View MQ80C286_8380915.PDF datasheet online --- IC-ON-LINE

Datasheet File OCR Text:

february 1990 order number: 271103-001 m80c286 high performance chmos microprocessor with memory management and protection military y high speed chmos iii technology y pin for pin, clock for clock, and functionally compatible with the hmos m80286 (see m80286 data sheet, order y 271028-003) y stop clock capability e uses less power (see i ccs specification) y 10 mhz clock rate y 68 lead pin grid array package y 68 lead ceramic quad flatpack package (see packaging spec., order y 231369) y military temperature range: b 55 cto a 125 c(t c ) introduction the m80c286 is an advanced 16 bit chmos iii microprocessor designed for multi-user and multi-tasking applications that require low power and high performance. the m80c286 is fully compatible with its predeces- sor the hmos m80286 and object-code compatible with the m8086 and m80386 family of products. in addition, the m80c286 has a power down mode which uses less power, making it ideal for mobile applications. the m80c286 has built-in memory protection that maintains a four level protection mechanism for task isola- tion, a hardware task switching facility and memory mangement capabilities that map 2 30 bytes (one gigabyte) of virtual address space per task (per user) into 2 24 bytes (16 megabytes) of physical memory. the m80c286 is upward compatible with m8086 and m8088 software. using m8086 real address mode, the m80c286 is object code compatible with existing m8086, m8088 software. in protected virtual address mode, the m80c286 is source code compatible with m8086, m8088 software which may require upgrading to use virtual addresses supported by the m80c286's integrated memory management and protection mechanism. both modes operate at full m80c286 performance and execute a superset of the m8086 and m8088 instruc- tions. the m80c286 provides special operations to support the efficient implementation and execution of operating systems. for example, one instruction can end execution of one task, save its state, switch to a new task, load its state, and start execution of the new task. the m80c286 also supports virtual memory systems by providing a segment-not-present exception and restartable instructions. 271103 1 figure 1. m80c286 internal block diagram
m80c286 functional description introduction the m80c286 is an advanced, high-performance mi- croprocessor with specially optimized capabilities for multiple user and multi-tasking systems. depending on the application, a 10 mhz m80c286's perform- ance is up to eight times faster than the standard 5 mhz m8086's, while providing complete upward software compatibility with intel's m8086, 88, and 186 family of cpu's. the m80c286 operates in two modes: m8086 real address mode and protected virtual address mode. both modes execute a superset of the m8086 and 88 instruction set. in m8086 real address mode programs use real ad- dresses with up to one megabyte of address space. programs use virtual addresses in protected virtual address mode, also called protected mode. in pro- tected mode, the m80c286 cpu automatically maps 1 gigabyte of virtual addresses per task into a 16 megabyte real address space. this mode also pro- vides memory protection to isolate the operating system and ensure privacy of each tasks' programs and data. both modes provide the same base in- struction set, registers, and addressing modes. the following functional description describes first, the base m80c286 architecture common to both modes, second, m8086 real address mode, and third, protected mode. m80c286 base architecture the m8086, 88, 186, and 286 cpu family all contain the same basic set of registers, instructions, and addressing modes. the m80c286 processor is up- ward compatible with the m8086, m8088, and 80186 cpu's and fully compatible with the hmos m80286. register set the m80c286 base architecture has fifteen registers as shown in figure 2. these registers are grouped into the following four categories: general registers: eight 16-bit general purpose registers used to contain arithmetic and logical oper- ands. four of these (ax, bx, cx, and dx) can be used either in their entirety as 16-bit words or split into pairs of separate 8-bit registers. segment registers: four 16-bit special purpose registers select, at any given time, the segments of memory that are immediately addressable for code, stack, and data. (for usage, refer to memory organi- zation.) base and index registers: four of the general pur- pose registers may also be used to determine offset addresses of operands in memory. these registers may contain base addresses or indexes to particular locations within a segment. the addressing mode determines the specific registers used for operand address calculations. status and control registers: the 3 16-bit special purpose registers in figure 3 record or control cer- tain aspects of the m80c286 processor state includ- ing the instruction pointer, which contains the offset address of the next sequential instruction to be exe- cuted. 16-bit special register register name functions 7070 byte addressable ax ah al multiply/divide register (8-bit dx dh dl i/o instructions * shown) names cx ch cl ( loop/shift/repeat/count % bx bh bl base registers bp * si index registers di * sp ( stack pointer 15 0 general registers 15 0 cs code segment selector ds data segment selector ss stack segment selector es extra segment selector segment registers 15 0 f status word ip instruction pointer status and control registers figure 2. register set 2
m80c286 271103 2 figure 3. status and control register bit functions flags word description the flags word (flags) records specific characteris- tics of the result of logical and arithmetic instructions (bits 0, 2, 4, 6, 7, and 11) and controls the operation of the m80c286 within a given operating mode (bits 8 and 9). flags is a 16-bit register. the function of the flag bits is given in table 1. instruction set the instruction set is divided into seven categories: data transfer, arithmetic, shift/rotate/logical, string manipulation, control transfer, high level instruc- tions, and processor control. these categories are summarized in table 2. an m80c286 instruction can reference zero, one, or two operands; where an operand resides in a regis- ter, in the instruction itself, or in memory. zero-oper- and instructions (e.g. nop and hlt) are usually one byte long. one-operand instructions (e.g. inc and dec) are usually two bytes long but some are en- coded in only one byte. one-operand instructions may reference a register or memory location. two- operand instructions permit the following six types of instruction operations: eregister to register ememory to register eimmediate to register ememory to memory eregister to memory eimmediate to memory table 1. flags word bit functions bit name function position 0 cf carry flageset on high-order bit carry or borrow; cleared otherwise 2 pf parity flageset if low-order 8 bits of result contain an even number of 1-bits; cleared otherwise 4 af set on carry from or borrow to the low order four bits of al; cleared otherwise 6 zf zero flageset if result is zero; cleared otherwise 7 sf sign flageset equal to high-order bit of result (0 if positive, 1 if negative) 11 of overflow flageset if result is a too- large positive number or a too-small negative number (excluding sign-bit) to fit in destination operand; cleared otherwise 8 tf single step flageonce set, a sin- gle step interrupt occurs after the next instruction executes. tf is cleared by the single step interrupt. 9 if interrupt-enable flagewhen set, maskable interrupts will cause the cpu to transfer control to an inter- rupt vector specified location. 10 df direction flagecauses string instructions to auto decrement the appropriate index registers when set. clearing df causes auto increment. 3
m80c286 two-operand instructions (e.g. mov and add) are usually three to six bytes long. memory to memory operations are provided by a special class of string instructions requiring one to three bytes. for de- tailed instruction formats and encodings refer to the instruction set summary at the end of this document. for detailed operation and usage of each instruc- tion, see appendix b of the 80286/80287 program- mer's reference manual (order no. 210498). table 2. instruction set general purpose mov move byte or word push push word onto stack pop pop word off stack pusha push all registers on stack popa pop all registers from stack xchg exchange byte or word xlat translate byte input/output in input byte or word out output byte or word address object lea load effective address lds load pointer using ds les load pointer using es flag transfer lahf load ah register from flags sahf store ah register in flags pushf push flags onto stack popf pop flags off stack data transfer instructions movs move byte or word string ins input bytes or word string outs output bytes or word string cmps compare byte or word string scas scan byte or word string lods load byte or word string stos store byte or word string rep repeat repe/repz repeat while equal/zero repne/repnz repeat while not equal/not zero string instructions addition add add byte or word adc add byte or word with carry inc increment byte or word by 1 aaa ascii adjust for addition daa decimal adjust for addition subtraction sub subtract byte or word sbb subtract byte or word with borrow dec decrement byte or word by 1 neg negate byte or word cmp compare byte or word aas ascii adjust for subtraction das decimal adjust for subtraction multiplication mul multiple byte or word unsigned imul integer multiply byte or word aam ascii adjust for multiply division div divide byte or word unsigned idiv integer divide byte or word aad ascii adjust for division cbw convert byte to word cwd convert word to doubleword arithmetic instructions logicals not ``not'' byte or word and ``and'' byte or word or ``inclusive or'' byte or word xor ``exclusive or'' byte or word test ``test'' byte or word shifts shl/sal shift logical/arithmetic left byte or word shr shift logical right byte or word sar shift arithmetic right byte or word rotates rol rotate left byte or word ror rotate right byte or word rcl rotate through carry left byte or word rcr rotate through carry right byte or word shift/rotate logical instructions 4
m80c286 table 2. instruction set (continued) conditional transfers ja/jnbe jump if above/not below nor equal jae/jnb jump if above or equal/not below jb/jnae jump if below/not above nor equal jbe/jna jump if below or equal/not above jc jump if carry je/jz jump if equal/zero jg/jnle jump if greater/not less nor equal jge/jnl jump if greater or equal/not less jl/jnge jump if less/not greater nor equal jle/jng jump if less or equal/not greater jnc jump if not carry jne/jnz jump if not equal/not zero jno jump if not overflow jnp/jpo jump if not parity/parity odd jns jump if not sign jo jump if overflow jp/jpe jump if parity/parity even js jump if sign unconditional transfers call call procedure ret return from procedure jmp jump iteration controls loop loop loope/loopz loop if equal/zero loopne/loopnz loop if not equal/not zero jcxz jump if register cx e 0 interrupts int interrupt into interrupt if overflow iret interrupt return program transfer instructions flag operations stc set carry flag clc clear carry flag cmc complement carry flag std set direction flag cld clear direction flag sti set interrupt enable flag cli clear interrupt enable flag external synchronization hlt halt until interrupt or reset wait wait for busy not active esc escape to extension processor lock lock bus during next instruction no operation nop no operation execution environment control lmsw load machine status word smsw store machine status word process control instructions enter format stack for procedure entry leave restore stack for procedure exit bound detects values outside prescribed range high level instructions memory organization memory is organized as sets of variable length seg- ments. each segment is a linear contiguous se- quence of up to 64k (2 16 ) 8-bit bytes. memory is addressed using a two component address (a point- er) that consists of a 16-bit segment selector, and a 16-bit offset, see figure 4. the segment selector in- dicates the desired segment in memory. the offset component indicates the desired byte address within the segment. 271103 3 figure 4. two component address 5
m80c286 table 3. segment register selection rules memory segment register implicit segment reference needed used selection rule instructions code (cs) automatic with instruction prefetch stack stack (ss) all stack pushes and pops. any memory reference which uses bp as a base register. local data data (ds) all data references except when relative to stack or string destination external (global) data extra (es) alternate data segment and destination of string operation all instructions that address operands in memory must specify the segment and the offset. for speed and compact instruction encoding, segment selec- tors are usually stored in the high speed segment registers. an instruction need specify only the de- sired segment register and an offset in order to ad- dress a memory operand. most instructions need not explicitly specify which segment register is used. the correct segment reg- ister is automatically chosen according to the rules of table 3. these rules follow the way programs are written (see figure 5) as independent modules that require areas for code and data, a stack, and access to external data areas. special segment override instruction prefixes allow the implicit segment register selection rules to be overridden for special cases. the stack, data, and extra segments may coincide for simple programs. to access operands not residing in one of the four immediately available segments, a full 32-bit pointer or a new segment selector must be loaded. addressing modes the m80c286 provides a total of eight addressing modes for instructions to specify operands. two ad- dressing modes are provided for instructions that operate on register or immediate operands: register operand mode: the operand is locat- ed in one of the 8 or 16-bit general registers. immediate operand mode: the operand is in- cluded in the instruction. six modes are provided to specify the location of an operand in a memory segment. a memory operand address consists of two 16-bit components: seg- ment selector and offset. the segment selector is supplied by a segment register either implicitly cho- sen by the addressing mode or explicitly chosen by a segment override prefix. the offset is calculated by summing any combination of the following three address elements: the displacement (an 8 or 16-bit immediate val- ue contained in the instruction) the base (contents of either the bx or bp base registers) 271103 4 figure 5. segmented memory helps structure software the index (contents of either the si or di index registers) any carry out from the 16-bit addition is ignored. eight-bit displacements are sign extended to 16-bit values. combinations of these three address elements de- fine the six memory addressing modes, described below. direct mode: the operand's offset is contained in the instruction as an 8 or 16-bit displacement ele- ment. register indirect mode: the operand's offset is in one of the registers si, di, bx, or bp. based mode: the operand's offset is the sum of an 8 or 16-bit displacement and the contents of a base register (bx or bp). 6
m80c286 indexed mode: the operand's offset is the sum of an 8 or 16-bit displacement and the contents of an index register (si or di). based indexed mode: the operand's offset is the sum of the contents of a base register and an index register. based indexed mode with displacement: the op- erand's offset is the sum of a base register's con- tents, an index register's contents, and an 8 or 16-bit displacement. data types the m80c286 directly supports the following data types: integer: a signed binary numeric value con- tained in an 8-bit byte or a 16-bit word. all operations assume a 2's complement representation. signed 32 and 64-bit integers are supported using the numeric data processor, the m80c287. ordinal: an unsigned binary numeric value contained in an 8-bit byte or 16-bit word. pointer: a 32-bit quantity, composed of a segment selector component and an offset component. each component is a 16-bit word. string: a contiguous sequence of bytes or words. a string may contain from 1 byte to 64k bytes. ascii: a byte representation of alphanu- meric and control characters using the ascii standard of character rep- resentation. bcd: a byte (unpacked) representation of the decimal digits 0 9. packed bcd: a byte (packed) representation of two decimal digits 0 9 storing one digit in each nibble of the byte. floating point: a signed 32, 64, or 80-bit real num- ber representation. (floating point operands are supported using the m80c287 numeric processor). figure 6 graphically represents the data types sup- ported by the m80c286. i/o space the i/o space consists of 64k 8-bit or 32k 16-bit ports. i/o instructions address the i/o space with either an 8-bit port address, specified in the instruc- tion, or a 16-bit port address in the dx register. 8-bit port addresses are zero extended such that a 15 a 8 are low. i/o port addresses 00f8(h) through 00ff(h) are reserved. 271103 5 figure 6. m80c286 supported data types 7
