The external system can cause a multiple cycle
transfer when it can only supply 8 or 16 bits per
cycle.

Basic two clock read and write cycles are shown in
Figure 7.7. The Intel486 Microprocessor initiates a
cycle by asserting the address status signal (ADS#)
at the rising edge of the first clock. The ADS# output indicates that a valid bus cycle definition and
address is available on the cycle definition lines and
address bus.
The non-burst ready input (ROY #) is returned by the
external system in the second clock. ROY # indicates that the external system has presented valid
data on the data pins in response to a read or the
external system has accepted data in response to a
write.

Only multiple cycle transfers caused by internal requests are considered in this section. Cacheable cycles and 8- and 16-bit transfers are covered in Sections 7.2.3 and 7.2.5.

The Intel486 Microprocessor samples ROY # at the
end of the second clock. The cycle is complete if
ROY # is active (LOW) when sampled. Note that
RDY# is ignored at the end of the first clock of the
bus cycle.

7.2.2.1 Burst Cycles

The Intel486 Microprocessor can accept burst cycles for any bus requests that require more than a
single data cycle. During burst cycles, a new data
item is strobed into the Intel486 Microprocessor every clock rather than every other clock as in nonburst cycles. The fastest burst cycle requires 2
clocks for the first data item with subsequent data
items returned every clock.

The burst last signal (BLAST#) is asserted (LOW)
by the Intel486 Microprocessor during the second
clock of the first cycle in all bus transfers illustrated
in Figure 7.7. This indicates that each transfer is
complete after a single cycle. The Intel486 Microprocessor asserts BLAST # in the last cycle of a bus
transfer.

The Intel486 Microprocessor is capable of bursting a
maximum of 32 bits during a write. Burst writes can
only occur if BS8# or BS16# is asserted. For example, the Intel486 Microprocessor can burst write four
8-bit operands or two 16-bit operands in a single
burst cycle. But the Intel486 Microprocessor cannot
burst multiple 32-bit writes in a single burst cycle.

The timing of the parity check output (PCHK#) is
shown in Figure 7.7. The Intel486 Microprocessor
drives the PCHK# output one clock after ready terminates a read cycle. PCHK# indicates the parity
status for the data sampled at the end of the previous clock. The PCHK# signal can be used by the
external system. The Intel486 Microprocessor does
nothing in response to the PCHK# output.

Burst cycles begin with the Intel486 Microprocessor
driving out an address and asserting ADS# in the
same manner as non-burst cycles. The Intel486 microprocessor indicates that it is willing to perform a
burst cycle by holding the burst last signal
(BLAST#) inactive in the second clock of the cycle.
The external system indicates its willingness to do a
burst cycle by returning the burst ready signal
(BRDY #) active.

7.2.1.2 Inserting Wait States

The external system can insert wait states into the
basic 2-2 cycle by driving RDY# inactive at the end
of the second clock. ROY # must be driven inactive
to insert a wait state. Figure 7.8 illustrates a simple
non-burst, non-cacheable signal with one wait state
added. Any number of wait states can be added to
an Intel486 Microprocessor bus cycle by maintaining
ROY # inactive.

The addresses of the data items in a burst cycle will
all fall within the same 16-byte aligned area (corresponding to an internal Intel486 Microprocessor
cache line). A 16-byte aligned area begins at location XXXXXXXO and ends at location XXXXXXXF.
During a burst cycle, only BEO-3 #, A2, and A3 may
change. A4-A31, M/IO#, D/C#, and W/R# will remain stable throughout a burst. Given the first address in a burst, external hardware can easily calculate the address of subsequent transfers in advance.
An external memory system can be designed to
quickly fill the Intel486 microprocessor internal
cache lines.

The burst ready input (BRDY #) must be driven inactive on all clock edges where ROY # is driven inactive for proper operation of these simple non-burst
cycles.

105

intel .

Intel486TM OX MICROPROCESSOR

ClK

ADS#
A2-A31
1.1/10#
D/C#
BEO-3#
W/R#

RDY#

BLAST#

TO
CPU

DATA

L
TO
CPU

FROM CPU

PCHK#

LJ
READ

CJJ

WRITE

READ

240440-50

Figure 7.7. Basic 2-2 Bus Cycle

ClK

ADS#
A2-A31
1.1/10#
D/C#
BEO-3#
W/R#

RDY#

BLAST#

I
I

!;lATA

(
WRITE

READ

\
: FROM CPU

I
I

240440-51

Figure 7.8. Basic 3-3 Bus Cycle

106

intel .

Intel486TM OX MICROPROCESSOR

Burst cycles ar9 not limited to cache line fills. Any
multiple cycle read request by the Intel486 Microprocessor can be converted into a burst cycle. The
Intel486 Microprocessor will only burst the number
of bytes needed to complete a transfer. For example, eight bytes will be bursted in for a 64-bit floating
point non-cacheable read.

the external' system returns KEN # , BS8 # and
BS16#. BLAST# should only be sampled in the
second and subsequent clocks of a cycle when the
external system returns ROY # or BROY #.
The system may terminate a burst cycle by returning
ROY# instead of BROY#. BLAST# will remain
deasserted until the last transfer. However, any
transfers required to complete a cache line fill will
follow the burst order, e.g., if burst order was 4, 0, C,
8 and ROY # was returned at after 0, the next transfers will be from C and 8.

The external system converts a multiple cycle request into a burst cycle by returning BROY # active
rather than ROY # (non-burst ready) in the first cycle
of a transfer. For cycles that cannot be bursted such
as interrupt acknowledge and halt, BROY # has the
same effect as ROY #. BROY # is ignored if both
BROY # and ROY # are returned in the same clock.
Memory areas and peripheral devices that cannot
perform bursting must terminate cycles with ROY #.

7.2.2.3 Non-Cacheable, Non-Burst, Multiple
Cycle Transfers
Figure 7.9 illustrates a 2 cycle non-burst, non-cacheable multiple cycle read. This transfer is simply a
sequence of two single cycle transfers. The Intel486
Microprocessor indicates to the external system that
this is a multiple cycle transfer by driving BLAST #
inactive during the second clock of the first cycle.
The external system returns ROY # active indic~ting
that it will not burst the data. The external system
also indicates that the data is not cacheable by returning KEN # inactive one clock before it returns
ROY # active. When the Intel486 Microprocessor
samples ROY # active it ignores BROY #.

7.2.2.2 Terminating Multiple and
Burst Cycle Transfers
The Intel486 Microprocessor drives BLAST# inactive for all but the last cycle in a multiple cycle transfer. BLAST# is driven inactive in the first cycle to
inform the external system that the transfer could
take additional cycles. BLAST# is driven active in
the last cycle of the transfer indicating that the next
time BROY # or ROY # is returned the transfer is
complete.

Each cycle in the transfer begins when AOS# is
driven active and the cycle is complete when the
external system returns ROY # active.

BLAST # is not valid in the first clock of a bus cycle.
It should be sampled only in the second and subsequent clocks when ROY # or BROY # is returned.

The Intel486 Microprocessor indicates the last cycle
of the transfer by driving BLAST # active. The next
ROY # returned by the external system terminates
the transfer.

The number of cycles in a transfer is a function of
several factors including the number of bytes the microprocessor needs to complete an internal request
(1, 2, 4, 8, or 16), the state of the bus size inputs
(BS8# and BS16#), the state of the cache enable
input (KEN #) and alignment of the data to be transferred.

7.2.2.4 Non-Cacheable Burst Cycles
The external system converts a multiple cycle request into a burst cycle by returning BROY # active
rather than ROY # in the first cycle of the transfer.
This is illustrated in Figure 7.10.

When the Intel486 Microprocessor initiates a request it knows how many bytes will be transferred
and if the data is aligned. The external system must
tell the microprocessor whether the data is cacheable (if the transfer is a read) and the width of the
bus by returning the state of the KEN #, BS8 # and
BS16# inputs one clock before ROY# or BROY# is
returned. The Intel486 Microprocessor determines
how many cycles a transfer will take based on its
internal information and inputs from the external system.

There are several features to note in the burst read.
AOS# is only driven active during the first cycle of
the transfer. ROY # must be driven inactive when
BROY # is returned active.
BLAST# behaves exactly as it does in the non-burst
read. BLAST# is driven inactive in the second clock
of the first cycle of the transfer indicating more cycles to follow. In the last cycle, BLAST# is driven
active telling the external memory system to end the
burst after returning the next BROY # .

BLAST# is not valid in the first clock of a bus cycle
because the Intel486 Microprocessor cannot determine the number of cycles a transfer will take until

107

Intel486TM OX MICROPROCESSOR

ClK

ADS#
A2-A31
M/IO#
.D/C#
W/R#
BEO-3#

RDY#

BRDY#

KEN#

BlAST#

I
I

DATA

@-CPU
I

1st DATA

2nd DATA

240440-52

Figure 7.9. Non-Cacheable, Non-Burst, Multiple Cycle Transfers

ClK

ADS#
A2-A31
M/IO#
D/C#
W/R#
BEO-3#

RDY#

BRDY#

KEN#

BlAST#

,
I

DATA

I
I

~
CPU

CPU

Figure 7.10. Non-Cacheable Burst Cycle

108

240440-53

intel~

Intel486TM OX MICROPROCESSOR

7.2.3 CACHEABLE CYCLES

7.2.3_1 Byte Enables during a Cache Line Fill

Any memory read can become a cache fill operation.
The external memory system can allow a read request to fill a cache line by returning KEN # active
one clock before ROY # or BROY # during the first
cycle of the transfer on the external bus. Once
KEN # is asserted and the remaining three requirements described below are met, the Intel486 Microprocessor will fetch an entire cache line regardless
of the state of KEN #. KEN # must be returned active in the last cycle of the transfer for the data to be
written into the internal cache. The Intel486 Microprocessor will only convert memory reads or prefetches into a cache fill.

For the first cycle in the line fill, the state of the byte
enables should be ignored. In a non-cacheable
memory read, the byte enables indicate the bytes
actually required by the memory or code fetch.
The Intel486 Microprocessor expects to receive valid data on its entire bus (32 bits) in the first cycle of a
cache line fill. Data should be returned with the assumption that all the byte enable pins are driven active. However if BS8# is asserted only one byte
need be returned on data lines 00-07. Similarly if
BS16# is asserted two bytes should be returned on
00-015.

KEN# is ignored during write or I/O cycles. Memory
writes will only be stored in the on-chip cache if
there is a cache hit. I/O space is never cached in
the internal cache.

The Intel486 Microprocessor will generate the addresses and byte enables for all subsequent cycles
in the line fill. The order in which data is read during
a line fill depends on the address of the first item
read. Byte ordering is discussed in Section 7.2.4.

To transform a read or a prefetch into a cache line
fill the following conditions must be met:
1. The KEN # pin must be asserted one clock prior to ROY # or BROY # being returned for the
first data cycle.
2. The cycle must be of the type that can be internally cached. (Locked reads, I/O reads, and
interrupt acknowledge cycles are never cached).

7.2.3.2 Non-Burst Cacheable Cycles
Figure 7.11 shows a non-burst cacheable cycle. The
cycle becomes a cache fill when the Intel486 Microprocessor samples KEN # active at the end of the
first clock. The Intel486 Microprocessor drives
BLAST # inactive in the second clock in response to
KEN #. BLAST # is driven inactive because a cache
fill requires 3 additional cycles to complete.
BLAST # remains inactive until the last transfer in
the cache line fill. KEN # must be returned active in
the last cycle of the transfer for the data to be written into the internal cache.

3. The page table entry must have the page
cache disable bit (PCO) set to O. To cache a
page table entry, the page directory must have
PCO = O. To cache reads or prefetches when
paging is disabled, or to cache the page directory entry, control register 3 (CR3) must have
PCO=O.
4. The cache disable (CD) bit in control register 0
(CRO) must be clear.

Note that this cycle would be a single bus cycle if
KEN # was not sampled active at the end of the first
clock. The subsequent three reads would not have
happened since a cache fill was not requested.

External hardware can determine when the Intel486
Microprocessor has transformed a read or prefetch
into a cache fill by examining the KEN#, M/IO#,
O/C#, W/R#, LOCK#, and PCO pins. These pins
convey to the system the outcome of conditions 1-3
in the above list. In addition, the Intel486 drives PCO
high whenever the CD bit in CRO is set, so that external hardware can evaluate condition 4.

The BLAST # output is invalid in the first clock of a
cycle. BLAST# may be active during the first clock
due to earlier inputs. Ignore BLAST# until the second clock.
During the first cycle of the cache line fill the external system should treat the byte enables as if they
are all active. In subsequent cycles in the burst, the
Intel486 Microprocessor drives the address lines
and byte enables (see Section 7.2.4.2 for Burst and
Cache Line Fill Order).

Cacheable cycles can be burst or non-burst.

109

intel~

Intel486TM OX MICROPROCESSOR

ClK

\'---+--,'

ADS#
A2-A31
1.1/10#

D/C#

w/R#

BEO-3#

\'---+--,'

____~x~~____~x~~--~x~~--__~x~~-------------

RDY#

BRDY#

KEN#

w
I
I

BLAST#

DATA

I
I

\~-'---'-\_I
...£.-C_
I

------~-------+----~~~----~----~~~----~----~~~--~----~
240440-54

Figure 7.11. Non-Burst, Cacheable Cycles

The external system informs the Intel486 Microprocessor that it will burst the line in by driving BRDY #
active at the end of the first cycle in the transfer.

7.2.3.3 Burst Cacheable Cycles
Figure 7.12 illustrates a burst mode cache fill. As in
Figure 7.11, the transfer becomes a cache line fill
when the external system returns KEN # active at
the end of the first clock in the cycle.

Note that during a burst cycle ADS# is only driven
with the first address.

110

int:eL

Intel486TM OX MICROPROCESSOR

ClK

ADS#
M-A31 ,

M/IO#,
D/C#,
W/R#

\'--~/

____~x~~--~----~--~--~---

A2-A3,
BEO-3#

RDY#

BRDY#

\J)

KEN#

BlAST#

--r-'X

\,--_,--C_

DATA

\'----i--'X'----i--'X'--_+:--,L

PCHK#

240440-55

Figure 7.12. Burst Cacheable Cycle

cache line fill. Similarly, it uses the value of KEN # in
the last cycle, before early ROY # to load the line
just retrieved from the memory into the cache.
KEN # is sampled every clock, it must satisfy setup
and hold time.

7.2.3.4 Effect of Changing KEN# during a
Cache Line Fill

KEN # can change multiple times as long as it arrives at its final value in the clock before ROY # or
BROY# is returned. This is illustrated in Figure 7.13.
Note that the timing of BLAST # follows that of
KEN# by one clock. The Intel486 samples KEN#
every clock and uses the value returned in the clock
before ready to determine if a bus cycle would be a

KEN # can also change multiple times before a burst
cycle as long as it arrives at its final value one clock
before ready is returned active.

111

intel~

Intel486TM OX MICROPROCESSOR

ClK

'~.I....-J/

ADS#
A4-A31,
1.4/10#,
D/C#,

W/R#
A2-A3,
BEO-3#

----~x~_+--~----r---__--4------

____~x~-+__~----~--~x~~-----

RDY#
I

\JJ

KEN#

''--....J.--I/

BlAST#

DATA

\~.J.-...J/
I

----~---~---~--~~-~~~---~--~~
240440-56

Figure 7.13. Effect of Changing KEN #

Driving BRDY # and ROY # inactive adds a wait
state to the transfer. A burst cycle where two clocks
are required for every burst item is shown in Figure
7.14.

7.2.4 BURST MODE DETAILS
7.2.4.1 Adding Wait States to Burst Cycles
Burst cycles need not return data on every clock.
The Intel486 Microprocessor will only strobe data
into the chip when either RDY# or BRDY# are active.

112

inteL

Intel486TM OX MICROPROCESSOR

TI
ClK

ADS#

M-A31 ,

M/IO#,
D/C#,

W/R#
A2-A3,
BEO-3#

X
X

RDY#

BRDY#

KEN#

BlAST#

,'----'----

_--r-.....JX,-....J....-I!

DATA

--------~----~----~~~----~----~~~----~-----<~~----~----~~

240440-57

Figure 7.14. Slow Burst Cycle
Table 7.8. Burst Order

7.2.4.2 Burst and Cache Line Fill Order
The burst order used by the Intel486 Microprocessor
is shown in Table 7.8. This burst order is followed by
any burst cycle (cache or not), cache line fill (burst
or not) or code prefetch.
The microprocessor presents each request for data
in an order determined by the first address in the
transfer. For example, if the first address was 104
the next three addresses in the burst will be 100,
10C and 108.

First
Addr.

Second
Addr.

Third
Addr.

Fourth
Addr.

0
4
8
C

4
0
C
8

8
C
0
4

C
8
4
0

An example of burst address sequencing is shown in
Figure 7.15.

113

intel~

Intel486TM OX MICROPROCESSOR

ClK

,'--~/

ADS#

A2-A31

RDY#

BRDY#

KEN#

BlAST#

_-r---'x. . -I-....J!

,\..-_C,---

DATA
240440-58

Figure 7.15. Burst Cycle Showing Order of Addresses
The sequences shown in Table 7.7 accommodate
systems with 64-bit busses as well as systems with
32-bit data busses. The sequence applies to all
bursts, regardless of whether the purpose of the
burst is to fill a cache line, do a 64-bit read, or do a
pre-fetch. If either BS8# or BS16# is returned active, the Intel486 Microprocessor completes the
transfer of the current 32-bit word before progressing to the next 32-bit word. For example, a BS16#
burst to address 4 has the following order: 4-6-0-2C-E-8-A.

The Intel486 Microprocessor will automatically generate another normal bus cycle after being interrupted to complete the data transfer. This is called an
interrupted burst cycle. The external system can respond to an interrupted burst cycle with another
burst cycle.
The external system can interrupt a burst cycle by
returning RDY# instead of BRDY#. RDY# can be
returned after any number of data cycles terminated
with BRDY#.
An example of an interrupted burst cycle is shown in
Figure 7.16. The Intel486 Microprocessor immediately drives ADS # active to initiate a new bus cycle
after RDY # is returned active. BLAST # is driven
inactive one clock after ADS# begins the second
bus cycle indicating that the transfer is not complete.

7.2.4.3 Interrupted Burst Cycles
Some memory systems may not be able to respond
with burst cycles in the order defined in Table 7.7.
To support these systems the Intel486 Microprocessor allows a burst cycle to be interrupted at any time.

114

int'el..

Intel486TM OX MICROPROCESSOR

ClK

ADS#

A2-A31

104

X100:

10C

X108:

RDY#

BRDY#

KEN#

w
\~_C,---

BLAST#

DATA
240440-59

Figure 7.16. Interrupted Burst Cycle
KEN # need not be returned active in the first data
cycle of the second part of the transfer in Figure
7.16. The cycle had been converted to a cache fill in
the first part of the transfer and the Intel486 Microprocessor expects the cache fill to be completed.
Note that the first half and second half of the transfer in Figure 7.16 are each two cycle burst transfers.

An example of the order in which the Intel486 Microprocessor requests operands during a cycle in which
the external system mixes ROY # and BROY # is
shown in Figure 7.17. The Intel486 Microprocessor
initially requests a transfer beginning at location 104.
The transfer becomes a cache line fill when the external system returns KEN # active. The first cycle of
the cache fill transfers the contents of location 104
and is terminated with ROY #. The Intel486 Microprocessor drives out a new request (by asserting
AOS#) to address 100. If the external system terminates the second cycle with BROY #, the Intel486
Microprocessor will next request/expect address
10C. The correct order is determined by the first cycle in the transfer, which may not be the first cycle in
the burst if the system mixes ROY# with BROY#.

The order in which the Intel486 Microprocessor requests operands during an interrupted burst transfer
is determined by Table 7.7. Mixing ROY# and
BROY # does not change the order in which operand addresses are requested by the Intel486 Microprocessor.

115

infel .

Intel486TM OX MICROPROCESSOR

104

100

ClK

ADS#

A2-A31

I
I

X10C i X108:

RDY#

BRDY#

KEN#

BlAST#

DATA

\JJ
X

W
I

T
CPU

240440-60
Figure 7.17. Interrupted Burst Cycle with Unobvious Order of Addresses
Driving the 8816# and 888# active can force the
Intel486 Microprocessor to run additional cycles to
complete what would have been only a single 32-bit
cycle. 888# and 8816# may change the state of
8LA8T# when they force subsequent cycles from
the transfer.

7.2.5 8- AND 16-BIT CYCLES
The Intel486 Microprocessor supports both 16- and
8-bit external busses through the 8816# and 888#
inputs. 8816# and 888# allow the external system
to specify, on a cycle by cycle basis, whether the
addressed component can supply 8, 16 or 32 bits.
8816# and 888# can be used in burst cycles as
well as non-burst cycles. If both 8816# and 888#
are returned active for any bus cycle, the Intel486
Microprocessor will respond as if only 888 # were
active.

Figure 7.18 shows an example in which 888#
forces the Intel486 Microprocessor to run two extra
cycles to complete a transfer. The Intel486 Microprocessor issues a request for 24 bits of information.
The external system drives 888 # active indicating
that only eight bits of data can be supplied per cycle.
The Intel486 Microprocessor issues two extra cycles
to complete the transfer.

The timing of 8816# and 888# is the same as that
of KEN#. 8816# and 888# must be driven active
before the first ROY # or 8RDY # is driven active.

116

int'eL

Intel486™ OX MICROPROCESSOR

ClK

ADS#
A2-A31
M/IO#

D/c#
W/R#

\~--,I
~x~~

\'----7---'1

____ ____ ___
: c=
~

BEO-3#

RDY#

BS8#

BlAST#

__~x'---'---'/
I

DATA

------~------~----{~r----~---4~r----~----~
240440-61

Figure 7.18. 8·Bit Bus Size Cycle

Extra cycles forced by the BS16# and BS8# should
be viewed as independent bus cycles. BS16# and
BS8# should be driven active for each additional
cycle unless the addressed device has the ability to
change the number of bytes it can return between
cycles. The Intel486 Microprocessor will drive
BLAST# inactive until the last cycle before the
transfer is complete.

BS8# and BS16# operate during burst cycles in exactly the same manner as non-burst cycles. For example, a single non-cacheable read could be transferred by the Intel486 Microprocessor as four 8-bit
burst data cycles. Similarly, a single 32-bit write
could be written as four 8-bit burst data cycles. An
example of a burst write is shown in Figure 7.19.
Burst writes can only occur if BSB# or BS16# is
asserted.

Refer to Section 7.1.3 for the sequencing of addresses while BS8# or 8S16# are active.

117

Intel486TM OX MICROPROCESSOR

CLK

ADS#

ADDR
SPEC

BEO-3#

__~~x~____~x~~x~~x~_:_c=

RDY#

BRDY#

\~_ _ _ _----.J'/

BS8#

BLAST#
I

DATA

___-;-___...1...-«

:FROM CPU :

---r:---r----~

~-r:

240440-62

Figure 7.19. Burst Write as a Result of BS8# or BS16#

Locked cycles are implemented in hardware with the
LOCK# pin. When LOCK# is active, the processor
is performing a read-modify-write operation and the
external bus should not be relinquished until the cycle is complete. Multiple reads or writes can be
locked. A locked cycle is shown in Figure 7.20.
LOCK # goes active with the address and bus definition pins at the beginning of the first read cycle and
remains active until ROY # is returned for the last
write cycle. For unaligned 32 bits read-modify-write
operation, the LOCK# remains active for the entire
duration of the multiple cycle. It will go inactive when
ROY # is returned for the last write cycle.

7.2.6 LOCKED CYCLES
Locked cycles are generated in software for any in·
struction that performs a read·modify-write operation. During a read-modify-write operation the processor can read and modify a variable in external
memory and be assured that the variable is not accessed between the read and write.
Locked cycles are automatically generated during
certain bus transfers. The xchg (exchange) instruction generates a locked cycle when one of its operands is memory based. Locked cycles are generated when a segment or page table entry is updated
and during interrupt acknowledge cycles. Locked cycles are also generated when the LOCK instruction
prefix is used with selected instructions.

118

intel"

Intel486TM OX MICROPROCESSOR

ClK

ADS#
A2-A31
1.4/10#
D/C#
BEO-3#
W/R#

RDY#
I
I

DATA

( fROf.4:CPU ) - -

CPU
I

LOCK#

\
READ

WRITE

240440-63

Figure 7.20. Locked Bus Cycle
When LOCK# is active, the Intel486 Microprocessor
will recognize address hold and backoff but will not
recognize bus hold. It is left to the external system to
properly arbitrate a central bus when the Intel486
Microprocessor generates LOCK #.

sible. PLOCK# is asserted during the first write to
indicate that another write follows. This behavior is
shown in Figure 7.21.
The first cycle of a 64-bit floating point write is the
only case in which both PLOCK# and BLAST# are
asserted. Normally PLOCK# and BLAST# are the
inverse of each other.

7.2.7 PSEUDO-LOCKED CYCLES
Pseudo-locked cycles assure that no other master
will be given control of the bus during operand transfers which take more than one bus cycle. Examples
include 64-bit floating point read and writes, 64-bit
descriptor loads and cache line fills.

During all of the cycles where PLOCK # is asserted,
HOLD is not acknowledged until the cycle completes. This results in a large HOLD latency, especially when BS8# or BS16# is asserted. To reduce
the HOLD latency during these cycles, windows are
available between transfers to allow HOLD to be acknowledged during non-cacheable, non-bursted
code prefetches. PLOCK# will be asserted since
BLAST # is negated, but it is ignored and HOLD is
recognized during the prefetch.

Pseudo-locked transfers are indicated by the
PLOCK# pin. The memory operands must be
aligned for correct operation of a pseudo-locked cycle.
PLOCK# need not be examined during burst reads.
A 64-bit aligned operand can be retrieved in one
burst (note: this is only valid in systems that do not
interrupt bursts).

PLOCK # can change several times during a cycle
settling to its final value in the clock ready is returned.

The system must examine PLOCK # during 64-bit
writes since the Intel486 Microprocessor cannot
burst write more than 32 bits. However, burst can be
used within each 32-bit write cycle if BS8 # or
BS16# is asserted. BLAST will be deasserted in response to BS8# or BS16#. A 64-bit write will be
driven out as two non-burst bus cycles. BLAST# is
asserted during both writes since a burst is not pos-

7.2.8 INVALIDATE CYCLES
Invalidate cycles are needed to keep the Intel486
Microprocessor's internal cache contents consistent
with external memory. The Intel486 microprocessor
contains a mechanism for listening to writes by other
devices to external memory. When the processor
finds a write to a Section of external memory con-

119

intel®

Intel486TM OX MICROPROCESSOR

ClK

ADS#
A2-A31

M/IO#
D/C#

BEO-3#
W/R#

PlOCK#

RDY#

BLAST#

DATA
WRITE

WRITE

240440-64

Figure 7.21. Pseudo Lock Timing

tained in its internal cache, the processor's internal
copy is invalidated.

address bus before ready is returned terminating the
bus cycle.

Invalidations use two pins, address hold request
(AHOlD) and valid external address (EADS#).
There are two steps in an invalidation cycle. First,
the external system asserts the AHOlD input forcing
the Intel486 Microprocessor to immediately relinquish its address bus. Next, the external system asserts EADS# indicating that a valid address is on
the Intel486 Microprocessor's address bus. EADS#
and the invalidation address, Figure 7-22 shows the
fastest possible invalidation cycle. The Intel486 cycle CPU recognizes AHOlD on one ClK edge and
floats the address bus in response. To allow the address bus to float and avoid contention, EADS# and
the invalidation address should not be driven until
the following ClK edge. The microprocessor reads
the address oyer its address lines. If the microprocessor finds this address in its internal cache, the
cache entry is invalidated. Note that the Intel486 Microprocessor's address bus is input/output unlike
the 386 Microprocessor's bus, which is output only.

When AHOlD is asserted only the address bus is
floated, the data bus can remain active. Data can be
returned for a previously specified bus cycle during
address hold (see Figures 7.22, 7.23).
EADS # is normally asserted when an external master drives an address onto the bus. AHOlD need not
be driven for EADS# to generate an internal invalidate. If EADS# alone is asserted while the Intel486
Microprocessor is driving the address bus, it is possible that the invalidation address will come from the
Intel486 Microprocessor itself.
Note that it is also possible to run an invalidation
cycle by asserting EADS# when HOLD or BOFF#
is asserted.
Running an invalidate cycle prevents the Intel486
Microprocessor cache from satisfying other internal
requests, so invalidations should be run only when
necessary. The fastest possible invalidate cycle is
shown in Figure 7.22, while a more realistic invalidation cycle is shown in 7.23. Both of the examples
take one clock of cache access from the rest of the
Intel486 Microprocessor.

The Intel486 Microprocessor immediately relinquishes its address bus in the next clock upon assertion
of AHOlD. For example, the bus could be 3 wait
states into a read cycle. If AHOlD is activated, the
Intel486 Microprocessor will immediately float its

120

intel"

Intel486TM OX MICROPROCESSOR

ClK

ADS#

)

ADDR

(

CPu

AHOlD

[

\ 1

\JJ,

EADS#

RDY#

DATA

CPU

BREQ

\
240440-65

Figure 7.22. Fast Internal Cache Invalidation Cycle

ClK

ADS#

ADDR

)

(

CPu

AHOlD

\JJ,,

EADS#

RDY#

DATA

BREQ

CPU

I
240440-66

Figure 7.23. Typical Internal Cache Invalidation Cycle

121

Intel486TM OX MICROPROCESSOR

7.2.8.1 Rate of Invalidate Cycles
Intel486 ™

The Intel486 Microprocessor can accept one invalidate per clock except in the last clock of a line fill.
One invalidate per clock is possible as long as
EAOS# is negated in ONE or BOTH of the following
cases:

Microprocessor

1. In the clock ROY # or BROY # is returned for
the last time.
2. In the clock following ROY# or BROY# being
returned for the last time.

Address, Data &: Control Bus
Second
Level
Cache

This definition allows two system designs. Simple
designs can restrict invalidates to one every other
clock. The simple design need not track bus activity.
Alternatively, systems can request one invalidate
per clock provided that the bus is monitored.
7.2.8.2 Running Invalidate Cycles Concurrently
with Line Fills

Precautions are necessary to avoid caching stale
data in the Intel486 Microprocessor's cache in a system with a second level cache. An example of a
system with a second level cache is shown in Figure
7.24. An external device can be writing to main
memory over the system bus while the Intel486 Microprocessor is retrieving data from the second level
cache. The Intel486 Microprocessor will need to invalidate a line in its internal cache if the external
device is writing to a main memory address also
contained in the Intel486 Microprocessor's cache.

240440-67

Figure 7.24. System with Second Level Cache

A potential problem exists if the external device is
writing to an address in external memory, and at the
same time the Intel486 Microprocessor is reading
data from the same address in the second level
cache. The system must force an invalidation cycle
to invalidate the data that the Intel486 Microprocessor has requested during the line fill.
If the system asserts EAOS# before the first data in
the line fill is returned to the Intel486 Microprocessor, the system must return data consistent with the
new data in the external memory upon resumption of
the line fill after the invalidation cycle. This is illustrated by the asserted EAOS# signal labeled 1 in
Figure 7.25.

122

intel.,

Intel486TM OX MICROPROCESSOR

elK
I
I

ADS#

LiJ
I
I

AD DR

AHOlD

)r-~--~~~--~------~4(~__+-_____

\\....0.-_-I

EADS#

~
I

I
I

RDY#

BRDY#
I

KEN#

UJ
I
I

DATA

NOTES:
1. Data returned must be consistent if its address equals the invalidation address in this clock
2. Data returned will not be cached if its address equals the invalidation address in this clock

240440-68

Figure 7.25. Cache Invalidation Cycle Concurrent with Line Fill
If the system asserts EADS# at the same time or
after the first data in the line fill is returned (in the
same clock that the first ROY # or BRDY # is returned or any subsequent clock in the line fill) the
data will be read into the Intel486 Microprocessors
input buffers but it will not be stored in the on-chip
cache. This is illustrated by asserted EADS# signal
labeled 2 in Figure 7.25. The stale data will be used
to satisfy the request that initiated the cache fill cycle.

sor, the Intel486 Microprocessor can respond to
HOLD by floating its bus and asserting HLDA while
RESET is asserted.
Note that HOLD will be recognized during un-aligned
writes (less than or equal to 32-bits) with BLAST #
being active for each write. For greater than 32-bit or
un-aligned write, HOLD# recognition is prevented
by PLOCK # getting asserted.
The pins floated during bus hold are: BEO#-BE3#,
PCD, PWT, W/R#, D/C#, MlIO#, LOCK#,
PLOCK#, ADS#, BLAST#, 00-031, A2-A31,
DPO-DP3.

7.2.9 BUS HOLD
The Intel486 Microprocessor provides a bus hold,
hold acknowledge protocol using the bus hold request (HOLD) and bus hold acknowledge (HLDA)
pins. Asserting the HOLD input indicates that another bus master desires control of the Intel486 Microprocessor's bus. The processor will respond by
floating its bus and driving HLDA active when the
current bus cycle, or sequence of locked cycles is
complete. An example of a HOLD/HLDA transaction
is shown in Figure 7.26. Unlike the 386 Microproces-

7.2.10 INTERRUPT ACKNOWLEDGE
The Intel486 Microprocessor generates interrupt acknowledge cycles in response to maskable interrupt
requests generated on the interrupt request input
(INTR) pin. Interrupt acknowledge cycles have a
unique cycle type generated on the cycle type pins.

123

intel~

Intel486TM OX MICROPROCESSOR

ClK

\~--~----~~U~____

ADS#
A2-A31
M/IO#

D/C#

w/R#

8EO-3#
RDY#

DATA

HOLD

HlDA

240440-69

Figure 7.26. HOLD/HLDA Cycles

An example interrupt acknowledge transaction is
shown in Figure 7.27. Interrupt acknowledge cycles
are generated in locked pairs. Data returned during
the first cycle is ignored. The interrupt vector is returned during the second cycle on the lower 8 bits of
the data bus. The Intel486 Microprocessor has 256
possible interrupt vectors.

The state of A2 distinguishes the first and second
interrupt acknowledge cycles. The byte address
driven during the first interrupt acknowledge cycle is
4 (A31-A3 low, A2 high, BE3#-BE1 # high, and
BEO# low). The address driven during the second
interrupt acknowledge cycle is 0 (A31-A2 low,
BE3#-BE1 # high, BEO# low).

ClK

,
ADS#

ADDR

/ :.

4 CLOCKS:

RDY#
I

@--

DATA

lOCK#

CPU

240440-70

Figure 7.27. Interrupt Acknowledge Cycles

124

infel .

Intel486TM OX MICROPROCESSOR

Each of the interrupt acknowledge cycles are terminated when the external system returns ROY # or
BROY #. Wait states can be added by withholding
ROY # or BROY #. The Intel4B6 Microprocessor automatically generates four idle clocks between the
first and second cycles to allow for 8259A recovery
time.

The external hardware must acknowledge these
special bus cycles by returning ROY # or BROY #.
Table 7.9. Special Bus Cycle Encoding

7.2.11 SPECIAL BUS CYCLES
The Intel4B6 Microprocessor provides four special
bus cycles to indicate that certain instructions have
been executed, or certain conditions have occurred
internally. The special bus cycles in Table 7.9 are
defined when the bus cycle definition pins are in
the following state: MilO # = 0, O/C # = 0 and
WIR # = 1. Ouring these cycles the address bus is
driven low while the data bus is undefined.

BE2#

BEH

BEO#

Special
Bus Cycle

1
1
1
0

1
1
0
1

1
0
1
1

0
1
1
1

Shutdown
Flush
Halt
Write Back

7.2.11.1 Halt Indication Cycle
The Intel4B6 Microprocessor halts as a result of executing a HALT instruction. Signaling its entrance into
the halt state, a halt indication cycle is performed.
The halt indication cycle is identified by the bus definition signals in special bus cycle state and a byte
address of 2. BEO# and BE2# are the only signals
distinguishing halt indication from shutdown indication, which drives an address of O. Ouring the halt
cycle undefined data is driven on 00-031. The halt
indication cycle must be acknowledged by ROY # or
BROY # asserted.

Two of the special cycles indicate halt or shutdown.
Another special cycle is generated when the Intel4B6 Microprocessor executes an INVO (invalidate
data cache) instruction and could be used to flush
an external cache. The Write Back cycle is generated when the Intel486 Microprocessor executes the
WBINVO (write-back invalidate data cache) instruction and could be used to synchronize an external
write-back cache.

BE3#

T1b

ClK

ADS#
A2-A31
M/IO#
D/C#
BEO-3#
RDY#

BRDY#

KEN#

BOFF#

BLAST#

x=J

\J)

I
~

I
I
I

U,
I

DATA
240440-71

Figure 7.28. Restarted Read Cycle
125

infel .

Intel486™ OX MICROPROCESSOR

T1b

ClK

ADS#

ADDR
SPEC

''--.. . . . . .1
.

\'------~""'\\'-____I----JI

____~~X~--r-l-00~~)~~----~~(~_+--10-0~-r==

RDY#

BRDY#

BOFF#

DATA

240440-72
Figure 7.29. Restarted Write Cycle
ed and any data returned to the processor is ignored. The same pins are floated in response to
BOFF# as are floated in response to HOLD. HLDA
is not generated in response to BOFF #. BOFF #
has higher priority than RDY # or BRDY #. If either
RDY # or BRDY # are returned in the same clock as
BOFF #, BOFF # takes effect.

A halted Intel486 Microprocessor resumes execution when INTR (if interrupts are enabled) or NMI or
RESET is asserted.
7.2.11.2 Shutdown Indication Cycle
The Intel486 Microprocessor shuts down as a result
of a protection fault while attempting to process a
double fault. Signaling its entrance into the shutdown state, a shutdown indication cycle is performed. The shutdown indication cycle is identified
by the bus definition signals in special bus cycle
state and a byte address of O.

The device asserting BOFF # is free to run any cycles it wants while the Intel486 Microprocessor bus
is in its high impedance state. If backoff is requested
after the Intel486 Microprocessor has started a cycle, the new master should wait for memory to return
RDY# or BRDY# before assuming control of the
bus. Waiting for ready provides a handshake to insure that the memory system is ready to accept a
new cycle. If the bus is idle when BOFF # is asserted, the new master can start its cycle two clocks
after issuing BOFF # .

7.2.12 BUS CYCLE RESTART
In a multi-master system another bus master may
require the use of the bus to enable the Intel486
Microprocessor to complete its current bus request.
In this situation the Intel486 Microprocessor will
need to restart its bus cycle after the other bus master has completed its bus transaction.

The external memory can view BOFF # in the same
manner as BLAST#. Asserting BOFF# tells the external memory system that the current cycle is the
last cycle in a transfer.

A bus cycle may be restarted if the external system
asserts the backoff (BOFF#) input. The Intel486 Microprocessor samples the BOFF # pin every clock.
The Intel486 Microprocessor will immediately (in the
next clock) float its address, data and status pins
when BOFF# is asserted (see Figure 7.28). Any bus
cycle _in progress when BOFF # is asserted is abort-

The bus remains in the high impedance state until
BOFF# is negated. Upon negation, the Intel486 Microprocessor restarts its bus cycle by driving out the
address and status and asserting ADS #. The bus
cycle then continues as usual.

126

int:eL

Intel486TM OX MICROPROCESSOR

Asserting 80FF# during a burst, 8S8# or 8S16#
cycle will force the Intel486 Microprocessor to ignore data returned for that cycle only. Data from previous cycles will still be valid. For example, if
BOFF # is asserted on the third BRDY # of a burst,
the Intel486 Microprocessor assumes the data returned with the first and second BRDY # 's is correct
and restarts the burst beginning with the third item.
The same rule applies to transfers broken into multiple cycle by BS8# or BS16#.

aborted. There are two possible solutions to this
problem. The first is to have all devices recognize
this condition and ignore ADS# until ready comes
back. The second approach is to use a "two clock"
backoff: in the first clock AHOLD is asserted, and in
the second clock BOFF # is asserted. This guarantees that ADS# will not be floating low. This is only
necessary in systems where BOFF # may be asserted in the same clock as ADS#.

Asserting BOFF# in the same clock as ADS# will
cause the Intel486 Microprocessor to float its bus in
the next clock and leave ADS# floating low. Since
ADS# is floating low, a peripheral may think that a
new bus cycle has begun even-though the cycle was

7.2_13 BUS STATES

A bus state diagram is shown in Figure 7.30. A description of the signals used in the diagram is given
in Table 7.10.

(RDY# ASSERTED + (BRDY# 0 BLAST#)ASSERTED) 0
(HOLD + AHOLD + NO REQUEST)
BOFF# NEGATED

(RDY# ASSERTED + (BRDY#

REQUEST PENDING
HOLD NEGATED
AHOLD NEGATED 0
BOFF# NEGATED

REQUEST PENDING 0
BLAST#)ASSERTED) 0
HOLD NEGATED 0
AHOLD NEGATED 0
BOFF# NEGATED 0

BOFF# NEGATE/

'O()~~~~()

BOFF#
ASSERTED

<,<'<,)

BOFF#
NEGATED

~~SSERTED
AHOLD NEGATED 0
BOFF# NEGATED 0
(HOLD NEGATED 0)
• HOLD is only factored into this state transition if Tb was entered while

non-cacheable, non-bursted, code prefetch was in
Otherwise, ignore HOLD.

progress.

240440-73

Figure 7.30. Bus State Diagram
Table 7.10. Bus State Description
State

Means

Bus is idle. Address and status signals may be driven to undefined values, or
the bus may be floated to a high impedance state.

First clock cycle of a bus cycle. Valid address and status are driven and
ADS # is asserted.

Second and subsequent clock cycles of a bus cycle. Data is driven if the
cycle is a write, or data is expected if the cycle is a read. RDY # and BRDY #
are sampled.

T1b

First clock cycle of a restarted bus cycle. Valid address and status are driven
and ADS # is asserted.

Second and subsequent clock cycles of an aborted bus cycle.
127

int'eL

Intel486™ OX MICROPROCESSOR

When the NE bit in CRO is cleared, and IGNNE# is
asserted, the Intel486 Microprocessor will ignore a
user floating point error and continue executing
floating point instructions. When IGNNE# is negated, the Intel486 Microprocessor will freeze on floating point instructions which get errors (except for the
control instructions FNCLEX, FNINIT, FNSAVE,
FNSTENV, FNSTCW, FNSTSW, FNSTSW AX, FNE·
NI, FNDISI and FNSETPM). IGNNE# may be asynchronous to the Intel486 clock.

7.2.14 FLOATING POINT ERROR HANDLING·

The Intel486 Microprocessor provides two options
for reporting floating point errors. The simplest
method is to raise interrupt 16 whenever an unmasked floating point error occurs. This option may
be enabled by setting the NE bit in control register a
(CRO).
The Intel486 Microprocessor also provides the option of allowing external hardware to determine how
floating point errors are reported. This option is necessary for compatibility with the error reporting
scheme used in DOS based systems. The NE bit
must be cleared in CRO to enable user·defined error
reporting. User-defined error reporting is the default
condition because the NE bit is cleared on reset.

In systems with user-defined error reporting, the
FERR # pin is connected to the interrupt controller.
When an unmasked floating point error occurs, an
interrupt is raised. If IGNNE# is high at the time of
this interrupt, the Intel486 Microprocessor will freeze
(disallowing execution of a subsequent floating point
instruction) until the interrupt handler is invoked. By
driving the IGNNE# pin low (when clearing the interrupt request), the interrupt handler can allow execution of a floating point instruction, within the interrupt
handler, before the error condition is cleared (by
FNCLEX, FNINIT, FNSAVE or FNSTENV). If execution of a non-control floating point instruction, within
the floating point interrupt handler, is not needed,
the IGNNE# pin can be tied HIGH.

Two pins, floating point error (FERR#) and ignore
numeric error (IGNNE#), are provided to direct the
actions of hardware if user·defined error reporting is
used. The Intel486 Microprocessor asserts the
FERR# output to indicate that a floating point error
has occurred. FERR # corresponds to the ERROR #
pin on the 387 math coprocessor. However, there is
a difference in the behavior of the two.
In some cases FERR# is asserted when the next
floating point instruction is encountered and in other
cases it is asserted before the next floating point
instruction is encountered depending upon the execution state of the instruction causing the exception.

7.2.15 FLOATING POINT ERROR HANDLING IN
AT COMPATIBLE SYSTEMS

The Intel486 DX Microprocessor provides special
features to allow the implementation of an AT compatible numerics error reporting scheme. These features DO NOT replace the external circuit. Logic is
still required that decodes the OUT Fa instruction
and latches the FERR # signal. What follows is a
description of the use of these Intel486 DX Microprocessor features.

The following class of floating point exceptions drive
FERR # at the time the exception occurs (Le., before
encountering the next floating point instruction).
1. The stack fault, invalid operation, and denormal
exceptions on all transcendental instructions, integer arithmetic instructions, FSQRT, FSEALE,
FPREM(1), FXTRACT, FBLD, and FBSTP.
2. Any exceptions on store instructions (including
integer store instructions).

The features provided by the Intel486 DX Microprocessor are the NE bit in the Machine Status Register,
the IGNNE# pin, and the FERR# pin.

The following class of floating point exceptions drive
FERR# only after encountering the next floating
point instruction.
1. Exceptions other than on all transcendental instructions,
integer arithmetic
instructions,
FSQRT, FSCALE, FPREM(1), FXTRACT, FBLD,
and FBSTP.
2. Any exception on all basic arithmetic, load, compare, and control instructions (Le., all other instructions).

The NE bit determines the action taken by the Intel486 DX Microprocessor when a numerics error is
detected. When set this bit signals that non-DOS
compatible error handling will be implemented. In
this mode the Intel486 DX Microprocessor takes a
software exception (16) if a numerics error is detected.
If the NE bit is reset the Intel486 DX Microprocessor
uses the IGNNE# pin to allow an external circuit to
control the time at which non-control numerics instructions are allowed to execute. Note that floating
point control instructions such as FNINIT and
FNSAVE can be executed during a floating point error condition regardless of the state of IGNNE #.

For both sets of exceptions above, the 387 Math
Coprocessor asserts ERROR # when the error oc·
curs and does not wait for the next floating point
instruction to be encountered.
IGNNE# is an input to the Intel486 Microprocessor.
128

intel .

Intel486TM OX MICROPROCESSOR

Figure 7.31 illustrates the circuit required to perform
this function. Note that this circuit has not been tested. It is included as an example of the required error
handling logic.

To process a floating point error in the DOS environment the following sequence must take place:
1. The error is detected by the Intel486 OX Microprocessor which activates the FERR # pin.
2. FERR # is latched so that it can be cleared by the
OUT FO instruction.

Note that the IGNNE# input allows non-control instructions to be executed prior to the time the
FERR# Signal is reset by the Intel486 OX Microprocessor. This function is implemented to allow exact compatibility with the AT implementation. Most
programs reinitialize the floating point unit before
continuing after an error is detected. The floating
point unit can be reinitialized using one of the following four instructions: FCLEX, FINIT, FSAVE,
FSTENV.

3. The latched FERR # Signal activates an interrupt
at the interrupt controller. This interrupt is usually
handled on IRQ13.
4. The Interrupt Service Routine (ISR) handles the
error and then clears the interrupt by executing an
OUT instruction to port FO. The address FO is decoded externally to clear the FERR # latch. The
IGNNE# signal is also activated by the decoder
output.
5. Usually the ISR then executes an FNINIT instruction or other control instruction before restarting
the program. FNINIT clears the FERR# output.

RESET

I/O PORT FO
Address decoder

Processor Bus

)
5V
CLR
Q

FERR#

L
CLR
Q

.---

Intel486TM
Microprocessor

Q
PR

IRQ13

8259A
Programmable
Interrupt
Controller

t. 5V
IGNNE#
INTR

240440-95

Figure 7.31. DOS Compatible Numerics Error Circuit

129

intel~
8.0

Intel486TM OX MICROPROCESSOR

microprocessor performs reset and begins normal
operation at the completion of the BIST.

Intel486 CPU TESTABILITY

Testing the Intel486 Microprocessor can be divided
into three categories: Built-In Self Test (BIST),
Boundary Scan, and external testing. BIST performs
basic device testing on the Intel486 CPU, including
the non-random logic, control ROM (CRaM), translation lookaside buffer (TLB), and on-chip cache
memory. Boundary Scan provides additional test
hooks that conform to the IEEE Standard Test Access Port and Boundary Scan Architecture (IEEE
Std.1149.1). The Intel486 Microprocessor also has a
test mode in which all of its outputs are tristated.
Additional testing can be performed by using the test
registers within the Intel486 CPU.

8.1 Built-In Self Test (BIST)
The BIST is initiated by asserting AHOLD (address
hold) on the falling edge of RESET. AHOLD is a
synchronous signal only. It should be asserted in the
clock prior to RESET going from High to Low to start
BIST. FLUSH# must also be asserted (driven low)
prior to the falling edge of RESET to start BIST.
FLUSH # must be deasserted (driven high) during
BIST. A20M# must be deasserted (driven high) during the falling edge of RESET to start BIST. The
BIST takes approximately 2""20 clocks, or approximately 42 milliseconds with a 25 MHz Intel486 microprocessor. No bus cycles will be run by the Intel486 Microprocessor until the BIST is concluded.
Note that for the Intel486 Microprocessor the RESET must be active for 15 clocks with or without
BIST being enabled for warm resets.
The results of BIST is stored in the EAX register.
The Intel486 Microprocessor has successfullypassed the BIST if the contents of the EAX register
are zero. If the results in EAX are not zero then the
BIST has detected a flaw in the microprocessor. The

The non-random logic, control ROM, on-chip cache
and translation lookaside buffer (TLB) are tested
during the BIST.
The cache portion of the BIST verifies that the
cache is functional and that it is possible to read and
write to the cache. The BIST manipulates test registers TR3, TR4 and TR5 while testing the cache.
These test registers are described in Section 8.2.
The cache testing algorithm writes a value to each
cache entry, reads the value back, and checks that
the correct value was read back. The algorithm may
be repeated more than once for each of the 512
cache entries using different constants.
The TLB portion of the BIST verifies that the TLB is
functional and that it is possible to read and write to
the TLB. The BIST manipulates test registers TR6
and TR7 while testing the TLB. TR6 and TR7 are
described in Section 8.3.

8.2 On-Chip Cache Testing
The on-chip cache testability hooks are designed to
be accessible during the BIST and for assembly language testing of the cache.
The Intel486 Microprocessor contains a cache fill
buffer and a cache read buffer. For testability writes,
data must be written to the cache fill buffer before it
can be written to a location in the cache. Data must
be read from a cache location into the cache read
buffer before the microprocessor can access the
data. The cache fill and cache read buffer are both
128 bits wide.

TR3

ICache Data
--.JTestReglster

DATA

L -_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

TRS
SetSeiect
"'-_ _ _ _ _ _ _--'---=-:..c::..::.'--..JL-----l Test Register

Figure 8.1. Cache Test Registers
130

intel~

Intel486TM OX MICROPROCESSOR

8.2.1 CACHE TESTING REGISTERS TR3, TR4
AND TR5

The seven bit set select field determines which of
the 128 sets will be accessed.

Figure 8.1 shows the three cache testing registers:
the Cache Data Test Register (TR3), the Cache
Status Test Register (TR4) and the Cache Control
Test Register (TR5). External access to these registers is provided through MOV reg,TREG and MOV
TREG, reg instructions.

The functionality of the two entry select bits depend
on the state of the control bits. When the fill or read
buffers are being accessed, the entry select bits
point to the 32-bit location in the buffer being accessed. When a cache location is specified, the entry select bits point to one of the four entries in a set.
Refer to Table 8.1.

Cache Data Test Register: TR3
Five testability functions can be performed on the
cache. The two control bits in TR5 specify the operation to be executed. The five operations are:

The cache fill buffer and the cache read buffer can
only be accessed through TR3. Data to be written to
the cache fill buffer must first be written to TR3. Data
read from the cache read buffer must be loaded into
TR3.

1. Write cache fill buffer
2. Perform a cache testability write
3. Perform a cache testability read

TR3 is 32 bits wide while the cache fill and read
buffers are 128 bits wide. 32 bits of data must be
written to TR3 four times to fill the cache fill buffer.
32 bits of data must be read from TR3 four times to
empty the cache read buffer. The entry select bits in
TR5 determine which 32 bits of data TR3 will access
in the buffers.

4. Read the cache read buffer
5. Perform a cache flush
Table 8.1 shows the encoding of the two control bits
in TR5 for the cache testability functions. Table 8.1
also shows the functionality of the entry and set select bits for each control operation.

Cache Status Test Register: TR4

The cache tests attempt to use as much of the normal operating circuitry as possible. Therefore when
cache tests are being performed, the cache must be
disabled (the CD and NW bits in control register
must be set to 1 to disable the cache. See Section
5).

TR4 handles tag, LRU and valid bit information during cache tests. TR4 must be loaded with a tag and
a valid bit before a write to the cache. After a read
from a cache entry, TR4 contains the tag and valid
bit from that entry, and the LRU bits and four valid
bits from the accessed set.

8.2.2 CACHE TESTABILITY WRITE

Cache Control Test Register: TR5

A testability write to the cache is a two step process.
First the cache fill buffer must be loaded with 128
bits of data and TR4 loaded with the tag and valid
bit. Next the contents of the fill buffer are written to a
cache location. Sample assembly code to do a write
is given in Figure 8.2.

TR5 specifies which testability operation will be performed and the set and entry within the set which
will be accessed.

Table 8.1. Cache Control Bit Encoding and Effect of
Control Bits on Entry Select and Set Select Functionality
Control Bits
Bit 1

Bit 0

Entry Select Bits
Function

Operation

Enable

{ Fill Buffer Write
Read Buffer Read

Select 32-bit location in fill/read
buffer

Set Select Bits

Perform Cache Write

Select an entry in set.

Select a set to write to

Perform Cache Read

Select an entry in set.

Select a set to read from

Perform Flush Cache

131

intel·

Intel486TM OX MICROPROCESSOR

Sample Assembly Code
An example assembly language sequence to perform a cache write is:

eax. ebx. ecx. edx contain the cache line to write
edi contains the tag information to load
CRO already says to enable reads/write to TR5
fill the cache buffer
mov esi,O
mov tr5,esi
mov tr3,eax
mov eSi,4
mov tr5,esi
mov tr3,ebx
mov eSi,B
mov tr5,esi
mov tr3,ecx
mov esi,Och
mov tr5,esi
mov tr3,edx

set up command
load to TR5
load data into cache fill buffer

load the Cache Status Register
mov tr4,edi

; load 2l-bit tag and valid bit

perform the cache write
mov esi,l
mov tr5,esi

; write the cache (set 0, entry 0)

An example assembly language sequence to perform a cache read is:

data into eax, ebx, ecx, edx; status into edi
read the cache line back
mov esi,2
mov tr5,esi

; do cache testability read (set 0, entry 0)

read the data from the read buffer
mov
mov
mov
mov
mov
mov
mov
mov
mov
mov
mov
mov

esi,O
tr5,esi
eax,tr3
eSi,4
tr5,esi
ebx,tr3
eSi,B
tr5,esi
ecx,tr3
eSi,Och
tr5,esi
edx,tr3

read the status from TR4
mov edi,tr4
Figure 8.2 Sample Assembly Code for Cache Testing

132

infel"

Intel486TM OX MICROPROCESSOR

Loading the fill buffer is accomplished by first writing
to the entry select bits in TR5 and setting the control
bits in TR5 to 00. The entry select bits identify one of
four 32-bit locations in the cache fill buffer to put 32
bits of data. Following the write to TR5, TR3 is written with 32 bits of data which are immediately
placed in the cache fill buffer. Writing to TR3 initiates
the write to the cache fill buffer. The cache fill buffer
is loaded with 128 bits of data by writing to TR5 and
TR3 four times using a different entry select location
each time.

transfer into TR3 and the control bits in TR5 must be
loaded with 00. The register read of TR3 will initiate
the transfer of the 32-bit value from the read buffer
to the specified general purpose register.
Note that it is very important that the entire 128-bit
quantity from the read buffer and also the information from TR4 be read before any memory references are allowed to occur. If memory operations
are allowed to happen, the contents of the read buffer will be corrupted. This is because the testability
operations use hardware that is used in normal
memory accesses for the Intel486 microprocessor
whether the cache is enabled or not.

TR4 must be loaded with the 21-bit tag and valid bit
(bit 10 in TR4) before the contents of the fill buffer
are written to a cache location.

8.2.4 FLUSH CACHE

The contents of the cache fill buffer are written to a
cache location by writing TR5 with a control field of
01 along with the set select and entry select fields.
The set select and entry select field indicate the location in the cache to be written. The normal cache
LRU update circuitry updates the internal LRU bits
for the selected set.

The control bits in TR5 must be written with 11 to
flush the cache. None of the other bits in TR5 have
any meaning when 11 is written to the control bits.
Flushing the cache will reset the LRU bits and the
valid bits to 0, but will not change the cache tag or
data arrays.

Note that a cache testability write can only be done
when the cache is disabled for replaces (the CD bit
is control register 0 is reset to 1). Also note that care
must be taken when directly writing to entries in the
cache. If the entry is set to overlap an area of memory that is being used in external memory, that
cache entry could inadvertently be used instead of
the external memory. Of course, this IS exactly the
type of operation that one would desire if the cache
were to be used as a high speed RAM.

When the cache is flushed by writing to TR5 the
special bus cycle indicating a cache flush to the external system is not run (see Section 7.2.11, Special
Bus Cycles). The cache should be flushed with the
instruction INVD (Invalidate Data Cache) instruction
or the WBINVD (Write-back and Invalidate Data
Cache) instruction.

8.3 Translation Lookaside Buffer
(TLB) Testing

8.2.3 CACHE TESTABILITY READ

The Intel486 Microprocessor TLB testability hooks
are similar to those in the 386 Microprocessor. The
testability hooks have been enhanced to provide
added test features and to include new features in
the Intel486 Microprocessor. The TLB testability
hooks are designed to be accessible during the
BIST and for assembly language testing of the TLB.

A cache testability read is a two step process. First
the contents of the cache location are read into the
cache read buffer. Next the data is examined by
reading it out of the read buffer. Sample assembly
code to do a testability read is given in Figure 8.2.
Reading the contents of a cache location into the
cache read buffer is initiated by writing TR5 with the
control bits set to 10 and the desired seven-bit set
select and two-bit entry select. In response to the
write to TR5, TR4 is loaded with the 21-bit tag field
and the single valid bit from the cache entry read.
TR4 is also loaded with the three LRU bits and four
valid bits corresponding to the cache set that was
accessed. The cache read buffer is filled with the
128·bit value which was found in the data array at
the specified location.

8.3.1 TRANSLATION LOOKASIDE BUFFER
ORGANIZATION
The Intel486 Microprocessors TLB is 4-way set associative and has space for 32 entries. The TLB is
logically split into three blocks shown in Figure 8.3.
The data block is physically split into four arrays,
each with space for eight entries. An entry in the
data block is 22 bits wide containing a 20-bit physical address and two bits for the page attributes. The
page attributes are the PCD (page cache disable) bit
and the PWT (page write-through) bit. Refer to Section 4.5.4 for a discussion of the PCD and PWT bits.

The contents of the read buffer are examined by
performing four reads of TR3. Before reading TR3
the entry select bits in TR5 must loaded to indicate
which of the four 32-bit words in the read buffer to

133

Intel486TM OX MICROPROCESSOR

Tag
17 Blls

Page
Protection
Bits
4 Bits

Physical
Address
20 Bits

Page
Attributes
2 Bits

8 Entries

L------....II 1'--------1
'--------II 1'--------1
'--------II 1'--------1
[J :is
I

RU
Bits

240440-43

Figure 8.3. TLB Organization

The tag block is also split into four arrays, one for
each of the data arrays. A tag entry is 21 bits wide
containing a 17-bit linear address and four protection bits. The protection bits are valid (V), user/supervisor (UlS), read/write (R/W) and dirty (D).

TLB is the same as used by the on-chip cache. For a
description of this algorithm refer to Section 5.5.
8.3.2 TLB TEST REGISTERS TR6 AND TR7

The two TLB test registers are shown in Figure 8.4.
TR6 is the command test register and TR7 is the
data test register. External access to these registers
is provided through MOV reg,TREG and MOV
TREG,reg instructions.

The third block contains eight three bit quantities
used in the pseudo least recently used (LRU) replacement algorithm. These bits are called the LRU
bits. The LRU replacement algorithm used in the

Linear Address

12 11

4 3 2

:TR7
: TLB Data
' - -_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _---L_-'----L_ _ _.L....:._-'--'-_-"""a..;."""'''-''',I Test Register
Physical Address

t
'~=

unused

Replacement Painter Select (Writes)
Hit Indication (Lookup)

Figure 8.4. TLB Test Registers

134

t
Replacement Pointer (Writes)
Hit Location (Lookup)

Intel486TM OX MICROPROCESSOR

Command Test Register: TR6

test write, TR7 contains the physical address and
the page attribute bits to be stored in the entry. After
a TLB test lookup hit, TR7 contains the physical address, page attributes, LRU bits and entry location
from the access.

TR6 contains the tag information and control information used in a TLB test. Loading TR6 with tag and
control information initiates a TLB write or lookup
test.
'

TR7 contains a 20-bit physical address (bits 12-31),
two bits for PCD (bit 11) and PWT (bit 10) and three
bits for the LRU bits (bits 7 -9). The LRU bits in TR7
are only used during a TLB lookup test. The functionality of TR7 bit 4 differs for TLB writes and lookups. The encoding of bit 4 is defined in Tables 8.4
and 8.5. Finally TR7 contains two bits (bits 2-3) to
specify a TLB replacement pointer or the location of
a TLB hit.

TR6 contains three bit fields, a 20-bit linear address
(bits 12-31), seven bits for the TLB tag protection
bits (bits 5-11) and one bit (bit 0) to define the type
of operation to be performed on the TLB.
The 20-bit linear address forms the tag information
used in the TLB access. The lower three bits of the
linear address select which of the eight sets are accessed. The upper 17 bits of the linear address form
the tag stored in the tag array.

Table 8.4. Encoding of Bit 4 of TR7 on Writes

The seven TLB tag protection bits are described below.
The valid bit for this TLB entry
0,0#: The dirty bit for/from the TLB entry
U,U#: The user/supervisor bit for/from the TLB
entry
W,W#: The read/write bit for/from the TLB entry

TR7
Bit4

Replacement Pointer
Used on TLB Write

0
1

Pseudo-LRU Replacement Pointer
Data Test Register Bits 3:2

Table 8.5. Encoding of Bit 4 of TR7 on Lookups

Two bits are used to represent the 0, U/S and R/W
bits in the TLB tag to permit the option of a forced
miss or hit during a TLB lookup operation. The
forced miss or hit will occur regardless of the state
of the actual bit in the TLB. The meaning of these
pairs of bits is given in Table 8.2.

TR7
Bit 4

Meaning after TLB
Lookup Operation

0
1

TLB Lookup Resulted in a Miss
TLB Lookup Resulted in a Hit

A replacement pointer is used during a TLB write.
The pointer indicates which of the four entries in an
accessed set is to be written. The replacement
pointer can be specified to be the internal LRU bits
or bits 2-3 in TR7. The source of the replacement
pointer is specified by TR7 bit 4. The encoding of bit
4 during a write is given by Table 8.4.

The operation bit in TR6 determines if the TLB test
operation will be a write or a lookup. The function of
the operation bit is given in Table 8.3.
Table 8.3. TR6 Operation Bit Encoding
TR6
Bit 0

Note that both testability writes and lookups affect
the state of the internal LRU bits regardless of the
replacement pointer used. All TLB write operations
(testability or normal operation) cause the written
entry to become the most recently used. For example, during a testability write with the replacement
pointer specified by TR7 bits 2-3, the indicated entry is written and that entry becomes the most recently used as specified by the internal LRU bits.

TLB Operation
to Be Performed
TLB Write
TLB Lookup

0
1
Data Test Register: TR7

TR7 contains the information stored or read from the
data block during a TLB test operation. Before a TLB

Table 8.2. Meaning of a Pair of TR6 Protection Bits
'TR6 Protection Bit
(B),

TR6 Protection Bit#
(B#)

Meaning on
TLB Write Operation

Meaning on
TLB Lookup Operation

0
0
1
1

0
1
0
1

Undefined
Write 0 to TLB TAG Bit B
Write 1 to TLB TAG Bit B
Undefined

Miss any TLB TAG Bit B
Match TLB TAG Bit B if 0
Match TLB TAG Bit B if 1
Match any TLB TAG Bit B

135

Intel486TM OX MICROPROCESSOR

There are two TLB testing operations: write entries
into the TLB, and perform TLB lookups. One major
enhancement over TLB testing in the 386 Microprocessor is that paging need not be disabled while
executing testability writes or lookups.

Bits 9-7 will contain the LRU bits associated with
the accessed set. The state of the LRU bits is previous to their being updated for the current lookup.
If bit 4 in TR7 indicated that the lookup test resulted
in a miss the remaining bits in TR7 are undefined.

Note that any time one TLB set contains the same
linear address in more than one of its entries, looking up that linear address will not result in a hit.
Therefore a single linear address should not be written to one TLB set more than once.

Again it should be noted that a TLB testability lookup
operation affects the state of the LRU bits. The LRU
bits will be updated if a hit occurred. The entry which
was hit will become the most recently used.

8.3.3 TLB WRITE TEST

8.4 Tristate Output Test Mode

To perform a TLB write TR7 must be loaded followed by a TR6 load. The register operations must
be performed in this order since the TLB operation is
triggered by the write to TR6.

The Intel486 Microprocessor provides the ability to
float all its outputs and bidirectional pins. This includes all pins floated during bus hold as well as
pins which are never floated in normal operation of
the chip (HLDA, BREQ, FERR# and PCHK#).
When the Intel486 microprocessor is in the tri-state
output test mode external testing can be used to test
board connections.

TR7 is loaded with a 20-bit physical address and
values for PCD and PWT to be written to the data
portion of the TLB. In addition, bit 4 of TR7 must be
loaded to indicate whether to use TR7 bits 3-2 or the
internal LRU bits as the replacement pointer on the
TLB write operation. Note that the LRU bits in TR7
are not used in a write test.

The tri-state test mode is invoked by driving
FLUSH # low for 2 clocks before and 2 clocks after
RESET going low. The outputs are guaranteed to tristate no later than 10 clocks after RESET goes low
(see Figure 6.4). The Intel486 Microprocessor remains in the tristate test mode until the next RESET.

TR6 must be written to initiate the TLB write operation. Bit 0 in TR6 must be reset to zero to indicate a
TLB write. The 20-bit linear address and the seven
page protection bits must also be written in TR6 to
specify the tag portion of the TLB entry. Note that
the three least significant bits of the linear address
specify which of the eight sets in the data block will
be loaded with the physical address data. Thus only
17 of the linear address bits are stored in the tag
array.

8.5 Intel486TM Microprocessor
Boundary Scan (JTAG)
The Intel486 Microprocessor (50 MHz version only)
provides additional testability features compatible
with the IEEE Standard Test Access Port and
Boundary Scan Architecture (IEEE Std.1149.1). The
test logic provided allows for testing to insure that
components function correctly, that interconnections between various components are correct, and
that various components interact correctly on the
printed circuit board.

8.3.4 TLB LOOKUP TEST
To perform a TLB lookup it is only necessary to write
the proper tags and control information into TR6. Bit
o in TR6 must be set to 1 to indicate a TLB lookup.
TR6 must be loaded with a 20-bit linear address and
the seven protection bits. To force misses and
matches of the individual protection bits on TLB
lookups, set the seven protection bits as specified in
Table 8.2.

The boundary scan test logic consists of a boundary
scan register and support logic that are accessed
through a test access port (TAP). The TAP provides
a simple serial interface that makes it possible to
test all signal traces with only a few probes.

A TLB lookup operation is initiated by the write to
TR6. TR7 will indicate the result of the lookup operation following the write to TR6. The hit/miss indication can be found in TR7 bit 4 (see Table 8.5).

The TAP can be controlled via a bus master. The
bus master can be either automatic test equipment
or a component (PLD) that interfaces to the four-pin
test bus.

TR7 will contain the following information if bit 4 indicated that the lookup test resulted in a hit. Bits 2-3
will indicate in which set the match occurred. The 22
most significant bits in TR7 will contain the physical
address and page attributes contained in the entry.
136

int'et

Intel486TM OX MICROPROCESSOR

Each test data register is serially connected to TOI
and TOO, with TOI connected to the most significant
bit and TOO connected to the least significant bit of
the test data register. Data is shifted one stage (bit
position within the register) on each rising edge of
the test clock (TCK).

8.5.1 BOUNDARY SCAN ARCHITECTURE
The boundary scan test logic contains the following
elements:
-

Test access port (TAP), consisting of input pins
TMS, TCK, and TOI; and output pin TOO.

TAP controller, which interprets the inputs on the
test mode select (TMS) line and performs the
corresponding operation. The operations performed by the TAP include controlling the instruction and data registers within the component.

Instruction register (IR), which accepts instruction codes shifted into the test logic on the test
data input (TO I) pin. The instruction codes are
used to select the specific test operation to be
performed or the test data register to be accessed.

Test data registers: The Intel486 Microprocessor
contains three test data registers: Bypass register (BPR), Device Identification register (DID),
and Boundary Scan register (BSR).