m80c286 table 4. interrupt vector assignments interrupt related does return address function number instructions point to instruction causing exception? divide error exception 0 div, idiv yes single step interrupt 1 all nmi interrupt 2 int 2 or nmi pin breakpoint interrupt 3 int 3 into detected overflow exception 4 into no bound range exceeded exception 5 bound yes invalid opcode exception 6 any undefined opcode yes processor extension not available exception 7 esc or wait yes intel reserved do not use 8-15 processor extension error interrupt 16 esc or wait intel reserved do not use 17-31 user defined 32-255 interrupts an interrupt transfers execution to a new program location. the old program address (cs:ip) and ma- chine state (flags) are saved on the stack to allow resumption of the interrupted program. interrupts fall into three classes: hardware initiated, int instruc- tions, and instruction exceptions. hardware initiated interrupts occur in response to an external input and are classified as non-maskable or maskable. pro- grams may cause an interrupt with an int instruc- tion. instruction exceptions occur when an unusual condition, which prevents further instruction pro- cessing, is detected while attempting to execute an instruction. the return address from an exception will always point at the instruction causing the ex- ception and include any leading instruction prefixes. a table containing up to 256 pointers defines the proper interrupt service routine for each interrupt. in- terrupts 0 31, some of which are used for instruc- tion exceptions, are reserved. for each interrupt, an 8-bit vector must be supplied to the m80c286 which identifies the appropriate table entry. exceptions supply the interrupt vector internally. int instructions contain or imply the vector and allow access to all 256 interrupts. the interrupt vector assignments are listed in table 4. maskable hardware initiated inter- rupts supply the 8-bit vector to the cpu during an interrupt acknowledge bus sequence. non-maska- ble hardware interrupts use a predefined internally supplied vector. maskable interrupt (intr) the m80c286 provides a maskable hardware inter- rupt request pin, intr. software enables this input by setting the interrupt flag bit (if) in the flag word. all 224 user-defined interrupt sources can share this input, yet they can retain separate interrupt han- dlers. an 8-bit vector read by the cpu during the interrupt acknowledge sequence (discussed in sys- tem interface section) identifies the source of the interrupt. further maskable interrupts are disabled while serv- icing an interrupt by resetting the if but as part of the response to an interrupt or exception. the saved flag word will reflect the enable status of the proces- sor prior to the interrupt. until the flag word is re- stored to the flag register, the interrupt flag will be zero unless specifically set. the interrupt return in- struction includes restoring the flag word, thereby restoring the original status of if. non-maskable interrupt request (nmi) a non-maskable interrupt input (nmi) is also provid- ed. nmi has higher priority than intr. a typical use of nmi would be to activate a power failure routine. the activation of this input causes an interrupt with an internally supplied vector value of 2. no external interrupt acknowledge sequence is performed. while executing the nmi servicing procedure, the m80c286 will service neither further nmi requests, intr requests, nor the processor extension seg- ment overrun interrupt until an interrupt return (iret) instruction is executed or the cpu is reset. if nmi occurs while currently servicing an nmi, its presence will be saved for servicing after executing the first iret instruction. if is cleared at the beginning of an nmi interrupt to inhibit intr interrupts. 8
m80c286 single step interrupt the m80c286 has an internal interrupt that allows programs to execute one instruction at a time. it is called the single step interrupt and is controlled by the single step flag bit (tf) in the flag word. once this bit is set, an internal single step interrupt will occur after the next instruction has been executed. the interrupt clears the tf bit and uses an internally supplied vector of 1. the iret instruction is used to set the tf bit and transfer control to the next instruc- tion to be single stepped. interrupt priorities when simultaneous interrupt requests occur, they are processed in a fixed order as shown in table 5. interrupt processing involves saving the flags, return address, and setting cs:ip to point at the first in- struction of the interrupt handler. if other interrupts remain enabled they are processed before the first instruction of the current interrupt handler is execut- ed. the last interrupt processed is therefore the first one serviced. table 5. interrupt processing order order interrupt 1 instruction exception 2 single step 3 nmi 4 processor extension segment overrun 5 intr 6 int instruction initialization and processor reset processor initialization or start up is accomplished by driving the reset input pin high. reset forces the m80c286 to terminate all execution and local bus activity. no instruction or bus activity will occur as long as reset is active. after reset becomes inactive and an internal processing interval elapses, the m80c286 begins execution in real address mode with the instruction at physical location fffff0(h). reset also sets some registers to pre- defined values as shown in table 6. table 6. m80c286 initial register state after reset flag word 0002(h) machine status word fff0(h) instruction pointer fff0(h) code segment f000(h) data segment 0000(h) extra segment 0000(h) stack segment 0000(h) hold must not be active during the time from the leading edge of reset to 34 clks after the trailing edge of reset. machine status word description the machine status word (msw) records when a task switch takes place and controls the operating mode of the m80c286. it is a 16-bit register of which the lower four bits are used. one bit places the cpu into protected mode, while the other three bits, as shown in table 7, control the processor extension interface. after reset, this register contains fff0(h) which places the m80c286 in m8086 real address mode. table 7. msw bit functions bit name function position 0 pe protected mode enable places the m80c286 into protected mode and cannot be cleared except by reset. 1 mp monitor processor extension allows wait instructions to cause a processor extension not present exception (number 7). 2 em emulate processor extension causes a processor extension not present exception (number 7) on esc instructions to allow emulating a processor extension. 3 ts task switched indicates the next instruction using a processor extension will cause exception 7, allowing software to test whether the current processor extension context belongs to the current task. the lmsw and smsw instructions can load and store the msw in real address mode. the recom- mended use of ts, em, and mp is shown in table 8. table 8. recommended msw encodings for processor extension control instructions ts mp em recommended use causing exception 7 0 0 0 initial encoding after reset. m80c286 operation is identical to m8086, 88. none 0 0 1 no processor extension is available. software will emulate its function. esc 1 0 1 no processor extension is available. software will emulate its function. the current esc processor extension context may belong to another task. 0 1 0 a processor extension exists. none 1 1 0 a processor extension exists. the current processor extension context may belong to esc or another task. the exception 7 on wait allows software to test for an error pending wait from a previous processor extension operation. 9
m80c286 halt the hlt instruction stops program execution and prevents the cpu from using the local bus until re- started. either nmi, intr with if e 1, or reset will force the m80c286 out of halt. if interrupted, the saved cs:ip will point to the next instruction after the hlt. m8086 real address mode the m80c286 executes a fully upward-compatible superset of the m8086 instruction set in real address mode. in real address mode the m80c286 is object code compatible with m8086 and m8088 software. the real address mode architecture (registers and addressing modes) is exactly as described in the m80c286 base architecture section of this func- tional description. memory size physical memory is a contiguous array of up to 1,048,576 bytes (one megabyte) addressed by pins a 0 through a 19 and bhe .a 20 through a 23 should be ignored. memory addressing in real address mode physical memory is a contigu- ous array of up to 1,048,576 bytes (one megabyte) addressed by pins a 0 through a 19 and bhe . ad- dress bits a 20 a 23 may not always be zero in real mode. a 20 a 23 should not be used by the system while the m80c286 is operating in real mode. the selector portion of a pointer is interpreted as the upper 16 bits of a 20-bit segment address. the lower four bits of the 20-bit segment address are always zero. segment addresses, therefore, begin on multi- ples of 16 bytes. see figure 7 for a graphic repre- sentation of address information. all segments in real address mode are 64k bytes in size and may be read, written, or executed. an ex- ception or interrupt can occur if data operands or instructions attempt to wrap around the end of a segment (e.g. a word with its low order byte at offset ffff(h) and its high order byte at offset 0000(h). if, in real address mode, the information contained in a segment does not use the full 64k bytes, the unused end of the segment may be overlayed by another segment to reduce physical memory requirements. reserved memory locations the m80c286 reserves two fixed areas of memory in real address mode (see figure 8); system initiali- zation area and interrupt table area. locations from addresses ffff0(h) through fffff(h) are re- served for system initialization. initial execution be- gins at location ffff0(h). locations 00000(h) through 003ff(h) are reserved for interrupt vectors. 271103 6 figure 7. m8086 real address mode address calculation 271103 7 figure 8. m8086 real address mode initially reserved memory locations 10
m80c286 table 9. real address mode addressing interrupts function interrupt related return address number instructions before instruction? interrupt table limit too small exception 8 int vector is not within table limit yes processor extension segment overrun 9 esc with memory operand extend- no interrupt ing beyond offset ffff(h) segment overrun exception 13 word memory reference with offset yes e ffff(h) or an attempt to exe- cute past the end of a segment interrupts table 9 shows the interrupt vectors reserved for ex- ceptions and interrupts which indicate an addressing error. the exceptions leave the cpu in the state ex- isting before attempting to execute the failing in- struction (except for push, pop, pusha, or popa). refer to the next section on protected mode initiali- zation for a discussion on exception 8. protected mode initialization to prepare the m80c286 for protected mode, the lidt instruction is used to load the 24-bit interrupt table base and 16-bit limit for the protected mode interrupt table. this instruction can also set a base and limit for the interrupt vector table in real address mode. after reset, the interrupt table base is initial- ized to 000000(h) and its size set to 03ff(h). these values are compatible with m8086, 88 software. lidt should only be executed in preparation for pro- tected mode. shutdown shutdown occurs when a severe error is detected that prevents further instruction processing by the cpu. shutdown and halt are externally signalled via a halt bus operation. they can be distinguished by a 1 high for halt and a 1 low for shutdown. in real address mode, shutdown can occur under two con- ditions: # exceptions 8 or 13 happen and the idt limit does not include the interrupt vector. # a call int or push instruction attempts to wrap around the stack segment when sp is not even. an nmi input can bring the cpu out of shutdown if the idt limit is at least 000f(h) and sp is greater than 0005(h), otherwise shutdown can only be exit- ed via the reset input. protected virtual address mode the m80c286 executes a fully upward-compatible superset of the m8086 instruction set in protected virtual address mode (protected mode). protected mode also provides memory management and pro- tection mechanisms and associated instructions. the m80c286 enters protected virtual address mode from real address mode by setting the pe (protection enable) bit of the machine status word with the load machine status word (lmsw) instruc- tion. protected mode offers extended physical and virtual memory address space, memory protection mechanisms, and new operations to support operat- ing systems and virtual memory. all registers, instructions, and addressing modes de- scribed in the m80c286 base architecture section of this functional description remain the same. pro- grams for the m8086, 88, 186, and real address mode m80c286 can be run in protected mode; how- ever, embedded constants for segment selectors are different. memory size the protected mode m80c286 provide s a 1 gigabyte virtual address space per task mapped into a 16 megabyte physical address space defined by the ad- dress pin a 23 a 0 and bhe . the virtual address space may be larger than the physical address space since any use of an address that does not map to a physical memory location will cause a re- startable exception. memory addressing as in real address mode, protected mode uses 32- bit pointers, consisting of 16-bit selector and offset components. the selector, however, specifies an in- dex into a memory resident table rather than the up- per 16-bits of a real memory address. the 24-bit base address of the desired segment is obtained 11
m80c286 from the tables in memory. the 16-bit offset is add- ed to the segment base address to form the physical address as shown in figure 10. the tables are auto- matically referenced by the cpu whenever a seg- ment register is loaded with a selector. all m80c286 instructions which load a segment register will refer- ence the memory based tables without additional software. the memory based tables contain 8 byte values called descriptors. 271103 8 figure 9. protected mode memory addressing descriptors descriptors define the use of memory. special types of descriptors also define new functions for transfer of control and task switching. the m80c286 has segment descriptors for code, stack and data seg- ments, and system control descriptors for special system data segments and control transfer opera- tions, see figure 10. descriptor accesses are per- formed as locked bus operations to assure descrip- tor integrity in multi-processor systems. code and data segment descriptors (s e 1) besides segment base addresses, code and data descriptors contain other segment attributes includ- ing segment size (1 to 64k bytes), access rights (read only, read/write, execute only, and execute/ read), and presence in memory (for virtual memory systems) (see figure 11). any segment usage vio- lating a segment attribute indicated by the segment descriptor will prevent the memory cycle and cause an exception or interrupt. 271103 9 * must be set to 0 for compatibility with 80386. figure 10. code or data segment descriptor access rights byte definition bit name function position 7 present (p) p e 1 segment is mapped into physical memory. p e 0 no mapping to physical memory exits, base and limit are not used. 6 5 descriptor privilege segment privilege attribute used in privilege tests. level (dpl) 4 segment descrip- s e 1 code or data (includes stacks) segment descriptor tor (s) s e 0 system segment descriptor or gate descriptor 3 executable (e) e e 0 data segment descriptor type is: if 2 expansion direc- ed e 0 expand up segment, offsets must be s limit. data tion (ed) ed e 1 expand down segment, offsets must be l limit. segment 1 writeable (w) w e 0 data segment may not be written into. (s e 1, type w e 1 data segment may be written into. * e e 0) field 3 executable (e) e e 1 code segment descriptor type is: if definition 2 conforming (c) c e 1 code segment may only be executed code when cpl t dpl and cpl segment remains unchanged. 1 readable (r) r e 0 code segment may not be read (s e 1, r e 1 code segment may be read. * e e 1) 0 accessed (a) a e 0 segment has not been accessed. a e 1 segment selector has been loaded into segment register or used by selector test instructions. figure 11. code and data segment descriptor formats 12