In addition the Intel486 CPU contains a runbist register to support the RUNBIST boundary scan instruction.
8.5.2.1 Bypass Register
The Bypass Register is a one-bit shift register that
provides the minimal length path between TOI and
TOO. This path can be selected when no test operation is being performed by the component to allow
rapid movement of test data to and from other components on the board. While the bypass register is
selected, data is transferred from TOI to TOO without inversion.
8.5.2.2 Boundary Scan Register

The instruction and test data registers are separate
shift-register paths connected in parallel and have a
common serial data input and a common serial data
output connected to the TAP signals, TOI and TOO,
respectively.

The Boundary Scan Register is a single shift register
path containing the boundary scan cells that are
connected to all input and output pins of the Intel486
CPU. Figure 8.1 shows the logical structure of the
boundary scan register. While output cells determine
the value of the signal driven on the corresponding
pin, input cells only capture data; they do not affect
the normal operation of the device. Data is transferred without inversion from TOI to TOO through the
boundary scan register during scanning. The boundary scan register .can be operated by the EXTEST
and SAMPLE instructions. The boundary scan register order is described in Section 8.5.5.

8.5.2 DATA REGISTERS
The Intel486 CPU contains the two required test
data registers; bypass register and boundary scan
register. In addition, they also have a device identification register.

--------------------------------------------------.
I

BOUNDARY SCAN REGISTER

I
I
I

.--------------------I
I

I SYSTEM
BIDIRECTIONAL
I PIN

I
I
I
I

I
I
I
I
I

I
I
I

I
I

SYSTEM
LOGICi---,.,4
INPUT I

I
I

SYSTEM
LOGIC

I
I

I
I SYSTEM

TCK

3-STATE
I OUTPUT
I
I
I
I

I
I
I

I
I

._-------

-------_.

TDI

TOO

240440-88

Figure 8.1. Logical Structure of Boundary Scan Register

137

infel .

Intel486TM OX MICROPROCESSOR

tion register is four (4) bits wide. The most significant
bit is connected to TDI and the least significant bit is
connected to TDO. There are no parity bits associated with the Instruction register. Upon entering the
Capture-IR TAP controller state, the Instruction register is loaded with the default instruction "0001",
SAMPLE/PRELOAD. Instructions are shifted into
the instruction register on the rising edge of TCK
while the TAP controller is in the Shift-IR state.

8.5.2.3 Device Identification Register
The Device Identification Register contains the manufacturer's identification code, part number code,
and version code in the format shown in Figure 8.2.
Table 8.1 lists the codes corresponding to the Intel486 CPU.

8.5.2.4 Runblst Register
The Runbist Register is a one bit register used to
report the results of the Intel486 CPU BIST when it
is initiated by the RUNBIST instruction. This register
is loaded with a "1" prior to invoking the BIST and is
loaded with "0" upon successful completion.

8.5.3.1 Intel486 CPU Boundary Scan
Instruction Set
The Intel486 CPU supports all three mandatory
boundary scan instructions (BYPASS, SAMPLE/
PRELOAD, and EXTESn along with two optional instructions (IDCODE and RUNBIST). Table 8.2 lists
the Intel486 CPU boundary scan instruction codes.
The instructions listed as PRIVATE cause TDO to
become enabled in the Shift-DR state and cause
"0" to be shifted out of TDO on the rising edge of
TCK. Execution of the PRIVATE instructions will not
cause hazardous operation of the Intel486 CPU.

8.5.3 INSTRUCTION REGISTER
The Instruction Register (IR) allows instructions to
be serially shifted into the device. The instruction
selects the particular test to be performed, the test
data register to be accessed, or both. The instruc-

/31302928/2726252423222120191817161514131f 1110 9 8 7 6 5 4 3 2 1 / 0 /

VERSION

MANUFACTURER
IDENTITY

PART NUMBER

II
240440-89

Figure 8.2. Format of Device Identification Register

Table 8.1
Component Code

Version Code

Part Number Code

Manufacturer Identity

Intel486 CPU (Ax)

OOh

0410h

09h

Intel486 CPU (Bx)

OOh

0411h

09h

138

intel~

Intel486TM OX MICROPROCESSOR

Table 8.2
Instruction Code

Instruction Name

0000

EXTEST

0001

SAMPLE

0010

IDCODE

0011

PRIVATE

0100

PRIVATE

0101

PRIVATE

0110

PRIVATE

0111

PRIVATE

1000

RUNBIST

1001

PRIVATE

1010

PRIVATE

1011

PRIVATE

1100

PRIVATE

1101

PRIVATE

1110

PRIVATE

1111

BYPASS

EXTEST

IDCODE

BYPASS

The instruction code is "0000". The EXTEST instruction allows testing of circuitry external to the component package, typically board interconnects. It
does so by driving the values loaded
into the Intel486 CPU's boundary scan
register out on the output pins corresponding to each boundary scan cell
and capturing the values on Intel486
CPU input pins to be loaded into their
corresponding boundary scan register
locations. I/O pins are selected as input
or output, depending on the value loaded into their control setting locations in
the boundary scan register. Values
shifted into input latches in the boundary scan register are never used by the
internal logic of the Intel486 CPU.
NOTE:
After using the EXTEST instruction, the
Intel486 CPU must be reset before normal (non-boundary scan) use.

RUNBIST

SAMPlE/ The instruction code is "0001". The
PRELOAD SAMPLE/PRELOAD has two functions
that it performs. When the TAP controller is in the Capture-DR state, the SAMPLE/PRELOAD instruction allows a
"snap-shot" of the normal operation of

139

the component without interfering with
that normal operation. The instruction
causes boundary scan register cells associated with outputs to sample the value being driven by the Intel486 CPU. It
causes the cells associated with inputs
to sample the value being driven into
the Intel486 CPU. On both outputs and
inputs the sampling occurs on the rising
edge of TCK. When the TAP controller
is in the Update-DR state, the SAMPLE/PRELOAD instruction preloads
data to the device pins to be driven to
the board by executing the EXTEST instruction. Data is preloaded to the pins
from the boundary scan register on the
falling edge of TCK.
The instruction code is "0010". The 10CODE instruction selects the device
identification register to be connected
to TDI and TOO, allowing the device
identification code to be shifted out of
the device on TOO. Note that the device identification register is not altered
by data being shifted in on TDI.
The instruction code is "1111". The
BYPASS instruction selects the bypass
register to be connected to TDI or TOO,
effectively bypassing the test logic on
the Intel486 microprocessor by reducing the shift length of the device to one
bit. Note than an open circuit fault in the
board level test data path will cause the
bypass register to be selected following
an instruction scan cycle due to the
pull-up resistor on the TDI input. This
has been done to prevent any unwanted interference with the proper operation of the system logic.
The instruction code is "1000". The
RUNBIST instruction selects the one (1)
bit runbist register, loads a value of "1"
into the runbist register, and connects it
to TOO. It also initiates the built-in self
test (BIST) feature of the Intel486 CPU,
which is able to detect approximately
60% of the stuck-at faults on the Intel486 CPU. The Intel486 CPU AC/DC
Specifications for Vee and ClK must be
met and reset must have been asserted
at least once prior to executing the
RUNBIST boundary scan instruction.
After loading the RUNBIST instruction
code in the instruction register, the TAP
controller must be placed in the RunTest/Idle state. BIST begins on the first
rising edge of TCK after entering the
Run-Test/Idle state. The TAP con-

Intel486™ OX MICROPROCESSOR

troller must remain in the Run-Test/Idle
state until BIST is completed. It requires
1.2 million clock (ClK) cycles to complete BIST and report the result to the
runbist register. After completing the 1.2
million clock (ClK) cycles, the value in
the runbist register should be shifted
out on TOO during the Shift-DR state. A
value of "0" being shifted out on TOO
indicates BIST successfully completed.
A value of "1" indicates a failure occurred. After executing the RUNBIST instruction, the Intel486 CPU must be reset prior to normal operation.

The value of the test mode state (TMS) input signal
at a rising edge of TCK controls the sequence of the
state changes. The state diagram for the TAP controller is shown in Figure 8.3. Test designers must
consider the operation of the state machine in order
to design the correct sequence of values to drive on
TMS.
8.5.4.1 Test-Logic-Reset State
In this state, the test logic is disabled so that normal
operation of the device can continue unhindered.
This is achieved by initializing the instruction register
such that the IOCOOE instruction is loaded. No matter what the original state of the controller, the controller enters Test-logic-Reset state when the TMS
input is held high (1) for at least five rising edges of
TCK. The controller remains in this state while TMS
is high. The TAP controller is also forced to enter
this state at power-up.

8.5.4 TEST ACCESS PORT (TAP)
CONTROLLER
The TAP controller is a synchronous, finite state machine. It controls the sequence of operations of the
test logic. The TAP controller changes state only in
response to the following events:
1. a rising edge of TCK

8.5.4.2 Run-Test/ldle State
A controller state between scan operations. Once in
this state, the controller remains in this state as long

2. power-up.

240440-90

Figure 8.3. TAP Controller State Diagram

140

int:el.

Intel486TM OX MICROPROCESSOR

as TMS is held low. In devices supporting the
RUNBIST instruction, the BIST is performed during
this state and the result is reported in the runbist
register. For instruction not causing functions to execute during this state, no activity occurs in the test
logic. The instruction register and all test data registers retain their previous state. When TMS is high
and a rising edge is applied to TCK, the controller
moves to the Select-DR state.

nates the scanning process. If TMS is held low and a
rising edge is applied to TCK, the controller enters
the Pause-DR state.
The test data register selected by the current instruction retains its previous value during this state.
The instruction does not change in this state.

8.5.4.7 Pause-Dr State
The pause state allows the test controller to temporarily halt the shifting of data through the test data
register in the serial path between TDI and TOO. An
example of using this state could be to allow a tester
to reload its pin memory from disk during application
of a long test sequence.

8.5.4.3 Select-OR-Scan State
This is a temporary controller state. The test data
register selected by the current instruction retains its
previous state. If TMS is held low and a rising edge
is applied to TCK when in this state, the controller
moves into the Capture-DR state, and a scan sequence for the selected test data register is initiated.
If TMS is held high and a rising edge is applied to
TCK, the controller moves to the Select-IR-Scan
state.

The test data register selected by the current instruction retains its previous value during this state.
The instruction does not change in this state.
The controller remains in this state as long as TMS
is low. When TMS goes high and a rising edge is
applied to TCK, the controller moves to the Exit2-DR
state.

The instruction does not change in this state.

8.5.4.4 Capture-DR State
In this state, the boundary scan register captures
input pin data if the current instruction is EXTEST or
SAMPLE/PRELOAD. The other test data registers,
which do not have parallel input, are not changed.

8.5.4.8 Exit2-DR State
This is a temporary state. While in this state, if TMS
is held high, a rising edge applied to TCK causes the
controller to enter the Update-DR state, which terminates the scanning process. If TMS is held low and a
rising edge is applied to TCK, the controller enters
the Shift-DR state.

The instruction does not change in this state.
When the TAP controller is in this state and a rising
edge is applied to TCK, the controller enters the
Exit1-DR state if TMS is high or the Shift-DR state if
TMS is low.

The test data register selected by the current instruction retains its previous value during this state.
The instruction does not change in this state.

8.5.4.5 Shift-DR State
8.5.4.9 Update-DR State

In this controller state, the test data register connected between TDI and TOO as a result of the current instruction, shifts data one stage toward its serial output on each rising edge of TCK.

The boundary scan register is provided with a
latched parallel output to prevent changes at the
parallel output while data is shifted in response to
the EXTEST and SAMPLE/PRELOAD instructions.
When the TAP controller is in this state and the
boundary scan register is selected, data is latched
onto the parallel output of this register from the shiftregister path on the falling edge of TCK. The data
held at the latched parallel output does not change
other than in this state.

The instruction does not change in this state.
When the TAP controller is in this state and a rising
edge is applied to TCK, the controller enters the
Exit1-DR state if TMS is high or remains in the ShiftDR state if TMS is low.

All shift-register stages in test data register selected
by the current instruction retains its previous value
during this state. The instruction does not change in
this state.

8.5.4.6 Exit1-DR State
This is a temporary state. While in this state, if TMS
is held high, a rising edge applied to TCK causes the
controller to enter the Update-DR state, which termi-

141

Intel486™ OX MICROPROCESSOR

rising edge is applied to TCK, the controller enters
the Pause-IR state.

8.5.4.10 Select-IR-Scan State
This is a temporary controller state. The test data
register selected by the current instruction retains its
previous state. If TMS is held low and a rising edge
is applied to TCK when in this state, the controller
moves into the Capture-IR state, and a scan sequence for the instruction register is initiated. If TMS
is held high and a rising edge is applied to TCK, the
controller moves to the Test-Logic-Reset state.

The test data register selected by the current instruction retains its previous value during this state.
The instruction does not change in this state.
8.5.4.14 Pause-IR State
The pause state allows the test controller to temporarily halt the shifting of data through the instruction
register.

The instruction does not change in this state.

The test data register selected by the current instruction retains its previous value during this state.
The instruction does not change in this state.

8.5.4.11 Capture-IR State
In this controller state the shift register contained in
the instruction register loads the fixed value "0001"
on the rising edge of TCK.

The controller remains in this state as long as TMS
is low. When TMS goes high and a rising edge is
applied to TCK, the controller moves to the Exit2-IR
state.

The test data register selected by the current instruction retains it previous value during this state.
The instruction does not change in this state.

8.5.4.15 Exit2-IR State

When the controller is in this state and a rising edge
is applied to TCK, the controller enters the Exit1-IR
state if TMS is held high, or the Shift-IR state if TMS
is held low.

This is a temporary state. While in this state, if TMS
is held high, a rising edge applied to TCK causes the
controller to enter the Update-IR state, which terminates the scanning process. If TMS is held low and a
rising edge is applied to TCK, the controller enters
the Shift-IR state.

8.5.4.12 Shift-IR State
In this state the shift register contained in the instruction register is connected between TOI and
TOO and shifts data one stage towards its serial output on each rising edge of TCK.

The test data register selected by the current instruction retains its previous value during this state.
The instruction does not change in this state.

8.5.4.16 Update-IR State
The instruction shifted into the instruction register is
latched onto the parallel output from the shift-register path on the falling edge of TCK. Once the new
instruction has been latched, it becomes the current
instruction.

When the controller is in this state and a rising edge
is applied to TCK, the controller enters the Exit1-IR
state if TMS is held high, or remains in the Shift-IR
state if TMS is held low.

Test data registers selected by the current instruction retain the previous value.

8.5.4.13 Exlt1-IR State
This is a temporary state. While in this state, if TMS
is held high, a rising edge applied to TCK causes the
controller to enter the Update-IR state, which terminates the scanning process. If TMS is held low and a

8.5.5 BOUNDARY SCAN REGISTER CELL
The boundary scan register contains a cell for each
pin, as well as cells for control of 110 and tristate
pins.

142

Intel486™ OX MICROPROCESSOR

The following is the bit order of the Intel486 CPU
boundary scan register: (from left to right and top to
bottom).
TDI

All the 'CTL cells are control cells that are used to
select the direction of bidirectional pins or tristate
output pins. If "1" is loaded into the control cell
(*CTL), the associated pin(s) are tristated or selected as input. The following lists the control cells and
their corresponding pins.

~ WRCTL ABUSCTL BUSCTL MISCCTL
ADS# BLAST# PLOCK# LOCK# PCHK#
BRDY# BOFF# BS16# BS8# RDY# KEN#
HOLD AHOLD CLK HLDA WR# BREQ BEO#
BE1 # BE2# BE3# MIO# DC# PWT PCD
EADS# A20M# RESET FLUSH# INTR NMI
FERR# IGNNE# D31 D30 D29 D28 D27 D26
D25 D24 DP3 D23 D22 D21 D20 D19 D18 D17
D16 DP2 D15 D14 D13 D12 D11 D10 D9 D8
DP1 D7 D6 D5 D4 D3 D2 D1 DO DPO A31 A30
A29 A28 A27 A26 A25 A24 A23 A22 A21 A20
A19 A18 A17 A16 A15 A14 A13 A12 A11 A10
A9 A8 A7 A6 RESERVED A5 A4 A3

1. WRCTL controls the D31-0 and DP3-0 pins.
2. ABUSCTL controls the A31-A2 pins.
3. BUSCTL controls the ADS#, BLAST#,
PLOCK#, LOCK#, WR#, BEO#, BE1 #, BE2#,
BE3#, MIO#, DC#, PWT, and PCD pins.
4. MISCCTL controls the PCHK#, HLDA, BREQ,
and FERR # pins.

8.5.6 TAP CONTROLLER INITIALIZATION

A2~TDO

The TAP controller is automatically initialized when a
device is powered up. In addifion, the TAP controller
can be initialized by applying a high signal level on
the TMS input for five TCK periods.

"RESERVED" corresponds to no connect "NC" signals on the Intel486 CPU.

8.5.7 BOUNDARY SCAN DESCRIPTION
LANGUAGE (BSDL)

Available through Intel.

143

Intel486™ OX MICROPROCESSOR

9.0

on-chip registers, an instruction execution breakpoint can be placed in ROM code or in code shared
by several tasks, neither of which can be supported
by the INTS breakpoint opcode.

DEBUGGING SUPPORT

The Intel486 Microprocessor provides several features which simplify the debugging process. The
three categories of on-chip debugging aids are:

The Intel486 Microprocessor contains six Debug
Registers, providing the ability to specify up to four
distinct breakpoints addresses, breakpoint control
options, and read breakpoint status. Initially after reset, breakpoints are in the disabled state. Therefore,
no breakpoints will occur unless the debug registers
are programmed. Breakpoints set up in the Debug
Registers are autovectored to exception number 1.

1) the code execution breakpoint opcode (OCCH),
2) the single-step capability provided by the TF bit
in the flag register, and
S) the code and data breakpoint capability provided
by the Debug Registers DRO-S, DR6, and DR?

9.1 Breakpoint Instruction
9.3.1 LINEAR ADDRESS BREAKPOINT
REGISTERS (DRO-DR3)

A single-byte-opcode breakpoint instruction is available for use by software debuggers. The breakpoint
opcode is OCCH, and generates an exception Strap
when executed. In typical use, a debugger program
can "plant" the breakpoint instruction at all desired
code execution breakpoints. The single-byte breakpoint opcode is an alias for the two-byte general
software interrupt instruction, INT n, where n = S.
The only difference between INT S (OCCh) and INT n
is that INT S is never IOPL-sensitive but INT n is
IOPL-sensitive in Protected Mode and Virtual 8086
Mode.

Up to four breakpoint addresses can be specified by
writing into Debug Registers ORO-DRS, shown in
Figure 9.1. The breakpoint addresses specified are
S2-bit linear addresses. Intel486 Microprocessor
hardware continuously compares the linear breakpoint addresses in ORO-DRS with the linear addresses generated by executing software (a linear
address is the result of computing the effective address and adding the S2-bit segment base address).
Note that if paging is not enabled the linear address
equals the physical address. If paging is enabled,
the linear address is translated to a physical S2-bit
address by the on-chip paging unit. Regardless of
whether paging is enabled or not, however, the
breakpoint registers hold linear addresses.

9.2 Single-Step Trap
If the single-step flag (TF, bit 8) in the EFLAG register is found to be set at the end of an instruction, a
single-step exception occurs. The single-step exception is auto vectored to exception number 1. Precisely, exception 1 occurs as a trap after the insJruction following the instruction which set TF. In typical
practice, a debugger sets the TF bit of a flag register
image on the debugger's stack. It then typically
transfers control to the user program and loads the
flag image with a signal instruction, the IRET instruction. The single-step trap occurs after executing one
instruction of the user program.

9.3.2 DEBUG CONTROL REGISTER (DR7)
A Debug Control Register, DR? shown in Figure 9.1,
allows several debug control functions such as enabling the breakpoints and setting up other control
options for the breakpoints. The fields within the Debug Control Register, DR7, are as follows:
LENi (breakpoint length specification bits)

Since the exception 1 occurs as a trap (that is, it
occurs after the instruction has already executed),
the CS:EIP pushed onto the debugger's stack pOints
to the next unexecuted instruction of the program
being debugged. An exception 1 handler, merely by
ending with an IRET instruction, can therefore efficiently support single-stepping through a user program.

A 2-bit LEN field exists for each of the four breakpoints. LEN specifies the length of the associated
breakpoint field. The choices for data breakpoints
are: 1 byte, 2 bytes, and 4 bytes. Instruction execution breakpoints must have a length of 1 (LENi =
00). Encoding of the LENi field is as follows:

9.3 Debug Registers
The Debug Registers are an advanced debugging
feature of the Intel486 Microprocessor. They allow
data access breakpoints as well as code execution
breakpoints. Since the breakpoints are indicated by
144

Intel486TM OX MICROPROCESSOR

16 15

31
BREAKPOINT 0 LINEAR ADDRESS

DRO

BREAKPOINT 1 LINEAR ADDRESS

DR1

BREAKPOINT 2 LINEAR ADDRESS

DR2

BREAKPOINT 3 LINEAR ADDRESS

DR3

Intel reserved. Do not define.

DR4

Intel reserved. Do not define.

DR5
DR6
DR7

16 15

NOTE:
Qi indicates Intel reserved: Do not define; SEE SECTION 2.3.10
Figure 9.1. Debug Registers

2 bytes

All 32-bits used to
specify a single-byte
breakpoint field.

I" I

A1-A31 used to specify
a two-byte, wordaligned breakpoint field.
AO in Breakpoint
Address Register is not
used.

DR2=00000005H;

I~ :~ ~:

LEN2 = 01B

~----r-----+-----~----~

00000008H

-- bkpt fld2 ~ 00000004H

Undefineddo not use
this encoding
4 bytes

IbkPtfld21

L -_ _ _ _

A2-A31 used to specify
a four-byte, dwordaligned breakpoint field.
AO and Ai in
Breakpoint Address
Register are not used.

____

DR2=00000005H;
31

____

00000008H

00000004H

r---~----~----~-----1

-The LENi field controls the size of breakpoint field i
by controlling whether all low-order linear address
bits in the breakpoint address register are used to
detect the breakpoint event. Therefore, all breakpoint fields are aligned; 2-byte breakpoint fields begin on Word boundaries, and 4-byte breakpoint
fields begin on Dword boundaries.

L -_ _

bkptfld2

____

OOOOOOOOH

LEN2 = 11B

1 byte

LEN2 = OOB

DR2 = 00000005H;

Usage of Least
Significant Bits in
Breakpoint Address
Register i, (i = 0 - 3)

Breakpoint
Field Width

LENi
Encoding

____

_ _ _ _- J OOOOOOOOH

RWi (memory access qualifier bits)
A 2-bit RW field exists for each of the four breakpoints. The 2-bit RW field specifies the type of usage
which must occur in order to activate the associated
breakpoint.

The following is an example of various size breakpoint fields. Assume the breakpoint linear address in
DR2 is 00000005H. In that situation, the following
illustration indicates the region of the breakpoint
field for lengths of 1, 2, or 4 bytes.
145

int:et

Intel486™ OX MICROPROCESSOR

RW
Encoding

Usage
Causing Breakpoint

00
01
10
11

Instruction execution only
Data writes only
Undefined-do not use this encoding
Data reads and writes only

bug Register resources when required. The GO bit,
when set, causes an exception 1 fault if an instruction attempts to read or write any Debug Register.
The GD bit is then automatically cleared when the
exception 1 handler is invoked, allowing the exception 1 handler free access to the debug registers.
GE and LE (Exact data breakpoint match, global and
local)

RW encoding 00 is used to set up an instruction
execution breakpoint. RW encodings 01 or 11 are
used to set up write-only or read/write data breakpoints.

The breakpoint mechanism of the Intel486 Microprocessor differs from that of the 386. The Intel486
Microprocessor always does exact data breakpoint
matching, regardless of GE/LE bit settings. Any data
breakpoint trap will be reported exactly after completion of the instruction that caused the operand transfer. Exact reporting is provided by forcing the Intel486 Microprocessor execution unit to wait for
completion of data operand transfers before beginning execution of the next instruction.

Note that instruction execution breakpoints are
taken as faults (Le., before the instruction executes), but data breakpoints are taken as traps
(Le., after the data transfer takes place).
Using LENi and RWi to Set Data Breakpoint i

When the Intel486 Microprocessor performs a task
switch, the LE bit is cleared. Thus, the LE bit supports fast task switching out of tasks, that have
enabled the exact data breakpoint match for their
task-local breakpoints. The LE bit is cleared by the
processor during a task switch, to avoid having exact data breakpoint match enabled in the new task.
Note that exact data breakpoint match must be reenabled under software control.

A data breakpoint can be set up by writing the linear
address into DRi (i = 0-3). For data breakpoints,
RWi can = 01 (write-only) or 11 (write/read). LEN
can = 00,01, or 11.
If a data access entirely or partly falls within the data
breakpoint field, the data breakpoint condition has
occurred, and if the breakpoint is enabled, an exception 1 trap will occur.
Using LENi and RWi to Set Instruction Execution
Breakpoint i

The Intel486 Microprocessor GE bit is unaffected
during a task switch. The GE bit supports exact data
breakpoint match that is to remain enabled during all
tasks executing in the system.

An instruction execution breakpoint can be set up by
writing address of the beginning of the instruction
(including prefixes if any) into DRi (i = 0-3). RWi
must = 00 and LEN must = 00 for instruction execution breakpoints.

Note that instruction execution breakpoints are always reported exactly.
Gi and Li (breakpoint enable, global and local)

If the instruction beginning at the breakpoint address
is about to be executed, the instruction execution
breakpoint condition has occurred, and if the breakpoint is enabled, an exception 1 fault will occur before the instruction is executed.

If either Gi or Li is set then the associated breakpoint
(as defined by the linear address in DRi, the length
in LENi and the usage criteria in RWi) is enabled. If
either Gi or Li is set, and thelntel486 Microprocessor detects the ith breakpoint condition, then the exception 1 handler is invoked.

Note that an instruction execution breakpoint address must be equal to the beginning byte address
of an instruction (including prefixes) in order for the
instruction execution breakpoint to occur.

When the Intel486 Microprocessor performs a task
switch to a new Task State Segment (TSS), all Li
bits are cleared. Thus, the Li bits support fast task
switching out of tasks that use some task-local
breakpoint registers. The Li bits are cleared by the
processor during a task switch, to avoid spurious exceptions in the new task. Note that the breakpoints
must be re-enabled under software control.

GD (Global Debug Register access detect)
The Debug Registers can only be accessed in Real
Mode or at privilege level 0 in Protected Mode. The
GO bit, when set, provides extra protection against
any Debug Register access even in Real Mode or at
privilege level 0 in Protected Mode. This additional
protection feature is provided to guarantee that a
software debugger can have full control over the De-

All Intel486 Microprocessor Gi bits are unaffected
during a task switch. The Gi bits support breakpoints
that are active in all tasks executing in the system.
146

intel~

Intel486™ OX MICROPROCESSOR

IMPORTANT NOTE: A flag Bi is set whenever the
hardware detects a match condition on enabled
breakpoint i. Whenever a match is detected on at
least one enabled breakpoint i, the hardware immediately sets all Bi bits corresponding to breakpoint
conditions matching at that instant, whether enabled
or not. Therefore, the exception 1 handler may see
that multiple Bi bits are set, but only set Bi bits corresponding to enabled breakpoints (Li or Gi set) are
true indications of why the exception 1 handler was
invoked.

9.3.3 DEBUG STATUS REGISTER (DRS)
A Debug Status Register, DR6 shown in Figure 9.1,
allows the exception 1 handler to easily determine
why it was invoked. Note the exception 1 handler
can be invoked as a result of one of several events:
1) DRO Breakpoint fault/trap.
2) DR1 Breakpoint fault/trap.
3) DR2 Breakpoint fault/trap.
4) DR3 Breakpoint fault/trap.
5) Single-step (TF) trap.
6) Task switch trap.
7) Fault due to attempted debug register access
when GD=1.

BD (debug fault due to attempted register access
when GD bit set)
This bit is set if the exception 1 handler was invoked
due to an instruction attempting to read or write to
the debug registers when GD bit was set. If such an
event occurs, then the GD bit is automatically
cleared when the exception 1 handler is invoked,
allowing handler access to the debug registers.

The Debug Status Register contains single-bit flags
for each of the possible events invoking exception 1.
Note below that some of these events are faults (exception taken before the instruction is executed),
while other events are traps (exception taken after
the debug events occurred).

BS (debug trap due to single-step)

The flags in DR6 are set by the hardware but never
cleared by hardware. Exception 1 handler software
should clear DR6 before returning to the user program to avoid future confusion in identifying the
source of exception 1.

This bit is set if the exception 1 handler was invoked
due to the TF bit in the flag register being set (for
single-stepping).

The fields within the Debug Status Register, DR6,
are as follows:

This bit is set if the exception 1 handler was invoked
due to a task switch occurring to a task having a
Intel486 Microprocessor TSS with the T bit set. Note
the task switch into the new task occurs normally;
but before the first instruction of the task is executed, the exception 1 handler is invoked. With respect
to the task switch operation, the operation is considered to be a trap.

BT (debug trap due to task switch)

Bi (debug fault/trap due to breakpoint 0-3)
Four breakpoint indicator flags, BO-B3, correspond
one-to-one with the breakpoint registers in DRODR3. A flag Bi is set when the condition described
by DRi, LENi, and RWi occurs.

9.3.4 USE OF RESUME FLAG (RF) IN FLAG

If Gi or Li is set, and if the ith breakpoint is detected,
the processor will invoke the exception 1 handler.
The exception is handled as a fault if an instruction
execution breakpoint occurred, or as a trap if a data
breakpoint occurred.

REGISTER
The Resume Flag (RF) in the flag word can suppress an instruction execution breakpoint when the
exception 1 handler returns to a user program at a
user address which is also an instruction execution
breakpoint.

147

inteL

Intel486™ OX MICROPROCESSOR

10.0 INSTRUCTION SET SUMMARY

2. Accesses are aligned. Add three clocks to each
misaligned access.

This section describes the Intel486 Microprocessor
instruction set. Tables 10.1 through 10.3 list all instructions along with instruction encoding diagrams
and clock counts. Further details of the instruction
encoding are then provided in Section 10.2, which
completely describes the encoding structure and the
definition of all fields occurring within the Intel486
Microprocessor instructions.

3. Cache fills complete before subsequent accesses to the same line. If a read misses the cache
during a cache fill due to a previous read or prefetch, the read must wait for the cache fill to
complete. If a read or write accesses a cache
line still being filled, it must wait for the fill to
complete.
4. If an effective address is calculated, the base
register is not the destination register of the preceding instruction. If the base register is the
destination register of the preceding instruction
add 1 to the clock counts shown. Back-to-back
PUSH and POP instructions are not affected by
this rule.

10.1 Intel486TM Microprocessor
Instruction Encoding and Clock
Count Summary
To calculate elapsed time for an instruction, multiply
the instruction clock count, as listed in Tables 10.1
through 10.3 by the processor clock period (e.g.,
40 ns for a 25 MHz Intel486 Microprocessor).

5. An effective address calculation uses one base
register and does not use an index register.
However, if the effective address calculation
uses an index register, 1 clock may be added to
the clock count shown.

For more detailed information on the encodings of
instructions, refer to Section 10.2 Instruction Encodings. Section 10.2 explains the general structure of
instruction encodings, and defines exactly the encodings of all fields contained within the instruction.

6. The target of a jump is in the cache. If not, add r
clocks for accessing the destination instruction
of a jump. If the destination instruction is not
completely contained in the first dword read,
add a maximum of 3b clocks. If the destination
instruction is not completely contained in the
first 16 byte burst, add a maximum of another
r + 3b clocks.

INSTRUCTION CLOCK COUNT ASSUMPTIONS
The Intel486 Microprocessor instruction clock count
tables give clock counts assuming data and instruction accesses hit in the cache. A separate penalty
column defines clocks to add if a data access misses in the cache. The combined instruction and data
cache hit rate is over 90%.

7. If no write buffer delay, w clocks are added only
in the case in which all write buffers are full.
Typically, this case rarely occurs.
8. Displacement and immediate not used together.
If displacement and immediate used together, 1
clock may be added to the clock count shown.

A cache miss will force the Intel486 Microprocessor
to run an external bus cycle. The Intel486 Microprocessor 32-bit burst bus is defined as r-b-w.

9. No invalidate cycles. Add a delay of 1 clock for
each invalidate cycle if the invalidate cycle contends for the internal cache/external bus when
the Intel486 CPU needs to use it.

Where:
r = The number of clocks in the first cycle of a
burst read or the number of clocks per data
cycle in a non-burst read.

10. Page translation hits in TLB. A TLB miss will add
13, 21 or 28 clocks to the instruction depending
on whether the Accessed and/or Dirty bit in neither, one or both of the page entries needs to
be set in memory. This assumes that neither
page entry is in the data cache and a page fault
does not occur on the address translation.

b = The number of clocks for the second and subsequent cycles in a burst read.
w = The number of clocks for a write.
The fastest bus the Intel486 microprocessor can
support is 2 -1 - 2 assuming 0 wait states. The
clock counts in the cache miss penalty column assume a 2 -1 - 2 bus. For slower busses add r - 2
clocks to the cache miss penalty for the first dword
accessed. Other factors also affect instruction clock
counts.

11. No exceptions are detected during instruction
execution. Refer to Interrupt Clock Counts Table for extra clocks if an interrupt is detected.
12. Instructions that read multiple consecutive data
items (i.e. task switch, paPA, etc.) and miss the
cache are assumed to start the first access on a
16-byte boundary. If not, an extra cache line fill
may be necessary which may add up to (r + 3b)
clocks to the cache miss penalty.

Instruction Clock Count Assumptions
1. The external bus is available for reads or writes
at all times. Else add clocks to reads until the
bus is available.
148

int:et

Intel486TM OX MICROPROCESSOR

Table 10.1. Intel486™ Microprocessor Integer Clock Count Summary
INSTRUCTION

FORMAT

Cache Hit

Penalty II
eacheMlss

Notes

INTEGER OPERATIONS
MOV = Move:
reg1 to reg2

1000100W

reg1 reg21

reg2 to reg1

1000101w

reg1 reg21

memory to reg

1000101w

mod reg

rim 1

reg to memory

1000100w

mod reg

r/ml

Immediate to reg

1100011 w

11000

reg immediate data

1011w reg

immediate data

1
1

I displacement

Immediate to Memory

1100011 w

mod 000

Memory to Accumulator

1010000w

lull displacement

Accumulator to Memory

1010001w

full displacement

r m immediate

1
2

MOVSX/MOVZX = Move with SlgnlZero Extension
reg2 to reg1
memory to reg

Instruction

0
1

MOVZX
MOVSX

I 00001111
I 00001111

1 1011011 w 1 mod reg

I 11111111

111

1 1011011 w 111

reg1 reg21

rim 1

3
3

PUSH = Push
reg
or
memory
immediate
PUSHA = Push All

101010

110

reg 1

4
1

reg 1

I 11111111 1mod 110 r/ml
I 011010s0 I immediate data
1 01100000 1

1
11

POP = Pop
reg
or
memory
POPA = Pop All

1 10001111 111

000

reg 1

4
1

10001111 1mod 000

rim 1

7/15

16/32

101011

I
I

reg 1

01100001 1

XCHG = Exchange
reg1 with reg2

Accumulator with reg

110010

Memory with reg
NOP = No Operation
LEA = Load EA to Register
no index register
with index register

I
I
I

1000011w 111

reg1 reg21

reg 1

1000011w 1mod reg

r/ml

10010000 1
10001101 1mod reg

r/ml
1
2

149

int:et

Intel486TM OX MICROPROCESSOR

Table 10.1. Intel486TM Microprocessor Integer Clock Count Summary (Continued)
INSTRUCTION

FORMAT

Cache Hit

Penalty II
Cache Miss

Notes

INTEGER OPERATIONS (Continued)
Instruction

TIT

ADD ~ Add
ADC ~ Add with Carry
AND ~ Logical AND
OR ~ Logical OR
SUB ~ Subtract
SBB ~ Subtract with Borrow
XOR ~ Logical Exclusive OR

000
010
100
001
101
011
110

reglto reg2
reg2to regl
memory to register

I
I
I
I
I

OOTTTOOw 111

regl reg21

OOTTTOlw 111

regl reg21

OOTTTOlw I mod reg
OOTTTOOw I mod reg
100000sw 111

immediate to accumulator

I o OTTT lOw

immediate to memory

NOT
NEG

I
~
~

Logical Complement
Negate

010
011

I
I

TTT reg I

regj

lllllllw

TIT

memory
CMP

l l l l l l l w 111

Instruction

reg

6/2

U/L

6/2

U/L

6/2

U/L

6/2

U/L

1
1

100000sw ImodTTT rIm immediate data

101 TTT

memory

immediate data

000
001

reg immediate register

1
2

TIT

Instruction
INC = Increment
DEC ~ Decrement
reg

TTT

I
rim I
I
rim

mod TTT r/mj

1111011 w 111
1111011 w

TTT

mod TTT

I
rim I
reg

Compare

rogl with rog2

I
I

0011100w

regl reg21

0011101 w

regl reg21

memory with register

0011100w

mod reg

r/mj

r/ml

reg2 with reg1

1
1

0011101w

mod reg

immediate with register

100000sw

immediate with ace.

0011110w

immediate data

immediate with memory

100000sw

mod 111 rIm immediate data

1000010w

regl reg21

mod reg

r/ml

reg immediate data

TEST

111

reg

I immediate data

1
2

Logical Compare

regl and reg2

memory and register

1000010w

immediate and register

1111011 w

immediate and acc.

1010100w

immediate data

immediate and memory

1111011 w

mod 000 rim immediate data

000

150

Intel486TM OX MICROPROCESSOR

Table 10.1. Intel486TM Microprocessor Integer Clock Count Summary (Continued)
INSTRUCTION

Cache Hit

FORMAT

Penalty If
Cache Miss

Notes

INTEGER OPERATIONS (Continued)

= Multiply (unsigned)

MUL

acc. with register

1111011 w 111

100

reg 1

13/18
13/26
13/42

Multiplier-Byte
Word

Dword
ace. with memory

1111011 w 1 mod 100

rIm 1
13/18
13/26

Multiplier-Byte
Word

13/42

Dword
IMUL

1
1
1

MN/MX,3
MN/MX,3
MN/MX,3

= Integer Multiply (signed)

acc. with register

1111011 w 111

101

reg 1

13/18

Mulliplier-Byte

Dword
acc. with memory

1 1111011 w 1 mod 101

Dword

00001111

1 10101111 111

1 00001111 1 10101111 1 mod

reg

01101 Os 1 111

13/18
13/26
13/42

MN/MX,3

01101 Os 1 1mod

reg

rIm

1
1
1

1111011 w 111

110

2
2
2

24
40

Dword
1111011 w 1 mod 110

r/ml

Divisor-Byte

Word

24
40

Dword

= Integer Divide (signed)
1111011 w 111

111

MN/MX,3
MN/MX,3

13/18

Word

MN/MX,3
MN/MX,3

MN/MX,3

13/26
13/42

reg 1

Divisor-Byte

MN/MX,3

I immediate data

Multiplier-Byte
Word
Dword
DIV = Divide (unsigned)

acc. by register

MN/MX,3
MN/MX,3

13/18
13/26
13/42

Dword

ace. by memory

MN/MX,3

reg1 reg21 immediate data

Multiplier-Byte
Word

acc. by register

13/42

13/18
13/26
13/42

Dword

memo with imm. to reg.

MN/MX,3
MN/MX,3

r/ml

Multiplier-Byte
Word

reg1 with imm. to reg2

13/18
13/26

reg1 reg21

Multiplier-Byte
Word
Dword

MN/MX,3

r/ml

Multiplier-Byte
Word

reg 1 with reg2

MN/MX,3
MN/MX,3

13/26
13/42

Word

IDIV

MN/MX,3
MN/MX,3
MN/MX,3

reg 1

Divisor-Byte

Word
Dword

27
43

151

MN/MX,3
MN/MX,3
MN/MX,3

Intel486™ OX MICROPROCESSOR

Table 10.1. Intel486TM Microprocessor Integer Clock Count Summary (Continued)
INSTRUCTION

FORMAT

Cache Hit

Penalty If
Cache Miss

Notes

INTEGER OPERATIONS (Continued)

acc. by memory

I I I I 0 I I w I mod I I I rim

Divisor-Byte
Word
Dword
CBW/CWO

CWO/COQ

20
28
44

Convert Byte to Word!
Convert Word to Dword
Convert Word to Oword!
Convert Dword to
Quad Word

1100110001

100 I 100 I

Instruction

TTT

ROL ~ Rotate Left
ROR ~ Rotate Right
RCL ~ Rotate through Carry Left
RCR ~ Rotate through Carry Right
SHL/SAL ~ Shift Logicall Arithmetic Left
SHR ~ Shift Logical Right
SAR ~ Shift Arithmetic Right

000
001
010
Oil
100
101
III

Not Through Carry (ROL, ROR, SAL, SAR, SHL, and SHR)

reg by I

1101000w

memory by 1

1101000w

mod TTT r/ml

reg by CL

I I 01 00 I w

memorybyCL

I I 01 001 w

mod TTT

TTT

reg

3
4

I
rim I

I
I

reg by immediate count

I I OOOOOw

I I

reg immediate 8-bit data

mem by immediate count

1100000w

mod TTT rIm immediate a-bit data

TTT

Through Carry (RCL and RCR)
reg by I

1 1101000w

I I

memory by I

1 1101000w

mod TTT

reg byCL

I I

memorybyCL

1 I I 01 001 w

mod TTT

reg by immediate count

mem by immediate count

1 I 100000w

I 101001 w

I 100000w

Instruction

TTT

SHLD ~ Shift Left Double
SHRD ~ Shift Right Double

100
101

TTT

mod TTT

I
rim I
I
rim I
reg

8/30

MN/MX,4

9/31

MN/MX,5

8/30

MN/MX,4

9/31

MN/MX,5

I
rim Iimmediate 8-bit data

reg immediate 8-bit data

I
I

1 00001111 I I OTTTI 00

11 I

1 0000 I I I I

I mod

reg

00001111 I I OTTTI 01

II I

reg2 regll

00001111 110TTT10l

I mod reg

00001111 I I 100 I

BSWAP
XAOO

Byte Swap

I
I
I

110TTT100

reg

reg2 reg 1 imm 8-bit data

rim imm 8-bit data

r/ml

I
I

memory, reg
CMPXCHG

00001111

I I 100000w

00001111 I I 100000w

III

reg2 regl

I mod reg

1 00001111 11011000W

II I

memory, reg

I mod

0000 I I I I

11011000w

152

reg2 regl
reg

r/ml

Compare and Exchange

regl, reg2

3
4

Exchange and Add

regl, reg2

memory by CL

reg

memory by immediate
register by CL

reg

rim

I
I

3
4

6/2

U/L

6
7110

Intel486TM OX MICROPROCESSOR

Table 10.1. Intel486TM Microprocessor Integer Clock Count Summary (Continued)
INSTRUCTION

Cache Hit

FORMAT

Penalty II
Cache Miss

Notes

CONTROL TRANSFER (within segment)
NOTE: Times are jump takenlnot taken

Jece = Jump on eec

I
I

8-bit displacement
full displacement

0111 tttn

8-bitdisp_

3/1

TINT,23

00001111

1000tttn

I full displacement

3/1

TINT,23

00001111 I

1001tttn

111

000

reg I

4/3

00001111 I

1001tttn

I mod 000

r/ml

3/4

NOTE: Times are jump takenlnot taken
SETcccc

Set Byte on ecce (TImes are ecce true/false)

I
I

reg

memory
Mnemonic

Condition

ttln

Overflow
No Overflow
Below/Not Above or Equal
Not Belowl Above or Equal
Equal/Zero
Not Equal/Not Zero
Below or Equal/Not Above
Not Below or Equal/ Above
Sign
Not Sign
ParitylParity Even
Not Parity IParity Odd
Less ThanlNot Greater or Equal
Not Less ThanlGreater or Equal
Less Than or Equal/Greater Than
Not Less Than or Equal/Greater Than

0000
0001
0010
0011
0100
0101
0110
0111
1000
1001
1010
1011
1100
1101
1110
1111

ecce
0
NO
B/NAE
NB/AE
E/Z
NE/NZ
BE/NA
NBE/A
S
NS
PIPE
NP/PO
LlNGE
NLIGE
LEING
NLE/G
~

LOOP

LOOP CX Times

I
I
I
I
I

11100010 I

8-bitdisp.

7/6

LlNL,23

11100001 I

8-bitdisp.

9/6

L/NL,23

11100000 I

8-bit disp.

9/6

L/NL,23

11100011 I

8-bit disp.

8/5

T/NT,23

11100011 I
(Address Size Prefix Differentiates JCXZ for JECXZ)

8-bitdisp.

8/5

T/NT,23

8-bitdisp.

7,23

LOOPZ/LOOPE

LOOPNZ/LOOPNE

JCXZ

JECXZ

JMP

Loop with
ZerolEqual
~

Loop while
Not Zero

Jump on CX Zero

Jump on ECX Zero

Unconditional Jump (within segment)

Short
Direct
Register Indirect
Memory Indirect
CALL

11101011 I
11101001

I full displacement

1 1 111 11 1 111

100

1 1 111111 I mod 100

reg

r/ml

7,23

Call (within segment)

Direct

RET

I
I
I
I
I
I
I

11101000

I full displacement

11 11 111 1 111

010

11111111 Imod010

7,23

reg I

7,23

r/ml

Return from CALL (within segment)

Adding Immediate to SP

I
I

11000011 I
11000010 I

16-bit disp.

I
153

in1'et

Intel486TM OX MICROPROCESSOR

Table

10.1. Intel486TM

INSTRUCTION

Microprocessor Integer Clock Count Summary

FORMAT

(Continued)

Cache Hit

Penalty II
C8cheMlss

Notes

CONTROL TRANSFER (within segment) (Continued)
ENTER

Enter Procedure

11001000 116-blt disp., B-bH level

Level ~ 0
Level ~ 1
Level(L) > 1
LEAVE = Leave Procedure

11001001

14
17
17+3L

sreg3 reg

3/9

0/3

RVlP, 9

rIm

3/9

2/5

RV/P, 9

2/5

RVlP,9

MULTIPLE-SEGMENT INSTRUCTIONS
MOV

Move

reg. to segment reg.
memory to segment reg.

I
I

10001110 111
10001110

mod sreg3

I
I
I
rIm I

segment reg. to reg.

110001100 111' sreg3 reg

segment reg. to memory

110001100

PUSH

mod sreg3

3
3

Push

segment reg.
(ES, CS, SS, or OS)

1000sreg21101

segment reg. (FS or GS)

100001111110 sreg30001

POP

Pop

segment reg.
(ES, SS, or OS)

10008reg2111

segment reg. (FS or GS)

1 00001111

Load Pointer to OS

LDS

LES

LFS

LGS

LSS

CALL

3/9

10 Sreg30011

I
rIm I
I
I
I
rIm

11000101

mod reg

Load Pointer to ES

11000100

mod reg

Load Pointer to FS

00001111

10110100

mod reg

Load POinter to GS

00001111

10110101

mod reg

Load Pointer to SS

00001111

10110010

mod reg

Call

Direct intersegment

10011010

to same level
thru Gate to same level
to inner level, no parameters
to inner level, x parameter (d) words
toTSS
thru Task Gate
Indirect intersegment

11111111

unsigned full offset, selector

mod 011

rIm

to same level
thru Gate to same level
to inner level. no parameters
to inner level, x parameter (d) words
toTSS
thru Task Gate
RET ~ Return lrom CALL
Intersegmen!

11001011

to same level

to outer level
Intersegment adding
imm.toSP

11001010

16-bHdisp.

I
rIm I
rIm I

rIm

3/9

2/5

RVlP,9

6/12

7/10

RVlP,9

6/12

7/10

RVlP, 9

6112

7/10

RVlP,9

6/12

7/10

RVlP, 9

6/12

7/10

RVlP, 9

R,7,22

20
35
69
77+4X
37+TS
38+TS

3
6
17
17+n
3
3

P,9
P,9
P,9
P,11,9
P,10,9
P,10,9

R,7

20
35
69
77+4X
37+TS
38+TS

10
13
24
24+n
10
10

P,9
P.9
P,9
P,II,9
P,10,9
P,10,9

.13

R,7

17
35

9
12

P.9
P,9

14
18
36

8
9
12

R,7
P,9
P,9

to same level
to outer level

154

Intel486TM OX MICROPROCESSOR

Table 10.1. Intel486TM Microprocessor Integer Clock Count Summary (Continued)
INSTRUCTION

Cache Hit

FORMAT

Penalty II
Cache Miss

Notes

MULTIPLE·SEGMENT INSTRUCTIONS (Continued)
~

JMP

Unconditional Jump

Direct intersegment

1 11101010 1unsigned full oilset, selector

to same level
thru Call Gate to same level

thruTSS
thru Task Gate

Indirect intersegment

1 11111111 1mod 101

rIm 1

to same level
thru Call Gate to same level
thruTSS
thru Task Gate

R, 7, 22

19
32
42+TS
43+TS

3
6
3
3

P,9
P,9
P, 10, 9
P, 10, 9

R,7,9

18
31
41+TS
42+TS

10
13
10
10

P,9
P,9
P,10,9
P, 10, 9

BIT MANIPULATION
BT

Test bit

I
I

1 00001111

memory. immediate

regl, reg2

1 00001111 110100011

memory. reg

I
Instruction

BTS
BTR
BTC

~
~
~

00001111

memory, immediate

regl, rog2

100001111

memory. reg

1 00001111

10100011

111

reg2 regll

mod reg

rIm

3
8

00001111

I
I
I
I

10111010 111
10111010

mod TTT

10TTTOIl 111
10TTTOIl

I
rIm Iimrn. B-bit data

TTT reg imm. 8-bit data

reg2 regll

mod reg

rIm

6
8

2/0

UIL

3/1

UIL

6
13

Scan Bit Forward

regl, reg2

00001111

reg1, re92

00001111

memory. reg

00001111

1010011 w

memory, reg

BSR

101
110
111
1 00001111

100

TTT

Test Bit and Set
Test Bit and Reset
Test Bit and Compliment

BSF

10111010

I
I

reg imm. 8-bit data

mod 100 rim imm. a-bit data

10111010 111

I
I

10111100 111
10111100

rog2 regll

mod reg

r/ml

MN/MX,12

6/42
7/43

MN/MX,13

Scan Bit Reverse

I
I

10111101 111
10111101

r8 92 re91 1

mod reg

r/ml

MN/MX,14

6/103
7/104

MN/MX,15

STRING INSTRUCTIONS
CMPS

Compare Byte Word

LODS

Load Byte/Word
to ALI AX/EAX

1 1010110w

MOVS

Move BytelWord

SCAS

Scan Byte/Word

STOS

Store BytelWord
from ALI AX/EX

XLA T

Translate String

I
I

I 1010101w

I
I
I

1010010w
1010111 w

11010111

155

int:eL

Intel486™ OX MICROPROCESSOR

Table 10.1.lnteI486TM Microprocessor Integer Clock Count Summary (Continued)
INSTRUCTION

Cache Hit

FORMAT

Penalty If
CacheMlss

Notes

REPEATED STRING INSTRUCTIONS
Repeated by Count in CX or ECX (C = Count in CX or ECX)
REPE CMPS = Compare String
(Find Non-Match)
C=O
C>O
REPNE CMPS = Compare String
(Find Match)
C=O
C>O
REP LODS = Load String
C=O
C>O
REP MOVS = Move String
C=O
C= 1
C>1
REPE SCAS = Scan String
(Find Non-ALI AX/EAX)
C=O
C>O
REPNE SCAS = Scan String
(Find ALI AX/EAX)
C=O
C>O
REP STOS = Store String
C=O
C>O

I 11110011 I 1010011 w I

I
I
I

11110010

11110011

I
I
I

1010011 w

1010110w

1010010w

5
7+7c

16,17

5
7+7c

16,17

5
7+4c

16,18

I
I
I
5
13
12+3c

I
I
I

11110011

11110010

11110011

I
I
I

1010111 w

1010101 w

16
16,19

I
5
7+5c

5
7+5c

I
I
5
7+4c

FLAG CONTROL
CLC = Clear Carry Flag
STC = Set Carry Flag
CMC

= Complement Carry Flag

CLD

Clear Direction Flag

STD = Set Direction Flag
CLI = Clear Interrupt
Enable Flog
STI

= Set Interrupt
Enable Flag

LAHF = Load AH Into Flag
SAHF = Store AH Into Flags
PUSHF = Push Flags
POPF = Pop Flags

I
I
I
I
I
I
I
I
I
I
I

11111000

11111001

11110101

11111100

11111101

11111010

11111011

10011111
10011110
10011100
10011101

I
I

I
I
I

4/3

RV/P

9/6

RViP

DECIMAL ARITHMETIC
AAA

= ASCII Adjustfor Add

AAS = ASCII Adjust for
Subtract

AAM = ASCII Adjustfor
Multiply

I
I

00110111
00111111

11010100

I
I

00001010

I
156

int:eL

Intel486TM OX MICROPROCESSOR

Table 10.1. Intel486TM Microprocessor Integer Clock Count Summary (Continued)
INSTRUCTION

FORMAT

Cache Hit

Penally If
Cache Miss

Notes

DECIMAL ARITHMETIC (Continued)
AAD = ASCII Adjuslfor
Divide
DAA = Decimal Adjust for Add
DAS = Decimal Adjust for Subtract

I
I
I

11010 to 1

00100111
00101111

I
I
I

00001010

2
2

PROCESSOR CONTROL INSTRUCTIONS
HLT = Halt

11110100

MOV = Move To and From ControllDebuglTest Reglslers

CRO from register

00001111

00100010

000

reg

CR21CR3 from register

00001111

00100010

eee

reg

Reg from CRO-3

00001111

00100000

eee

reg

DRO-3 from register

00001111

00100011

eee

reg

DR6-7 from register

00001111

00100011

eee

reg

00001111

00100001

eee

reg

00001111

00100001

eee

reg

00001111

00100110

011

reg

TR4-7 from register

00001111

00100110

eee

reg

00001111

00100100 111

011

reg

Aegister Irom TR4-7

00001111

00100100 111

eee

reg

00001111

00000110

00001111

00001000

00001111

00001001

TR3 from register

CLTS = Clear Task Switched Flag
INVD = Invalidate Data Cache
WBINVD = Wrlte·Back and Invalidate
Data Cache

I
I
I

INVLPG = Invalidate TLB Entry
INVLPG memory

00001111

00000001

I
I
I
I
I
I
I
I
I
I
I

I
I
I
I

mod 111 rlml

4
10
10

9
9
4
4
3
4
7

LOCK = Bus Lock Prefix
Operand Size Prefix

I
I
I

01100111
11110000
01100110

I
I
I

12111

1
1
1

Segment Override Prefix
CS:
DS:
ES:
FS:
GS:
SS:

I
I
I
I
I
I

00101110

00111110

00100110

01100100

01100101

00110110

157

PREFIX BYTES
Address Size Prefix

HINH

intel~

Intel486TM OX MICROPROCESSOR

Table 10.1. Intel486TM Microprocessor Integer Clock Count Summary (Continued)
INSTRUCTION

FORMAT

Cache HIt

Penalty II
Cache MIss

PROTECTION CONTROL
~

ARPL

Adjust Requested PrIvilege Level
regl reg21

From register

I 01100011 111

From memory

I 01100011 I mod reg

LAR

r/ml

Load Access RIghts

From register

I 00001111 I 00000010 111

regl reg21

From memory

I 00001111 I 00000010 I mod reg

r/ml

I 00001111 I 00000001 ImodOl0

r/ml

I 00001111 I 00000001 I mod 011

rim 1

LGDT

Load Global Descriptor

Table register
~

LlDT

Load Interrupt DescrIptor

Table register
~

LLDT

Load Local DescrIptor

Table register from reg.

I 00001111 I 00000000 111

reg 1

Table register from memo

I 00001111 I 00000000 ImodOl0

r/ml

From register

I 00001111 I 00000001 111

110

reg 1

From memory

I 00001111 I 00000001 I mod 110

rim 1

LMSW

LSL

010

Load MachIne Status Word

Load Segment LImIt

From register

I 00001111 I 00000011 111

From memory

I 00001111 I 00000011 I mod reg

LTR

regl reg21

rim 1

Load Task RegIster

From Register

I 00001111 I 00000000 111

011

reg I

From Memory

I 00001111 I 00000000 I mod 011

rim I

r/ml

I 00001111 I 00000001 I mod 001

r/ml

To register

I 00001111 I 00000000 111

000

reg I

To memory

I 00001111 I 00000000 I mod 000

rim I

To register

I 00001111 I 00000001 111

100

reg I

To memory

I 00001111 I 00000001 I mod 100

rim I

SGDT

Star. Global DescrIptor Table

I 00001111 I 00000001 I mod 000
~

SlOT

SLOT

SMSW

STR

Store Interrupt DescrIptor Table

Store Local DescrIptor Table

Store MachIne Status Word

Star. Task RegIster

To register

I 00001111 I 00000000 111

001

reg I

To memory

I 00001111 I 00000000 I mod 001

rim I

I 00001111 I 00000000 111

100

rim I

Memory

I 00001111 I 00000000 I mod 100

rim I

VERR

VERW

VerIfy Read Access

Verily WrIte Access

To register

I 00001111 I 00000000 111

101

reg I

To memory

I 00001111 I 00000000 I mod 101

r/mi

158

Notes

infel .

Intel486TM OX MICROPROCESSOR

Table 10.1. Intel486TM Microprocessor Integer Clock Count Summary (Continued)
INSTRUCTION

FORMAT

Cache Hit

Penalty I'
Cache Miss

Notes

INTERRUPT INSTRUCTIONS
INT n

= Interrupt Type n

INT 3

= Interrupt Type 3

INTO

= Interrupt 4 I'

I
I
I

Overflow Flag Set
Taken
Not Taken
BOUND

= InterruptSl' Detect
Value Out Range

11001101
11001100
11001110

01100010

I
I
I
I

type

mod reg

rIm

INT+O

INT+2
3

21
21

= Interrupt Return

Real ModelVirlual Mode
Protected Mode
To same level
To outer level
To nested task (EFLAGS.NT

11001111

INT+24

7
7

20
36
TS+32

11
t9
4

21
21

= 1)

Extemallnterrupt
NMI

RVlP,21

Illn range
If out of range
IRET

INT+4/0

= Non-Maskable Interrupt

Page Fault

9
9
9,10

INT+ll

INT+3

INT+24

INT+B
INT+B
INT+9
INT+9
INT+B
INT+9

21
21

INT+50
INT+51

21
21

INT+50
INT+51
INT+50
INT+50
INT+51
INT+51

21
21
21
21
21
21

VM86 Exceptions

eLi
STI
INTn
PUSHF
POPF
IRET
IN
Fixed Port
Variable Port
OUT
Fixed Port
Variable Port
INS
OUTS
REP INS
REP OUTS

21
21

Task Switch Clock Counts Table
Value forTS

Method
VM/intel486 CPUl286 TSS To Intel486 CPU TSS
VM/intel486 CPU/286 TSS To 286 TSS
VM/intel486 CPU/286 TSS To VM TSS

159

Cache Hit

Miss Penalty

162
143
140

55
31
37

int:et

Intel486TM OX MICROPROCESSOR

Interrupt Clock Counts Table
Value for INT

Method
Cache Hit

Miss Penalty

Real Mode
Protected Mode
Interrupt/Trap gate, same level
Interrupt/Trap gate, different level
Task Gate

Virtual Mode
Interrupt/Trap gate, different level
Task gate

Abbreviations
16/32

U/L
MN/MX
L/NL
RV/P
R

P
T/NT
H/NH

Notes

17
3

9
9
9, 10

17
3

+ TS
82

+ TS

Definition
16/32 bit modes ,-,
unlocked/locked
minimum/maximum
loop/no loop
real and virtual mode/protected mode
real mode
protected mode
taken/ not taken
hitlno hit

NOTES:
1. Assuming that the operand address and stack address fall in different cache sets.
2. Always locked, no cache hit case.
3. Clocks = 10 + max(log2(lml),n)
m = multiplier value (min clocks for m = 0)
n = 3/5 for ±m
4. Clocks = (quotient(countloperand length) )"7 + 9
= 8 if count :s; operand length (8/16/32)
5, Clocks = (quotient(countloperand length) )"7 + 9
= 9 if count :s; operand length (8/16/32)
6. Equal/not equal cases (penalty is the same regardless of lock).
7. Assuming that addresses for memory read (for indirection), stack push/pop, and branch fall in different cache sets.
8. Penalty for cache miss: add 6 clocks for every 16 by1es copied to new stack frame.
9. Add 11 clocks for each unaccessed descriptor load.
10. Refer to task switch clock counts table for value of TS.
11. Add 4 extra clocks to the cache miss penalty for each 16 by1es.
For notes 12-1:;J: (b = 0-3, non-zero by1e number);
(i = 0-1, non-zero nibble number);
(n = 0-3, non bit number in nibble);
12. Clocks = 8+4 (b+1) + 3(i+1) + 3(n+1)
= 6 if second operand = 0
13. Clocks = 9+4(b+ 1) + 3(i+ 1) + 3(n+ 1)
= 7 if second operand = 0
For notes 14-15: (n = bit position 0-31)
14. Clocks = 7 + 3(32-n)
6 if second operand = 0
15. Clocks = 8 + 3(32-n)
7 if second operand = 0
16. Assuming that the two string addresses fall in different cache sets.
17. Cache miss penalty: add 6 clocks for every 16 by1es compared. Entire penalty on first compare.
18. Cache miss penalty: add 2 clocks for every 16 by1es of data. Entire penalty on first load.
19. Cache miss penalty: add 4 clocks for every 16 by1es moved.
(1 clock for the first operation and 3 for the second)
20. Cache miss penalty: add 4 clocks for every 16 by1es scanned.
(2 clocks each for first and second operations)
21. Refer to interrupt clock counts table for value of INT
22. Clock count includes one clock for using both displacement and immediate.
23. Refer to assumption 6 in the case of a cache miss.

160

intel"

Intel486TM OX MICROPROCESSOR

Table 10.2. Intel486TM Microprocessor I/O Instructions Clock Count Summary
INSTRUCTION

Real
Mode

FORMAT

Protected
Protected
Virtual 86
Mode
Mode
Mode
(CPL;;IOPL) (CPL>IOPL)

Notes

I/O INSTRUCTIONS
IN

Inputfrom:

Fixed Port

1111001 Ow

Variable Port
OUT

1111011 Ow

I
I

11110011 wi

Variable Port

11110111 wi

OUTS

Output to:

Fixed Port

INS

port number

Input Byte/Word
from OX Port

1011011 Ow

Output Byte/Word
to OX Port

10110111 wi

Input String

1 11110011 1011011 Ow

1 11110011 10110111 wi

REP INS

REP OUTS

Output String

16+8c

10+8c

30+8c

29+8c

17+5c

11+5c

31+5c

30+5c

NOTES:
1. Two clock cache miss penalty in all cases.
2. C = count in CX or ECX.
3. Cache miss penalty in all modes: Add 2 clocks for every 16 bytes. Entire penalty on second operation.

161

intel..

Intel486TM OX MICROPROCESSOR

Table 10.3. Intel486™ Microprocessor Floating Point Clock Count Summary
Cache Hit
INSTRUCTION

Avg(Lower
Range .•.
Upper Range)

FORMAT

Penalty If
Cache Miss

Concurrent
Execution

Avg(Lower Notes
Range .•.
Upper Range)

DATA TRANSFER
FLD

Real Load to ST(O)

32·bit memory

111011

oOllmod 000

rim I

s·i·bl disp.

64~bit

memory

111011

1011 mod 000

rim I

s·i·b/disp.

80·bit memory

111011

0111 mod 101

rim

ST(i)

11101 t

001111000

= Integer Load to ST(O)

FILD

ST(i)

I
I

s·i·b/disp.

16-bit memory

111011

1111 mod 000

rim

0111 mod 000

rim

s·i·bl disp.

64-bit memory

111011

1111 mod 101

I
I
rim I

s·i·b/disp.

111011

1111 mod 100

rlml

FST

= BCD Load to ST(O)

Store Real from ST(O)

32-bit memory

111011

oOllmod 010

rim

64-bit memory

111011

1011 mod 010

rim

ST(i)

111011

101111010

ST(i)

I
I
I

s·i·b/disp.
s·i·b/disp.

s·i·bl disp.
s·i·b/disp.

I
I
I
I
I
I

14.5(13-16)

11.5(9-12)

4(2-4)

16.8(10-18)

7.8(2-8)

75(70-103)

7.7(2-8)

= Store Real from ST(O) and Pop

FSTP

32-bit memory

111011

oOllmod 011

rlml

s-i-bl disp.
s·i·b/disp.

64-bit memory

111011

1011 mod 011

rlml

80·bit memory

111011

0111 mod 111

rim

ST(i)

111011

101111001

16-bit memory

111011

1111 mod 010

rlml

s·l·b/disp.

32-bit memory

It 1 011

0111 mod 010

rlml

s·i·bl disp.

FIST

I
I

32-bit memory

FBLD

ST(i)

I
I

s·i·bl disp.

I
I
I

6
3

= Store Integer from ST(O)

FISTP

Store Integer from ST(O) and Pop

16-bit memory

111011

1111 mod 011

rim

32·bit memory

111011

0111 mod 011

rlml

s·i·bl disp.

64·bit memory

111011

1111 mod 111

rlml

s·i·bl disp.

111011

1111 mod 110

rlml

s·i·bl disp.

111011

001111001

32-bit memory

111011

oooimod 010

64-bit memory

111011

100lmod 010

ST(i)

111011

000111010

FBSTP

FXCH

Store BCD from
ST(O) and Pop

Exchange ST(O) and ST(I)

ST(i)

s·i·bl disp.

I
I

I
I
I
I

33.4(29-34)
32.4(28-34)

33.4(29-34)
33.4(29-34)
33.4(29-34)
175(172-176)

COMPARISON INSTRUCTIONS
FCOM

FCOMP

Compare ST(O) with Real

rlml

s·i·bl disp.

rlml

s·i·bl disp.

ST(i)

I
I

= Compare ST(O) with Real and Pop

32-bit memory

111011

oooimod 011

rlml

64-bit memory

111011

10olmod 011

rim

ST(il

111011

000111011

ST(ill

162

s·i·bl disp.
s·i·b/disp.

I
I

intel~

Intel486TM OX MICROPROCESSOR

Table 10.3.lnteI486TM Microprocessor Floating Point Clock Count Summary (Continued)
Cache Hit
Penalty If
INSTRUCTION

FORMAT

Avg(Lower
Range •••
Upper Range)

Cache Miss

Concurrent
Execution
Avg(Lower Notes
Range •••
Upper Range)

COMPARISON INSTRUCTIONS (Continued)
FCOMPP

FICOM

Compare ST(O) with Integer

Compare ST(O) with
ST(I) and Pop Twice

111011

11011101

10011

I
I

18(16-20)

16.5(15-17)

18(16-20)

16.5(15-17)

16·bit memory

111011

1101 mod 010 rlml

s·i·b/disp.

32·bit memory

111011

ololmod 010

rlml

s·i·b/disp.

111011

1101 mod 011

rIm

111011

010 mod 011

Compare ST(O) with 0.0

111011

001

0100

111011

101 11100

ST(i)

Unordered compare
111011
ST(O) with ST(I) and Pop

101 11101

ST(i)

0101 1110

10011

00111110

01011

FICOMP

Compare ST(O) with Integer

16·bit memory
32·bit memory
FTST

FUCOM

Unordered compare
ST(O) with ST(I)
~

FUCOMP

FUCOMPP

FXAM

Unordered compare
111011
ST(O) with ST(I) and Pop Twice

Examine ST(O)

111011

1110

I
rIm I
I
I
I

s·i·b/disp.
s·i·b/disp.

I
I

CONSTANTS
FLDZ

Load

+ 0.0 Into ST(O)

11011

001

1110

11101

FLD'

Load

+ 1.0 Into ST(O)

11011

001

1110

10001

11011

001

1110

10111

FLDL2T

FLDPI

Load" Into ST(O)
Load IOg2(10) Into ST(O)

11011

001

1110

10011

FLDL2E

Load log2(e) Into ST(O)

11011

001 1110

10101

FLDLG2

Load logI0(2) Into ST(O)

11011

001

1110

11001

FLDLN2

Load log.(2) Into ST(O)

11011

001

1110

11011

ARITHMETIC
FADD

Add Real with ST(O)

ST(O) <- ST(O)

+ 32·bit memory

111011

oooimod 000 rlml

ST(O) <- ST(O)

+ 64·bit memory

111011

1001 mod 000

ST(d) <- ST(O)

+ ST(i)

111011

doolll000

ST(i)

Add real with ST(O) and
111011
Pop (ST(I) <- ST(O) + ST(Il)

110111000

ST(i)

I
I
I

FADDP
FSUB

rIm

Subtract real from ST(O)

ST(O) <- ST(O) - 32·bit memory

111011

oooimod 100 rIm

ST(O) <- ST(O) - 64·bit memory

111011

1001 mod 100 rlml

ST(d) <- ST(O) - STeil

111011

doollll0d

ST(i)

Subtract real from ST(O)
111011
and Pop (ST(I) <- ST(O) - ST(Il)

110111101

ST(i)

FSUBP

I
I

163

s·i·b/disp.
s·i·b/disp.