m80c286 code and data (including stack data) are stored in two types of segments: code segments and data segments. both types are identified and defined by segment descriptors (s e 1). code segments are identified by the executable (e) bit set to 1 in the descriptor access rights byte. the access rights byte of both code and data segment descriptor types have three fields in common: present (p) bit, de- scriptor privilege level (dpl), and accessed (a) bit. if p e 0, any attempted use of this segment will cause a not-present exception. dpl specifies the privilege level of the segment descriptor. dpl con- trols when the descriptor may be used by a task (refer to privilege discussion below). the a bit shows whether the segment has been previously accessed for usage profiling, a necessity for virtual memory systems. the cpu will always set this bit when ac- cessing the descriptor. data segments (s e 1, e e 0) may be either read- only or read-write as controlled by the w bit of the access rights byte. read-only (w e 0) data seg- ments may not be written into. data segments may grow in two directions, as determined by the expan- sion direction (ed) bit: upwards (ed e 0) for data segments, and downwards (ed e 1) for a segment containing a stack. the limit field for a data segment descriptor is interpreted differently depending on the ed bit (see figure 11). a code segment (s e 1, e e 1) may be execute- only or execute/read as determined by the read- able (r) bit. code segments may never be written into and execute-only code segments (r e 0) may not be read. a code segment may also have an attri- bute called conforming (c). a conforming code seg- ment may be shared by programs that execute at different privilege levels. the dpl of a conforming code segment defines the range of privilege levels at which the segment may be executed (refer to priv- ilege discussion below). the limit field identifies the last byte of a code segment. system segment descriptors (s e 0, type e 13) in addition to code and data segment descriptors, the protected mode m80c286 defines system seg- ment descriptors. these descriptors define special system data segments which contain a table of de- scriptors (local descriptor table descriptor) or seg- ments which contain the execution state of a task (task state segment descriptor). figure 12 gives the formats for the special system data segment descriptors. the descriptors contain a 24-bit base address of the segment and a 16-bit lim- it. the access byte defines the type of descriptor, its state and privilege level. the descriptor contents are valid and the segment is in physical memory if p e 1. if p e 0, the segment is not valid. the dpl field is only used in task state segment descriptors and indicates the privilege level at which the descriptor may be used (see privilege). since the local de- scriptor table descriptor may only be used by a spe- cial privileged instruction, the dpl field is not used. bit 4 of the access byte is 0 to indicate that it is a system control descriptor. the type field specifies the descriptor type as indicated in figure 12. system segment descriptor 271103 10 * must be set to 0 for compatibility with 80386. system segment descriptor fields name value description type 1 available task state segment (tss) 2 local descriptor table 3 busy task state segment (tss) p 0 descriptor contents are not valid 1 descriptor contents are valid dpl 0 3 descriptor privilege level base 24-bit base address of special system data number segment in real memory limit 16-bit offset of last byte in segment number figure 12. system segment descriptor format gate descriptors (s e 0, type e 47) gates are used to control access to entry points within the target code segment. the gate descrip- tors are call gates, task gates, interrupt gates and trap gates. gates provide a level of indirection be- tween the source and destination of the control transfer. this indirection allows the cpu to automati- cally perform protection checks and control entry point of the destination. call gates are used to change privilege levels (see privilege), task gates are used to perform a task switch, and interrupt and trap gates are used to specify interrupt service rou- tines. the interrupt gate disables interrupts (resets if) while the trap gate does not. figure 13 shows the format of the gate descriptors. the descriptor contains a destination pointer that points to the descriptor of the target segment and the entry point offset. the destination selector in an interrupt gate, trap gate, and call gate must refer to a code segment descriptor. these gate descriptors contain the entry point to prevent a program from constructing and using an illegal entry point. task gates may only refer to a task state segment. since task gates invoke a task switch, the destination off- set is not used in the task gate. 13
m80c286 gate descriptor 271103 11 * must be set to 0 for compatibility with 80386 (x is don't care) gate descriptor fields name value description 4 call gate type 5 task gate 6 interrupt gate 7 trap gate p 0 descriptor contents are not valid 1 descriptor contents are valid dpl 0 3 descriptor privilege level word number of words to copy count 031 from callers stack to called procedures stack. only used with call gate. selector to the target code destination 16-bit segment (call, interrupt or selector selector trap gate) selector to the target task state segment (task gate) destination 16-bit entry point within the target offset offset code segment figure 13. gate descriptor format exception 13 is generated when the gate is used if a destination selector does not refer to the correct de- scriptor type. the word count field is used in the call gate descriptor to indicate the number of parameters (0 31 words) to be automatically copied from the caller's stack to the stack of the called routine when a control transfer changes privilege levels. the word count field is not used by any other gate descriptor. the access byte format is the same for all gate de- scriptors. p e 1 indicates that the gate contents are valid. p e 0 indicates the contents are not valid and causes exception 11 if referenced. dpl is the de- scriptor privilege level and specifies when this de- scriptor may be used by a task (refer to privilege discussion below). bit 4 must equal 0 to indicate a system control descriptor. the type field specifies the descriptor type as indicated in figure 13. segment descriptor cache registers a segment descriptor cache register is assigned to each of the four segment registers (cs, ss, ds, es). segment descriptors are automatically loaded (cached) into a segment descriptor cache register (figure 14) whenever the associated segment regis- ter is loaded with a selector. only segment descrip- tors may be loaded into segment descriptor cache registers. once loaded, all references to that seg- ment of memory use the cached descriptor informa- tion instead of reaccessing the descriptor. the de- scriptor cache registers are not visible to programs. no instructions exist to store their contents. they only change when a segment register is loaded. selector fields a protected mode selector has three fields: descrip- tor entry index, local or global descriptor table indi- cator (ti), and selector privilege (rpl) as shown in figure 15. these fields select one of two memory based tables of descriptors, select the appropriate table entry and allow highspeed testing of the selec- tor's privilege attribute (refer to privilege discussion below). 271103 12 figure 15. selector fields 271103 13 figure 14. descriptor cache registers 14
m80c286 local and global descriptor tables two tables of descriptors, called descriptor tables, contain all descriptors accessible by a task at any given time. a descriptor table is a linear array of up to 8192 descriptors. the upper 13 bits of the selec- tor value are an index into a descriptor table. each table has a 24-bit base register to locate the descrip- tor table in physical memory and a 16-bit limit regis- ter that confine descriptor access to the defined lim- its of the table as shown in figure 16. a restartable exception (13) will occur if an attempt is made to reference a descriptor outside the table limits. one table, called the global descriptor table (gdt), contains descriptors available to all tasks. the other table, called the local descriptor table (ldt), con- tains descriptors that can be private to a task. each task may have its own private ldt. the gdt may contain all descriptor types except interrupt and trap descriptors. the ldt may contain only segment, task gate, and call gate descriptors. a segment can- not be accessed by a task if its segment descriptor does not exist in either descriptor table at the time of access. 271103 14 figure 16. local and global descriptor table definition the lgdt and lldt instructions load the base and limit of the global and local descriptor tables. lgdt and lldt are privileged, i.e. they may only be exe- cuted by trusted programs operating at level 0. the lgdt instruction loads a six byte field containing the 16-bit table limit and 24-bit physical base address of the global descriptor table as shown in figure 17. the ldt instruction loads a selector which refers to a local descriptor table descriptor containing the base address and limit for an ldt, as shown in fig- ure 16. 271103 15 * must be set to 0 for compatibility with 80386. figure 17. global descriptor table and interrupt descriptor table data type interrupt descriptor table the protected mode m80c286 has a third descriptor table, called the interrupt descriptor table (idt) (see figure 18), used to define up to 256 interrupts. it may contain only task gates, interrupt gates and trap gates. the idt (interrupt descriptor table) has a 24-bit physical base and 16-bit limit register in the cpu. the privileged lidt instruction loads these registers with a six byte value of identical form to that of the lgdt instruction (see figure 17 and pro- tected mode initialization). 271103 16 figure 18. interrupt descriptor table definition references to idt entries are made via int instruc- tions, external interrupt vectors, or exceptions. the idt must be at least 256 bytes in size to allocate space for all reserved interrupts. privilege the m80c286 has a four-level hierarchical privilege system which controls the use of privileged instruc- tions and access to descriptors (and their associat- ed segments) within a task. four-level privilege, as shown in figure 19, is an extension of the user/su- pervisor mode commonly found in minicomputers. the privilege levels are numbered 0 through 3. 15
m80c286 271103 17 figure 19. privilege levels level 0 is the most privileged level. privilege levels provide protection within a task. (tasks are isolated by providing private ldt's for each task.) operating system routines, interrupt handlers, and other sys- tem software can be included and protected within the virtual address space of each task using the four levels of privilege. each task in the system has a separate stack for each of its privilege levels. tasks, descriptors, and selectors have a privilege level attribute that determines whether the descrip- tor may be used. task privilege effects the use of instructions and descriptors. descriptor and selector privilege only effect access to the descriptor. task privilege a task always executes at one of the four privilege levels. the task privilege level at any specific instant is called the current privilege level (cpl) and is de- fined by the lower two bits of the cs register. cpl cannot change during execution in a single code segment. a task's cpl may only be changed by con- trol transfers through gate descriptors to a new code segment (see control transfer). tasks begin exe- cuting at the cpl value specified by the code seg- ment selector within tss when the task is initiated via a task switch operation (see figure 20). a task executing at level 0 can access all data segments defined in the gdt and the task's ldt and is con- sidered the most trusted level. a task executing a level 3 has the most restricted access to data and is considered the least trusted level. descriptor privilege descriptor privilege is specified by the descriptor privilege level (dpl) field of the descriptor access byte. dpl specifies the least trusted task privilege level (cpl) at which a task may access the descrip- tor. descriptors with dpl e 0 are the most protect- ed. only tasks executing at privilege level 0 (cpl e 0) may access them. descriptors with dpl e 3 are the least protected (i.e. have the least re- stricted access) since tasks can access them when cpl e 0, 1, 2, or 3. this rule applies to all descrip- tors, except ldt descriptors. selector privilege selector privilege is specified by the requested priv- ilege level (rpl) field in the least significant two bits of a selector. selector rpl may establish a less trusted privilege level than the current privilege level for the use of a selector. this level is called the task's effective privilege level (epl). rpl can only reduce the scope of a task's access to data with this selector. a task's effective privilege is the numeric maximum of rpl and cpl. a selector with rpl e 0 imposes no additional restriction on its use while a selector with rpl e 3 can only refer to segments at privilege level 3 regardless of the task's cpl. rpl is generally used to verify that pointer parameters passed to a more trusted procedure are not allowed to use data at a more privileged level than the caller (refer to pointer testing instructions). descriptor access and privilege validation determining the ability of a task to access a seg- ment involves the type of segment to be accessed, the instruction used, the type of descriptor used and cpl, rpl, and dpl. the two basic types of segment accesses are control transfer (selectors loaded into cs) and data (selectors loaded into ds, es or ss). data segment access instructions that load selectors into ds and es must refer to a data segment descriptor or readable code segment descriptor. the cpl of the task and the rpl of the selector must be the same as or more privileged (numerically equal to or lower than) than the descriptor dpl. in general, a task can only ac- cess data segments at the same or less privileged levels than the cpl or rpl (whichever is numerically higher) to prevent a program from accessing data it cannot be trusted to use. an exception to the rule is a readable conforming code segment. this type of code segment can be read from any privilege level. if the privilege checks fail (e.g. dpl is numerically less than the maximum of cpl and rpl) or an incor- rect type of descriptor is referenced (e.g. gate de- 16