I
I

10(8-20)

7(5-17)

10(8-20)

7(5-17)

10(8-20)

7(5-17)

10(8-20)

7(5-17)

10(8-20)

7(5-17)

10(8·20)

7(5-17)

10(8-20)

7(5-17)

10(8-20)

7(5-17)

Intel486TM OX MICROPROCESSOR

Table

10.3.

Intel486TM Microprocessor Floating Point Clock Count Summary

(Continued)

Cach.Hlt
INSTRUCTION

Avg(Low.r
Rang •••.
Upp.r Rang.)

FORMAT

P.nalty If
Cach. Miss

Concurrent
Execution

Avg(Low.r Notes
Rang ••.•
Upp.r Rang.)

ARITHMETIC (Continued)

= Subtract r ••1r.v.rsed (Subtract ST(O) from r.al)

FSUBR

rlml

ST(O) ..... 32·bit memory - ST(O)

111011

ST(O) ..... 64·bit memory - ST(O)

111011

100lmod 101

ST(d) ..... ST(i) - ST(O)

111011

doollll0d

ST(i)

111011
and Pop (ST(I) ..... ST(I) - ST(O»

110111100

ST(i)

FSUBRP
FMUL

= Subtract r.al r.versed

0001 mod 101

rim

s-i-b/disp.

111011

oooimod 001

rlml

s-i-b/disp.

rlml

s·i·b/disp.

ST(O) ..... ST(O) x 64·bit memory

111011

toolmod 001

ST(d) ..... ST(O) x ST(i)

111011

dooll1001

ST(i)

111011
and Pop (ST(I) ..... ST(O) x ST(I))

110111001

ST(i)

= Multiply ST(O) with ST(I)

FMULP

= Dlvld. ST(O) by Real

I
I

ST(O) ..... ST(0)/32·bit memory

111011

000 mod 110

rlml

s.i·b/disp.

ST(O) ..... ST(0)/64·bit memory

111011

1001 mod 110

rlml

s·i·b/disp.

ST(d) ..... ST(O)/ST(i)
FDIVP

I
I

10(8-20)

7(5-17)

10(8-20)

7(5-17)

10(8-20)

7(5-17)

10(8-20)

7(5-17)

= Multiply real with ST(O)

ST(O) ..... ST(O) x 32·bit memory

FDIV

I
I
I

s·i·b/disp.

= Divide ST(O) by ST(I) and

111011

doolll11 d

ST(i>i

111011

110111111

ST(i)

I
I

8
11

Pop (ST(I) ..... ST(O)/ST(I»
FDIVR

= Divide real revers.d (ReaI/ST(O))

ST(O) ..... 32·bit memoryIST(O)
ST(O) ..... 64·bit memoryIST(O)
ST(d) ..... ST(i)/ST(O)
FDIVRP

= Divide real r.v.rs.d and

111011

0001 mod 111

111011

100lmod 111

I
rim I
I
I
rim

s·i·b/disp.
s·i·b/disp.

I
I

111011

doolll11 d

ST(i)

111011

110111110

ST(i)

Pop (ST(I) ..... ST(I)/ST(O))
FIADD

= Add Integer to ST(O)

ST(O) .... ST(O)

+ 16·bit memory

111011

1101 mod 000

rlml

s·i·bl disp.

ST(O) ..... ST(O)

+ 32·bit memory

111011

0101 mod 000

rlml

s·i·bl disp.

FISUB

= Subtract Int.g.r from ST(O)

ST(O) .... ST(O) - 16·bit memory

111011

1101 mod 100

rim

ST(O) .... ST(O) - 32·bit memory

111011

ololmod 100

rlml

s·i·bl disp.

FISUBR

s·i·bl disp.

111011

1101 mod 101

rlml

s·i·bl disp.

ST(O) .... 32·bi\ memory - ST(O)

111011

ololmod 101

rlml

s·i·bl disp.

ST(O) .... ST(O) x 16·bit memory

111011

1101 mod 001

rlml

s·i·b/disp.

ST(O) ..... ST(O) x 32·bit memory

111011

ololmod 001

rim

s·i·bl disp.

rim

s·i·b/disp.

FIDIV

I
I

24(20-35)

7(5-17)

22.5(19-32)

7(5-17)

24(20-35)

7(5-17)

22.5(19-32)

7(5-17)

= Int.g.r Subtract Reversed

ST(O) .... 16·bit memory - ST(O)

FIMUL

I
I

24(20-35)

7(5-17)

22.5(19-32)

7(5-17)

25(23-27)

23.5(22-24)

87(85-89)

85.5(84-86)

= Multiply Int.ger with ST(O)

= Int.g.r Divide

ST(O) .... ST(0)/16·bit memory

111011

1101 mod 110

ST(O) ..... ST(0)/32·bit memory

111011

ololmod 110 rlml

164

s·i·b/disp.

I
I
I
I

intel"

Intel486TM OX MICROPROCESSOR

Table

10.3. Intel486TM

Microprocessor Floating Point Clock Count Summary (Continued)
Cache Hit

INSTRUCTION

FORMAT

Avg (Lower

Penalty II
Cache Miss

Range •.•
Upper Range)

Concurrent
Execution
Avg (Lower Notes
Range •••
Upper Range)

ARITHMETIC (Continued)
~

FIDIVR

Integer Divide Reversed

ST(O) <-16·bit memoryIST(O)

111011

1101 mod 111

rlml

ST(O) <- 32·bit memoryIST(O)

111011

010 mod 111

rim

FSQRT

Square Root

FSCALE

FPREMI

I
I

87(85-89)

85.5(84-86)

001 1111

10101

85.5(83-87)

001

11011

31(30-32)

11101 t

001 1111

0100

19(16-20)

4(2-4)

11011

001 1111

1000

84(70-138)

2(2-8)

Partial Reminder (IEEE)

11011

001

01011

94.5(72-167)

5.5(2-18)

Round ST(O) to Integer

11011

001 1111

29.1 (21-30)

7.4(2-8)

Extract components
olST(O)

Partial Reminder

FRNDINT

s·i·bl disp.

111011

FPREM

s·i·bl disp.

111011

Scale ST(O) by ST(I)

FXTRACT

1111

1100

I
I
I

FABS

Absolute value 01 ST(O)

11011

001 1110

00011

FCHS

Change sign 01 ST(O)

11011

001

0000

11011

001 1111

11111

241 (193-279)

6,7

11011

001 1111

00101

244(200-273)

6,7

11011

001

1111

00111

289(218-303)

5(2-17)

11011

001 1111

11101

241 (193-279)

6,7

11011

001 1111

10111

291 (243-329)

6,7

11011

001

1111

00001

242(140-279)

11011

001

1111

00011

311 (196-329)

11011

001

1111

10011

313(171-326)

111011

01111110

00111

111011

11111110

00001

Store stalus word
Inlomemory

111011

1011 mod 111

rlml

s-i-b/disp.

1110

TRANSCENDENTAL
~

FCOS

Cosine 01 ST(O)

FPTAN

FPATAN
FSIN

Partial tangent 01 ST(O)
Partial arctangent

Sine 01 ST(O)

FSINCOS

Sine and cosine 01 ST(O)

F2XM 1 ~ 2ST(O) - 1
FYL2X

ST(I)
~

FYL2XPI

ST(I)

IOg2(ST(O))

log2(ST(O)

1.0)

PROCESSOR CONTROL
FINIT

Initialize FPU

FSTSW AX

FSTSW

Store status word
InloAX

FLDCW

Load control word

111011

oOllmod 101

rlml

s-i-b/disp.

FSTCW

Store conlrol word

111011

oOllmod 111

rlml

s-i-bl disp.

FCLEX

Clear exceptions

111011

01111110

FSTENV

FLDENV

I
I
I

00101

SIore envlronmenl
111011
Real and Virtual modes 16-bit Address
Real and Virtual modes 32-bit Address
Protected mode 16-bitAddress
Protected mode 32-bit Address

oOllmod 110

Load environment
111011
Real and Virtual modes 16-bit Address
Real and Virtual modes 32-bit Address
Protected mode 16-bit Address
Protected mode 32-bit Address

0011 mod 100

rim

I
I

s-i-bl disp.

s-i-b/disp.

67
67
56
56

4
4
4
4

I
I
44
44
34
34

165

2
2
2
2

intel·

Intel486TM OX MICROPROCESSOR

Table 10.3.lnteI486™ Microprocessor Floating Point Clock Count Summary (Continued)
Concurrent

Cach.Hlt
INSTRUCTION

Avg(Low.r
Range •••
Upper Range)

FORMAT

P.naltylf
cache MIlS

ExecutIon
Avg(Low.r Notes
Rang ••••
Upper Rang.)

PROCESSOR CONTROL (Continued)
FSAVE

= Save atate

111011
Real and Virtual modes 16-bH Address
Real and Virtual modes 32-blt Address
Protected mode 16-bH Address
Protected mode 32-bit Address

FRSTOR

= Restore state

111011
Real and Virtual modes 16-bit Address
Real and Virtual modes 32-blt Address
Protected mode 16-bij Address
Protected mode 32-bit Address

FINCSTP

= Increm.nt Stack PoInter

FDECSTP

= D.cr.ment Steck Polnt.r 11 1 0 1 1

FFREE

= Free ST(I)

111011

1011mod 110 rIm

1011mod 100

s-i-b/disp_

I
154
154
143
143

s-I-bl

001 1111· 01111

001 1111

01101

ST(~I

00001

111011

101 11000

= No operatIons

111011

001 1101

WAIT

= Walt unUI FPU ready

4
4
4
4

I
131
131
120
120

FNOP

(Mlnimum/Maxlmum)

rIm

23
27
23
27

10011011
1/3

NOTES:
1. If operand is 0 clock counts = 27.
2. If operand is 0 clock counts = 28_
3. If CW.PC indicates 24 bit preCision then subtract 38 clocks.
If CW.PC indicates 53 bit precision then subtract 11 clocks.
4. If there is a numeric error pending from a previous instruction add 17 clocks.
5. If there is a numeric error pending from a previous instruction add 18 clocks.
6. The INT pin is polled several times while this instruction is executing to assure short interrupt latency.
7. If ABS(operand) is greater than Tr/4then add n clocks. Where n = (operand/(Tr/4»_

166

intel~

Intel486TM OX MICROPROCESSOR

addressing byte, the scale-index-base byte, follows
the mod rim byte to fully specify the addressing
mode.

10.2 Instruction Encoding
10.2.1 OVERVIEW

Addressing modes can include a displacement immediately following the mod rim byte, or scaled index byte. If a displacement is present, the possible
sizes are S, 16 or 32 bits.

All instruction encodings are subsets of the general
instruction format shown in Figure 10.1. Instructions
consist of one or two primary opcode bytes, possibly
an address specifier consisting of the "mod rim"
byte and "scaled index" byte, a displacement if required, and an immediate data field if required.

If the instruction specifies an immediate operand,
the immediate operand follows any displacement
bytes. The immediate operand, if specified, is always
the last field of the instruction.

Within the primary opcode or opcodes, smaller encoding fields may be defined. These fields vary according to the class of operation. The fields define
such information as direction of the operation, size
of the displacements, register encoding, or sign extension.

Figure 10.1 illustrates several of the fields that can
appear in an instruction, such as the mod field and
the rim field, but the Figure does not show all fields.
Several smaller fields also appear in certain instructions, sometimes within the opcode bytes themselves. Table 10.4 is a complete list of all fields appearing in the Intel4S6 Microprocessor instruction
set. Further ahead, following Table 10.4, are detailed tables for each field.

Almost all instructions referring to an operand in
memory have an addressing mode byte following
the primary opcode byte(s). This byte, the mod rim
byte, specifies the address mode to be used. Certain
encodings of the mod rim byte indicate a second

ITTTTTTTT 1 T TTTTTTT 1 mod TTT rim

ss index base Id321161s1 none data321161s1 none

OJ\, 7 6 5 3 2 0 1 ... 7 6 5 3 2 0]1.

0 7

'-------v----~

opcode
(one or two bytes)
(T represents an
opcode bit.)

"mod rim"
byte

"s-i-b"
byte

~~---------v--------~.
register and address
mode specifier

I I.

'----y--~

'-----.,----'

address
displacement
(4, 2, 1 bytes
or none)

immediate
data
(4, 2, 1 bytes
or none)

Figure 10.1. General Instruction Format

Table 10.4. Fields within Intel486TM Microprocessor Instructions
Field Name

Description

Number of Bits

w
d
s
reg
mod rim

Specifies if Data is Byte or Full Size (Full Size is either 16 or 32 Bits
Specifies Direction of Data Operation
Specifies if an Immediate Data Field Must be Sign-Extended
General Register Specifier
Address Mode Specifier (Effective Address can be a General Register)

ss
index
base
sreg2
sreg3
tttn

Scale Factor for Scaled Index Address Mode
General Register to be used as Index Register
General Register to be used as Base Register
Segment Register Specifier for CS, SS, OS, ES
Segment Register Specifier for CS, SS, OS, ES, FS, GS
For Conditional Instructions, Specifies a Condition Asserted
or a Condition Negated

1
1
1
3
2 for mod;
3 forr/m
2
3
3
2
3

NOTE:
Tables 10.1-10.3 show encoding of individual instructions.

167

intet

Intel486TM OX MICROPROCESSOR

10.2.2 32-81T EXTENSIONS OF THE
INSTRUCTION SET

10.2.3 ENCODING OF INTEGER
INSTRUCTION FIELDS

With the Intel486 Microprocessor, the 8086/801861
80286 instruction set is extended in two orthogonal
directions: 32-bit forms of all 16-bit instructions are
added to support the 32-bit data types, and 32-bit
addressing modes are made available for all instructions referencing memory. This orthogonal instruction set extension is accomplished having a Default
(D) bit in the code segment descriptor, and by having 2 prefixes to the instruction set.

Within the instruction are several fields indicating
register selection, addressing mode and so on. The
exact encodings of these fields are defined immediately ahead.
10.2.3.1 Encoding of Operand Length (w) Field
For any given instruction performing a data operation, the instruction is executing as a 32-bit operation
or a 16-bit operation. Within the constraints of the
operation size, the w field encodes the operand size
as either one byte or the full operation size, as
shown in the table below.

Whether the instruction defaults to operations of 16
bits or 32 bits depends on the setting of the D bit in
the code segment descriptor, which gives the default length (either 32 bits or 16 bits) for both operands and effective addresses when executing that
code segment. In the Real Address Mode or Virtual
8086 Mode, no code segment descriptors are used,
but a D value of 0 is assumed internally by the Intel486 Microprocessor when operating in those
modes (for 16-bit default sizes compatible with the
8086/80186/80286).
Two prefixes, the Operand Size Prefix and the Effective Address Size Prefix, allow overriding individually
the Default selection of operand size and effective
address size. These prefixes may precede any opcode bytes and affect only the instruction they precede. If necessary, one or both of the prefixes may
be placed before the opcode bytes. The presence of
the Operand Size Prefix and the Effective Address
Prefix will toggle the operand size or the effective
address size, respectively, to the value "opposite"
from the Default setting. For example, if the default
operand size is for 32-bit data operations, then presence of the Operand Size Prefix toggles the instruction to 16-bit data operation. As another example, if
the default effective address size is 16 bits, presence of the Effective Address Size prefix toggles the
instruction to use 32-bit effective address computations.

wField

Operand Size
During 16-8it
Data Operations

Operand Size
During 32-8it
Data Operations

0
1

8 Bits
16 Bits

8 Bits
32 Bits

10.2.3.2 Encoding of the General
Register (reg) Field
The general register is specified by the reg field,
which may appear in the primary opcode bytes, or as
the reg field of the "mod rim" byte, or as the rim
field of the "mod rim" byte.
Encoding of reg Field When w Field
is not Present in Instruction
reg Field
000
001
010
011
100
101
110
111

These 32-bit extensions are available in all Intel486
Microprocessor modes, including the Real Address
Mode or the Virtual 8086 Mode. In these modes the
default is always 16 bits, so prefixes are needed to
specify 32-bit operands or addresses. For instructions with more than one prefix, the order of prefixes
is unimportant.
Unless specified otherwise, instructions with 8-bit
and 16-bit operands do not affect the contents of
the high-order bits of the extended registers.

168

EAX
ECX
EDX
EBX
ESP
EBP
ESI
EDI

inteL

Intel486TM OX MICROPROCESSOR

Encoding of reg Field When w Field
is Present in Instruction

3·Bit sreg3 Field

reg

(when w = 0)

(when w = 1)

AL
CL
OL
BL
AH
CH
OH
BH

AX
CX
OX
BX
SP
BP
SI
01

000
001
010
011
100
101
110
111

(when w

AL
CL
OL
BL
AH
CH
OH
BH

000
001
010
011
100
101
110
111

ES
CS
SS
OS
FS
GS
do not use
do not use

Except for special instructions, such as PUSH or
POP, where the addressing mode is pre-determined,
the addressing mode for the current instruction is
specified by addressing bytes following the primary
opcode. The primary addressing byte is the "mod
rim" byte, and a second byte of addressing information, the "s-i-b" (scale-index-base) byte, can be
specified.

Function of w Field
(whenw

Segment
Register
Selected

10.2.3.4 Encoding of Address Mode

3·Bit
sreg3 Field

EAX
ECX
EOX
EBX
ESP
EBP
ESI
EOI

The s-i-b byte (scale-index-base byte) is specified
when using 32-bit addressing mode and the "mod
rim" byte has rim = 100 and mod = 00,01 or 10.
When the sib byte is present, the 32-bit addressing
mode is a function of the mod, ss, index, and base
fields.
The primary addressing byte, the "mod rim" byte,
also contains three bits (shown as Tn in Figure
10.1) sometimes used as an extension of the primary opcode. The three bits, however, may also be
used as a register field (reg).

10.2.3.3 Encoding of the Segment
Register (sreg) Field
The sreg field in certain instructions is a 2-bit field
allowing one of the four 80286 segment registers to
be specified. The sreg field in other instructions is a
3-bit field, allowing the Intel486 Microprocessor FS
and GS segment registers to be specified.

When calculating an effective address, either 16-bit
addressing or 32-bit addressing is used. 16-bit addressing uses 16-bit address components to calculate the effective address while 32-bit addressing
uses 32-bit address components to calculate the effective address. When 16-bit addressing is used, the
"mod rim" byte is interpreted as a 16-bit addressing
mode specifier. When 32-bit addressing is used, the
"mod rim" byte is interpreted as a 32-bit addressing
mode specifier.

2·Bit sreg2 Field
2·Bit
sreg2 Field

Segment
Register
Selected

00
01
10
11

ES
CS
SS
OS

Tables on the following three pages define all encodings of all 16-bit addressing modes and 32-bit
addressing modes.

169

infel .

Intel486TM OX MICROPROCESSOR

Encoding of 16-blt Address Mode with "mod rIm" Byte
mod rIm

Effective Address

00000
00001
00010
00011
00100
00101
00110
00111

Effective Address
DS:[BX+SIl
DS:[BX+DI)
SS:[BP+SIl
SS:[BP+DI)
DS:[SI)
DS:[DIl
DS:d16
DS:[BX)

10000
10001
10010
10011
10100
10101
10110
10111

DS:[BX+SI+d16)
DS:[BX + DI + d16)
SS:[BP + SI + d16)
SS:[BP+DI+d16)
DS:[SI+d16)
DS:[DI+d16)
SS:[BP+d16)
DS:[BX+d16)

01000
01001
01010
01011
01100
01101
01110
01 111

DS:[BX + SI + dB)
DS: [BX + DI + dB)
SS:[BP + SI + dB)
SS: [BP + DI + dB)
DS:[SI+dB)
DS:[DI+dB)
SS:[BP+dB)
DS:[BX+dB)

11000
11001
11010
11 011
11100
11 101
11 110
11 111

register-see below
register-see below
register-see below
register-see below
register-see below
register-see below
register-see below
register-see below

mod rIm

Function of w Field
(whenw=O)

(whenw =1)

AL
CL
DL
BL
AH
CH
DH
BH

AX
CX
DX
BX
SP
BP
SI
DI

mod rIm
11000
11001
11010
11 011
11100
11101
11 110
11 111

170

Function of w Field
(whenw=O)

(whenw =1)

AL
CL
DL
BL
AH
CH
DH
BH

EAX
ECX
EDX
EBX
ESP
EBP
ESI
EDI

infel .

Intel486™ OX MICROPROCESSOR

Encoding of 32-blt Address Mode with "mod rIm" byte (no "s-I-b" byte present):
mod rIm

Effective Address

mod rIm

Effective Address

00000
00001
00010
00011
00100
00101
00110
00111

Ds:[EAX]
Ds:[ECX]
Ds:[EDX]
Ds:[EBX]
s-i-b is present
Ds:d32
Ds:[Esl]
Ds:[EDI]

10000
10001
10010
10011
10100
10101
10110
10111

Ds: [EAX + d32]
Ds: [ECX + d32]
Ds: [EDX + d32]
Ds: [EBX + d32]
s-i-b is present
ss:[EBP+d32]
Ds: [Esl + d32]
Ds:[EDI+d32]

01000
01001
01010
01011
01100
01101
01110
01 111

Ds:[EAX+dS]
Ds:[ECX+dS]
Ds: [EDX + dS]
Ds: [EBX + dS]
s-i-b is present
ss:[EBP+dS]
Ds:[Esl+dS]
Ds:[EDI+dS]

11000
11001
11010
11 011
11100
11 101
11110
11 111

register-see below
register-see below
register-see below
register-see below
register-see below
register-see below
register-see below
register-see below

Register Specified by reg or rIm
during 16-Blt Data Operations:
mod rIm
11000
11001
11010
11 011
11100
11101
11 110
11 111

Function of w field
(whenw=O)

(whenw=1)

AL
CL
DL
BL
AH
CH
DH
BH

AX
CX
DX
BX
SP
BP
51
DI

mod rIm
11000
11001
11010
11011
11100
11101
11 110
11 111

171

Function of w field
(whenw=O)

(whenw=1)

AL
CL
DL
BL
AH
CH
DH
BH

EAX
ECX
EDX
EBX
ESP
EBP
Esl
EDI

infel .

Intel486TM OX MICROPROCESSOR

Encoding of 32-blt Address Mode (Umod rIm" byte and us-I-b" byte present):
Effective Address

Scale Factor

00000
00001
00010
00011
00100
00101
00110
00111

mod base

OS: [EAX + (scaled index)]
OS: [ECX + (scaled index)]
OS: [EOX + (scaled index)]
OS: [EBX + (scaled index)]
SS: [ESP + (scaled index)]
OS: [d32 + (scaled index)]
OS: [ESI + (scaled index)]
OS: [EOI + (scaled index)]

00
01
10
11

x1
x2
x4
x8

Index

Index Register

01000
01001
01010
01011
01100
01101
01110
01 111

OS: [EAX + (scaled index) + d8]
OS: [ECX + (scaled index) + d8]
OS: [EOX + (scaled index) + d8]
OS: [EBX + (scaled index) + d8]
SS: [ESP + (scaled index) + d8]
SS: [EBP + (scaled index) + d8]
OS: [ESI + (scaled index) + d8]
OS: [EOI + (scaled index) + d8]

000
001
010
011
100
101
110
111

EAX
ECX
EOX
EBX
no index reg"
EBP
ESI
EOI

10000
10001
10010
10011
10100
10101
10110
10111

NOTE:
Mod field in "mod
"s-i-b" byte.

··IMPORTANT NOTE:
When index field is 100, indicating "no index register," then
ss field MUST equal 00. If index is 100 and ss does not
equal 00, the effective address is undefined.

OS: [EAX + (scaled index) + d32]
OS: [ECX + (scaled index) + d32]
OS: [EOX + (scaled index) + d32]
OS: [EBX + (scaled index) + d32]
SS: [ESP + (scaled index) + d32]
SS: [EBP + (scaled index) + d32]
OS: [ESI + (scaled index) + d32]
OS: [EOI + (scaled index) + d32]

rIm" byte; ss, index, base fields in

172

int:eL

Intel486TM OX MICROPROCESSOR

10.2.3.5 Encoding of Operation
Direction (d) Field

Mnemonic

In many two-operand instructions the d field is present to indicate which operand is considered the
source and which is the destination.
d

Direction of Operation

Register/Memory <- - Register
"reg" Field Indicates Source Operand;
"mod r/m" or "mod ss index base" Indicates
Destination Operand

Register <- - Register/Memory
"reg" Field Indicates Destination Operand;
"mod r/m" or "mod ss index base" Indicates
Source Operand

NO
B/NAE
NB/AE
E/Z
NEINZ
BE/NA
NBE/A
S
NS
PIPE
NP/PO
LlNGE
NLIGE
LE/NG
NLE/G

Condition

tttn

Overflow
No Overflow
Below/Not Above or Equal
Not Below/Above or Equal
Equal/Zero
Not Equal/Not Zero
Below or Equal/Not Above
Not Below or Equal/Above
Sign
Not Sign
Parity/Parity Even
Not Parity/Parity Odd
Less ThanlNot Greater or Equal
Not Less Than/Greater or Equal
Less Than or Equal/Greater Than
Not Less or Equal/Greater Than

0000
0001
0010
0011
0100
0101
0110
0111
1000
1001
1010
1011
1100
1101
1110
1111

10.2.3.6 Encoding of Sign-Extend (s) Field
10.2.3.8 Encoding of Control or Debug
or Test Register (eee) Field

The s field occurs primarily to instructions with immediate data fields. The s field has an effect only if
the size of the immediate data is 8 bits and is being
placed in a 16-bit or 32-bit destination.
Effect on
Immediate
Data8

For the loading and storing of the Control, Debug
and Test registers.

Effect on
Immediate
Data 16132

None

Sign-Extend Data8 to Fill
16-Bit or 32-Bit Destination

None

When Interpreted as Control Register Field
eeeCode

Reg Name

000
010
011

CRO
CR2
CR3

Do not use any other encoding
When Interpreted as Debug Register Field

10.2.3.7 Encoding of Conditional
Test (tttn) Field
For the conditional instructions (conditional jumps
and set on condition), tttn is encoded with n indicating to use the condition (n = 0) or its negation (n = 1),
and ttt giving the condition to test.

eeeCode

Reg Name

000
001
010
011
110
111

ORO
DR1
DR2
DR3
DR6
DR7

Do not use any other encoding
When Interpreted as Test Register Field
eeeCode

Reg Name

011
100
101
110
111

TR3
TR4
TR5
TR6
TR7

Do not use any other encoding

173

intel .

Intel486TM OX MICROPROCESSOR

Instruction
First Byte

11011

OPA

Second Byte

11011

MF
P

11011

15-11

Optional
Fields

mod
mod

OPA
OPA

rim

s-i-b

OPB

rim

s-i-b

OPB

STeil

OPB

disp
disp

OP
43210

10.2.4 ENCODING OF FLOATING POINT
INSTRUCTION FIELDS

d = Destination
O-Destination is ST(O)
1-Destination is ST(i)

Instructions for the FPU assume one of the five
forms shown in the following table. In all cases, instructions are at least two bytes long and begin with
the bit pattern 11011 B.

R XOR d = O-Destination (op) Source
R XOR d = 1-Source (op) Destination
STeil = Register stack element i
000 = Stack top
001 = Second stack element

OP = Instruction opcode, possible split into two
fields OPA and OPB

..
....

MF = Memory Format
00-32-bit real
01-32-bit integer
10-64-bit real
11-16-bit integer

111 = Eighth stack element
mod (Mode field) and rim (Register/Memory specifier) have the same interpretation as the corresponding fields of the integer instructions.

P = Pop
O-Do not pop stack
1-Pop stack after operation

s-i-b (Scale Index Base) byte and disp (displacement) are optionally present in instructions that have
mod and rim fields. Their presence depends on the
values of mod and rim, as for integer instructions.

174

intel~
11.0

Intel486TM OX MICROPROCESSOR

DIFFERENCES BETWEEN THE
Intel486™ MICROPROCESSOR
AND THE 386™
MICROPROCESSOR PLUS THE
387™ MATH COPROCESSOR
EXTENSION

The differences between the Intel486 Microprocessor and the 386 Microprocessor are due to performance enhancements. The differences between the
microprocessors are listed below.
1. Instruction clock counts have been reduced to
achieve higher performance. See Section 10.
2. The Intel486 Microprocessor bus is significantly
faster than the 386 Microprocessor bus. Differences include a 1X clock, parity support, burst
cycles, cacheable cycles, cache invalidate cycles
and 8-bit bus support. The Hardware Interface
and Bus Operation Sections (Sections 6 and 7) of
the data sheet should be carefully read to understand the Intel486 Microprocessor bus functionality.
3. To support the on-chip cache new bits have been
added to control register 0 (CD and NW) (Section
2.1.2.1), new pins have been added to the bus
(Section 6) and new bus cycle types have been
added (Section 7). The on-chip cache needs to
be enabled after reset by clearing the CD and
NW bit in CRO.
4. The complete 387 math coprocessor instruction
set and register set have been added. No 1/0
cycles are performed during Floating Point instructions. The instruction and data pointers are
set to 0 after FINIT IFSAVE. Interrupt 9 can no
longer occur, interrupt 13 occurs instead.
5. The Intel486 Microprocessor supports new floating point error reporting modes to guarantee
DOS compatibility. These new modes required a
new bit in control register 0 (NE) (Section 2.1.2.1)
and new pins (FERR# and IGNNE#) (Section
6.2.13 and 7.2.14).
6. In some cases FERR# is asserted when the next
floating point instruction is encountered and in
other cases it is asserted before the next floating
point instruction is encountered, depending upon

10.

the execution state the instruction causing exception (see Sections 6.2.13 and 7.2.14). For
both of these cases, the 387 Math Coprocessor
asserts ERROR # when the error occurs and
does not wait for the next floating point instruction to be encountered.
Six new instructions have been added:
Byte Swap (BSWAP)
Exchange-and-Add (XADD)
Compare and Exchange (CMPXCHG)
Invalidate Data Cache (INVD)
Write-back and Invalidate Data Cache
(WBINVD)
Invalidate TLB Entry (INVLPG)
There are two new bits defined in control register 3, the page table entries and page directory
entries (PCD and PWT) (Section 4.5.2.5).
A new page protection feature has been added.
This feature required a new bit in control register
o (WP) (Section 2.1.2.1 and 4.5.3).
A new Alignment Check feature has been added. This feature required a new bit in the flags
register (AC) (Section 2.1.1.3) and a new bit in
control register 0 (AM) (Section 2.1.2.1).

11. The replacement algorithm for the translation
lookaside buffer has been changed from a random algorithm to a pseudo least recently used
algorithm like that used by the on-chip cache.
See Section 5.5 for a description of the algorithm.
12. Three new testability registers, TR3, TR4 and
TR5, have been added for testing the on-chip
cache. TLB testability has been enhanced. See
Section 8.
13. The prefetch queue has been increased from 16
bytes to 32 bytes. A jump always needs to execute after modifying code to guarantee correct
execution of the new instruction.
14. After reset, the 10 in the upper byte of the OX
register is 04. The contents of the base registers including the floating point registers may be
different after reset.

175

intel .
12.0

Intel486TM OX MICROPROCESSOR

Component Orientation: The most common mis"
take made by end-users and resellers when installing Math CoProcessor upgrades is incorrect orientation of the chip. This can result in irreversible damage to the chip and/or the PC. To solve this problem, Intel has designed the OverDrive Processor
with a 169 pin Pin Grid Array (PGA) pinout, with the
169th pin as a non-electrical "key pin" used to ensure proper orientation of the OverDrive Processor
by the PC user. The OverDrive Processor Socket
should, therefore, be a 169 pin PGA socket compatible with the OverDrive Processor pinout.(1) In addition, the location of the key pin should be clearly
marked on the mot~erboard or CPU card, for example by silk screening.

OVERDRIVE PROCESSOR
SOCKET

Inclusion of the OverDrive Processor Socket in sys·
tems based on Intel486 OX Microprocessors pro·
vides the end-user with an easy and cost-effective
way to increase system performance. The paradigm
of simply installing an additional component into an
empty OverDrive Processor Socket to achieve enhanced system performance is familiar to the millions of end-users and dealers who have purchased
Intel Math CoProcessor upgrades to boost system
floating point performance. The OverDrive Processor provides an overall performance increase for
systems based on Intel486 OX Microprocessors.

Insertion Force: The third major concern voiced by
end-users refers to how much pressure should be
exerted on the chip and PC board for proper installation without damage. This becomes even more of a
concern with the larger 169 pin components which
require up to 150 pounds of pressure for insertion
into a standard screw machine socket. This level of
pressure can easily result in cracked traces and
stress to solder joints. To minimize the risk of system damage, it is recommended that a Zero Insertion Force (ZIF) socket be used for the OverDrive
Processor Socket. Designing with a ZIF socket eliminates the need to design in additional structural support to prevent flexing of the PC board during installation, and results in improved end-user and reseller
product satisfaction due to easy "drop-in" installation.

As a new system architectural feature, the provision
of the OverDrive Processor Socket as a means for
PC users to take advantage of the ever more rapid
advances in software and hardware technology will
help to maintain the competitiveness of X86 PCcompatible systems over other architectures into the
future.
The majority of upgrade installations which take advantage of the OverDrive Processor Socket will be
performed by end-users and resellers. Therefore it
is important that the design be "end-user easy", a~d
that the amount of training and technical expertise
required to install the OverDrive Processor be minimized. Upgrade installation instructions should be
clearly described in the system user's manual. In addition, by making installation simple and foolproof,
PC manufacturers can reduce the risk of system
damage, warranty claims and service calls. Feedback from Intel's Math CoProcessor customers highlights three main characteristics of end-user easy
designs: accessible OverDrive Processor Socket location, clear indication of component orientation,
and minimization of insertion force.

12.1 OverDrive Processor Overview
The Intel OverDrive Processor is essentially an enhanced Intel486 Microprocessor. There are three
functional differences between the Intel OverDrive
Processor and Intel486 Microprocessors. First, the
Intel OverDrive Processor has an internal clock doubling circuit which decreases the time required to
execute instructions. Second, the Intel OverDrive
Processor does not support the JTAG boundary
scan test feature (available with the PQFP version of
the Intel486 OX Microprocessor). Third, the Intel
OverDrive Processor has a different CPU revision
identification than the Intel486 OX CPU. These three
differences are described in the following sections
according to how they effect the CPU functionality.

OverDrive Processor Socket Location: The OverDrive Processor Socket for Intel486 OX and Intel486
SX Microprocessor based. systems is an empty
socket which can be located on either the motherboard or modular CPU card. The OverDrive Processor Socket should be easily accessible for installation and readily visible when the PC case is removed. The OverDrive Processor Socket should not
be located in a position that requires removal of any
other hardware (such as hard disk drives) in order to
install the OverDrive Processor. Since Math CoProcessor sockets are typically found near the CPU
socket on the motherboard, similarly locating the
OverDrive Processor Socket near the CPU further
adds to the ease of installation.