m80c286 scriptor or execute only code segment) exception 13 occurs. if the segment is not present, exception 11 is generated. instructions that load selectors into ss must refer to data segment descriptors for writable data seg- ments. the descriptor privilege (dpl) and rpl must equal cpl. all other descriptor types or a privilege level violation will cause exception 13. a not present fault causes exception 12. control transfer four types of control transfer can occur when a se- lector is loaded into cs by a control transfer opera- tion (see table 10). each transfer type can only oc- cur if the operation which loaded the selector refer- ences the correct descriptor type. any violation of these descriptor usage rules (e.g. jmp through a call gate or ret to a task state segment) will cause exception 13. the ability to reference a descriptor for control trans- fer is also subject to rules of privilege. a call or jump instruction may only reference a code seg- ment descriptor with dpl equal to the task cpl or a conforming segment with dpl of equal or greater privilege than cpl. the rpl of the selector used to reference the code descriptor must have as much privilege as cpl. ret and iret instructions may only reference code segment descriptors with descriptor privilege equal to or less privileged than the task cpl. the selector loaded into cs is the return address from the stack. after the return, the selector rpl is the task's new cpl. if cpl changes, the old stack pointer is popped after the return address. when a jmp or call references a task state seg- ment descriptor, the descriptor dpl must be the same or less privileged than the task's cpl. refer- ence to a valid task state segment descriptor caus- es a task switch (see task switch operation). refer- ence to a task state segment descriptor at a more privileged level than the task's cpl generates ex- ception 13. when an instruction or interrupt references a gate descriptor, the gate dpl must have the same or less privilege than the task cpl. if dpl is at a more privi- leged level than cpl, exeception 13 occurs. if the destination selector contained in the gate refer- ences a code segment descriptor, the code seg- ment descriptor dpl must be the same or more priv- ileged than the task cpl. if not, exception 13 is is- sued. after the control transfer, the code segment descriptors dpl is the task's new cpl. if the desti- nation selector in the gate references a task state segment, a task switch is automatically performed (see task switch operation). the privilege rules on control transfer require: e jmp or call direct to a code segment (code segment descriptor) can only be to a conforming segment with dpl of equal or greater privilege than cpl or a non-conforming segment at the same privilege level. e interrupts within the task or calls that may change privilege levels, can only transfer control through a gate at the same or a less privileged level than cpl to a code segment at the same or more privileged level than cpl. e return instructions that don't switch tasks can only return control to a code segment at the same or less privileged level. e task switch can be performed by a call, jump or interrupt which references either a task gate or task state segment at the same or less privileged level. table 10. descriptor types used for control transfer control transfer types operation types descriptor descriptor referenced table intersegment within the same privilege level jmp, call, ret, iret * code segment gdt/ldt intersegment to the same or higher privilege level interrupt call call gate gdt/ldt within task may change cpl. interrupt instruction, trap or idt exception, external interrupt interrupt gate intersegment to a lower privilege level (changes task cpl) ret, iret * code segment gdt/ldt call, jmp task state gdt segment task switch call, jmp task gate gdt/ldt iret ** interrupt instruction, task gate idt exception, external interrupt * nt (nested task bit of flag word) e 0 ** nt (nested task bit of flag word) e 1 17
m80c286 privilege level changes any control transfer that changes cpl within the task, causes a change of stacks as part of the oper- ation. initial values of ss:sp for privilege levels 0, 1, and 2 are kept in the task state segment (refer to task switch operation). during a jmp or call con- trol transfer, the new stack pointer is loaded into the ss and sp registers and the previous stack pointer is pushed onto the new stack. when returning to the original privilege level, its stack is restored as part of the ret or iret instruc- tion operation. for subroutine calls that pass param- eters on the stack and cross privilege levels, a fixed number of words, as specified in the gate, are cop- ied from the previous stack to the current stack. the inter-segment ret instruction with a stack adjust- ment value will correctly restore the previous stack pointer upon return. protection the m80c286 includes mechanisms to protect crit- ical instructions that affect the cpu execution state (e.g. hlt) and code or data segments from improper usage. these protection mechanisms are grouped into three forms: restricted usage of segments (e.g. no write al- lowed to read-only data segments). the only seg- ments available for use are defined by descrip- tors in the local descriptor table (ldt) and global descriptor table (gdt). restricted access to segments via the rules of privilege and descriptor usage. privileged instructions or operations that may only be executed at certain privilege levels as de- termined by the cpl and i/o privilege level (iopl). the iopl is defined by bits 14 and 13 of the flag word. these checks are performed for all instructions and can be split into three categories: segment load checks (table 11), operand reference checks (table 12), and privileged instruction checks (table 13). any violation of the rules shown will result in an ex- ception. a not-present exception related to the stack segment causes exception 12. the iret and popf instructions do not perform some of their defined functions if cpl is not of suffi- cient privilege (numerically small enough). precisely these are: # the if bit is not changed if cpl l iopl. # the iopl field of the flag word is not changed if cpl l 0. no exceptions or other indication are given when these conditions occur. table 11. segment register load checks error description exception number descriptor table limit exceeded 13 segment descriptor not-present 11 or 12 privilege rules violated 13 invalid descriptor/segment type seg- ment register load: eread only data segment load to ss especial control descriptor load to ds, es, ss 13 eexecute only segment load to ds, es, ss edata segment load to cs eread/execute code segment load to ss table 12. operand reference checks error description exception number write into code segment 13 read from execute-only code segment 13 write to read-only data segment 13 segment limit exceeded 1 12 or 13 note: carry out in offset calculations is ignored. table 13. privileged instruction checks error description exception number cpl i 0 when executing the following instructions: 13 lidt, lldt, lgdt, ltr, lmsw, cts, hlt cpl l iopl when executing the fol- lowing instructions: 13 ins, in, outs, out, sti, cli, lock exceptions the m80c286 detects several types of exceptions and interrupts, in protected mode (see table 14). most are restartable after the exceptional condition is removed. interrupt handlers for most exceptions can read an error code, pushed on the stack after the return address, that identifies the selector in- volved (0 if none). the return address normally points to the failing instruction, including all leading prefixes. for a processor extension segment over- run exception, the return address will not point at the esc instruction that caused the exception; however, the processor extension registers may contain the address of the failing instruction. 18
m80c286 table 14. protected mode exceptions return always error interrupt function address restart- code vector at falling able? on stack? instruction? 8 double exception detected yes no 2 yes 9 processor extension segment overrun no no 2 no 10 invalid task state segment yes yes yes 11 segment not present yes yes yes 12 stack segment overrun or stack segment not present yes yes 1 yes 13 general protection yes no 2 yes note: 1. when a pusha or popa instruction attempts to wrap around the stack segment, the machine state after the exception will not be restartable because stack segment wrap around is not permitted. this condition is identified by the value of the saved sp being either 0000(h), 0001(h), fffe(h), or ffff(h). 2. these exceptions indicate a violation to privilege rules or usage rules has occurred. restart is generally not attempted under those conditions. these exceptions indicate a violation to privilege rules or usage rules has occurred. restart is gener- ally not attempted under those conditions. all these checks are performed for all instructions and can be split into three categories: segment load checks (table 11), operand reference checks (table 12), and privileged instruction checks (table 13). any violation of the rules shown will result in an ex- ception. a not-present exception causes exception 11 or 12 and is restartable. special operations task switch operation the m80c286 provides a built-in task switch opera- tion which saves the entire m80c286 execution state (registers, address space, and a link to the pre- vious task), loads a new execution state, and com- mences execution in the new task. like gates, the task switch operation is invoked by executing an in- ter-segment jmp or call instruction which refers to a task state segment (tss) or task gate descriptor in the gdt or ldt. an int n instruction, exception, or external interrupt may also invoke the task switch operation by selecting a task gate descriptor in the associated idt descriptor entry. the tss descriptor points at a segment (see figure 20) containing the entire m80c286 execution state while a task gate descriptor contains a tss selector. the limit field of the descriptor must be l 002b(h). each task must have a tss associated with it. the current tss is identified by a special register in the m80c286 called the task register (tr). this regis- ter contains a selector referring to the task state segment descriptor that defines the current tss. a hidden base and limit register associated with tr are loaded whenever tr is loaded with a new selec- tor. the iret instruction is used to return control to the task that called the current task or was interrupted. bit 14 in the flag register is called the nested task (nt) bit. it controls the function of the iret instruc- tion. if nt e 0, the iret instruction performs the regular current task by popping values off the stack; when nt e 1, iret performs a task switch opera- tion back to the previous task. when a call, jmp, or int instruction initiates a task switch, the old (except for case of jmp) and new tss will be marked busy and the back link field of the new tss set to the old tss selector. the nt bit of the new task is set by call or int initiated task switches. an interrupt that does not cause a task switch will clear nt. nt may also be set or cleared by popf or iret instructions. the task state segment is marked busy by changing the descriptor type field from type 1 to type 3. use of a selector that references a busy task state seg- ment causes exception 13. processor extension context switching the context of a processor extension (such as the m80c287 numerics processor) is not changed by the task switch operation. a processor extension context need only be changed when a different task attempts to use the processor extension (which still contains the context of a previous task). the m80c286 detects the first use of a processor exten- sion after a task switch by causing the processor extension not present exception (7). the interrupt handler may then decide whether a context change is necessary. whenever the m80c286 switches tasks, it sets the task switched (ts) bit of the msw. ts indicates that a processor extension context may belong to a different task than the current one. the processor extension not present exception (7) will occur when attempting to execute an esc or wait instruction if ts e 1 and a processor extension is present (mp e 1 in msw). 19
m80c286 pointer testing instructions the m80c286 provides several instructions to speed pointer testing and consistency checks for maintaining system integrity (see table 15). these instructions use the memory management hardware to verify that a selector value refers to an appropri- ate segment without risking an exception. a condi- tion flag (zf) indicates whether use of the selector or segment will cause an exception. 271103 18 figure 20. task state segment and tss registers 20
m80c286 table 15. m80c286 pointer test instructions instruction operands function arpl selector, adjust requested privilege register level: adjusts the rpl of the selector to the numeric maximum of current selec- tor rpl value and the rpl value in the register. set zero flag if selector rpl was changed by arpl. verr selector verify for read: sets the zero flag if the segment re- ferred to by the selector can be read. verw selector verify for write: sets the zero flag if the segment re- ferred to by the selector can be written. lsl register, load segment limit: reads selector the segment limit into the register if privilege rules and descriptor type allow. set zero flag if successful. lar register, load access rights: reads selector the descriptor access rights byte into the register if privilege rules allow. set zero flag if successful. double fault and shutdown if two separate exceptions are detected during a sin- gle instruction execution, the m80c286 performs the double fault exception (8). if an execution occurs during processing of the double fault exception, the m80c286 will enter shutdown. during shutdown no further instructions or exceptions are processed. ei- ther nmi (cpu remains in protected mode) or re- set (cpu exits protected mode) can force the m80c286 out of shutdown. shutdown is externally signalled via a halt bus operation with a 1 low. protected mode initialization the m80c286 initially executes in real address mode after reset. to allow initialization code to be placed at the top of physical memory, a 23 a 20 will be high when the m80c286 performs memory ref- erences relative to the cs register until cs is changed. a 23 a 20 will be zero for references to the ds, es, or ss segments. changing cs in real ad- dress mode will force a 23 a 20 low whenever cs is used again. the initial cs:ip value of f000:fff0 provides 64k bytes of code space for initialization code without changing cs. protected mode operation requires several registers to be initialized. the gdt and idt base registers must refer to a valid gdt and idt. after executing the lmsw instruction to set pe, the m80c286 must immediately execute an intra-segment jmp instruc- tion to clear the instruction queue of instructions de- coded in real address mode. to force the m80c286 cpu registers to match the initial protected mode state assumed by software, execute a jmp instruction with a selector referring to the initial tss used in the system. this will load the task register, local descriptor table register, segment registers and initial general register state. the tr should point at a valid tss since any task switch operation involves saving the current task state. system interface the m80c286 system interface appears in two forms: a local bus and a system bus. the local bus consists of address, data, status, and control signals at the pins of the cpu. a system bus is any buffered version of the local bus. a system bus may also dif- fer from the local bus in terms of coding of status and control lines and/or timing and loading of sig- nals. the m80c286 family includes several devices to generate standard system buses such as the ieee 796 standard multibus. bus interface signals and timing the m80c286 microsystem local bus interfaces the m80c286 to local memory and i/o components. the interface has 24 address lines, 16 data lines, and 8 status and control signals. the m80c286 cpu, m82c284 clock generator, m82c288 bus controller, transceivers, and latches provide a buffered and decoded system bus inter- face. the m82c284 generates the system clock and synchronizes ready and reset. the m82c288 converts bus operation status encoded by the m80c286 into command and bus control signals. these components can provide the timing and elec- trical power drive levels required for most system bus interfaces including the multibus. physical memory and i/o interface a maximum of 16 megabytes of physical memory can be addressed in protected mode. one mega- byte can be addressed in real address mode. memo- ry is accessible as bytes or words. words consist of any two consecutive bytes addressed with the least significant byte stored in the lowest address. byte transfers occur on either half of the 16-bit local data bus. even bytes are accessed over d 7 d 0 while odd bytes are transferred over d 15 d 8 . even- addressed words are transferred over d 15 d 0 in one bus cycle, while odd-addressed word require two bus operations. the first transfers data on d 15 d 8 , and the second transfers data on d 7 d 0 . both byte data transfers occur automatically, trans- parent to software. 21