12.1.1 HARDWARE INTERFACE

The Intel OverDrive Processor bus has been designed to be identical with the Intel486 Microprocessor bus. Although the external clock is internally
doubled and data and instructions are manipulated
in the CPU core at twice the external frequency, the
external bus is functionally identical with the Intel486
CPU.
176

intet

Intel486TM OX MICROPROCESSOR

The four boundary scan test signals (TCK, Test
clock; TMS, Test Mode select; TDI, Test Data Input;
TOO, Test Data Output), defined for the PQFP Intel
486 SX CPU, are not specified for the Intel OverDrive Processor.

the external bus for data (a cache miss). This number must be multiplied by 2 to convert it to an equal
number of internal CPU core clock counts and added to the base core clocks to compute the total
number of core clocks for this instruction.

The UP# (Upgrade Present) signal, which is defined
as an input for the PQFP Intel486 CPU, is an output
signal on the Intel OverDrive Processor. The UP#
pin on the Intel OverDrive Processor provides a logical low output signal which can be used to enable
logic to recognize and configure the system for the
Intel OverDrive Processor.

The actual number of core clocks for an instruction
with a cache miss may be less than the base clock
counts (from the cache hit column) plus the penalty
clock counts (2 times the cache miss column number). The clock counts in the cache miss penalty
column can be a cumUlative value of external bus
clocks (for data reads) and internal clocks for manipulating the data which has been loaded from the external bus. The number of clocks which are related
to external bus accesses are correctly represented
in terms of internal core clocks by multiplying by two.
However, the clock counts related to internal data
manipulation should not be multiplied by two. Therefore the total number of CPU core clock counts for
an instruction with a cache miss represents a worstcase approximation.

The OX register always contains the component
identifier at the conclusion of RESET. The Intel
OverDrive Processor has a different revision identifier in the DL register than the Intel486 OX Microprocessor. When the OverDrive Processor is installed in
a system the component identifier is supplied by the
OverDrive Processor, rather than the original CPU.
The stepping identification portion of the component
identification will change with different revisions of
the OverDrive Processor. The designer should only
assume that the component identification for the
OverDrive Processor will be 043xH, where 'x' is the
stepping identifier.

To calculate the execution time for an OverDrive
Processor instruction, multiply the total CPU core
clock counts by the core clock period. For example,
in a 25 MHz system the core clock period is 50 ns
(1/50 MHz).

12.1.2 TESTABILITY

Additionally, the assumptions specified below
should be understood in order to estimate instruction execution time.

As detailed in Section 13.1.1, the Intel OverDrive
Processor does not support the JTAG boundary
. scan testability feature.

A cache miss will force the OverDrive Processor to
run an external bus cycle. The Intel486 OX microprocessor 32-bit burst bus is defined as r-b-w.

12.1.3 INSTRUCTION SET SUMMARY
The Intel OverDrive Processor supports all Intel486
extensions to the 8086/80186/80286 instruction
set. In general, instructions will execute faster on the
Intel OverDrive Processor than the Intel486 Microprocessor. Specifically, an instruction that only uses
memory from the on-chip cache executes at the full
core clock rate while all bus accesses execute at the
bus clock rate. To calculate the elapsed time of an
instruction, the number of clock counts for that instruction must be multiplied by the clock period for
the system. The instruction set clock count summary
tables from Section 10.0 can be used for the OverDrive Processor witth the following modifications:
-

Where:
r=

The number of bus clocks in the first cycle of a
burst read or the number of clocks per data
cycle is a non-burst read.
The number of bus clocks for the second and
subsequent cycles in a burst read.

w = The number of bus clocks for a write.
The fastest bus the OverDrive Processor can support is 2 -1 - 2 assuming 0 wait states. The clock
counts in the cache miss penalty column assume a
2 -1 - 2 bus. For slower busses add r - 2 clocks to
the cache miss penalty for the first dword accessed.
Other factors also affect instruction clock counts.

Clock counts for a cache hit: This value represents the number of internal CPU core clocks for
an instruction that requires no external bus accesses or the base core clocks for an instruction
requiring external bus accesses.

Instruction Clock Count Assumptions
1. The external bus is available for reads or writes at
all times. Else add bus clocks to reads until the
bus is available

Penalty clock counts for a cache miss: This value
represents the worst-case approximation of the
additional number of external clock counts that
are required for an instruction which must access

2. Accesses are aligned. Add three core clocks to
each misaligned access.

177

Intel486TM OX MICROPROCESSOR

8. Displacement and immediate not used together.
If displacement and immediate used together, 1
core clock may be added to the core clock count
shown.
9. No invalidate cycles. Add a delay of 1 bus clock
for each invalidate cycle if the invalidate cycle
contends for the internal cache/external bus
when the OverDrive Processor needs to use it.

4. If an effective address is calculated, the base register is not the distination register of the preceding
instruction. If the base register is the destination
register of the preceding instruction add 1 to the
core clock counts shown. Back-to-back PUSH
and POP instructions are not affected by this rule.

10. Page translation hits in TLB. A TLB miss will add
13, 21 or 28 bus clocks + 1 possible core clock
to the instruction depending on whether the Accessed and/or Dirty bit in neither, one or both of
the page entries needs to be set in memory. This
assumes that neither page entry is in the data
cache and a page fault does not occur on the
address translation.

5. An effective address calculation uses one base
register and does not use an index register.
However, if the effective address calculation
uses an index register. 1 core clock may be added to the clock shown.

11. No exceptions are detected during instruction
execution. Refer to interrupt core Clock Counts
Table for extra clocks if an interrupt is detected.
12. Instructions that read multiple consecutive data
items (i.e., task switch, POPA, etc.) and miss the
cache are assumed to start the first access on a
16-byte boundary. If not, an extra cache line fill
may be necessary which may add up to (r+3b)
bus clocks to the cache miss penalty.

6. The target of a jump is in the cache. If not, add r
clocks for accessing the destination instruction
of a jump. If the destination instruction is not
completely contained in the first dword read, add
a maximum of 3b bus clocks. If the destination
instruction is not completely contained in the first
16 byte burst, add a maximum of another r+3b
bus clocks.
7. If no write buffer delay, w bus clocks are added
only in the case in which all write buffers are full.

178

int:eL

Intel486TM OX MICROPROCESSOR

samples FLUSH # active during reset, the Intel486
OX CPU enters tri-state output test mode after reset,
which causes the Intel486 OX CPU to float all of its
output signals. To float most of the Intel486 OX
CPU's output pins before the end of reset, BOFF#
is also driven active to the Intel486 OX CPU. BOFF #
immediately causes all output signals to float except
PCHK#, BREa, HLDA and FERR#.

12.2 IntelOverDrive™ Processor
Circuit Design
Figure 12.1 shows the interface circuit for the
Intel486 OX CPU and the OverDrive Processor socket. This circuit allows Intel486 OX CPU-based systems to be upgraded with the OverDrive Processor.
12.2.1 UPGRADE CIRCUIT FOR PGA INTEL486
DX BASED SYSTEMS

In addition to floating the Intel486 OX CPU's outputs,
the Intel486 OX CPU's HLDA and FERR # signals
must be gated to prevent potential bus contention
with the Intel OverDrive Processor's HLDA and
FERR # signals during reset. During reset the Intel486 OX CPU may not recognize HOLD active because BOFF# is driven active to the Intel486 OX
CPU by the Intel OverDrive Processor. If the Intel486
OX CPU does not recognize HOLD active, it will not
drive HLDA active. However, the Intel OverDrive
Processor will recognize HOLD active and drive
HLDA. By gating the HLDA signals from the Intel486
OX CPU and Intel OverDrive Processor Socket, bus
contention is avoided if HOLD is driven active during
reset. Because the state of FERR # is undefined
during reset, bus contention is also avoided by gating FERR#.

The Intel OverDrive Processor Socket Circuit for Intel486 OX CPU based systems allows the Intel486
OX CPU complete control of the system when the
Intel OverDrive Processor Socket is unpopulated.
The HLDA signal from the Intel OverDrive Processor
Socket should be tied low through a resistor while
the UP# and FERR# signals from the Intel OverDrive Processor Socket should be tied high through
a resistor to insure that the Intel486 OX CPU functions correctly when an Intel OverDrive Processor
Socket component is not installed.
When the Intel OverDrive Processor is installed, the
Upgrade Present output, UP# pin, causes the
FLUSH # and BOFF # signals to be driven active to
the Intel486 OX CPU. When the Intel486 OX CPU

,.._p.___________

...

,.._ _ _ _ _ _ _ _ _ _ _ _ _. , ._ _ _ CTRl

ClK

.,._~--

...

,.._p._~---------.,.-~-,.--

DATA

ADDR

ClK

CTRl

DATA

' - - - - - - - 1 > ClK

HlDA
FlUSH#

Intel

OVERDRIVE'" UP#
PROCESSOR

b - - -......---1

ADDR

DATA

CTRl
HlDA

FlUSH#

PGA
1486™DX

D---.-.

BOFF#

BOFF# b----1~+-t-I
IGNNE# FERR# HOLD

IGNNE# FERR# HOLD

HOLD

IGNNE#

Vee

BOFF#

FlUSH#

240440-96

Figure 12.1. Intel OverDrive™ Socket Circuit Diagram for PGA Intel486TM DX CPU Based Systems

179

infel .

Intel486™ OX MICROPROCESSOR

Table 12.1. OverDrive Processor,169-Pln, PGA
Package Dimensions with Heat Sink Attached

12.3 Socket Layout
This section discusses three aspects for the OverDrive Processor Socket: size, upgradability, and vendors.

Minimum

Maximum

A. Heat Sink Width

1.520

1.550

B. PGA Package
Width

1.735

1.765

12.3.1 PHYSICAL DIMENSIONS
The OverDrive Processor Socket for Intel486 DX microprocessor-based systems is equivalent to a standard 169-lead PGA package.

C. Heat Sink Edge
Gap

0.065

0.155

D. Heat Sink Height

0.212

0.260

The OverDrive Processor will be provided with a
heat sink attached (see Figure 12-2), to dissipate
heat.

E. Adhesive
Thickness

0.008

0.012

F. Package Height
from Stand-Ofts

0.140

0.180

G. Total Height from
Stand-Ofts to Top
of Heat Sink

0.360

0.452

Dimension (Inches)

The maximum and minimum dimensions of the
OverDrive Processor package with the heat sink are
shown in Table 12-1.

=j;~

I·

OVERDRIVE PROCESSOR
OMNI-DIRECTIONAL HEAT SINK

/ADHESIVE
~

UPGRADE PROCESSOR. 169 PIN. PGA PACKAGE
I

1
240440-98

Figure 12.2. Intel OverDrlve™ Processor, 169-Pln, PGA Package with Heat Sink Attached

180

int'et

Intel486TM OX MICROPROCESSOR

I~·I~·-·==========g,-----------··~·Ir--

SEATING~

SI-1

@@@@@@@@@@@@@@@@@
R?".
L-@@@@@@@@@@@@@@@@@
.-@@@@@@@@@@@@@@@@@
T
@@@
@@@
@@@
@@@
@@@
@@@
@@@
@@@
@@@
@@@
@@@
@@@
@@@
@@@
C3""""\ @ @ @
".,/
@@@
@@@
@@@
O@ @ @ @
@ @@
@@@
@@O@@@@@@@@@@@n@:@
@@@@@@@@@@@@@@@o@

(/J1.65

(

PLANE

=
=

·1

ll!REF
1.52
•
45° CHAMFER
(INDEX CORNER)

SEATING
PLANE
(/JB (ALL PINS)

Fc:=:Ofl

-"1
I

SWAGGED
PIN
DETAIL

=
=

~@@@@@@@@@@@@@@@o@
SWAGGED
PIN
(4 PL)

=
=
=
=
=
=
=

'-Ar
~"7r
L~~'rr==

....

Al--L

BASE.=: A2
PLANE

240440-99

Family: Ceramic Pin Grid Array Package
Millimeters

Symbol
Min

Max

3.56

4.57

0.64

1.14

2.8

3.5

1.14

Inches
Notes

Min

Max

0.140

0.180

SOLID LID

0.025

0.045

SOLID LID

0.110

0.140

SOLID LID

1.40

0.045

0.055

0.43

0.51

0.017

0.020

44.07

44.83

1.735

1.765

40.51

40.77

1.595

1.605

2.29

2.79

0.090

0.110

2.54

3.30

0.100

N
Sl
ISSUE

169
1.52
IWS

Notes

0.130
169

0.060

2.54

0.100

REVX 7/15/88

Figure 12.3. Intel OverDrive™ Processor, 169·Lead Ceramic PGA Package Dimensions

181

infel .

Intel486TM OX MICROPROCESSOR

Table 12.2. Intel OverDrlve™ Processor Ceramic PGA Package Dimension Symbols
Letter or
Symbol

Description of Dimensions

Distance from seating plane to highest point of body

Distance between seating plane and base plane (lid)

Distance from base plane to highest point of body

Distance from seating plane to bottom of body

Diameter of terminal lead pin

Largest overall package dimension of length

A body length dimension, outer lead center to outer lead center

Linear spacing between true lead position centerlines

Distance from seating plane to end of lead
Other body dimension, outer lead center to edge of body

NOTES:
1. Controlling dimension: millimeter.
2. Dimension "e1" ("e") is non·cumulative.
3. Seating plane (standoff) is defined by P.C. board hole size: 0.0415-0.0430 inch.
4. Dimensions "S", "S1" and "C" are nominal.
5. Details of Pin 1 identifier are optional.

1.540
2X 0.040 REF

0.079 REF

~0.015:!:O.010

SECTION

A- A

.
240440-AO

Dimensions are in inches

Figure 12.4. Intel OverDrlve™ Processor Heat Sink Dimensions

182

Intel486TM OX MICROPROCESSOR

12.3.2 "END USER EASY" UPGRADABILITY
PC buyers value easy and safe upgrade installation. PC manufacturers can make the Intel OverDrive Processor installation in the Intel OverDrive Processor Socket simple and foolproof for the end user and reseller by
implementing the suggestions listed in Table 12-3.
Table 12.3. Socket and Layout Considerations
"End User Easy"
Feature

Implementation

Visible OverDrive Processor Socket The Intel OverDrive Processor Socket should be easily visible when
the PC's cover is removed. Label the Intel OverDrive Processor Socket
and the location of pin 1 by silk screening this information on the PC
board.
Accessible Overdrive Processor
Socket

Make the Intel OverDrive Processor Socket easily accessible to the
end user (i.e., do not place the Intel OverDrive Processor Socket under
a disk drive). If a Low Insertion Force (L1F) or screw machine socket is
used, position the Intel OverDrive Processor Socket on the PC board
such that there is ample clearance around the socket.

Foolproof Chip Orientation

Intel packages all Intel OverDrive Processors in a 169-pin, PGA
package. The 169th pin is called the "key" pin and insures that the
Intel OverDrive Processor fits into a 169-pin socket in only the correct
orientation. Supplying a 169-pin socket as the Intel OverDrive
Processor Socket eliminates the possibility of end users or resellers
damaging the PC board or Intel OverDrive Processor by powering up
the system with the Intel OverDrive Processor incorrectly oriented.

Zero Insertion Force
Upgrade Socket

The high pin count of the Intel OverDrive Processor makes the
insertion force required for installation in a screw machine PGA socket
excessive for end users or resellers. Even most Low Insertion Force
(L1F) sockets often require more than 60 Ibs. of insertion force. A Zero
Insertion Force (ZIF) socket insures that the chip insertion force does
not damage the PC board. If the ZIF socket has a handle, be sure to
allow enough clearance for the socket handle. If a L1F or screw
machine socket is used, additional PC board support is recommended.

"Plug and Play"

Jumper or switch changes should not be needed to electrically
configure the system for the Intel OverDrive Processor.

Thorough Documentation

Describe the Intel OverDrive Processor's installation procedure in the
PC's User's Manual.

183

intel®

Intel486TM OX MICROPROCESSOR

12.3.3 ZIF and LlF SOCKET VENDORS

Low Insertion Force Sockets and Vendors:

The following lists provide examples of sockets
which can be used as the Intel OverDrive Socket for
Intel486 DX CPU based systems.

1. AMP Inc.
P.O. Box 3608
Harrisburg, PA 17105-3608
Tel: (800) 522-6752
Part Number:
(Premium Base Material) 55589-5
(Standard Base Material) 916227-3

NOTE:
This is not a comprehensive list. Intel has not tested the sockets listed below and cannot guarantee
that these sockets will meet every PC manufacturer's specific requirements.

2. Thomas and Betts
200 Executive Center Drive
P.O. Box 24901
Greenville, SC 29616-2401
Tel: (803) 676-2900
Part Number: LPG 169A 17-S-1 AC

Zero Insertion Force Upgrade Sockets and
Vendors:
1. AMP Inc.
P.O. Box 3608
Harrisburg, PA 17105-3608
Tel: (800) 522-6752
Part Number: 55287-3
Contact: Rick Simonic, New Product Manager
(717) 561-6143

12.4 Thermal Management
The OverDrive Processor Socket must be designed
to dissipate the heat generated by the OverDrive
Processor. In the following Sections the airflow required over the OverDrive Processor Socket is calculated for a hypothetical system design.

2. Aries Electronics
P.O. Box 130
Frenchtown, NJ 08825
Tel: (908) 996-6841
Part Number: 169-PRS17012-10
Contact: Frank Folmsbee, Marketing Manager
(908) 996-6841

12.4.1 THERMAL CALCULATIONS FOR
HYPOTHETICAL SYSTEM
The maximum temperature specification for the
OverDrive Processor is 85°C (with heat sink attached). Therefore, the temperature of the heat sink
surface (TS) cannot exceed 85°C under the worst
case specified operating conditions for the system.
The variables which affect the heat sink temperature
include ambient temperature inside the system box
(TA), Vee, and Icc. An equation for the approximate
OverDrive Processor temperature (Ts) is:

3. JAE
599 N. Mathilda Ave., Suite 8
Sunnyvale, CA 94086
Tel: (408) 733-0493
Part Number: PCPS-169-002
Contact: Bob Gerleman, Western Sales Manager
(408) 733-0493

TS = TA

4. Thomas and Betts
200 Executive Center Drive
P.O. Box 24901
Greenville, SC 29616-2401
Tel: (803) 676-2900
Part Number: PGA 169A 17-S-1 AC
Contact: Scott Roland,
Product Marketing Manager
(803) 676-2910

Power * ()SA

where Power = Vcc • Icc

In the above equation, the variables under worst
case conditions are specified as follows:
T s:

Specified as 85°C for the OverDrive Processor
(See Figure 12-5).

TA:

Specified by the PC manufacturer for the
worst case system operating conditions.

Vee: Specified for the OverDrive Processor as 5V.

5. Yamaichi Electronics
1420 Koll Circle, Suite B
San Jose, CA 95112
Tel: (408) 452-0797
Part Number: NP111-16911-G4
Contact: Jim Bennett, Sales Manager
(408) 452-0797

Icc:

Specified for the OverDrive Processor and related to clock frequency.

8SA: 8SA = 8JA - 8JS·
8JA and 8JS are specified in Table 13-4.

184

intel~

Intel486™ DX MICROPROCESSOR

Thermocouple

Name Plate

---::;--C;;=;:;:~;:;:::::::;::;J
Heal Sink

;/1J....<"""1l~~~~J....,

13.6

,~"

BS1@~~ijS8# SelupTime

It~ :!~:,!~>

lfiy.\%>,'*'"
'

(Nole 1)

intel"

~[fJ[g[LO[MJOOO~[fJW

Intel486TM OX MICROPROCESSOR

Table 13.5.50 MHz Intel4BSTM Microprocessor A.C. Specifications
VCC

5V ±5%; TCASE

Symbol

O°C 10

+ 85°C; CL =

See Nole 2

Parameter

Min

Max

Unit

Figure

Notes

MHz

62.5

13.1

at2V(I)

13.1

at 0.8W)

Frequency
11

ClK Period

11a

ClK Period Stabilily

ClK High Time

ClK low Time

ClK Fall Time

(2.0V-0.8V)(I)

ClK Rise Time

0.8V -2.0V)(I)

A2-A31, PWT, PCD, BEO-3#, M/IO#,
D/C#, W/R#, ADS#, lOCK#,
FERR#, BREO, HlDA Valid Delay

A2-A31, PWT, PCD, BEO-3#, M/IO#,
D/C#, W/R#, ADS#, lOCK#,
FERR#, BREO Floal Delay

PCHK# Valid Delay

18a

BlAST#, PlOCK# Valid Dela

1X ClK 10 Inlel486

0.1%

Adjacent Clocks

(Nole 1)

13.5
13.6

t9
ns

110
111

13.6

13.2

t12

EADS# Selup ;rim

113

EADS# Hold Time

13.2

114

KEN#, BS16#, BS

13.2

116

13.3

RDY#,

118

HOLD,

(Note 1)

115

117

(Note 1)

13.5

D Selup Time

13.3

13.2

118a

BOFF # Selup Time

13.2

119

HOLD, AHOlD, BOFF# Hold Time

13.2

120

RESET, FlUSH#, A20M#, NMI, INTR,
IGNNE# Setup Time

13.2

121

RESET, FLUSH #, A20M #, NMI, INTR,
IGNNE# Hold Time

13.2

122

DO-D31, DPQ-3, A4-A31 Read Data
SelupTime

13.2,13.3

123

DO-D31, DPO-3, A4-A31 Read Data
Hold Time

13.2, 13.3

NOTES:
1. Nol 100% tested. Guaranteed by design characterization.
2. Specifications assume CL = 0 pF. 1/0 Buffer model must be used to determine delays due 10 loading (trace and compo·
nent). First Order 1/0 buffer models for the Intel486 CPU are available. Contact Intel for the latest release.
3. All timings are referenced at 1.5V (as illustrated in the listed figures) unless otherwise noted.

196

int:eL

Intel486TM OX MICROPROCESSOR

Table 13.6.50 MHz Intel486TM Microprocessor A.C. Characteristics for Boundary Scan Test Signals
Vcc = 5V

± 5%; T CASE

= O°C to

Symbol

+ 85°C; Cl

= 50 pF. All Inputs and Outputs are TTL Level

Parameter

t24

TCK Frequency

t25

TCK Period

Min

Figure

Notes

Max

Unit

MHz

1xCIock

(Note 2)

t26

TCK High Time

@2.0V

t27

TCKLowTime

@0.8V

t28

TCK Rise Time

(Note 1)

t29

TCKFaliTime

(Note 1)

t30

TDI, TMS Setup Time

13.7

(Note 3)

t31

TDI, TMS Hold Time

13.7

(Note 3)

t32

TOO Valid Delay

13.7

(Note 3)

t33

TOO Float Delay

TBD

13.7

(Note 3)

13.7

(Notes 3,5)

t34

All Outputs (Non-Test) Valid Delay

t35

All Outputs (Non-Test) Float Delay

t36

All Inputs (Non-Test) Setup Time

13.7

(Note 3)

t37

All Inputs (Non-Test) Hold Time

13.7

(Note 3)

NOTES:

1. Rise/Fall times are measured between O.BV and 2.0V. Rise/Fall times can be relaxed by 1 ns per 10 ns increase in TCK
period.
2. TCK period :e: ClK period.
3. Parameter measured from TCK.
4. Boundary Scan A.C. Specifications in the above table are target values. They have not been characterized. Therefore
they are subject to change.
5. Not 100% tested. Guaranteed by design characterization.

197

int:et

Intel486TM OX MICROPROCESSOR

1.5V

t5
~------

------~

240440-45

Figure 13.1. elK Waveforms

EADS# [

BS8#. BSI6#. [
KEN#

~~~-+--~~

-+__

~~~ _ _

-J.~~

BOFF#. AHOlD. [
HOLD

u::.~~---l---.A~

RESET. FlUSH#.
A20M#. IGNNE#. [
INTR. NMI

~~~~--t--_a:~

M-A31 [
(READ)

W~~_ _ _ _ _~~

240440-46

Figure 13.2. Input Setup and Hold Timing

elK [

RDY#. BROY# [

~~~:::::t::::~J~t-

00-031 [

OPO-OP3

~~~~

I-__

,a,:~

240440-47

Figure 13.3. Input Setup and Hold Timing

198

intet

Intel486TM OX MICROPROCESSOR

BROY#, ROY# [

:...l.:I~~"""--1---..Ll~

00-031 [
~~~~ _ _"';:;;;:"'_....J.~~

DPO-DP3

PCHK#

[

240440-82

Figure 13.4. PCHK # Valid Delay Timing

ClK

[

A2-A31, PWT, PCO,
BEO-3#, M/IO#,
O/C#, W/R#, AOS#,
lOCK#, fERR#, BREQ,
HlOA

[

00-031, OPO-3,
(WRITE)

[

BlAST#, PlOCK#

[

240440-83

Figure 13.5. Output Valid Delay Timing

ClK [
A2-A31, PWT. PCO,
BEO-3#, M/IO#,
O/C#,W/R#, AOS#, [
lOCK#, fERR#, BREQ,
HlOA
00-031, OPO-3,
(WRITE)