m80c286 two bus signals, a 0 and bhe , control transfers over the lower and upper halves of the data bus. even address byte transfers are indicated by a 0 low and bhe high. odd address byte transfers are indicat- ed by a 0 high and bhe low. both a 0 and bhe are low for even address word transfers. the i/o address space contains 64k addresses in both modes. the i/o space is accessible as either bytes or words, as is memory. byte wide peripheral devices may be attached to either the upper or lower byte of the data bus. byte-wide i/o devices attached to the upper data byte (d 15 d 8 ) are accessed with odd i/o addresses. devices on the lower data byte are accessed with even i/o addresses. an interrupt controller such as intel's 82c59a-2 must be con- nected to the lower data byte (d 7 d 0 ) for proper return of the interrupt vector. bus operation the m80c286 uses a double frequency system clock (clk input) to control bus timing. all signals on the local bus are measured relative to the system clk input. the cpu divides the system clock by 2 to produce the internal processor clock, which deter- mines bus state. each processor clock is composed of two system clock cycles named phase 1 and phase 2. the m82c284 clock generator output (pclk) identifies the next phase of the processor clock. (see figure 21.) 271103 19 figure 21. system and processor clock relationships six types of bus operations are supported; memory read, memory write, i/o read, i/o write, interrupt ac- knowledge, and halt/shutdown. data can be trans- ferred at a maximum rate of one word per two proc- essor clock cycles. the m80c286 bus has three basic states: idle (t i ), send status (t s ), and perform command (t c ). the m80c286 cpu also has a fourth local bus state called hold (t h ). t h indicates that the m80c286 has surrendered control of the local bus to another bus master in response to a hold request. each bus state is one processor clock long. figure 22 shows the four m80c286 local bus states and allowed transitions. 271103 20 figure 22. m80c286 bus states bus states the idle (t i ) state indicates that no data transfers are in progress or requested. the first active state t s is signaled by status line s1 or s0 going low and identifying phase 1 of the processor clock. dur- ing t s , the command encoding, the address, and data (for a write operation) are available on the m80c286 output pins. the m82c288 bus controller decodes the status signals and generates multibus compatible read/write command and local trans- ceiver control signals. after t s , the perform command (t c ) state is en- tered. memory or i/o devices respond to the bus operation during t c , either transferring read data to the cpu or accepting write data. t c states may be repeated as often as necessary to assure sufficient time for the memory or i/o device to respond. the ready signal determines whether t c is repeated. a repeated t c state is called a wait state. during hold (t h ), the m80c286 will float * all address, data, and status output pins enabling another bus master to use the local bus. the m80c286 hold input signal is used to place the m80c286 into the t h state. the m80c286 hlda output signal indi- cates that the cpu has entered t h . pipelined addressing the m80c286 uses a local bus interface with pipe- lined timing to allow as much time as possible for data access. pipelined timing allows a new bus oper- ation to be initiated every two processor cycles, while allowing each individual bus operation to last for three processor cycles. the timing of the address outputs is pipelined such that the address of the next bus operation becomes available during the current bus operation. or in oth- er words, the first clock of the next bus operation is overlapped with the last clock of the current bus op- eration. therefore, address decode and routing logic can operate in advance of the next bus operation. * note: see section on bus hold circuitry. 22
m80c286 271103 21 figure 23. basic bus cycle external address latches may hold the address sta- ble for the entire bus operation, and provide addi- tional ac and dc buffering. the m80c286 does not maintain the address of the current bus operation during all t c states. instead, the address for the next bus operation may be emit- ted during phase 2 of any t c . the address remains valid during phase 1 of the first t c to guarantee hold time, relative to ale, for the address latch inputs. bus control signals the m82c288 bus controller provides control sig- nals; address latch enable (ale), read/write com- mands, data transmit/receive (dt/r ), and data en- able (den) that control the address latches, data transceivers, write enable, and output enable for memory and i/o systems. the address latch enable (ale) output determines when the address may be latched. ale provides at least one system clk period of address hold time from the end of the previous bus operation until the address for the next bus operation appears at the latch outputs. this address hold time is required to support multibus and common memory systems. the data bus transceivers are controlled by m82c288 outputs data enable (den) and data transmit/receive (dt/r ). den enables the data transceivers; while dt/r controls tranceiver direc- tion. den and dt/r are timed to prevent bus con- tention between the bus master, data bus transceiv- ers, and system data bus transceivers. command timing controls two system timing customization options, command extension and command delay, are provided on the m80c286 local bus. command extension allows additional time for exter- nal devices to respond to a command and is analo- gous to inserting wait states on the m8086. external logic can control the duration of any bus operation such that the operation is only as long as necessary. the ready input signal can extend any bus opera- tion for as long as necessary, see figure 23. command delay allows an increase of address or write data setup time to system bus command active for any bus operation by delaying when the system bus command becomes active. command delay is controlled by the m82c288 cmdly input. after t s , the bus controller samples cmdly at each failing edge of clk. if cmdly is high, the m82c288 will not activate the command signal. when cmdly is low, the m82c288 will activate the command sig- nal. after the command becomes active, the cmdly input is not sampled. when a command is delayed, the available re- sponse time from command active to return read data or accept write data is less. to customize sys- tem bus timing, an address decoder can determine which bus operations require delaying the com- mand. the cmdly input does not affect the timing of ale, den, or dt/r . 23
m80c286 271103 22 figure 24. cmdly controls the leading edge of command signal figure 24 illustrates four uses of cmdly. example 1 shows delaying the read command two system clks for cycle n-1 and no delay for cycle n, and example 2 shows delaying the read command one system clk for cycle n-1 and one system clk de- lay for cycle n. bus cycle termination at maximum transfer rates, the m80c286 bus alter- nates between the status and command states. the bus status signals become inactive after t s so that they may correctly signal the start of the next bus operation after the completion of the current cycle. no external indication of t c exists on the m80c286 local bus. the bus master and bus controller enter t c directly after t s and continue executing t c cycles until terminated by ready . ready operation the current bus master and m82c288 bus controller terminate each bus operation simultaneously to achieve maximum bus operation bandwidth. both are informed in advance by ready active (open- collector output from m82c284) which identifies the last t c cycle of the current bus operation. the bus master and bus controller must see the same sense of the ready signal, thereby requiring ready be synchronous to the system clock. synchronous ready the m82c284 clock generator provides ready synchronization from both synchronous and asyn- chronous sources (see figure 25). the synchronous ready input (srdy ) of the clock generator is sam- pled with the falling edge of clk at the end of phase 1 of each t c . the state of srdy is then broadcast to the bus master and bus controller via the ready output line. asynchronous ready many systems have devices or subsystems that are asynchronous to the system clock. as a result, their ready outputs cannot be guaranteed to meet the m82c284 srdy setup and hold time requirements. but the m82c284 asynchronous ready input (ardy ) is designed to accept such signals. the ardy input is sampled at the beginning of each t c cycle by m82c284 synchronization logic. this provides one system clk cycle time to resolve its value before broadcasting it to the bus master and bus controller. 24
m80c286 notes: 271103 23 1. srdyen is active low. 2. if srdyen is high, the state of srdy will no affect ready . 3. ardyen is active low. figure 25. synchronous and asynchronous ready ardy or ardyen must be high at the end of t s . ardy cannot be used to terminate bus cycle with no wait states. each ready input of the m82c284 has an enable pin (srdyen and ardyen ) to select whether the cur- rent bus operation will be terminated by the synchro- nous or asynchronous ready. either of the ready in- puts may terminate a bus operation. these enable inputs are active low and have the same timing as their respective ready inputs. address decode logic usually selects whether the current bus operation should be terminated by ardy or srdy . data bus control figures 26, 27, and 28 show how the dt/r , den, data bus, and address signals operate for different combinations of read, write, and idle bus operations. dt/r goes active (low) for a read operation. dt/r remains high before, during, and between write op- erations. the data bus is driven with write data during the second phase of t s . the delay in write data timing allows the read data drivers, from a previous read cycle, sufficient time to enter 3-state off * before the m80c286 cpu begins driving the local data bus for write operations. write data will always remain valid for one system clock past the last t c to provide sufficient hold time for multibus or other similar memory or i/o systems. during write-read or write- idle sequences the data bus enters 3-state off * during the second phase of the processor cycle after the last t c . in a write-write sequence the data bus does not enter 3-state off * between t c and t s . bus usage the m80c286 local bus may be used for several functions: instruction data transfers, data transfers by other bus masters, instruction fetching, processor extension data transfers, interrupt acknowledge, and halt/shutdown. this section describes local bus ac- tivities which have special signals or requirements. * note: see section on bus hold circuitry. 25
m80c286 271103 24 figure 26. back to back read-write cycles 271103 25 figure 27. back to back write-read cycles 26
m80c286 271103 26 figure 28. back to back write-write cycles hold and hlda hold and hlda allow another bus master to gain control of the local bus by placing the m80c286 bus into the t h state. the sequence of events required to pass control between the m80c286 and another local bus master are shown in figure 29. in this example, the m80c286 is initially in the t h state as signaled by hlda being active. upon leav- ing t h , as signaled by hlda going inactive, a write operation is started. during the write operation an- other local bus master requests the local bus from the m80c286 as shown by the hold signal. after completing the write operation, the m80c286 per- forms one t i bus cycle, to guarantee write data hold time, then enters t h as signaled by hlda going ac- tive. the cmdly signal and ardy ready are used to start and stop the write bus command, respectively. note that srdy must be inactive or disabled by srdyen to guarantee ardy will terminate the cy- cle. hold must not be active during the time from the leading edge of reset until 34 clks following the trailing edge of reset. lock the cpu asserts an active lock signal during inter- rupt-acknowledge cycles, the xchg instruction, and during some descriptor accesses. lock is also as- serted when the lock prefix is used. the lock prefix may be used with the following asm-286 as- sembly instructions; movs, ins, and outs. for bus cycles other than interrupt-acknowledge cycles, lock will be active for the first and subsequent cy- cles of a series of cycles to be locked. lock will not be shown active during the last cycle to be locked. for the next-to-last cycle, lock will become inactive at the end of the first t c regardless of the number of wait-states inserted. for interrupt-acknowledge cy- cles, lock will be active for each cycle, and will be- come inactive at the end of the first t c for each cy- cle regardless of the number of wait-states inserted. instruction fetching the m80c286 bus unit (bu) will fetch instructions ahead of the current instruction being executed. this activity is called prefetching. it occurs when the local bus would otherwise be idle and obeys the following rules: a prefetch bus operation starts when at least two bytes of the 6-byte prefetch queue are empty. the prefetcher normally performs word prefetches independent of the byte alignment of the code seg- ment base in physical memory. the prefetcher will perform only a byte code fetch operation for control transfers to an instruction be- ginning on a numerically odd physical address. prefetching stops whenever a control transfer or hlt instruction is decoded by the iu and placed into the instruction queue. 27
m80c286 in real address mode, the prefetcher may fetch up to 6 bytes beyond the last control transfer or hlt in- struction in a code segment. in protected mode, the prefetcher will never cause a segment overrun exception. the prefetcher stops at the last physical memory word of the code segment. exception 13 will occur if the program attempts to execute beyond the last full instruction in the code segment. if the last byte of a code segment appears on an even physical memory address, the prefetcher will read the next physical byte of memory (perform a word code fetch). the value of this byte is ignored and any attempt to execute it causes exception 13. 271103 27 notes: 1. status lines are not driven by m80c286, yet remain high due to internal pullup resistors during hold state. see section on bus hold circuitry. 2. address, m/io and cod/inta may start floating during any t c depending on when internal m80c286 bus arbiter decides to release bus to external hold. the float starts in w 2oft c . see section on bus hold circuitry. 3. bhe and lock may start floating after the end of any t c depending on when internal m80c286 bus arbiter decides to release bus to external hold. the float starts in w 1oft c . see section on bus hold circuitry. 4. the minimum hold to hlda time is shown. maximum is one t h longer. 5. the earliest hold time is shown. it will always allow a subsequent memory cycle if pending is shown. 6. the minimum hold to hlda time is shown. maximum is a function of the instruction, type of bus cycle and other machine state (i.e., interrupts, waits, lock, etc.). 7. asynchronous ready allows termination of the cycle. synchronous ready does not signal ready in this example. syn- chronous ready state is ignored after ready is signaled via the asynchronous input. figure 29. multibus write terminated by asynchronous ready with bus hold 28
m80c286 processor extension transfers the processor extension interface uses i/o port ad- dresses 00f8(h), 00fa(h), and 00fc(h) which are part of the i/o port address range reserved by intel. an esc instruction with machine status word bits em e 0 and ts e 0 will perform i/o bus operations to one or more of these i/o port addresses indepen- dent of the value of iopl and cpl. esc instructions with memory references enable the cpu to accept pereq inputs for processor exten- sion operand transfers. the cpu will determine the operand starting address and read/write status of the instruction. for each operand transfer, two or three bus operations are performed, one word trans- fer with i/o port address 00fa(h) and one or two bus operations with memory. three bus operations are required for each word operand aligned on an odd byte address. note: odd-aligned numerics instructions should be avoid- ed when using an m80c286 system running six or more memory-write wait-states. the m80c286 can generate an incorrect numerics address if all the following conditions are met: e two floating point (fp) instructions are fetched and in the m80c286 queue. e the first fp instruction is any floating point store except fstsw ax. e the second fp instruction is any floating point store except fstsw ax. e the second fp instruction accesses memory. e the operand of the first instruction is aligned on an odd memory address. e more than five wait-states are inserted during ei- ther of the last two memory write transfers (transferred as two bytes for odd aligned oper- ands) of the first instruction. the second fp instruction operand address will be incremented by one if these conditions are met. these conditions are most likely to occur in a multi- master system. for a hardware solution, contact your local intel representative. ten or more command delays should not be used when accessing the numerics coprocessor. exces- sive command delays can cause the m80c286 and m80c287 to lose synchronization. interrupt acknowledge sequence figure 30 illustrates an interrupt acknowledge se- quence performed by the m80c286 in response to an intr input. an interrupt acknowledge sequence consists of two inta bus operations. the first allows a master m8259a programmable interrupt control- ler (pic) to determine which if any of its slaves should return the interrupt vector. an eight bit vector is read on d0 d7 of the m80c286 during the sec- ond inta bus operation to select an interrupt han- dler routine from the interrupt table. the master cascade enable (mce) signal of the m82c288 is used to enable the cascade address drivers, during inta bus operations (see figure 30), onto the local address bus for distribution to slave interrupt controllers via the system address bus. the m80c286 emits the lock signal (active low) dur- ing t s of the first inta bus operation. a local bus ``hold'' request will not be honored until the end of the second inta bus operation. three idle processor clocks are provided by the m80c286 between inta bus operations to allow for the minimum inta to inta time and cas (cascade address) out delay of the m8259a. the second inta bus operation must always have at least one extra t c state added via logic controlling ready . this is needed to meet the m8259a minimum inta pulse width. local bus usage priorities the m80c286 local bus is shared among several internal units and external hold requests. in case of simultaneous requests, their relative priorities are: (highest) any transfers which assert lock either explicitly (via the lock instruction prefix) or implicitly (i.e. some segment descriptor accesses, interrupt acknowledge se- quence, or an xchg with memory). the second of the two byte bus opera- tions required for an odd aligned word op- erand. the second or third cycle of a processor extension data transfer. local bus request via hold input. processor extension data operand trans- fer via pereq input. data transfer performed by eu as part of an instruction. (lowest) an instruction prefetch request from bu. the eu will inhibit prefetching two proc- essor clocks in advance of any data transfers to minimize waiting by eu for a prefetch to finish. 29