[

BlAST#, PlOCK#

[

240440-84

Figure 13.6. Maximum Float Delay Timing

199

intel~

Intel486TM OX MICROPROCESSOR

TCK

~~~~!

t34i

xxxxxxxxxxxxL
"l;:t36

Sl~":a~: XXXXXXXXXX~

t35--:1

t37:j~

x"'-----.....r-

240440-91

Figure 13.7. Test Signal Timing Diagram
13.4.1 TYPICAL OUTPUT VALID DELAY VERSUS LOAD CAPACITANCE UNDER WORST CASE
CONDITIONS FOR THE 25 MHz AND 33 MHz MHz Intel486 CPU
nom+6

'iii'

-=:s....>c

nom+4

I-

:::>
Q.

I-

:::>
0

..J

«
0

a:
f:

100

125

150

CL (picofarads)
NOTE:
This graph will not be linear outside of the CL range shown.
nom= nominal value given in A.C. Characteristics table.

200

240440-75

intel~

~OO~IbOIMlOOO~OOW

Intel486™ OX MICROPROCESSOR

13.4.2 TYPICAL OUTPUT VALID DELAY VERSUS LOAD CAPACITANCE UNDER WORST CASE
CONDITIONS FOR THE 25 MHz and 33 MHz Intel486 CPU

D20

C
0

D22

4
5
6

D13

CLKSEL

D17

D23
vss

CLK2
vss

E
0
vss

0
vee

0
Dl0

F
0

DP3

D24

D15

D12

0
D3

0
DP2

0
vee

K
0
vss

L
0
vss

0
D14

0
D2

0
Dl

vee

0
D7

0
D4

Vss

vee
D16

0
DPO

0
0

A29

vss

A30

0
A19

vee

A21

D26

A22

0
0

LOW POWER
168-PIN PGA PINOUT
Intel486TM DX CPU
PIN SIDE VIEW

D30

0
0

0
A7

0
A2

8516#

EADS#

0
858#

0
80FF#

0
Vee

0
Vss

0
RDY#

0
8E3#

0
NC

0
Vee

0
8RDY#

8E2#

8El#
Vee

Vee

PCD

Vss
Vss

0
8EO#

0
PWT

0
Vee

LOCK#

Vee

4
5

0
0
All

0
AB

0
A3

vss

0
Vss

0
vss

0
Al0

13
14

0
vss

0
A6

ADS#

Vss

vss

PLOCK#
A4
8LAST#
PCHK#

W/R#

8REQ

M/IO#

Vss

0
HLDA

Vee

Vss
Vss

0
D/C#

0
A12

0
FERR#

RESET

0
A15

Vee
A9

FLUSH#
HOLD
A20M#
KEN#

A13

vss

vee

INTR
AHOLD

0
A14

vee

NMI

A16

NC
IGNNE#

0
NC

vee

0
A23

A20

vee

A24

D28

0
A26

AlB

vee

0
A25

vee

0
A27

vee

vee
D29

0
A2B

A17

vee

A31

Q
0

vss

0
vee

0
vss

D27

D25

vss

Vss

vss

DPI

D31

vss

D18
D21

Dll

D19

S
240440-A6

NOTE:
This graph will not be linear outside of the CL range shown.
nom~nominal value given in A.C. Characteristics table.

201

intel@

Intel486™ OX MICROPROCESSOR

13.4.3.a TYPICAL LOADING DELAY VERSUS CAPACITIVE LOADING UNDER WORST-CASE
CONDITIONS FOR A HIGH TO LOW TRANSITION ON THE 50 MHz Intel486 CPU
10
9

-c;;-

-=-

7
6

c
c

"
:;;
c

0
..J

3
2

0
0

100

125

150

Capacitive Loading (pF)

240440-92

13.4.3.b TYPICAL LOADING DELAY VERSUS CAPACITIVE LOADING UNDER WORST·CASE
CONDITIONS FOR A LOW TO HIGH TRANSITION ON THE 50 MHz Intel486 CPU
5
4.5
4

-=-

c
"i
c

3.5
3
2.5

:;;
c
0

..J

2
1.5

0.5
0
0

100

125

150

Capacitive Loading (pF)

240440-93

202

int'et

Intel486TM OX MICROPROCESSOR

DC Loading: ICD-486 adds ± 15 p.A loading to the
CLK and data bus signals and ± 5 p.A loading to the
address and control signals.

13.4.4 TYPICAL OUTPUT RISE TIME VERSUS
LOAD CAPACITANCE UNDER WORSTCASE CONDITIONS

Power Requirements: For noise immunity and
CMOS latch-up protection the ICD-486 is powered
by the target system through the power and ground
pins of the Intel486 CPU socket. The circuitry on the
ICD-486 draws up to 1.3A excluding the Intel486
CPU Icc.

7r--'---'---T---r~~
6r-~---+--~--~~~

5r-~---+

No Connects: Pins specified as N.C. in the Intel486
CPU pin description must be left unconnected. Connection of any of these pins to power, ground, or any
other signal may cause the processor or the ICD486 to malfunction.
100

125

150

Intel486 CPU Location and Orientation: The ICD-486
may require lateral clearance. Figure 13.4 shows the
clearance requirements of the ICD-486.

CL (picofarads)

NOTE:
240440-76
This graph will not be linear outside of the CL range
shown.

Optional Isolation Board (OIB)
Due to its unbuffered design, the ICD-486 is susceptible to errors on the target system's bus. The OIB
installs between the ICD-486 and Intel486 CPU
socket in the target system and allows the ICD-486
to function in systems with faults (i.e., shorted signals). After electrical verification the OIB may be removed. The OIB has the following electrical and mechanical characteristics:

13.5 Designing for ICD·486
(Advance Information)
The ICD·486 (In·Circuit Debugger) is a hardware as·
sisted debugger for the Intel486 CPU. To use the
ICD·486, the Intel486 CPU component must be reo
moved from its socket replaced with the ICD·486
module. Because of the high operating frequency of
Intel486 CPU systems, there is no buffering of sig·
nals between the Intel486 CPU in the ICD·486 and
the target system. A direct result of the non·buffered
interconnect is that the ICD·486 shares the address
and data bus of the target system. In order for the
ICD·486 to function properly (without the Optional
Isolation Board installed), the design of the target
system must meet the following restrictions:

Buffer Characteristics: The OIB buffers the address
and data busses as well as the byte enables, ADS#,
W/R#, M/IO#, BLAST#, and HLDA. The buffers
are advanced CMOS devices and have the following
DC drive specifications: IOH = -15 mA, IOL =
64 mAo The propagation delay of each buffer is 5 ns
max driving a 50 pF load. To guarantee proper operation with the OIB, the clock period should be increased by the round trip buffer delay (10 ns) unless
the target system design already has enough timing
margin.

1. The bus controller must only enable data trans·
ceivers onto the data bus during valid read cycles
of the Intel486 CPU, other local devices, or other
bus masters.
2. Before another bus master drives the local processor address bus, the other bus master must
gain access to the address bus through the use
of HOLD·HLDA, AHOLD, or BOFF#.

Unbuffered Signals: Signals not listed above as buffered are passed through the OIB and will have additional capacitive loading due to the connectors and
circuit board of up to 10 pF.

In addition to the above restrictions, the ICD-486 has
several electrical and mechanical characteristics
that should be taken into consideration when designing the Intel486 CPU system.

Power Requirements: The OIB is also powered by
the target system through the Intel486 CPU socket
and requires 0.5A in addition to the ICD-486 and Intel486 CPU requirements.

Capacitive Loading: ICD-486 adds up to 30 pF to the
CLK signal, and up to 20 pF to each of the other
Intel486 CPU signals.

OIB Clearance Requirements: The OIB requires an
extra 0.55" of vertical clearance in the target system
above the Intel486 CPU socket.

203

6'5"-~l
-<0

0.4"

Serial CABLE

!!
co

PIN 1

..
...

CI)

Co)

CJ)

!II

4.0"

(;

J,.

I\)

0
./>.

i!
c
><
s:
(5

-I

;:
'tI

o'U
:D
o

0
IT

(/I

en
en

ID
::J

::J
(/I

Serial CABLE

L--------------------------------------,I''~liilrlrlrITITITITlilil'I'lililr

La" MAX

1
240440-48

ICD Probe with OIB Installed

Serlol CABLE

""","AX

IIIIIIIIII:~I~

'------;:nl

1L..._________I, _ _ _ _ _0_·1~5'_

OIB /

240440-41

ICD Probe with LAI Installed

"11

cO'
c

...

( I)

3.1"

c;,)

~O .. '

0
c

I\)

0'1

go
Ol
-4

6.5"

II)

:i>:
(XI
c»

-I

Serial CABLE

...'tI0

n
J:I
o
J:I
o
(')

PIN 1

II)

c
3'

m
CJ)
CJ)

II)

::s

III

4.0"

oJ:I

4.6"

::s

III

l
Logic Analyzer Interface (LA!)

240440-42

Processor Module Board Dimensions

.25"
I l.t" 11-0

.l.or.

~q
i :

1---•.5··---1

"',

-======l:L;;::::==:;;;;;;;JI.:'5"

PIN'

240440-77

240440-44

Processor Module Assembly Dimensions

Top View

.......

Iij'

[]r---------;I .~:-r--~l~il

Co)

:...
~

....,

I\)

1-------------'7.5"--------------11--

c::

[2.2"J

en
-t

!I:

:;;:

CI)
Q)

....~

c
><
5:
c;
240440-78

'V
0
1:1'

Processor Module Assembly Dimensions

c
3'

1-------------------------27.'''--------------------------/

Side View

CD
:::I
III

:::I
III

b 21

±
1.25"

o:D

\~
240440-79

Processor Module Assembly Dimensions
Side View, OIB Installed

±
1.75"

(f)
(f)

Processor Module

o
:D
o"
o

240440-80

intel~

Intel486TM OX MICROPROCESSOR

14.0 MECHANICAL DATA
SEATING_
PLANE
A

A3 -

III 1.65 @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @

r---

R~@@@@@@@@@@@@@@@@@
.-@@®@@@@@@@@@@@~@@

@@@
@@@
@@@
@@@
@@@
@@@
@@@
@@@
@@@
@@@
@@@
@@@
@@@
@@@
PIN C3 ~ @ @ @
'-..../
@@@
@@@
@@@
@@@@@
@ @
@@@
@@O@@@@@@@@@@@a@;@
@@@@@@@@@@@@@@@o@
~@@@@@@@@@@@@@@@o@

(

2.rREF
1.52 .
45 0 CHAMFER
(INDEX CORNER)

SWAGGED
PIN
(4 PL)

r-r

i -=t~~

---------

SEATING

PLANE~

IIlB (ALL PINS)

{==c:=OU
SWAGGED
PIN
DETAIL

A1 -i-BASS= A2
PLANE

L
240440-49

Family: Ceramic Pin Grid Array Package
Millimeters

Symbol
Min

Max

3.56

4.57

0.64

1.14

2.8

3.5

1.14

Inches
Notes

Max

0.140

0.180

SOLID LID

0.025

0.045

SOLID LID

0.110

0.140

SOLID LID

1.40

0.045

0.055

0.43

0.51

0.017

0.020

44.07

44.83

1.735

1.765

40.51

40.77

1.595

1.605

2.29

2.79

0.090

0.110

2.54

3.30

0.100

N
Sl
ISSUE

1.52

0.130
168

168
IWS

Notes

Min

0.060

2.54

0.100

REV X 7/15/88

Figure 14.1. 168 Lead Ceramic PGA Package Dimensions

207

Intel486TM OX MICROPROCESSOR

Table 14.1 Ceramic PGA Package Dimension Symbols
Letter or
Symbol

Description of Dimensions

Distance from seating plane to highest point of body

Distance between seating plane and base plane (lid)

Distance from base plane to highest point of body

Distance from seating plane to bottom of body

Diameter of terminal lead pin

Largest overall package dimension of length

A body length dimension, outer lead center to outer lead center

Linear spacing between true lead position centerlines

Distance from seating plane to end of lead
Other body dimension, outer lead center to edge of body

NOTES:
1. Controlling dimension: millimeter.
2. Dimension "e1" ("e") is non·cumulative.
3. Seating plane (standoff) is defined by P.C. board hole size: 0.0415-0.0430 inch.
4. Dimensions "8", "81" and "C" are nominal.
5. Details of Pin 1 identifier are optional.

where TJ, TA, Tc = Junction, Ambient and Case
Temperature respectively. OJC, OJA = Junction-toCase and Junction-to-Ambient Thermal Resistance,
respectively.

14.1 Package Thermal Specifications
The Intel486 Microprocessor is specified for operation when TC (the case temperature) is within the
range of 0·C-85·C. T C may be measured in any environment to determine whether the Intel486 microprocessor is within specified operating range. The
case temperature should be measured at the center
of the top surface opposite the pins.

P = Maximum Power Consumption

The values for OJA and OJC are given in Table 14.2
for the 1.75 sq. in., 168-pin, ceramic PGA.
Table 14.3 shows the T A allowable (without exceeding Tc) at various airflows and operating frequencies
(fCLK)'

The ambient temperature (TA) is guaranteed as long
as T C is not violated. The ambient temperature can
be calculated from OJC and OJA from the following
equations.

Note that T A is greatly improved by attaching "fins"
TJ = Tc

or a "heat sink" to the package. P (the maximum

+ P * oJC

power consumption) is calculated by using the maximum Icc at 5V as tabulated in the DC Characteristics of Section 13.

TA = TJ - P * OJA
Tc = TA

P' [OJA -

oJcl

Table 14.2.a. Thermal Resistance ("C/W) OJC and OJA for the 25 MHz and 33 MHz Intel486 CPU

0JA vs Airflow-ft/min (m/sec)
OJC

I
I

0
(0)

200
(1.01)

400
(2.03)

600
(3.04)

800
(4.06)

1000
(5.07)

Without Heat Sink

1.5

14.5

12.5

11.0

10.0

9.5

With Heat Sink'

2.0

8.0

6.0

5.0

4.5

4.25

'0.350" high umdlreclional heat sink (AI alloy 6063, 40 mil fin width, 155 mil
center-to-center fin spacing).

208

intel .

Intel486TM OX MICROPROCESSOR

Table 14.2.b. Thermal Resistance ("C/W) 9JC and 9JA for the 50 MHz Intel4S6 CPU
9JA vs Airflow-ft/min (m/sec)

I
I

9JC

0
(0)

200
(1.01)

400
(2.03)

600
(3.04)

SOO
(4.06)

1000
(5.07)

Without Heat Sink

1.5

16.5

14.0

12.0

10.5

9.5

9.0

With Heat Sink"

2.0

12.0

7.0

5.0

4.0

3.5

3.25

·0.350" high unidirectional heat sink (AI6063·T5, 40 mil fin width, 155 mil center to center fin spacing) .

0.040" --j r-

--j

0.115" r-

Heat Sink Dimensions

r- 0.290" ---j

.---_.....1+

:=--=--=--=--=------1'.53"-=--------_-_-_----J---I17

0.350"
1

240440-81

Table 14.3. Maximum T A at Various Airflows In ·C
Alrflow-ft/min (m/sec)

TA with Heat Sink

TA without Heat Sink

fClK
(MHz)

0
(0)

200
(1.01)

400
(2.03)

600
(3.04)

SOO
(4.06)

1000
(5.07)

25.0

33.3

77.5

78.75

25.0

33.3

22.5

32.5

47.5

209

infel .
15.0

Intel486™ OX MICROPROCESSOR

The following section on the Low Power Intel 486
DX Microprocessor contains information specific to
the Low Power device only. All data not defined are
located in the appropriate sections of this data sheet
unless specified otherwise.

LOW POWER INTEL486™ OX
MICROPROCESSOR

• Lower Power Dissipation
- Dynamic Frequency Scalability
-

lec1

INTERNAL
PROCESSOR CLOCK PERIOD

CLK2 PERIOD

4>2

CLK2 PERIOD

4>1

CLK2 PERIOD

4>2

CLK2

INTERNAL
Intel486™CpU CLK
(hall the Ireq.
01 CLK2)

24044D-A7

Figure 15.3. CLK2 Signal and Internal Processor Clock

reset) to establish the phase relationship of the 2X
clock. The reset pulse width during cold reset should
be at least 1 ms. As shown in Figure 15.4, the pulse
on CLKSEL should be asserted by the end of reset
(approximately 0.9 ms after driving reset active) and
at least 30 CLK2 periods before the falling edge of
reset.

All set·up, hold, float·delay and valid delay timings
are referenced to the phase one of the clock.
The internal processor clock (CLK) is similar to the
clock signal of the standard Intel486 Microprocessor. All 1/0 signals get sampled on the rising edge of
this signal, Le. the rising edge of phase one. Thus it
is important to synchronize the external circuitry with
the phase one of CLK2.

Figure 15.5 shows the detailed timing definition of
this pulse. The pulse on CLKSEL pin is only required
during power-up reset. During all other times including warm resets the CLKSEL pin should be driven
low and must be free of spikes or glitches. After the
power-up reset, the system must track the phase of
CLK2 at all times including during warm resets so
that the input/output signals can be sampled at the
appropriate clock edge. The phase relationship is
described in the next section.

CLKSEL

Clock Select pin selects the 2X mode required for
the Low Power Intel486 DX CPU. This pin should be
driven low after power-up and during the entire operation of the CPU. However, a well defined pulse is
required on CLKSEL pin during cold boot (power-up

216

int:eL

Intel486TM OX MICROPROCESSOR

CLK2

RESET

'""'----+-----;.-ot least o.9ms--;----~·1
CLKSEL

240440-A8

Refer to Figure 15-5 for exact timings of the CLKSEL pulse.

Figure 15.4. CLKSEL Pulse with Reference to the Reset Pulse Width

<1>1 or <1>2

<1>2

<1>1

<1>2

<1>1

CLK2

INTERNAL ~...,...--......~~~~~~~~~

...,.-'-.,....'-¥-"'""-'''''"'''"-+............+~_-I

Intel486™ CPU CLK ...........,._ _

RESET

CLKSEL

Tl =T2=T3=2 ns (MIN)

T4=8 ns (MIN)

T5=30 CLK2 periods (min)
240440-A9

Figure 15.5. CLKSEL Timing Definition during Power-Up Reset

217

int:et

Intel486™ OX MICROPROCESSOR

BS8#, BS16#, KEN#, EADS#, BOFF#, HOLD
and AHOLD) at the rising edge of phase 1, as long
as proper setup and hold times relative to that clock
edge are met.

15.6 Architecture Overview
The Low Power Intel486 DX Microprocessor is architecturally similar to the Intel486 CPU. Thus all bus
cycles follow the same definition The difference lies
in the fact that the Low Power Intel486 CPU works
with an external 2X clock input (CLK2). As shown in
Figure 16-3, each of the internal processor clock
(CLK) cycle is two CLK2 cycles wide. Thus a 25 MHz
Low Power Intel486 DX Microprocessor needs a
50 MHz clock input.

The Low Power Intel486 CPU samples all its asynchronous input signals (i.e. RESET, INTR, NMI,
A20M# FLUSH#, IGNNE#) at every other rising
edge of the system clock (Phase 1), as long as proper setup and hold times relative to that clock edge
are met.
OUTPUT SIGNALS

CLK2 provides the fundamental timing for the Low
Power Intel486 CPU. It is divided by two internally to
generate the internal processor clock (CLK) used for
instruction execution. The internal clock is comprised of two phases, "phase one" and "phase
two". Each CLK2 period is a phase of the internal
clock. All Low Power Intel486 Microprocessor inputs
are sampled at the rising edge of phase 1. Each bus
cycle is comprised of at least two bus states, T1 and
T2. Each bus state in turn consists of two CLK2 cycles phase 1 and phase 2 of the bus state. The bus
state diagram in Section 7.2.13 is valid for the Low
Power Intel486 Microprocessor.

The A.C. timing specifications for output signals (i.e.
valid and float delay timings) are specified with respect to the rising edge of the Phase 1 of the system
clock. This holds true for all output signals including
ADS# and PCHK#.

15.7 Variable CPU Frequency
The Low Power Intel486 Microprocessor allows the
CPU frequency to change dynamically. As shown in
Figures 15.6 and 15.7, the relationship between frequency and power consumption is approximately linear. Thus lowering the CPU frequency, reduces the
power supply current (Icd consumed by the CPU.

NOTE:
The timing diagrams given in the Intel486 data
sheet can be used for the Low Power Intel486 Microprocessor. Read "CLK" signal as the internal
clock of the CPU, with "CLK2" (the input clock of
the Low Power Intel486 CPU) being twice the frequency of the internal processor clock as shown in
Figure 15.3.

The following must be satisified to change the CPU
frequency:
1. Frequency can be changed at least 8 clocks after
satisfying t4 (see Figure 15.5). The system can be
started at a lower frequency and after satisfying
the CLKSEL pulse specifications, it can be operated at the required speed.
2. The change in frequency should satisfy the minimum specification of "CLK2 high time" and
"CLK2 low time". That is, at no time should the
clock period go below the specified clock high
and clock low times (see A.C. specifications for
exact values).

The following describes how the input signals are
sampled and output signals are referenced with respect to the input clock (CLK2):
INPUT SIGNALS:
The Low Power Intel486 CPU samples all its synchronous input signals (i.e. RDY #, BRDY #,

218

int:eL

Intel486TM OX MICROPROCESSOR

600
500

<'
5

400

300

200

100

-----

----

------10

Frequency (MHz)

240440-BO

Figure 15.6. Frequency vs Icc -inf
see if they are the same and
remove them
look at status from FCOMPP

fp_status
ax,fp_status
dX,offset fp_80287
restore_EFLAGS
dX,offset fp_80387

store 80287 message
see if infinities matched
jump if 8087/80287 is present
store 80387 message

restore_EFLAGS:
finit
mov
int
db
push
db
popf
mov
jmp

clear any pending fp exception
print NPX message

ah,9h
2lh
66h
cx
66h

push ECX
restore original EFLAGS register
restore original stack pointer

sp,bx
exit

print_one:
mov
int
jmp

ah,9h
2lh
exit

print out CPU ID with no NPX

mov
int
cmp
mov
je
mov

ah,9h
2lh
present_86,l
dX,offset fp_8087
print_fpu
dX,offset fp_80287

print out 8086/8088/80286 first

mov
int
jmp

ah,9h
2lh
exit

print out NPX

mov
mov
int

dX,offset period
ah,9h
2lh

print out a period of end message

mov
int

ax,4cOOh
2lh

terminate program

end

start

prinL87_287:
if 8086/8088 flag is on
store 8087 message
else CPU = 80286, store 80287
message

print_fpu:

exit:

A-4

NORTH AMERICAN SALES OFFICES
AlABAMA

GEORGIA

::1 ~u'!'.w.ro South
Suite 104-1
Huntsvilio 35802

tlntol Corp.
20 Technology Parkway
Sullel50
Norcross 30092
Tel: (404) 449-054t
FAX: (404) 605-9782

~~='~~M1k~rl
ARIZONA
tlnlol Corp.
410 North 44th Street
suno 500
Phoenix 85008
Tol: (602) 231.()388
FAX: (602) 244-0448
CAlIFORNIA
tlntol Corp.
21515 Vanowon Slroot.
sun. 118

¥:r(Bf:"{~=

FAX: (818) 340-1144
Inlol Corp.
1 Siorra Gate Plaza
suno 260C
Rooevillo 95678
Tol: (918) 782-6086
FAX: (916) 782·8153
tlnlel Corp.
9865 Chesapeake Dr.
suno 325
San DlmO 92123
Tol: (61 292·6086
FAX: (81 ) 292-ll829
"tlnlal Corp.
400 N. Tustin Avenue
Suite 450
Santa Ana 92705

~rJt~~rm

FAX: (714) 541-9157

"tlnlal Corp.
Sen Tomas 4

2700 Son Tomas Expreesway
2nd Floor
Sonta Clara 95051
Tol: (408) 986-6086
TWX: 910-338-0255
FAX: (408) 727-2620
COLORADO
"tlntel Corp.
600 S. Cherry St.
Suite 700
Denver 60222

~~~~~1=
FAX: (303) 322-8670
CONNECTICUT

~r'L;.of!''''m Corporate Park

83 Woostor Holgh18 Rd.
Danbury 08610

~~=,=)7::-~9
FLORIDA

tlntel Corp.
800 Fairway Drive
Suite 160
Deerfiold Beach 33441

m:(~~)~J~~

tlntol Corp.
5850 T.G. Lee Blvd.
Sune340
Orlando 32822
Tel: (407) 240-6000
FAX: (407) 240-8097

tSalee and service 0flI00
*Fleld Application Location

IWNOIS
"tlntol Corp.
Woodfield Corp. Center III
300 N. Martlngalo Roed
Sulto 400

~;ra8:ra~u=~

FAX: (708) 708-9782
INDIANA

t~i~1 ~~.:ruo Rood

suno 350
Indianapolis 48288
Tol: (31~t5-0823
FAX: (31 875-8938
MARYLAND
"tlntol Corp.
10010 JunCllon Dr.
Sullo 200
Annapolis JunCllan 20701
Tel: (410) 208-2860
FAX: (410) 208-3878
MASSACHUSETTS
"tlntol Corp.
Westford Corp. Centor
5 Carlisle Rood
2nd Floor
Westford 01888
Tol: (508) 692-0960
TWX: 710-343-6333
FAX: (508) 692-7887
MICHIGAN
tlntol Corp.
7071 Orchard Leko Road
Sunol00
Wost Bloomfield 48322
Tel: (313) 851-8096
FAX: (313) 851-8no

tlntol Corp.
300 Wastage Business Center
Suite 230
Fishkill 12524
Tol: (914) 897-3860
FAX: (914) 897-3125

~~2J~~_!~~~

FAX: (804) 282.()673

OKLAHOMA
lrig\ <;f.r~;oadway
Sulto115
Oklahoma Chy 73162
Tol: (405) B48-8088
FAX: (405) 840·9819
OREGON

t~J~<;f.~

Greenbrlor Pkwy.
Building B
Beaverton 97006
Tel: (503) 645-8051
TWX: 910467·8741
FAX: (503) 845-8181
PENNSVLVANIA
"tlntol Corp.
925 Harvest Drive
SUita 200
Blue Boll 18422
Tol: (215) 841-1000
FAX: (215) 641-0785

~~~~Emter Blvd.

Suite 610

~~~~~ti~~ ii1~70

=1~alithSt.

PUERTO RICO

NEWJERSEV

~t~~~~Ce Center

125 HaW Milo Rood
Red Bank OnOI
Tel: (908) 747-2233
FAX: (908) 747-0983
NEWVORK

*Intel Corp.

~~,r,'~ Office Park

~m~~~~~~

FAX: (718) 223-2581

"tlntel Corp.
2950 Expross Dr., South
Suite 130
Islandia 11722

~~5J~~.~~~f~

FAX: (516) 348-7939

~lJ~~m~gg

FAX: (713) 988-3860

OHIO
*tlntel Cor~.
3401 Park Contor Drlvo
suno 220
D8ron 45414
Te: (513~ 890-5350
TWX: 81 -450-2528
FAX: (513) 890-8658
"tlntol Corp.
25700 Science Park Or.
Sultol00
Boachwood 44122

MINNESOTA
Sullo 360
Bloomlnwon 55431
Tol: (612 835-8722
TWX: 910-578-2887
FAX: (812) 831-8497

"tlntel Corp.
7322 S.W. Freeway
Sune 1490
Houston n074

FAX: (412) 829-7578

tlnlol Corp.
South Industrial Park
P.O. Box 910
Los Piedras 00871
Tol: (809) 733-8818
SOUTH CAROUNA
Intol Corp.
100 executive Center Orive
Sullo 109, BI83
Greenville 29815
Tol: (803) 297-8086
FAX: (603) 297·3401
TEXAS

t~i~1 ~.°g'.;Pllai at Texas Hwy.

Sulto 4230

Austin 78759

Tol: (512) 784·8086
FAX: (512) 338-9335

*flntal Corp.

12000 Ford Road
Suite 400
Dallas 75234
Tel: (214) 241-8087
FAX: (214) 484-1180

UTAH

l~Jo~~rK.ioo South
Sune 104

~0~rrrlom~·6051

FAX: (601) 268-t457

WASHINGTON
tlntol Corp.
2800 156th Avonuo S.E.
Sulto 105
Bellevue 98007
Tol: (206) 843·6086
FAX: (206) 748-4495

~gl ~.rUIIsn Road
Suite 105
Spokane 99206

~~=,~j9~g:=7

WISCONSIN

~gl ~~;'cutlve Dr.
Suite 401
8rookflold 53005
Tol: (414) 789-2733
FAX: (414) 789-2748

CANADA
BRITISH COLUMBIA

Intel Semiconductor of
Canada, Ltd.
999 Canada Place
Sulto 404, #11
Vancouver V6C 3E2
Tol: (804) 844-2823
FAX: (804) 844·2813
ONTARIO
tlntol SomlconduClor of
Canada, Ltd.
2650 Queensview Drive
Sulto 250
Ottawa K2B 8H6
Tol: (813) 829-9714
FAX: (813) 820-5938
tlntol SemlconduClor at
Canada, Ltd.
190 Attwoll Drive
suno 500
Roxdale M9W 6H8
Tol: (418) 875-2105
FAX: (418) 875·2438
QUEBEC

tlntal Semiconductor of
Canada, Ltd.
1 Rue Holiday
SuHo115
Tour East
Pt. Clalro H9R 5N3
Tol: (514) 694·9130
FAX: 514-684-0064

CG/SALE/050892

intel~
AlABAMA
Arrow/Schweber Electronics
1015 Henderson Road
Huntsville 35806
Tel: (205) 837-6955
FAX: (205) 721-1581
Hamll1on/Avnet
4960 Corpora1e Drive, #135
Huntsville 35805
Tel: (205) 837-7210
FAX: (205) 72Hl358

~1Josro=a~~, mo
Huntsville 35805

~~:(~)S:C:~7
Pioneer Technologies Group
=~~~~square, #5

~~:(~)~7~
ARIZONA
Arrow/Schweber Electronics
2415 W. Erie Drive
Tempe 85282
Tel: (602) 43Hl030
FAX: (602) 252-9109

NORTH AMERICAN DISTRIBUTORS
Avnet Computer
1381 B Wee! l80th Street
Gardena 90248
Tel: (800) 428-7999
FAX: (310) 327-5389
Avnet Computer
755 Sunrise Blvd., #150
Roseville 95861
Tel: (916) 781-2521
FAX: (916) 781-3819
AVnet Computer
1175 Bordeaux Orive, #A

Sunnyvale 94089
Tel: (408) 743-3304
FAX: (408) 743-3348
Harnltton/Avnet
3170 Pullman Street
Costa Mesa 92826
Tel: (714) 641-4100
FAX: (714) 754-8033
Harnltton/Avnet
1175 Bordeaux Drive, #A

Sunnyvale 94089
Tel: (408) 743-3300
FAX: (408) 745-6679
Hamllton/Avnst

~~D~ewr~iMvenue

CALIFORNIA

Tel: (8~571-1900
FAX: (61 ) 571-8761
Hamltton/Avnet
21150 Celifa St.
Woodland Hills 91387
Tel: (818) 594-0404
FAX: (818) 594-8234
Hamltton/Avnet
755 Sunrise Avenue, #150
Roseviiie 95881
Tel: (916) 925-2216
FAX: (918) 925-3478
PionBsr Technologies Group
134 Rio Robl..
San Jose 95134
Tel: (408) 964-9100
FAX: (408) 954-9113

ArrrNI Commercial Systems Group

~laboratories

~n~~~~y Avenue
Chandler 85228
Tel: (802) 981-1,480
FAX: (802) 981-4787

Hamll1on/Avnet
30 South McKemy Avenue
Chandler 85228
Tel: (602) 981-6403
FAX: (802) 981-1331
Wyle Laboratories
4141 E. Raymond
Phoenix 85040
Tel: (802) 437-2088
FAX: (802) 437-2124

1502 Crocker Avenue

~n;g)~5371

FAX: (510) 489-9393

Am:NI Commercial ~ems Group

14242 Chambers Road
Tustin 92880
Tel: (714) 544-0200
FAX: (714) 731-8438

Arrow/Schwaber Electronics
28707 W. Agoura Road
Celabesas 91302
Tel: (818) 880-9888
FAX: (818) 772-8930
Arrow/Schwaber Electronics
9511 Rldgehaven Court
San DI~ 92123
Tel: (81 585-4800
FAX: (81 ) 279-8062.
Arrow/Schweber Electronics

~:'J~~IMrenue

Tel: (408) 441-9700
FAX: (408) 453-4810
Arrow/Schweber Electronics
2961 Dow Avenue

Tustin 92880
Tel: (714) 839-5422
FAX: (714) 838-4151
Avnet Compuler
3170 Pullman S1reet
Cos1e Mesa 92828
Tel: (714) 841-4150
FAX: (714) 841-4170

1
Barranca Pkwy.
INine 92713
Tel: (714) 753-9953
Wyle Laboratories
2951 Sunrtse Blvd., #175
Rancho Cordova 95742

Tel: (916) 638-5282
FAX: (916) 638-1491

~~ ~~~~: Drive

San DIOC 92123
Tel: (61 585-9171
FAX: (81 ) 385-0512
Wyle Laboratories
3000 Bowers Avenue
San1e Clara 95051
Tel: (408) 727-2500
FAX: (408) 727-5898
Wyle Laboratorie.
17872 Cowan Avenue
lNine 92714
Tel: (714) 883-9953
FAX: (714) 283-0473

~;o~~::':~ri~~, #150

Celabases 91302
Tel: (818) 880-9000
FAX: (818) 880-5510

COLORADO
Arrow/Schweber Electronics
61 Inverness Dr. East, #105
Englawood 80112
Tel: (303) 799-0258
FAX: (303) 373-5780

Hamltton/Avnet
9605 Maroon Circle, #200
Englewood 80112
Tel: (303) 799-7800
FAX: (303) 799-7801

~eE~~t~~e:nU8
Thornton 80241
Tel: (303) 457-9953
FAX: (303) 457-4831
CONNECTICUT
Arrow/Schwaber Electronics
12 Beaumont Road

f;:"&t"~~~,

FAX: (203) 265-7988
Avnet Computer
55 Federal Road, #103
Danbury 08810
Tel: (203) 797-2880
FAX: (203) 791-9050
Hamilton/Avnet
55 Federal Road, #103
Danbury 08810
Tel: (203) 743-6077
FAX: (203) 791-9050
Ploneer...standard
2 Trap Fall. Rd., #101
Shelton 06464
Tel: (203) 929-5800
FAX: (203) 838-9901
FLORIDA
Arrow/Schwaber Electronics
400 Fairway Drive, #102
Deerlield Beach 33441
Tel: (305) 429-8200
FAX: (305) 428-3991

GEORGIA

~c~'b~~~;~~ ~:~ems Group
Duluth 30138
Tel: (404) 623-8825
FAX: (404) 623-8802
Arrow/Schwaber Electronics
4250 E. Rivergreen Pkwy., #E
Duluth 30138
Tel: (404) 497-1300
FAX: (404) 476-1493
Avnet Computer
3425 Corporale Way, #G
Duluth 30138
Tel: (404) 623-8452
FAX: (404) 476-0125

Hamllton/Avnet
3425 Corporate Way, #G
Dululh 30136
Tel: (404) 446-0811
FAX: (404) 446-1011
Pioneer Technologies Group
4250 C. Rlvergreen Parkway
Duluth 30138
Tel: (404) 623-1003
FAX: (404) 623-0665
ILLINOIS
Arrow/Schweber Electronics
1140 W. Thorndale Rd.
"asca 60143
Tel: (708) 250-0500

Arrow/Schweber Electronics

Avnet Computer
1124 Thorndale Avenue
Bensenville 60106
Tel: (708) 860-8573
FAX: (708) 773-7976

Tel: (407) 333-9300
FAX: (407) 333-9320

Hamltton/Avnet
1130 Thorndale Avenue
Bensenville 60106

~~~~ ~~~:e #3101

Avnet Computer
3343 W. Commercial Blvd.

~t~~~f.;!~~:&S

Tel: (305) 979-9067
FAX: (305) 730-0388

~~~~\~~~~~~ North
~;t~r~i~";U~IJ8
FAX: (813) 572-4324

Hamltton/Avnet
5371 N. W. 33rd Avenue
Ft. Lauderdale 33309
Tel: (305) 484-5016
FAX: (305) 484-8369
Hamltton/Avnet
3247 Tech Drive North

~;t(~lr~i~";U~;J6
FAX: (813) 572-4329

Hamltton/Avnet
7079 University Boulevard
Winter Park 32791
Tel: (407) 857-3300
FAX: (407) 678-1878
Pioneer Technologies Group
337 Northlake SlviI., #1000
Ana Monte Springs 32701
Tel: (407) 834-9090
FAX: (407) 834-0885

~~~r.Il~~~:'.~r'e. Group
oaerlield Beach 33442
Tel: (305) 428-88n
FAX: (305) 481-2950

~~,c~~)~~~0

MTI Systems
1140 W. Thorndale Avenue
ttasca80143
Tel: (708) 250-8222
FAX: (708) 250-8275
Pioneer-Standard
2171 Executive Dr., #200
Addison 60101

Tel: (708) 495-9680
FAX: (708) 495-9631
INDIANA
Arrow/Schwaber Electronics
7108 Lakeview Parkway West Or.

Indianapolis 46268
Tel: (317) 299-2071
FAX: (317) 299-2379
Avnet Computer
485 Gradle Drive
Carmel 46032
Tel: (317) 575-8029
FAX: (317) 844-4964
Hamilton/Avnet
485 Gradle Drive
Carmel 46032
Tel: (317) 844-9333
FAX: (317) 844-5921
Pioneer-Standard

~d~:ar~:~ ~~~owest Dr.
Tel: (317) 573-0880
FAX: (317) 573-0979

CGlSALEJ050892

NORTH AMERICAN DISTRIBUTORS (Contd.)
IOWA
Hamlllon/AvnOl

~~ ~~~~~~~., N.E.

~7&:(~J~~)3:t~~lo
KANSAS

Arrow/Schwaber Electronics

~:~!.';.e~1~oad

~7&:(~J~~)~;'::J8
AvnOl Compu18r
15313 W. 951h StreOl
Lenexa 81219
Tel: (913) 541-7989
FAX: (913) 541-7904
Hamlnon/Avnel
15313 W. 951h
Ove~end Park 88215
Tel: (913) 888-1055
FAX: (913) 541-7951

KENTUCKY
Hamlnon/AvnOl
805 A. Newlown Circle
LeXln~on 40511

~7&:«~)2~2~
MARYLAND

Arrow/Schweber Electronics
9800J Patuxenl Woods Dr.
Columbia 21048
Tel: (301) 598-7800
FAX: (301) 995-6201
Avnet Computer
7172 Columbia Galeway Dr.. #G
Columbia 21045
Tel: (301) 995·3571
FAX: (301) 99~515
Hamlllon/AvnOl
7172 Columbia Ga1eway Dr.. #F
Columbia 21045

~7&PlgJhs:~m5

'Norlh Atlantic Industriea

~r:WI~~':~

Dr.
Columbia 21046
Tel: (301) 312-5800
FAX: (301) 290-7951

MICHIGAN

NEW JERSEY

Arrow/Schweber Electronics

Arrow/Schweber Electronics
4 EBBt Stow Rd.. UnH 11
Marllon 08053
Tel: (809) 598-8000
FAX: (809) 598-9832

~~gt~hmCt~:t, S.W., #5

Arrow/Schweber Electronics
43 Route 48 East
Pine Brook 07058
Tel: (201) 227-7880
FAX: (201) 538-4982

~~ ~.:::r~~e~rook Rd. #120
Nevi 48375

AvnOl Computer
l-B Keystone Ave., Bldg. 38
Cher;108OO3
Tel: (
424-8881
FAX: ( ) 751-2502

Hamliton/AvnOl
2876 28th Stree~ S.W., #5
Grandville 49418

Hamlllon/AvnOl
1 Keystone Ave., Bldg. 36

1Jv~~?aH~~~~~ Road
Tel: (800) 231-7902
FAX: (313) 482-2888
Grandville 49418
Tel: (818) 531-9607
FAX: (816) 531-0059

~7&:(~J~Ml:r7~7
~7&:('J~b)2~i~~

Avnet Computer
100 Centennial Drive
Peabody 01980
Tel: (508) 532-9888
FAX: (508) 532-9860
Hamliton/AvnOl
10 0 Centennial Drive
Peabody 01960
Tel: (508) 531-7430
FAX: (508) 532-9802
Ploneer·Standard
44 Hartwell Avenue

~Be~ru~'ll~:les

Pioneer-Standard
940 Fairport Park
Fairport 144SO
Tel: (716~381-7070
FAX: (71 381-5955

~~=kllJ~o
FAX: (201) 538-6430

Ploneer.standard
13495 Stamford
Livonia 481 SO
Tel: (313) 525-1600
FAX: (313) 427-3720

Ploneer-5tandard
14-A Madison Rd.
Falrtleld 07008
Tel: (201) 575-3510
FAX: (201) 57~454

MINNESOTA

NEW MEXICO

Arrow/Schweber Electronics
10100 Viking Drive, #100
Eden Prairie 55344
Tel: (612) 941-5290
FAX: (812) 942-7903

Alliance Eledronlcs. Inc.
10510 Research Avenue

Avnet Computer
10000 West 76th Street
Eden Prairie 55344

Avnet Computer
7801 Academy Road
Bldg. 1, SuHe 204
Albu~erqUe 87109
Tel: ( 5~ 828-9725
FAX: (SO ) 929-0360

~7&:(,m)8~g~gl

~7&:('~~~)s:m~
MISSOURI

Arrow/Schweber Electronics
2380 Schuetz Road
51. Louis 63141
Tel: (314) 567-8888
FAX: (314) 567-1164

Avnet Computer
739 Goddard Avenue
Ghestertleld 83005
Tel: (314) 537-2725
FAX: (314) 537-4248
Hamlllon/AvnOl
741 Goddard
Chestertleld 63005
Tel: (314) 537-1800
FAX: (314) 537-4246

~::uw~rq~~~~
FAX:

i~) 275-8392

Hamlllon/AvnOl
7801 Academy Rd. N.E.
Bldg. 1, sune 204

:~~~7~7~_1735

FAX: (919) 972-4972

Hamillon/Avnet
5250-n Center Dr. #350
Ch~otta 28217
Tel: (704) 527-2485
FAX: (704) 527-8058
Hamillon/Avnat

~Ie~ ~~&!orest Drive

NEW YORK

Charlotte 28210
Tel: (704) 527-8188
FAX: (704) 522-8564

FAX: (S05) 243-1395

Arrow/Schweber Electronics
3375 Brighton Henrietta Townllne Rd.
Rochester 14823
Tel: (718) 427-0300
FAX: (718) 427-0735
Arrow/Schweber Electronics
20 Oser Avenue

~:,~gf~g33Wg&

FAX: (518) 231-1072

~~e~~~~~~~~f~: ~p
~~e~e~=~~~r~~~

Durham2n13
Tel: (919) 544-5400
FAX: (919) 544-5885
OHIO

~~~~~~

Arrow Commercial Systems Group
284 Cramer Craek COurt
Dublin 43017
Tel: (814) 889-9347
FAX: (814) 889-9880

=\~~w~ehd.

Arrow/Schweber ElectroniCS
9573 Cochran Road, #E
Solon 44138

Arrow/Schweber ElectroniCS
~e~'lr.h= Village Dr.