m80c286 271103 28 notes: 1. data is ignored, upper data bus, d 8 d 15 , should not change state during this time. 2. first inta cycle should have at least one wait state inserted to meet m8259a minimum inta pulse width. 3. second inta cycle should have at least one wait state inserted to meet m8259a minimum inta pulse width. 4. lock is active for the first inta cycle to prevent a bus arbiter from releasing the bus between inta cycles in a multi- master system. lock is also active for the second inta cycle. 5. a 23 a 0 exits 3-state off during w 2 of the second t c in the inta cycle. see section on bus hold circuitry. 6. upper data bus should not change state during this time. figure 30. interrupt acknowledge sequence halt or shutdown cycles the m80c286 externally indicates halt or shutdown conditions as a bus operation. these conditions oc- cur due to a hlt instruction or multiple protection exceptions while attempting to execute one instruc- tion. a halt or shutdown bus operation is signalled when s1 ,s0 and cod/inta are low and m/io is high. a 1 high indicates halt, and a 1 low indi- cates shutdown. the 82288 bus controller does not issue ale, nor is ready required to terminate a halt or shutdown bus operation. during halt or shutdown, the m80c286 may service pereq or hold requests. a processor extension segment overrun exception during shutdown will in- hibit further service of pereq. either nmi or reset will force the m80c286 out of either halt or shut- down. an intr, if interrupts are enabled, or a proc- essor extension segment overrun exception will also force the m80c286 out of halt. 30
m80c286 271103 29 figure 31. example power-down sequence the power-down feature of the m80c286 the m80c286, unlike the hmos part, can enter into a power-down mode. by stopping the processor clk, the processor will enter a power-down mode. once in the power-down mode, all m80c286 outputs remain static (the same state as before the mode was entered). the m80c286 d.c. specification i ccs rates the amount of current drawn by the processor when in the power-down mode. when the clk is reapplied to the processor, it will resume execution where it was interrupted. in order to obtain maximum benefits from the power- down mode, certain precautions should be taken. when in the power-down mode, all m80c286 out- puts remain static and any output that is turned on and remains in a high condition will source current when loaded. best low-power performance can be obtained by first putting the processor in the hold condition (turning off all of the output buffers), and then stopping the processor clk in the phase 2 state. in this condition, any output that is loaded will source only the ``bus hold sustaining current''. when stopping the processor clock, minimum clock high and low times cannot be violated (no glitches on the clock line). violating this condition can cause the m80c286 to erase its internal register states. note that all inputs to the m80c286 (clk, hold, pereq, reset, ready, intr, nmi, busy, and error) should be at v cc or v ss ; any other value will cause the m80c286 to draw additional current. when coming out of power-down mode, the system clk must be started with the same polarity in which it was stopped. an example power down sequence is shown in figure 31. bus hold circuitry to avoid high current conditions caused by floating inputs to peripheral cmos devices and eliminate the need for pull-up/down resistors, ``bus-hold'' circuitry has been used on all tri-state m80c286 outputs. see table 16 for a list of these pins and figures 32 and 33 for a complete description of which pins have bus hold circuitry. these circuits will maintain the last valid logic state if no driving source is present (i.e., an unconnected pin or a driving source which goes to a high impedance state). to overdrive the ``bus hold'' circuits, an external driver must be capable of supplying the maximum ``bus hold overdrive'' sink or source current at valid input voltage levels. since this ``bus hold'' circuitry is active and not a pull-up/pull-down 271103 30 figure 32. bus hold circuitry pins 36 51, 66 67 31
m80c286 ``resistive'' type element, the associated power sup- ply current is negligible and power dissipation is sig- nificantly reduced when compared to the use of pas- sive pull-up resistors. table 16. bus hold circuitry on the m80c286 signal pin polarity pulled to location when tri-stated s1 ,s0 , peack , lock 4 6, 68 hi, see figure 33 data bus (d 0 d 15 ) 36 51 hi/lo, see figure 32 cod/inta , m/io 66 67 hi/lo, see figure 32 pull-up 271103 31 figure 33. bus hold circuitry pins 4 6, 68 system configurations the versatile bus structure of the m80c286 micro- system, with a full complement of support chips, al- lows flexible configuration of a wide range of sys- tems. the basic configuration, shown in figure 34, is similar to an m8086 maximum mode system. it in- cludes the cpu plus an m8259a interrupt controller, m82c284 clock generator, and the m82c288 bus controller. as indicated by the dashed lines in figure 34, the ability to add processor extensions is an integral fea- ture of m80c286 microsystems. the processor ex- tension interface allows external hardware to per- form special functions and transfer data concurrent with cpu execution of other instructions. full system integrity is maintained because the m80c286 super- vises all data transfers and instruction execution for the processor extension. the m80c287 npx can perform numeric calcula- tions and data transfers concurrently with cpu pro- gram execution. numerics code and data have the same integrity as all other information protected by the m80c286 protection mechanism. the m80c286 can overlap chip select decoding and address propagation during the data transfer for the previous bus operation. this information is latched by ale during the middle of a t s cycle. the latched chip select and address information remains stable during the bus operation while the next cycle's ad- dress is being decoded and propagated into the sys- tem. decode logic can be implemented with a high speed prom or pal. the optional decode logic shown in figure 32 takes advantage of the overlap between address and data of the m80c286 bus cycle to generate advanced memory and lo-select signals. this minimizes sys- tem performance degradation caused by address propagation and decode delays. in addition to se- lecting memory and i/o, the advanced selects may be used with configurations supporting local and system buses to enable the appropriate bus inter- face for each bus cycle. the cod/inta and m/io signals are applied to the decode logic to distinguish between interrupt, i/o, code and data bus cycles. by adding a bus arbiter, the m80c286 provides a multibus system bus interface as shown in figure 35. the ale output of the m82c288 for the multibus bus is connected to its cmdly input to delay the start of commands one system clk as required to meet multibus address and write data setup times. this arrangement will add at least one extra t c state to each bus operation which uses the multibus. a second m82c288 bus controller and additional latches and transceivers could be added to the local bus of figure 35. this configuration allows the m80c286 to support an on-board bus for local mem- ory and peripherals, and the multibus for system bus interfacing. 32
m80c286 figure 34. basic m80c286 system configuration 271103 32 33
m80c286 271103 33 figure 35. multibus system bus interface 34
m80c286 271103 34 figure 36. m80c286 system configuration with dual-ported memory figure 36 shows the addition of dual ported dynamic memory between the multibus system bus and the m80c286 local bus. the dual port interface is provided by the 8207 dual port dram controller. the 8207 runs synchronously with the cpu to maxi- mize throughput for local memory references. it also arbitrates between requests from the local and sys- tem buses and performs functions such as refresh, initialization of ram, and read/modify/write cycles. the 8207 combined with the 8206 error checking and correction memory controller provide for single bit error correction. the dual-ported memory can be combined with a standard multibus system bus interface to maximize performance and protection in multiprocessor system configurations. mechanical data the m80c286 pinout for both the ceramic quad flatpack, cqfp, and pin grid array, pga, packages are shown in figure 37. v cc and gnd connections must be made to mutiple v cc and v ss (gnd) pins. each v cc and v ss must be connected to the ap- propriate voltage level. the circuit board should in- clude v cc and gnd planes for power distribution and all v cc pins must be connected to the appropri- ate plane. table 17 shows the pin assignments for both the cqfp and pga components. note: pins identified as ``n.c.'' should remain completely unconnected. 35
m80c286 component pad views eas viewed from underside of component when mounted on the board. p.c. board views eas viewed from the component side of the p.c. board. ceramic quad flatpack 271103 35 pin grid array note: n.c. signals must not be connected 271103 36 figure 37. m80c286 pin configuration 36
m80c286 table 17. pin cross reference for m80c286 signal cqfp pga a0 44 34 a1 45 33 a2 46 32 a3 50 28 a4 51 27 a5 52 26 a6 53 25 a7 54 24 a8 55 23 a9 56 22 a10 57 21 a11 58 20 a12 59 19 a13 60 18 a14 61 17 a15 62 16 a16 63 15 a17 64 14 a18 65 13 a19 66 12 a20 67 11 a21 68 10 a22 2 8 signal cqfp pga a23 3 7 d0 42 36 d1 40 38 d2 38 40 d3 36 42 d4 34 44 d5 32 46 d6 30 48 d7 28 50 d8 41 37 d9 39 39 d10 37 41 d11 35 43 d12 33 45 d13 31 47 d14 29 49 d15 27 51 clk 47 31 reset 49 29 bhe 91 s1 64 s0 55 peack 46 signal cqfp pga lock 10 68 m/io 11 67 cod/inta 12 66 hlda 13 65 hold 14 64 ready 15 63 pereq 17 61 nmi 19 59 intr 21 57 busy 24 54 error 25 53 cap 26 52 v ss 19 v ss 18 35 v ss 43 60 v cc 16 30 v cc 48 62 n.c. 7 2 n.c. 8 3 n.c. 20 55 n.c. 22 56 n.c. 23 58 table 18. pin description the following pin function descriptions are for the m80c286 microprocessor : symbol type name and function clk i system clock provides the fundamental timing for m80c286 systems. it is divided by two inside the m80c286 to generate the processor clock. the internal divide-by-two circuitry can be synchronized to an external clock generator by a low to high transition on the reset input. d 15 d 0 i/o data bus inputs data during memory, i/o, and interrupt acknowledge read cycles; outputs data during memory and i/o write cycles. the data bus is active high and floats to 3-state off * during bus hold acknowledge. a 23 a 0 o address bus outputs physical memory and i/o port addresses. a0 is low when data is to be transferred on pins d 70 .a 23 a 16 are low during i/o transfers. the address bus is active high and floats to 3-state off * during bus hold acknowledge. bhe o bus high enable indicates transfer or data on the upper byte of the data bus. d 158 . eight-bit oriented devices assigned to the upper byte of the data bus would normally use bhe to condition chip select functions. bhe is active low and floats to 3-state off * during bus hold acknowledge. * see bus hold circuitry section. 37
m80c286 table 18. pin description (continued) symbol type name and function bhe bhe and a0 encodings (continued) bhe value a0 value function 0 0 word transfer 0 1 transfer on upper half of data bus (d 15 d 8 ) 1 0 byte transfer on lower half of data bus (d 7 d 0 ) 1 1 will never occur s1 ,s0 o bus cycle status indicates initiation of a bus cycle and, along with m/io and cod/ inta , defines the type of bus cycle. the bus is in a t s state whenever one or both are low, s1 and s0 are active low and float to 3-state off * during bus hold acknowledge. m80c286 bus cycle status definition cod/inta m/io s1 s0 bus cycle initiated 0 (low) 0 0 0 interrupt acknowledge 0 0 0 1 will not occur 0 0 1 0 will not occur 0 0 1 1 none; not a status cycle 0 1 0 0 if a1 e 1 then halt; else shutdown 0 1 0 1 memory data read 0 1 1 0 memory data write 0 1 1 1 none; not a status cycle 1 (high) 0 0 0 will not occur 1 0 0 1 i/o read 1 0 1 0 i/o write 1 0 1 1 none; not a status cycle 1 1 0 0 will not occur 1 1 0 1 memory instruction read 1 1 1 0 will not occur 1 1 1 1 none; not a status cycle m/io o memory i/o select distinguishes memory access from i/o access. if high during t s ,a memory cycle or a halt/shutdown cycle is in progress. if low, an i/o cycle or an interrupt acknowledge cycle is in progress. m/io floats to 3-state off * during bus hold acknowledge. cod/inta o code/interrupt acknowledge distinguishes instruction fetch cycles from memory data read cycles. also distinguishes interrupt acknowledge cycles from i/o cycles. cod/ inta floats to 3-state off * during bus hold acknowledge. its timing is the same as m/io . lock o bus lock indicates that other system bus masters are not to gain control of the system bus for the current and the following bus cycle. the lock signal may be activated explicitly by the ``lock'' instruction prefix or automatically by m80c286 hardware during memory xchg instructions, interrupt acknowledge, or descriptor table access. lock is active low and floats to 3-state off * during bus hold acknowledge. ready i bus ready terminates a bus cycle. bus cycles are extended without limit until terminated by ready low. ready is an active low synchronous input requiring setup and hold times relative to the system clock be met for correct operation. ready is ignored during bus hold acknowledge. hold i bus hold request and hold acknowledge control ownership of the m80c286 hlda o local bus. the hold input allows another local bus master to request control of the local bus. when control is granted, the m80c286 will float its bus drivers to 3-state off * and then activate hlda, thus entering the bus hold acknowledge condition. the local bus will remain granted to the requesting master until hold becomes inactive which results in the m80c286 deactivating hlda and regaining control of the local bus. this terminates the bus hold acknowledge condition. hold may be asynchronous to the system clock. these signals are active high. intr i interrupt request requests the m80c286 to suspend its current program execution and service a pending external request. interrupt requests are masked whenever the interrupt enable bit in the flag word is cleared. when the m80c286 responds to an interrupt request, it performs two interrupt acknowledge bus cycles to read an 8-bit interrupt vector that identifies the source of the interrupt. to assure program interruption, intr must remain active until the first interrupt acknowledge cycle is completed. intr is sampled at the beginning of each processor cycle and must be active high at least two processor cycles before the current instruction ends in order to interrupt before the next instruction. intr is level sensitive, active high, and may be asynchronous to the system clock. * see bus hold circuitry section. 38
m80c286 table 18. pin description (continued) symbol type name and function nmi i non-maskable interrupt request interrupts the m80c286 with an internally supplied vector value of 2. no interrupt acknowledge cycles are performed. the interrupt enable bit in the m80c286 flag word does not affect this input. the nmi input is active high, may be asynchronous to the system clock, and is edge triggered after internal synchronization. for proper recognition, the input must have been previously low for at least four system clock cycles and remain high for at least four system clock cycles. pereq i processor extension operand request and acknowledge peack o extend the memory management and protection capabilities of the m80c286 to processor extensions. the pereq input requests the m80c286 to perform a data operand transfer for a processor extension. the peack output signals the processor extension when the requested operand is being transferred. pereq is active high and floats to 3-state off * during bus hold acknowledge. peack may be asynchronous to the system clock. peack is active low. busy i processor extension busy and error indicate the operating error i condition of a processor extension to the m80c286. an active busy input stops m80c286 program execution on wait and some esc instructions until busy becomes inactive (high). the m80c286 may be interrupted while waiting for busy to become inactive. an active error input causes the m80c286 to perform a processor extension interrupt when executing wait or some esc instructions. these inputs are active low and may be asynchronous to the system clock. these inputs have internal pull-up resistors. reset i system reset clears the internal logic of the m80c286 and is active high. the m80c286 may be reinitialized at any time with a low to high transition on reset which remains active for more than 16 system clock cycles. during reset active, the output pins of the m80c286 enter the state shown below: m80c286 pin state during reset pin value pin names 1 (high) s0 ,s1 , peack , a23 a0, bhe , lock 0 (low) m/io , cod/inta , hlda (note 1) 3-state off * d 15 d 0 operation of the m80c286 begins after a high to low transition on reset. the high to low transition of reset must be synchronous to the system clock. approximately 38 clk cycles from the trailing edge of reset are required by the m80c286 for internal initialization before the first bus cycle, to fetch code from the power-on execution address, occurs. a low to high transition of reset synchronous to the system clock will end a processor cycle at the second high to low transition of the system clock. the low to high transition of reset may be asynchronous to the system clock; however, in this case it cannot be predetermined which phase of the processor clock will occur during the next system clock period. synchronous low to high transitions of reset are required only for systems where the processor clock must be phase synchronous to another clock. v ss i system ground: 0 volts. v cc i system power: a 5 volt power supply. cap i substrate filter capacitor: a 0.047 m f g 20% 12v capacitor can be connected between this pin and ground for compatibility with the hmos m80286. for systems using only an m80c286, this pin can be left floating. * see bus hold circuitry section. note: 1. hlda is only low if hold is inactive (low). 39
m80c286 table 19. m80c286 systems recommended pull up resistor values m80c286 pin and name pullup value purpose 4es1 pull s0 , s1, and peack inactive during m80c286 hold periods 5es0 20 k x g 10% (note 1) 6epeack 63eready 910 x g 5% pull ready inactive within required minimum time (c l e 150 pf, l r s 7 ma) note: 1. pullup resistors are not required for s0 and s1 when the corresponding pins on the m82c284 are connected to s0 and s1 . m80286 in-circuit emulation considerations one of the advantages of using the m80c286 is that full in-circuit emulation development support is avail- able thru either the i 2 ice 80286 probe for 8 mhz/10 mhz or ice286 for 12.5 mhz designs. to utilize these powerful tools it is necessary that the designer be aware of a few minor parametric and functional differences between the m80c286 and the in-circuit emulators. the i 2 ice datasheet (i 2 ice integrated instrumentation and in-circuit emulation system, order y 210469) contains a detailed de- scription of these design considerations. the ice286 fact sheet ( y 280718) and user's guide ( y 452317) contain design considerations for the 80286 12.5 mhz microprocessor. it is recommended that the appropriate document be reviewed by the 80286 system designer to determine whether or not these differences affect the design. package thermal specifications the m80c286 microprocessor is specified for opera- tion when case temperature (t c ) is within the range of b 55 c a 125 c. case temperature, unlike ambi- ent temperature, is easily measured in any environ- ment to determine whether the m80c286 microproc- essor is within the specified operating range. the case temperature should be measured at the center of the top surface of the component. the maximum ambient temperature (t a ) allowable without violating t c specifications can be calculated from the equations shown below. t j is the 80c286 junction temperature. p is the power dissipated by the m80c286. t j e t c a p * i jc t a e t j b p * i ja t c e t a a p * [ i ja b i jc ] values for i ja and i jc are given in table 20. table 21 shows the maximum t a allowable (without ex- ceeding t c ). junction temperature calculations should use an i cc value that is measured without external resistive loads. the external resistive loads dissipate addi- tional power external to the m80c286 and not on the die. this increases the resistor temperature, not the die temperature. the full capacitive load (c l e 100 pf) should be applied during the i cc measure- ment. table 20. thermal resistances ( c/w) package i jc i jc 68-lead pga 5.5 30 68-lead cqfp 11 32 note: the numbers in table 20 were calculated using an i cc of 150 ma, which is representative of the worst case i cc at t c e 125 c with the outputs unloaded. table 21. maximum (t a ) package t a ( c) 68-lead pga 105 68-lead cqfp 108 40
m80c286 absolute maximum ratings * case temperature under bias b 55 cto a 125 c storage temperature b 65 cto a 150 c voltage on any pin with respect to ground b 1.0v to a 7v power dissipation1.1w notice: this data sheet contains information on products in the sampling and initial production phases of development. the specifications are subject to change without notice. verify with your local intel sales office that you have the latest data sheet be- fore finalizing a design. * warning: stressing the device beyond the ``absolute maximum ratings'' may cause permanent damage. these are stress ratings only. operation beyond the ``operating conditions'' is not recommended and ex- tended exposure beyond the ``operating conditions'' may affect device reliability. operating conditions symbol description min max units t c case temperature (instant on) b 55 a 125 c v cc digital supply voltage 4.50 5.50 v d.c. characteristics over specified operating conditions symbol parameter min max unit comments i cc supply current 200 ma c l e 100 pf (note 6) i ccs supply current (static) 5 ma (note 7) c clk clk input capacitance 20 pf freq e 1 mhz c in other input capacitance 10 pf freq e 1 mhz c o input/output capacitance 20 pf freq e 1 mhz v il input low voltage b 0.5 0.8 v freq e 2 mhz v ih input high voltage 2.0 v cc a 0.5 v freq e 2 mhz v ilc clk input low voltage b 0.5 0.8 v freq e 2 mhz v ihc clk input high voltage 3.8 v cc a 0.5 v freq e 2 mhz v ol output low voltage 0.45 v i ol e 2.0 ma, freq e 2 mhz v oh output high voltage 3.0 v i oh eb 2.0 ma, freq e 2 mhz v cc b 0.5 v i oh eb 100 m a, freq e 2 mhz i li input leakage current g 10 m av in e gnd or v cc (note 6) i lo output leakage current g 10 m av o e gnd or v cc (note 1) i il input sustaining current on b 30 b 500 m av in e 0v (note 1) busy y and error y pins i bhl input sustaining current 35 200 m av in e 1.0v (notes 1, 2) (bus hold low) i bhh input sustaining current b 50 b 400 m av in e 3.0v (notes 1, 3) (bus hold high) i bhlo bus hold low overdrive 250 m a (notes 1, 4) i bhho bus hold high overdrive b 420 m a (notes 1, 5) notes: 1. tested with the clock stopped. 2. i bhl should be measured after lowering v in to gnd and then raising to 1.0v on the following pins: 36 51, 66, 67. 3. i bhh should be measured after raising v in to v cc and then lowering to 3.0v on the following pins: 4 6, 36 51, 66 68. 4. an external driver must source at least i bhlo to switch this node from low to high. 5. an external driver must sink at least i bhho to switch this node from high to low. 6. tested with outputs unloaded and at maximum frequency. 7. tested while clock stopped in phase 2 and inputs at v cc or v ss with the outputs unloaded. 41
m80c286 a.c. characteristics over specified operating conditions a.c. timings are referenced to 1.5v points of signals as illustrated in datasheet waveforms, unless otherwise noted. symbol parameter 10 mhz unit comments min max 1 system clock (clk) period 50 dc ns 2 system clock (clk) low time 12 ns at 1.0v 3 system clock (clk) high time 16 ns at 3.6v 17 system clock (clk) rise time 8 ns 1.0v to 3.6v 18 system clock (clk) fall time 8 ns 3.6v to 1.0v 4 asynchronous inputs setup time 20 ns (note 1) 5 asynchronous inputs hold time 20 ns (note 1) 6 reset setup time 23 ns 7 reset hold time 5 ns 8 read data setup time 8 ns 9 read data hold time 8 ns 10 ready setup time 26 ns 11 ready hold time 25 ns 12a1 status active delay 5 22 ns (notes 2, 3) 12a2 peack active delay 5 22 ns (notes 2, 3) 12b status/peack inactive delay 3 30 ns (notes 2, 3) 13 address valid delay 4 35 ns (notes 2, 3) 14 write data valid delay 3 40 ns (notes 2, 3) 15 address/status/data float delay 2 47 ns (notes 2, 4) 16 hlda valid delay 3 47 ns (notes 2, 3) 19 address valid to status 27 ns (notes 2, 3) valid setup time notes: 1. asynchronous inputs are intr, nmi, hold, pereq, error , and busy . this specification is given only for testing purposes, to assure recognition at a specific clk edge. 2. delay from 1.0v on the clk, to 1.5v or float on the output as appropriate for valid or floating condition. 3. output load: c l e 100 pf. 4. float condition occurs when output current is less than i lo in magnitude. 42
m80c286 a.c. characteristics (continued) 271103 37 note: ac test loading on outputs 271103 38 note: ac drive and measurement pointseclk input 271103 39 note: ac setup, hold and delay time measurementegeneral 43
m80c286 typical capacitive derating curves 271103 40 typical cmos level slew rates for address/data buffers 271103 41 44
m80c286 typical ttl level slew rates for address/data buffers 271103 42 typical i cc vs frequency for different output loads 271103 43 45
m80c286 a.c. characteristics (continued) m82c284 timing requirements symbol parameter m82c284-10 unit comments min max 11 srdy /srdyen setup time 17.5 ns 12 srdy /srdyen hold time 2 ns 13 ardy /ardyen setup time 0 ns (note 1) 14 ardy /ardyen hold time 30 ns (note 1) 19 pclk delay 0 35 ns c l e 75 pf i ol e 5ma i oh eb 1ma note: 1. these times are given for testing purposes to assure a predetermined action. m82c288 timing requirements symbol parameter m82c288-10 unit comments min max 12 cmdly setup time 15 ns 13 cmdly hold time 1 ns 30 command command inactive 5 20 c l e 300 pf max delay command active 3 21 ns i ol e 32 ma max 29 from clk i oh eb 5mamax 16 ale active delay 3 16 ns 17 ale inactive delay 19 ns 19 dt/r read active delay 23 ns c l e 150 pf 22 dt/r read inactive delay 5 20 ns i ol e 16 ma max 20 den read active delay 5 21 ns i oh eb 1mamax 21 den read inactive delay 3 21 ns 23 den write active delay 23 ns 24 den write inactive delay 3 19 ns 46
m80c286 waveforms major cycle timing 271103 44 note: 1. the modified timing is due to the cmdly signal being active. 47
m80c286 waveforms (continued) m80c286 asynchronous input signal timing 271103 45 notes: 1. pclk indicates which processor cycle phase will oc- cur on the next clk. pclk may not indicate the cor- rect phase until the first bus cycle is performed. 2. these inputs are asynchronous. the setup and hold times shown assure recognition for testing purposes. m80c286 reset input timing and subsequent processor cycle phase 271103 46 note: 1. when reset meets the setup time shown, the next clk will start or repeat w 2 of a processor cycle. exiting and entering hold 271103 47 notes: 1. these signals may not be driven by the m80c286 during the time shown. the worst case in terms of latest float time is shown. 2. the data bus will be driven as shown if the last cycle before t i in the diagram was a write t c . 3. the m80c286 floats its status pins during t h . external 20 k x resistors keep these signals high (see table 16). 4. for hold request set up to hlda, refer to figure 29. 5. bhe and lock are driven at this time but will not become valid until t s . 6. the data bus will remain in 3-state off if a read cycle is performed. 48
m80c286 waveforms (continued) m80c286 pereq/peack timing for one transfer only notes: 271103 48 1. peack always goes active during the first bus operation of a processor extension data operand transfer sequence. the first bus operation will be either a memory read at operand address or i/o read at port address oofa(h). 2. to prevent a second processor extension data operand transfer, the worst case maximum time (shown above) is: 3 c j b 12a2 max. b m min. . the actual, configuration dependent, maximum time is: 3 c j b 12a2 max. b m min. a a c 2 c j . a is the number of extra t c states added to either the first or second bus operation of the processor extension data operand transfer sequence. initial m80c286 pin state during reset notes: 271103 49 1. setup time for reset u may be violated with the consideration that w 1 of the processor clock may begin one system clk period later. 2. setup and hold times for reset v must be met for proper operation, but reset v may occur during w 1or w 2. 3. the data bus is only guaranteed to be in 3-state off at the time shown. 49
m80c286 271103 50 figure 35. m80c286 instruction format examples m80c286 instruction set summary instruction timing notes the instruction clock counts listed below establish the maximum execution rate of the m80c286. with no delays in bus cycles, the actual clock count of an m80c286 program will average 5% more than the calculated clock count, due to instruction sequences which execute faster than they can be fetched from memory. to calculate elapsed times for instruction se- quences, multiply the sum of all instruction clock counts, as listed in the table below, by the processor clock period. a 10 mhz processor clock has a clock period of 100 nanoseconds and requires an m80c286 system clock (clk input) of 20 mhz. instruction clock count assumptions 1. the instruction has been prefetched, decoded, and is ready for execution. control transfer in- struction clock counts include all time required to fetch, decode, and prepare the next instruction for execution. 2. bus cycles do not require wait states. 3. there are no processor extension data transfer or local bus hold requests. 4. no exceptions occur during instruction execution. instruction set summary notes addressing displacements selected by the mod field are not shown. if necessary they appear after the instruction fields shown. above/below refers to unsigned value greater refers to positive signed value less refers to less positive (more negative) signed values if d e 1 then to register; if d e 0 then from register if w e 1 then word instruction; if w e 0 then byte instruction if s e 0 then 16-bit immediate data form the oper- and if s e 1 then an immediate data byte is sign-ex- tended to form the 16-bit operand x don't care z used for string primitives for comparison with zf flag if two clock counts are given, the smaller refers to a register operand and the larger refers to a memory operand * e add one clock if offset calculation requires summing 3 elements n e number of times repeated m e number of bytes of code in next instruction level (l)elexical nesting level of the procedure 50