Hauppauge 11781
Tel: (51~434-7443
FAX: (51 434-7429

NEW HAMPSHIRE

~fh~bX:~~:S

Avnet Computer
2 Executive Park Drive
Bedford 03102
Tel: (800) 442-6638
FAX: (903) 624-2402

Hamlnon/AvnOl
933 Motor Parkway
Hauppauge 11788
Tel: (516) 231-9800
FAX: (518) 434-7426

*$elf Cenitled Small Business per Federal Acquisition Regulations

Avnet Computer
2725 Millbrook Rd., #123

~:~~~jI~:s~r~g

FAX: (817) 863-1547

Burlington 01803
Tel: (817) 272-7300
FAX: (817) 272-8809

NORTH CAROUNA
Arrow/Schweber Electronics
5240 Greensdalry Road
Ralal~h 27604
Tel: ( 19~ 878-3132
FAX: (91 ) 878-9517

Tel: (iI9) 878-0619

Rochester 14823
Tel: (716) 272-9110
FAX: (718) 272-9685

i:~I(Bl~) :1!sk

Ploneer-5tandard
68 Corporata Drive
Binghamton 13904
Tel: (80~{22-9300
FAX: (60 722-9562

Ploneer~ndard

4505 Broadmoor S.E.
Grand Rapids 49512
Tel: (616) 698-1800
FAX: (616) 688-1831

Pioneer-Standard
7625 Golden Triange Dr., #G
Eden Prairie 55344

FAX: (508) 694-1754

MTI System.
1 Penn Plaza
250 W. 34th StreOl
NowYortc 10119
Tel: (212) 843-1280
FAX: (212) 843-1288

Ploneer-5tandard
60 croasw%"ark West
Woodbury, n~ Island 11797
Tel: (516) 921-8 00
FAX: (518) 921-2143

FAX: (301) 870-8748

~:~(g~r'M'J:'k

) 751-2552

~~:(~m)~2~lo

Hamlllon/AvnOl
10 Industrial
Falrtleld 07008
Tel: (201) 575-3390
FAX: (201) 575-5839

Pioneer Technologies Group
15810 GaHher Road

MASSACHUSETTS
Arrow/Schwaber Electronics
25 ur,ton Dr.

FAX: (

Hamillon/Avnot
103 Twin Oaks Drive
Syracuse 13120

Hamllton/Avnet
41850 Garden Brook Rd., #100
Nevi 48375
Tel: (313) 347-4270
FAX: (313) 347-4021

Hamliton/AvnOl
12400 WhHewater Drive
MlnnOlonke 55343
Tel: (612) 932-0800
FAX: (612) 932-0613

¥:I:~~~"J~I~

¥~~r('i=10

Hamlllon/Avna1
2060 Townllne Rd.
Rochester 14823
Tsl: (718) 292-0730
FAX: (718) 292-0810

~7&:(~m)2~ma

~7&:(~m)~9

CGlSALE/050892

intel~
OHIO (eontd.)
Avnel Compular
7784 Washington Vlllaga Or.
Ooron45459

~~:(~J~~)~s:b~9

~~5c:J;,~~~e Rd•• Bldg. A
Solon 44139
Tal: (216) 349-2505
FAX: (216) 349·1684

Hamillon/Avnat
"{j60 W:m'rn Vlliaga Dr.
T:l'(;\3) 439-6733
FAX: (513) 439-6711
Hamll1on/Avnel
30325 BaInbridge
Solon 44139
Tal: (216) 349-4910
FAX: (216) 349-1684
Hamillon/Avnel
2600 Corp Exchanga Drive. #180
Columbus 43231
Tal: (614) 862-7004
FAX: (614) 862-6650

MTI SysIams Sal..

23404 Commarce Park Rd.
Beachwood 44122
Tel: (216) 484-6866
FAX: (216) 464-3584
Plonaar·Standard
4433 Interpolnl Boulevard

~r;,~

FAX: (513) 236-6133

Plonaar·Standard

4600 E. 131st _

Clavaland 44105
Tal: (216) 587-3800
FAX: (216) 883-1004

OKLAHOMA
Arrow/Schweber Electronics
12111 East 51st 81ree1. #101
Tulsa 74148
Tel: (916) 252·7537
FAX: (916) 254-0917

NORTH AMERICAN DISTRIBUTORS (Contd.)
Hamll1on/Avnel
213 executive. #320
Mars 16045
Tel: (412~281-4152
FAX: (41 772·1890
Pionaer~Standard

259 Kappa Drive
P~bur~h 15236
Tel: (41 b762.2300
FAX: (41 983-6255

PIoneer Technologl.. Group
500 Enterprlaa Road
=h:''7=ln... Canter

~~:~J~~"I~~
TEXAS
Arrow/Schwab., Electronics
3220 Commander Drive
Carrollton 75006
Tal: (214) 380-8484
FAX: (214) 248-7206
Avnel Compular
4004 Beltllna, SuHe 200
Dallas 75244
Tal: (214) 306-6181
FAX: (214) 308-8129
Avnel Computer
1235 North Loop West. #525
Houston
Tal: (713) 887-7500
FAX: (713) 861-6851

nooe

Hamll1on/Avnel
162I1-F Kramer Lana
Austin 78758

~~:(~m)~~~5

Hamil1on/Avnel
9750 Sou1hwast Nimbus Ave.
Beavarton 87005
Tel: (503) 627-()201
FAX: (503) 841-4012

:m~':~~~urt

_rton

Bldg. G.

Su~e
200
97005

Tel: (503) 843-7900
FAX: (503) 848-5488

~~:(7J~~)2:g;rml

Plon..r·Standard
10530 Rockley Rood, #100
Houston 77099
Tel: (713) 495-4700
FAX: (713) 495-5842

Mars 16048

~~m~~m2!\:o

~104

f.1:~~~~~~

FAX: (601) 972-2524

WASHINGTON
flJmaclArrow Electronics
14360 S.E. Eastgate Way
Bellevue 96007
Tel: (206) 843-9992
FAX: (206) 843-6709
Hamll10nlAvnel
17781 N.E. 78th PIaoa. #C
Redmond 86052
Tel: (206) 241·8555
FAX: (206) 241-5472

~~:,
78th PIeca
Redmond 86OS2
~~:(=)~t.J~1
~:S~he~rreat

Redmond 98052
Tal: (208) 861-1150
FAX: (206) 861-1587
WISCONSIN

Pioneer-standard

~:,=~=r #183
Tel: (414) 784-3480
ALASKA

~~~':=~n Blvd., #400

AnchO:~
98503
Tal: (90 274-9899
FAX: (90

CANADA

Tel: (214) 23S-9953
FAX: (214) 844-5084

ALBERTA

~g ~.:~~

~~:2~m&= Northeast

Lana, #330
Austin 78758
Tel: (51~34S-86S3
FAX: (51 345-6330

~~l~~"='crast. #100
Houston 77099
Tel: (713) 879-9953
FAX: (713) 879-6540
UTAH
Arrow/Schweber ElecIronlcs

~:'t!:~~1~~'
9~-6813

Tel: (801)

Hamllton/Avnat
8610 Commerce Court
Burnaby VSA 4N8
Tel: (804) 420-4101
FAX: (804) 420.s378
zentronlcs
1Jc1:!':er,T2Rd.• #106
Tal: (804) 273-5575
FAX: (804) 273-2413
ONTARIO
Arrow/Schwaber Electronics
39 Arrtarse Dr•• Un~ 100

~:rnr3K2~
FAX:

(61~) 723-2018

ArrowlSchweber Electronics
1093 Mayaralda. UnH 2

¥e~l~sl~~M4
FAX: (416) 870-7781

AvnatCom~

151 Supartor Blvd.

¥a~l~~~'
Avnat Computer
180 Colonada Road

~~~~~

FAX: (8\\) 2211-1184
Hamll1on/Avnat
151 Suparlor Blvd., UnHs 1-6

¥~":,,=~1
FAX: (416) 5114-8033

Hamlllon/Avnat
180 Colonade Road
Nemn K2E 7J5
Te: (613~ 228-1700
FAX: (81 ) 228-1184
Ztn1ronlcs
1355 Mayaralda Drive
MIssIssaU'/;'l LST 1C9
Tel: (41~ 84-8800
FAX: (41 584-3127
zentronlcs
155 Coionado Rd.. South
Un" 17
NepaanK2E7Kl
Tol: (813) 226-6840
FAX: (813) 228-S3S2
QUEBEC
Arrow/Schweber Electronics

~~~5BIvd.

Tel: (514) 421-7411
FAX: (514) 421-7430

277-2839

m;rg
=m~vanue
Richardson 75081

PENNSYLVANIA

~~~::'&,~'1lrlve. #320

FAX: (901)

m:l; ~~~South •.#E

Avnel Compular
20675 Crossroads Circla, #400
waukesha 53186
Tel: (414) 784-6205
FAX: (414) 784-6006
Hamll1on/Avnel
28675 Crossroad. Circle, #400
waukasha 53188
Tel: (414) 784-4510
FAX: (414) 784-6SOB

Pioneer-Standard
13785 Bela Rood
Oolles 75244
Tel: (214) 283-3186
FAX: (214) 4911-8419

Avnel Computer
8409 Sou1_ Nimbus Ava.
Beaverton 97005
Tel: (503) 827-0900
FAX: (503) 526-6242

Hamll1on/Avnat
1100 East 8600 South. #120

~::ij~_~l

Hamll1on/Avnel
1235 North Loop West, #521
HouslOn 77008

OREGON

mi~)~l

FAX: (601) 288-0082

Arrow/Schweber Electronics
200 N. Patrick Blvd., #100
B_1d 5800S
Tal: (414) 782-0150
FAX: (414) 782-0158

Plonaer-Standard
1828-0 Kramar Lane
Austin 78758
Tel: (512) 835-4000
FAX: (512) 835-9829

flJmBfJ/Arrow Electronics
1865 N.W. 189th PIaoa
Beavarton 97006

~t:ij~:t~l~l

Hamil1on/Avnel
4004 BeHllne, SuHe 200
00Ilas75244
Tel: (214) 306-6111
FAX: (214) 3011-8109

Hamll1on/Avnel
12121 E. 51st 81.• #102A
Tulaa 74148

~~:(9J~~)~~~

~~.f.=-s:.uth. #150

Calg~T2E 8Z2
Tel: (m291-3284
FAX: ( ) 2511-1581
zentronlcs
86158th _
N.E., #100

~:g/'4%f~

FAX: (403) 295-6714

BRITISH COWMBIA
All11OC-Arrow ElecIronlcs
8544 Baxter PIaoa
Burnaby V5A 4T8
Tal: (804) 421-2333
FAX: (904) 421-5030

Arrow/SchWeber ElectronIcs
~::IH~--=-BepIIate Ave.
Tel: (418~871-7500
FAX: (41 871-6818

:= lPS

rf.::.m.f,ularm

51 Laurem

Tel: (514) 335-2483
FAX: (514) 335-2481

Hamll1on/Avnel
2785 Halpam
81. Laurent H4S
Tel: (514) 335-1000
FAX: (514) 335-2481

lPS

zentronlcs

520 McCaIIrey

51 Laurent H4T lN3

Tal: (514) 737-9700
FAX: (514) 737-5212

EUROPEAN SALES OFFICES
FINLAND

GERMANY

Inl.1 Finland OY
RuaaUantla 2
00390 H.lslnkl
T.I: (358) 0544644
FAX: (358) 0 544 030

Inl.IGmbH
Domach.r Strassa 1
8016 F.ldklrchan bel Mu.neh.n

FRANCE

ISRAEL

~~:(m)~~~

\~~u~s':.'GpS~R.L
78054 St. Qu.nlln-an·Yvalines
Cad.x
T.I: (33) (1) 30 57 70 00
FAX: (33) (1) 3064 80 32

In181 S.mlconductor Ud.
A1Idim Induatrial Park·Nav. Sharal
P.O. Box 43202
T.I·AvIv 81430
T.I: (972) 03 498080
FAX: (972) 03 491870

ITALY
Int.1 Corporation ltalia S.pA
Mllanofiorl Palazzo E
20094 Assago
Milano
.
T.I: (39~ (02/99200950
FAX: (3 ) (2 3498484

SPAIN

NETHERLANDS
Inl.1 Semiconductor B.V.
Postbus 64130
3009 CC Rott.rdam
T.I: (31) 104071111
FAX: (31) 104554688

SWEDEN

Inl.llb.ria SA
Zubaran,28
28010 Madrid
T.I: (34) 308 25 52
FAX: (34) 410 7570

UNITED KINGDOM

~~!~~rallon (U.K.) Ud.
Swlndon, Willshire SN3 1RJ

~~:('l:l)(ram)~

Inl.1 SWad.n A.B.

~3i·Gof~a

T.I: (48) 8 734 01 00
FAX: (48) 8 278085

EUROPEAN DISTRIBUTORS/REPRESENTATIVES
AUSTRIA
Bach.r EI.ctronlcs GmbH
Rot.nmu.hlg.... 26
A-1120Wien
Tal: 43 222 813564BO
FAX: 43 222 834276
BELGIUM

Proolectron V.rtri.bs GmbH
Max·PIanck·Slr.... 1-3
8072 Dr.I.lch
T.I: 49 8103 304343
FAX: 49 6103 304425
GREECE

NETHERLANDS

Datelcom
En.rgl_l
2627 AP D.1ft
T.I: 31 15 60S 906
FAX: 31 15 619 194

In.1eo Belgium SA
Avenue des Croix de Guerra 94
1120 Bruxall..
T.I: 32 2 244 2811
FAX: 32 2 216 4301

Poulladls AssocIates Corp.
5 Koumbart StreB!
Kolonakl Square
10874At11ens
Tel: 30 1 3BO 3741
FAX: 30 1 3BO 7501

Diode Compon.nts b.••
Collbean 17
3439 NG Nlauwag.ln
Tel: 3402 91234
FAX: 3402 35924

FRANCE

IRELAND

SOU1H AFRICA

Almex

Micro Markaling
Taney Hall
Egllnlon T.rracs
Dundrum
Dublin 14
Tel: 010 3531 989 400
FAX: 010 3531 999 826

EBE
P.O. Box 912·1222
SII.erton 0127
Tol: 2712 803 7680
FAX: 27 12803 6294

ISRAEL

ATD Elactronlce, S.A.
Avda de la Industria, 32
Na.. 17, 2B
28100 Alcobendas
Madrid
Tol: 34 1 661 6651
FAX: 34 1 661 8300

48, Rue de l'Aubeplno
B.P.102

f.~~'f"~=
FAX: 33 1 4666 8028

lex Electron Ics
60-62 Ruo d•• Je'masux
Sille 595

~~u~~8~:

FAX: 33 1 4978 0598

Tokelec
5 Ru. Ceri. Vernal
BP2
92310 Savras
Tel: 33 1 4623 2425
FAX: 33 1 4507 2191
GERMANY
E2000 Vertrleb.·AG

=Ij,',~~~~:nl~

Tel: 4999420010
FAX: 49 89 42001209
Jermyn GmbH
1m Dechsstueck 9

~4~={"s080

FAX: 49 6431 506299

Eestronlcs ltd.
Rozanl.l1
P.O.B.39300
T.I Baruch
Tel·AvIv 81392
T.I: 972 3 6459m
FAX: 972 3 6459666
ITALY

Nortae Electronics A/S
Postbok. 123
Smedsvlng.n 4B
N·I364HVaIslad

~~2846210

FAX: 47 2 949545

Nort.e Electronics AB
Parkvag.n 2A
5-171
27 Solna
Swad.n
T.I: 46 8 7051850
SWITZERLAND
Industrad. A.G.
Hortlstrasse 31
CH·8304 WallI.ellon
Tel: 41 1 8328111
FAX: 41 1 8307550

SPAIN

OY Rnlronlc AB
HelkkllanUo 2a
SF-0210 Holslnkl
Finland
T.I: 359 0 9928022
FAX: 358 0 6621251

Lasl Elatlronica S.PA
P.I.00839000155
Vlale Fulvlo TesU, N.280
20126 Milano
Tel: 39 2 66101370
FAX: 39 2 66101385

ITT Multlkomponont A/S
Neveriand29
DK·2BOO Glostrup
Denmark
Tel: 4542451822
FAX: 45 42 450724

=~~sr,~lRW

Tel: 0256 707107
FAX: 0256 707162

Jermyn
V.stry EBlBl.
OtIord Road
Savonoaks
Kant TN14 5EU
T.I: 0732 743743
FAX: 0732 451251
MMDJRapId
3 Bennal Court
Bennal Road

~~~eRG2OQX

Tol: 0734 313232
FAX: 0734 313255

TURKEY
EMPA
Florya J. Merkozl
=01 LondraAslalll
OFlorya
Istanbul
Tel: 901 5993050
FAX: 901 5655353

SCANDINAVIA

Intesl Div. Della Deutseho
Divisione ITT Industries GmbH
P.I. D5550110156
20094 Assago (Milano)
Tel: 39 2 624701
FAX: 39 2 8242831

~~~==ents ltd.
Chlneharn Busln... Park
Crockford LBn.

YUGOSLAVIA
H.R. Microelectronics Corp.
2005 de Ia Cruz Blvd.
Suite 220
San18 Clara, CA 95050
U.SA

~~:(~~)~~

UNITED KINGDOM

Avnet-Access
JublleaHou.o
Jublle. Road
LetchWorth
He_hire
SG61QH
Tel: 0462 480866
FAX: 0462 662467

CGJSALEJ050B92

INTERNATIONAL SALES OFFICES
AUSTRALIA
Intel Australia Ply. Ltd.
Unn 13

A1lambie Grove Business Park
25 Frenchs Forest Road East
Frenchs Forest, NSW, 2086
Sydney
Tel: 61-2·975-3300
FAX: 61·2-975-3375
Intel Australia Ply. Ltd.
711 High Stroot
1st Floor
East Kw. Vic" 3102

Melbourne
Tel: 61-3-810-2141
FAX: 61-3-819 7200
BRAZIL

Intel Semiconductor ltd.·
10/F East Tower

Kumagaya-shl, Saitama 360

~~~M~rg44-4555

Tol: 0485-24-6871
FAX: 0485-24-7518

FAX: (852) 868-1989

INDIA
Intel Asia Electronics, Inc.

4/2, Samrah Plaza
51. Mark's Road

Bangatore 560001
Tol: 91-812-215773
Tl.X: 953-845-2646 INTEL IN
FAX: 091-812-215067

Intel Semlconductores do Brazfl LTDA
Avonlda Paulista, 1159-CJS 404/405
CEP 01311 • Sao Paulo· S.P.
Tel: 55-11·287·5899
Tl.X: 11-37-557-ISOB
FAX: 55-11-287-5119
CHINA/HONG KONG

Intel PAC Corporation
15/F, Offico I, Citlc Bldg.
Jian Guo Men Wal Street

~:I!i(~, :~4850 .

Tl.X: 22947 INTEL CN
FAX: (1) 500-2953

Intel J~n K.K.*

~~~8'HoUn~:~~ya

Bond Center
Queensway, Central

KOREA

Kowa·asa Bldg.

Intel Korea, Ltd.
16th Floor, Ufo Bldg.
61 Valda-dong, Voungdeungpo-Ku
Soou1150·010
Tol: (2) 784·8186
FAX: (2) 784-8096

2-11-5 Shin-Yokohama
Kohoku-ku, Yokohama-shl
Kanagawa, 222

SINGAPORE

Intel Japan K.K."

Tel: 045-474-7660

FAX: 045-471-4394

Intel Japan K.K. *
Ryokuchl·Ekl Bldg.
2-4-1 Terauchi

~~r~t~~.~lb~saka 560

Intel Singapore Technology, Ltd.
101 Thomson Road #08-03/06
United Square
Singapore 1130
Tol: (65) 250-7811
FAX: (65) 250-9256

FAX: 06-863·1084
JAPAN
Intel Japan K.K.
5-6 Tokodal, Tsukuba·shl
Ibarakl,3oo-26
Tol: 0298-47-8511
FAX: 0298-47-8450

Intol Japan K.K.
Shinmaru Bldg.
1-5-1 Marunouchi
Chiyoda·ku, Tokyo 100
Tol: 03-3201-3621
FAX: 03-3201-6850

Intel Japan K.K."

~::~~a~~~.K.K.

HaChiOjl,Shl, Tokyo 192
Tol: 0426-48-8770
FAX: 0426-48-8775

1-16-20 Nishiki
Naka-ku, Nagoya-shi
Alchi 460
Tol: 052-204-1261
FAX: 052-204-1285

~.f~~o~~~I~~~Chl

TAIWAN
Intel Technology Far East Ltd.
Taiwan Branch Office
8th Floor, No. 205
Bank Tower Bldg.
Tung Hua N. Road
Taipei
Tel: 886-2-5144202
FAX: 886-2-717-2455

INTERNATIONAL DISTRIBUTORS/REPRESENTATIVES
ARGENTINA

INDIA

Oafsys S.R.L.
Chacabuco, 90-6 Piso
1069-Buenos Aires
Tol. & FAX: 54.1334.1871

Micronlc Devices
Nun Complex
No. 65 D.V.G. Road
Basavanagudi
Bangalore 560 004
Tol: 011-91·812-600-631
011-91·812-611-365
Tl.X: 9538458332 MDBG

AUSTRALIA
Email Electronics
15-17 Hume Street
Huntingdale, 3166
Tol: 011·61-3-544-8244
Tl.X: M30895
FAX: 011-61-3'543-8179
NSD-Australia

~~~ ~:~d~~g~~u8~2~d.
Tel: 03 8900970
FAX: 03 8990819
BRAZIL
Microlinear
Largo do Arouche, 24
01219 Sao Paulo, SP
Tol: 5511·220-2215
FAX: 5511-220-5750
CHILE

Micronic Devices
No. 516 5th Floor
Swastik Chambers
Sian, Trombay Road
Chembur
Bombay 400 071
Tl.X: 9531 171447 MOEV
Micronic Devices
25/8, 1st Floor
Bada Bazaar Marg
Old Rajindor Nagar
Now Oolhl 110 060
Tol: 011-91-11-5723509
011-91-11-589771
Tl.X: 031-63253 MONO IN
Micronic Devices
6-3-348/12A Dwarakapuri Colony
Hydorabad 500 482
Tol: 011·91-842-226748

Sisteco
Vecinal 40- Las Condes
Santiago
Tol: 562-234-1644
FAX: 562-233-9895

S&S Corporation
1587 Kooser Road
San Jose, CA 95118
Tol: (408) 978-6216
Tl.X: 820281
FAX: (408) 978-8535

CHINA/HONG KONG

JAMAICA

Novel Precision Machinery Co., Ltd.
Room 728 Trade Square
681 Cheung Sha Wan Road
Kowloon, Hong Kong
Tol: (852) 360-8999
TWX: 32032 NVTNL HX
FAX: (852) 725-3695

MC Systems
10-12 Grenada Crescent
Kingston 5
Tol: (809) 929-2638
(809) 926-0188
FAX: (809) 926-0104
JAPAN

GUATEMALA
Abinltio
11 Calle 2-Zona 9
Guatemala City
Tol: 5022-32-4104
FAX: 5022-32-4123

"'Field Application Location

Asahi Electronics Co. Ltd.
KMM Bldg. 2-14-1 Asano
Kokurakita-ku

~:rk~~~~t~~~2

FAX: 093-551-7861

CTC Components Systems Co., Ltd.
4-8-1 Dobashi, Mlyamae-ku
Kawasaki-shl. Kanagawa 213
Tol: 044-852-5121
FAX: 044-877-4268
Dla Semlcon Systems, Inc.
Flower Hili Shinmachi Higashl-kan
1-23 Shlnmachi, Setagaya·ku
Tokyo 154
Tol: 03-3439-1600
FAX: 03-3439·1601

~~~r~ ~~~~e

SAUDI ARABIA
ME Systems, Inc.
642 N, Pastorla Ave.
Sunnyvalo, CA 94086
U.SA
Tol: (408) 732-1710
FAX: (408) 732-3095
Tl.X: 494-3405 ME SYS
SINGAPORE
Electronic Resources Pie, Ltd,

~~~~7~n~~~~re 1336

~:r~~~~:2~~~1a5shi 460

TWX: RS 56541 ERS

FAX: 052-204-8380

FAX: (65) 289-5327

Ryoyo Electro Corp.
Konwa Bldg.
1-12·22 Tsukiji

SOUTH AFRICA

~~~~t~5~~~,1 04
FAX: 03-3546-5044
KOREA
J·Tek Corporation
Dong Sung Bldg. 9/F
158-24, Samsung-Dong, Kangnam-Ku
Sooul 135-090
Tol: (822) 557-8039
FAX: (822) 557-8304
Samsung Electronics
Samsung Main Bld~.
~;~Ja1e86..~~~-RO' KA, Chung-Ku
C.P.O. Box 8780
Tol: (822) 751-3660
TWX: KORSST K 27970
FAX: (822) 753-9065
MEXICO

cO C.v.
b:r~~~~~,\1~~S~1~S

PSI SA

Tol: (65) 283-0888

~~8c~~~~~~i~;~roN~~:~eyet St.)

Meyerspark, Pretoria, 0184
Tol: 011-2712-803-7680
FAX: 011-2712-803-8294
TAIWAN

Micro Electronics Corporation
12th Floor, Section 3

~:?p~~~~~.t:~ast Road
Tel: (886) 2-7198419
FAX: (886) 2-7197916
Acer Sertek Inc,
15th Floor, Section 2
Chien Kuo North Rd.
Taipei 18479 R.O.C.
Tol: 886·2-501-0055
TWX: 23756 SERTEK
FAX: (886) 2-5012521
URUGUAY

Tol: 52-73-13-9412
52-73-17-5340
FAX: 52-73-17-5333

Interfase
Zabala 1378
11000 Montevideo
Tol: 5982-96-0490
5982-96·1143
FAX: 5982-96-2965

NEW ZEALAND

VENEZUELA

Email Electronics
36 Olive Road
Penrose, Auckland
Tol: 011·64-9-591-155
FAX: 011-64-9-592-661

Unixel C.A.
4 Transversal de Monte Cristo
Edt. AXXA, Piso 1. of. 1&2
Centro EmpresariaJ Boleita
Caracas
Tol: 582-238-6082
FAX: 582-238-1816

CG/SALE/05089:

NORTH AMERICAN SERVICE OFFICES
ALASKA
Inlel Corp.
c/o TransAlaska Network
1515 Lore Rd.

r.1~~~h~~~~'V76

Intel Corp.
C/o TranSAIaska Dale Systems

~2~ ~~0f,,':.~t~~::. 407
Fairbanks 99701

Tel: (907) 452·6264
ARIZONA
*Intel Corp.
410 North 44th Street
Suite 500
Phoenix 85008
Tel: (602) 231-0386
FAX: (602) 244-0446
*Intel Corp.

500 E. Fry Blvd., Sune M-15
Sierra Vista 85835
Tel: (602) 459-5010
ARKANSAS
Intel Corp.

rs"~te:~1 p,;erg~~e

Li1tle Rock 72204
CALIFORNIA

CONNECTICUT

;~1teLe~°:Pa"rm Corporate Park

83 Wooster Heights Rd.
Danbury 06811
Tel: (203) 748-3130

FLORIDA
.... Intel Corp.
800 Falrway Dr., Suna 160
Deerfield Beach 33441

~~~}~85~)4:J;~

*Intel Corp.
5850 T.G. Lee Blvd., Ste. 340
O~ando 32822
Tel: (407) 240-8000

~~?s~~~~~~~5~~'

Tel: (916) 351-6143
-Intel Corp.
9665 Chesapeake Or.• Sune 325

~ glf~o~~~~~
**Intel Corp.

400 N. Tustin Avenue

Suite 450
Santa Ana 92705
Tel: (714) 835-9642

5523 Theresa Street
Columbus 31907

~~~~(e\n~t~5~J

HAWAII

MISSISSIPPI

*'*Intel Corp.
Honolulu 96820
Tel: (B08) 847-6738

Intel Corp.
C/o Compu-eare
2001 Airport Road, sun. 205F
Jackson 3920B
Tel: (601) 932-8275

~;r,a~~8~u~5-~~
INDIANA

;~igl ~u~~ue Rd .. Ste. 350

Indianapolis 48268
Tel: (317) 875'()623

KANSAS
'Inlel Corp.
10985 Coay, Sune 140
Ova~and Park 68210
Tel: (913) 345-2727
KENTUCKY

COLORADO

Inlel Corp.
688 Hillcrest Road, Apt. A
Radcliff 40160 (Louisville)

·Intel Corp.

LOUISIANA

Tel: (303) 321-8086

Intel Corp.
5858 East MollOY Road
Syracusa 13211
Tel: (315) 454-0576

;!rJgl S;~rrcith St.. Sune 360

~~~~~~~8~:ark, sune 150

;;~e~~fomas Exp.• 1st Aoor

g~~';:;r ~~~ St., Suite 700

MICHIGAN

3 Carlisle Rd., 2nd Floor
Westford 01886
Tel: (508) 692-0960

Tel: (404) 449-0541

Intel Corp.
133 Walton Ava., Office lA
Lexln1:) 40508
Tel: (
255-2957

Santa Clara 95051
Tel: (408) 970-1747

Intel Corp.
300 Wastage Business Center
Suns 230
Fishkill 12524
Tel: (914) 897·3860

MINNESOTA

**tlntal Corp.
Woodfield Corp. Center III
300 N. MartlnM'e Rd.. Ste. 400

*Intel Corp.

MASSACHUSETTS

;!:!~r~°8:;rp. Center

*Intel Corp.

21515 Vanowen St., St•. 116

f~I~1~r£d~~~

*lnle1 Corp.
2950 Expressway Dr. South
Sune130
Islandia 11722
Tel: (516) 231·3300

GEORGIA

ILLINOIS

*Intel Corp.
300 N. Continental Blvd.
Sune 100

NEW YORK

··Intel Corp.

*Intel Corp.
7071 Orchard Lake Rd., Ste. 100
West Bloomfteld 48322
Tel: (313) 851-8905

-Intel Corp.

~:r(Bfar"{U~~gg

MARYLAND
10010 Junction Dr., Sune 200
Annapolis Junction 20701
Tel: (301) 21)6.2860

Hammond 70401
(seNlced from Jackson, MS)

MISSOURI
*'ntel Corp.
3300 Rider Trail South
Suite 170

Earth CIW 83045
Tel: (314 291-1990
Inlel CO'l'.
Route 2, Box 221
Smithville 64089
Tel: (913) 345-2727
NEW JERSEY
**Intal Corp.
300 Sylvan Avanue
Englewood Cliffs 07632
Tel: (201) 567-0921

~:~~~~ca

Center
125 Han Mile Road
Red Bank 07701
Tel: (908) 747-2233

NORTH CAROUNA

*Intel Corp.
5800 Executive Center Drive
Suns 105
Cha~otte 28212
Tel: (704) 568-8966

··Intel Corp.

5540 Centerview Dr., Sune 215

Intel Corp.
Rio Rancho 1
4100 Sara Road
Rio Rancho B7124-1 025

fe~~5~~~~~~&\

TEXAS
--Intel Corp.
Weslech 360, Sune 4230
~~lnN7~'1&~~kg~ Texas Hwy.
Tel: (512) 794-8086

·-tlntal Corp.

12000 Ford Rd., Suite 401
Dallas 75234
Tel: (214) 241-8087

;;~~e~Wf!:.eway, Sune 1490

Houston 77074
Tel: (713) 9811-6086

UTAH
Intel Corp.
428 East 6400 South
SunelO4

~:I~\~~ 9r::-8537

~~~1'l0t' ~~-8051

OHIO

VIRGINIA

**Intel

Co~.

3401 Park Center Dr•• Ste. 220

~:rrs'\ :r~~5350
~;~~~r.nce

Park Dr.. Ste. 100
Beachwood 44122
Tel: (216) 464-2736
OREGON

;~~:1 ~.w.·Greenbrler Pkwy.

Building B
Beaverton 97006
Tel: (503) 645-8051
PENNSYLVANIA
'tlntel Corp.
925 Harvesl Drive
Sune 200
Blue Bell 19422

i~Jb£~~s'.iJOOO
FAX: (215) 641-0785

·*flnlal Corp.
NEW MEXICO

PUERTO RICO
Intel Corp.
South Industrial Park
P.O. Box 910
Las Piedras 00671
Tel: (809) 733·8616

400 Penn center Blvd., Ste. 610

~:~~I~r Ji~70
""'ntal Corp.
1513 Cedar Cliff Dr.

~:t:"~r~1

;m'aeo

FAX: (801) 268-1457
*Intel Corp.

9030 Stony Point Pkwy.
Sune 360
Richmond 23235
Tel: (804) 330-9393
WASHINGTON
**Intel Corp.
155 108th Avenue N.E., Ste. 388
Bellevue 98004
Tel: (206) 453-B086

CANADA
ONTARIO

·*'ntel Semiconductor of

Canada, Ltd.
2650 QueensYIew Dr., Ste. 250
Ottawa K2B 8H6
Tel: (613) 829-9714
**Intel Semiconductor of
Canada. Ltd.
190 _ell Dr., Ste. 102
Rexdale (Toronto) Maw 6H8
Tel: (416) 675-2105
QUEBEC

"'ntel Semiconductor of

Canada, Ltd.
1 Rue Holiday
Suile115
Tour East
PI. Claire H9R 5N3

m'<~W-6s:t~J:

CUSTOMER TRAINING CENTERS
ARIZONA
2402 W. Beardsley Road
Phoenix 85027
Tel: (602) 869-4286
1-800-468-3548

SYSTEMS ENGINEERING OFFICES
MINNESOTA
3500 W. 80th Sireet
Sune 360

~~~:0(e\~~~~J

NEW YORK
2950 Expressway Dr., South
Islandia 11722
Tel: (506) 231-3300

*Qany-In locations

*-Carry-In/mail-In locations

CGlSALEl050682

UNITED STATES
Intel Corporation
2200 Mission College Boulevard
P.O. Box 58119
Santa Clara, CA 95052-8119
JAPAN
Intel Japan K.K.
5-6 Tokodai. Tsukuba-shi
Ibaraki, 300-26
FRANCE
Intel Corporation S.A.R.L.
1, Rue Edison, BP 303
78054 Saint-Quentin-en-Yvelines Cedex
UNITED KINGDOM
Intel Corporation (U.K.) Ltd.
Pipers Way
Swindon
Wiltshire, England SN3 1RJ
GERMANY
Intel GmbH
Dornacher Strasse 1
8016 Feldkirchen bei Muenchen
HONG KONG
Intel Semiconductor Ltd.
1O/F East Tower
Bond Center
Queensway, Central
CANADA
Intel Semiconductor of Canada, Ltd.
190 Artwell Drive, Suite 500
Rexdale, Ontario, M9W 6H8

Source Exif Data:

File Type                       : PDF
File Type Extension             : pdf
MIME Type                       : application/pdf
PDF Version                     : 1.3
Linearized                      : No
XMP Toolkit                     : Adobe XMP Core 4.2.1-c043 52.372728, 2009/01/18-15:56:37
Producer                        : Adobe Acrobat 9.2 Paper Capture Plug-in
Modify Date                     : 2010:01:13 16:37:16-08:00
Create Date                     : 2010:01:13 16:37:16-08:00
Metadata Date                   : 2010:01:13 16:37:16-08:00
Format                          : application/pdf
Document ID                     : uuid:b5af4d3e-7f6e-438d-9a9a-5033ac357dc2
Instance ID                     : uuid:c388d020-594b-4994-a9d8-98b9e1d9c0a5
Page Layout                     : SinglePage
Page Mode                       : UseNone
Page Count                      : 242

EXIF Metadata provided by EXIF.tools

486DX_Data_Sheet_Oct92 486DX Data Sheet Oct92

Navigation menu

Versions of this User Manual:

Views

Navigation