m80c286 the following comments describe possible excep- tions, side effects, and allowed usage for instruc- tions in both operating modes of the m80c286. real address mode only 1. this is a protected mode instruction. attempted execution in real address mode will result in an undefined opcode exception (6). 2. a segment overrun exception (13) will occur if a word operand reference at offset ffff(h) is at- tempted. 3. this instruction may be executed in real address mode to initialize the cpu for protected mode. 4. the iopl and nt fields will remain 0. 5. processor extension segment overrun interrupt (9) will occur if the operand exceeds the seg- ment limit. either mode 6. an exception may occur, depending on the value of the operand. 7. lock is automatically asserted regardless of the presence or absence of the lock instruction prefix. 8. lock does not remain active between all oper- and transfers. protected virtual address mode only 9. a general protection exception (13) will occur if the memory operand cannot be used due to ei- ther a segment limit or access rights violation. if a stack segment limit is violated, a stack seg- ment overrun exception (12) occurs. 10. for segment load operations, the cpl, rpl, and dpl must agree with privilege rules to avoid an exception. the segment must be present to avoid a not-present exception (11). if the ss reg- ister is the destination, and a segment not-pres- ent violation occurs, a stack exception (12) oc- curs. 11. all segment descriptor accesses in the gdt or ldt made by this instruction will automatically assert lock to maintain descriptor integrity in multiprocessor systems. 12. jmp, call, int, ret, iret instructions refer- ring to another code segment will cause a gener- al protection exception (13) if any privilege rule is violated. 13. a general protection exception (13) occurs if cpl i 0. 14. a general protection exception (13) occurs if cpl l iopl. 15. the if field of the flag word is not updated if cpl l iopl. the iopl field is updated only if cpl e 0. 16. any violation of privilege rules as applied to the selector operand do not cause a protection ex- ception; rather, the instruction does not return a result and the zero flag is cleared. 17. if the starting address of the memory operand violates a segment limit, or an invalid access is attempted, a general protection exception (13) will occur before the esc instruction is execut- ed. a stack segment overrun exception (12) will occur if the stack limit is violated by the oper- and's starting address. if a segment limit is vio- lated during an attempted data transfer then a processor extension segment overrun exception (9) occurs. 18. the destination of an int, jmp, call, ret or iret instruction must be in the defined limit of a code segment or a general protection exception (13) will occur. 51
m80c286 m80c286 instruction set summary clock count comments real protected real protected function format address virtual address virtual mode address mode address mode mode data transfer mov e move: register to register/memory 1000100w modreg r/m 2,3 * 2,3 * 29 register/memory to register 1000101w modreg r/m 2,5 * 2,5 * 29 immediate to register/memory 1100011w mod000 r/m data data if w e 1 2,3 * 2,3 * 29 immediate to register 1011w reg data data if w e 122 memory to accumulator 1010000w addr-low addr-high 5529 accumulator to memory 1010001w addr-low addr-high 3329 register/memory to segment register 10001110 mod0reg r/m 2,5 * 17,19 * 2 9,10,11 segment register to register/memory 10001100 mod0reg r/m 2,3 * 2,3 * 29 push e push: memory 11111111 mod110 r/m 5 * 5 * 29 register 01010 reg 3329 segment register 000reg110 3329 immediate 011010s0 data data if s e 0 3329 pusha e push all 01100000 17 17 2 9 pop e pop: memory 10001111 mod000 r/m 5 * 5 * 29 register 01011 reg 5529 segment register 000reg111 (reg i 01) 5 20 2 9,10,11 popa e popall 01100001 19 19 2 9 xchg e exhcange: register/memory with register 1000011w modreg r/m 3,5 * 3,5 * 2,7 7,9 register with accumulator 10010 reg 3 3 in e input from: fixed port 1110010w port 5 5 14 variable port 1110110w 5 5 14 out e output to: fixed port 1110011w port 3 3 14 variable port 1110111w 3 3 14 xlat e translate byte to al 11010111 5 5 9 lea e load ea to register 10001101 modreg r/m 3 * 3 * lds e load pointer to ds 11000101 modreg r/m (mod i 11) 7 * 21 * 2 9,10,11 les e load pointer to es 11000100 modreg r/m (mod i 1) 7 * 21 * 2 9,10,11 shaded areas indicate instructions not available in m8086, 88 microsystems. 52
m80c286 m80c286 instruction set summary (continued) clock count comments real protected real protected function format address virtual address virtual mode address mode address mode mode data transfer (continued) lahf load ah with flags 10011111 2 2 sahf e store ah into flags 10011110 2 2 pushf e push flags 10011100 3329 popf e pop flags 10011101 5 5 2,4 9,15 arithmetic add e add: reg/memory with register to either 000000dw modreg r/m 2,7 * 2,7 * 29 immediate to register/memory 100000sw mod000 r/m data data if s w e 01 3,7 * 3,7 * 29 immediate to accumulator 0000010w data data if w e 133 adc e add with carry: reg/memory with register to either 000100dw modreg r/m 2,7 * 2,7 * 29 immediate to register/memory 100000sw mod010 r/m data data if s w e 01 3,7 * 3,7 * 29 immediate to accumulator 0001010w data data if w e 133 inc e increment: register/memory 1111111w mod000 r/m 2,7 * 2,7 * 29 register 01000reg 2 2 sub e subtract: reg/memory and register to either 001010dw modreg r/m 2,7 * 2,7 * 29 immediate from register/memory 100000sw mod101 r/m data data if s w e 01 3,7 * 3,7 * 29 immediate from accumulator 0010110w data data if w e 133 sbb e subtract with borrow: reg/memory and register to either 000110dw modreg r/m 2,7 * 2,7 * 29 immediate from register/memory 100000sw mod011 r/m data data if s w e 01 3,7 * 3,7 * 29 immediate from accumulator 0001110w data data if w e 133 dec e decrement register/memory 1111111w mod001 r/m 2,7 * 2,7 * 29 register 01001 reg 2 2 cmp e compare register/memory with register 0011101w modreg r/m 2,6 * 2,6 * 29 register with register/memory 0011100w modreg r/m 2,7 * 2,7 * 29 immediate with register/memory 100000sw mod111 r/m data data if s w e 01 3,6 * 3,6 * 29 immediate with accumulator 0011110w data data if w e 133 neg e change sign 1111011w mod011 r/m 2 7 * 29 aaa e ascii adjust for add 00110111 3 3 daa e decimal adjust for add 00100111 3 3 53
m80c286 m80c286 instruction set summary (continued) clock count comments real protected real protected function format address virtual address virtual mode address mode address mode mode arithmetic (continued) aas e ascii adjust for subtract 00111111 3 3 das e decimal adjust for subtract 00101111 3 3 mul e multiply (unsigned): 1111011w mod100 r/m register-byte 13 13 register-word 21 21 memory-byte 16 * 16 * 29 memory-word 24 * 24 * 29 imul e integer multiply (signed): 1111011w mod101 r/m register-byte 13 13 register-word 21 21 memory-byte 16 * 16 * 29 memory-word 24 * 24 * 29 imul e integer immediate multiply 011010s1 modreg r/m data data if s e 0 21,24 * 21,24 * 29 (signed) div e divide (unsigned) 1111011w mod 110 r/m register-byte 14 14 6 6 register-word 22 22 6 6 memory-byte 17 * 17 * 2,6 6,9 memory-word 25 * 25 * 2,6 6,9 idiv e integer divide (signed) 1111011w mod111 r/m register-byte 17 17 6 6 register-word 25 25 6 6 memory-byte 20 * 20 * 2,6 6,9 memory-word 28 * 28 * 2,6 6,9 aam e ascii adjust for multiply 11010100 00001010 16 16 aad e ascii adjust for divide 11010101 00001010 14 14 cbw e convert byte to word 10011000 2 2 cwd e convert word to double word 10011001 2 2 logic shift/rotate instructions: register/memory by 1 1101000w modttt r/m 2,7 * 2,7 * 29 register/memory by cl 1101001w modttt r/m 5 a n,8 a n * 5 a n,8 a n * 29 register/memory by count 1100000w modttt r/m count 5 a n,8 a n * 5 a n,8 a n * 29 ttt instruction 000 rol 001 ror 010 rcl 011 rcr 1 0 0 shl/sal 101 shr 111 sar shaded areas indicate instructions not available in m8086, 88 microsystems. 54
m80c286 m80c286 instruction set summary (continued) clock count comments real protected real protected function format address virtual address virtual mode address mode address mode mode arithmetic (continued) and e and: reg/memory and register to either 001000dw modreg r/m 2,7 * 2,7 * 29 immediate to register/memory 1000000w mod100 r/m data data if w e 1 3,7 * 3,7 * 29 immediate to accumulator 0010010w data data if w e 133 test e and function to flags, no result: register/memory and register 1000010w modreg r/m 2,6 * 2,6 * 29 immediate data and register/memory 1111011w mod000 r/m data data if w e 1 3,6 * 3,6 * 29 immediate data and accumulator 1010100w data data if w e 133 or e or: reg/memory and register to either 000010dw modreg r/m 2,7 * 2,7 * 29 immediate to register/memory 1000000w mod001 r/m data data if w e 1 3,7 * 3,7 * 29 immediate to accumulator 0000110w data data if w e 133 xor e exclusive or: reg/memory and register to either 001100dw modreg r/m 2,7 * 2,7 * 29 immediate to register/memory 1000000w mod110 r/m data data if w e 1 3,7 * 3,7 * 29 immediate to accumulator 0011010w data data if w e 133 not e invert register/memory 1111011w mod010 r/m 2,7 * 2,7 * 29 string manipulation: movs e move byte/word 1010010w 5 5 2 9 cmps e compare byte/word 1010011w 8 8 2 9 scas e scan byte/word 1010111w 7 7 2 9 lods e load byte/wd to al/ax 1010110w 5 5 2 9 stos e stor byte/wd from al/a 1010101w 3 3 2 9 ins e input byte/wd from dx port 0110110w 5 5 2 9,14 outs e output byte/wd to dx port 0110111w 5 5 2 9,14 repeated by count in cx mov 5 e move string 11110011 1010010w 5 a 4n 5 a 4n 2 9 cmps e compare string 1111001z 1010011w 5 a 9n 5 a 9n 2,8 8,9 scas e scan string 1111001z 1010111w 5 a 8n 5 a 8n 2,8 8,9 lods e load string 11110011 1010110w 5 a 4n 5 a 4n 2,8 8,9 stos e store string 11110011 1010101w 4 a 3n 4 a 3n 2,8 8,9 ins e input string 11110011 0110110w 5 a 4n 5 a 4n 2 9,14 outs e output string 11110011 0110111w 5 a 4n 5 a 4n 2 9,14 shaded areas indicate instructions not available in m8086, 88 microsystems. 55
m80c286 m80c286 instruction set summary (continued) clock count comments real protected real protected function format address virtual address virtual mode address mode address mode mode control transfer call e call: direct within segment 11101000 disp-low disp-high 7 a m7 a m218 register/memory 11111111 mod010 r/m 7 a m, 11 a m * 7 a m, 11 a m * 2,8 8,9,18 indirect within segment direct intersegment 10011010 segment offset 13 a m26 a m 2 11,12,18 protected mode only (direct intersegment): segment selector via call gate to same privilege level 41 a m 8,11,12,18 via call gate to different privilege level, no parameters 82 a m 8,11,12,18 via call gate to different privilege level, x parameters 86 a 4x a m 8,11,12,18 via tss 177 a m 8,11,12,18 via task gate 182 a m 8,11,12,18 indirect intersegment 11111111 mod011 r/m (mod i 11) 16 a m29 a m * 2 8,9,11,12,18 protected mode only (indirect intersegment): via call gate to same privilege level 44 a m * 8,9,11,12,18 via call gate to different privilege level, no parameters 83 a m * 8,9,11,12,18 via call gate to different privilege level, x parameters 90 a 4x a m * 8,9,11,12,18 via tss 180 a m * 8,9,11,12,18 via task gate 185 a m * 8,9,11,12,18 jmp e unconditional jump: short/long 11101011 disp-low 7 a m7 a m18 direct within segment 11101001 disp-low disp-high 7 a m7 a m18 register/memory indirect within segment 11111111 mod100 r/m 7 a m, 11 a m * 7 a m, 11 a m * 2 9,18 direct intersegment 11101010 segment offset 11 a m23 a m 11,12,18 protected mode only (direct intersegment): segment selector via call gate to same privilege level 38 a m 8,11,12,18 via tss 175 a m 8,11,12,18 via task gate 180 a m 8,11,12,18 indirect intersegment 11111111 mod101 r/m (mod i 11) 15 a m * 26 a m * 2 8,9,11,12,18 protected mode only (indirect intersegment): via call gate to same privilege level 41 a m * 8,9,11,12,18 via tss 178 a m * 8,9,11,12,18 via task gate 183 a m * 8,9,11,12,18 ret e return from call: within segment 11000011 11 a m11 a m 2 8,9,18 within seg adding immed to sp 11000010 data-low data-high 11 a m11 a m 2 8,9,18 intersegment 11001011 15 a m25 a m 2 8,9,11,12,18 intersegment adding immediate to sp 11001010 data-low data-high 15 a m 2 8,9,11,12,18 protected mode only (ret): to different privilege level 55 a m 9,11,12,18 56
m80c286 m80c286 instruction set summary (continued) clock count comments real protected real protected function format address virtual address virtual mode address mode address mode mode control transfer (continued) je/jz e jump on equal zero 01110100 disp 7 a mor3 7 a mor3 18 jl/jnge e jump on less/not greater or equal 01111100 disp 7 a mor3 7 a mor3 18 jle/jng e jump on less or equal/not greater 01111110 disp 7 a mor3 7 a mor3 18 jb/jnae e jump on below/not above or equal 01110010 disp 7 a mor3 7 a mor3 18 jbe/jna e jump on below or equal/not above 01110110 disp 7 a mor3 7 a mor3 18 jp/jpe e jump on parity/parity even 01111010 disp 7 a mor3 7 a mor3 18 jo e jump on overflow 01110000 disp 7 a mor3 7 a mor3 18 js e jump on sign 01111000 disp 7 a mor3 7 a mor3 18 jne/jnz e jump on not equal/not zero 01110101 disp 7 a mor3 7 a mor3 18 jnl/jge e jump on not less/greater or equal 01111101 disp 7 a mor3 7 a mor3 18 jnle/jg e jump on not less or equal/greater 01111111 disp 7 a mor3 7 a mor3 18 jnb/jae e jump on not below/above or equal 01110011 disp 7 a mor3 7 a mor3 18 jnbe/ja e jump on not below or equal/above 01110111 disp 7 a mor3 7 a mor3 18 jnp/jpo e jump on not par/par odd 01111011 disp 7 a mor3 7 a mor3 18 jno e jump on not overflow 01110001 disp 7 a mor3 7 a mor3 18 jns e jump on not sign 01111001 disp 7 a mor3 7 a mor3 18 loop e loop cx times 11100010 disp 8 a mor4 8 a mor4 18 loopz/loope e loop while zero/equal 11100001 disp 8 a mor4 8 a mor4 18 loopnz/loopne e loop while not zero/equal 11100000 disp 8 a mor4 8 a mor4 18 jcxz e jump on cx zero 11100011 disp 8 a mor4 8 a mor4 18 enter e enter procedure 11001000 data-low data-high l 2,8 8,9 l e 0 11 11 2,8 8,9 l e 1 15 15 2,8 8,9 l l 1 16 a 4(l b 1) 16 a 4(l b 1) 2,8 8,9 leave e leave procedure 11001001 5 5 int e interrupt: type specified 11001101 type 23 a m 2,7,8 type 3 11001100 23 a m 2,7,8 into e interrupt on overflow 11001110 24 a m or 3 2,6,8 (3 if no (3 if no interrupt) interrupt) shaded areas indicate instructions not available in m8086, 88 microsystems. 57
m80c286 m80c286 instruction set summary (continued) clock count comments real protected real protected function format address virtual address virtual mode address mode address mode mode control transfer (continued) protected mode only: via interrupt or trap gate to same privilege level 40 a m 7,8,11,12,18 via interrupt or trap gate to fit different privilege level 78 a m 7,8,11,12,18 via task gate 167 a m 7,8,11,12,18 iret e interrupt return 11001111 17 a m31 a m 2,4 8,9,11,12,15,18 protected mode only: to different privilege level 55 a m 8,9,11,12,15,18 to different task (nt e 1) 169 a m 8,9,11,12,18 bound e detect value out of range 01100010 modreg r/m 13 * 13 * 2,6 6,8,9,11,12,18 (use int clock count if exception 5) processor control clc e clear carry 11111000 2 2 cmc e complement carry 11110101 2 2 stc e set carry 11111001 2 2 cld e clear direction 11111100 2 2 std e set direction 11111101 2 2 cli e clear interrupt 11111010 3 3 14 sti e set interrupt 11111011 2 2 14 hlt e halt 11110100 2 2 13 wait e wait 10011011 3 3 lock e bus lock prefix 11110000 0 0 14 cts e clear task switched flag 00001111 00000110 2 2 3 13 esc e processor extension escape 11011ttt modlll r/m 920 * 920 * 5,8 8,17 (ttt lll are opcode to processor extension) seg e segment override prefix 001 reg 110 0 0 protection control lgdt e load global descriptor table register 00001111 00000001 mod010 r/m 11 * 11 * 2,3 9,13 sgdt e store global descriptor table register 00001111 00000001 mod000 r/m 11 * 11 * 2,3 9 lidt e load interrupt descriptor table register 00001111 00000001 mod011 r/m 12 * 12 * 2,3 9,13 sidt e store interrupt descriptor table register 00001111 00000001 mod001 r/m 12 * 12 * 2,3 9 lldt e load local descriptor table register from register memory 00001111 00000000 mod010 r/m 17,19 * 1 9,11,13 sldt e store local descriptor table register to register/memory 00001111 00000000 mod000 r/m 2,3 * 19 shaded areas indicate instructions not available in m8086, 88 microsystems. 58
m80c286 m80c286 instruction set summary (continued) clock count comments real protected real protected function format address virtual address virtual mode address mode address mode mode protection control (continued) ltr e local task register from register/memory 00001111 00000000 mod011 r/m 17,19 * 1 9,11,13 str e store task register to register memory 00001111 00000000 mod001 r/m 2,3 * 19 lmsw e load machine status word from register/memory 00001111 00000001 mod110 r/m 3,6 * 3,6 * 2,3 9,13 smsw e store machine status word 00001111 00000001 mod100 r/m 2,3 * 2,3 * 2,3 9 lar e load access rights from register/memory 00001111 00000010 modreg r/m 14,16 * 1 9,11,16 lsl e load segment limit from register/memory 00001111 00000011 modreg r/m 14,16 * 1 9,11,16 arpl e adjust requested privilege level: 01100011 modreg r/m 10 * ,11 * 2 8,9 from register/memory verr e verify read access: register/memory 00001111 00000000 mod100r/m 14,16 * 1 9,11,16 verr e verify write access: 00001111 00000000 mod101r/m 14,16 * 1 9,11,16 shaded areas indicate instructions not available in m8086, 88 microsystems. 59
m80c286 footnotes the effective address (ea) of the memory operand is computed according to the mod and r/m fields: if mod e 11 then r/m is treated as a reg field if mod e 00 then disp e 0 * , disp-low and disp-high are absent if mod e 01 then disp e disp-low sign-extended to 16 bits, disp-high is absent if mod e 10 then disp e disp-high: disp-low if r/m e 000 then ea e (bx) a (si) a disp if r/m e 001 then ea e (bx) a (di) a disp if r/m e 010 then ea e (bp) a (si) a disp if r/m e 011 then ea e (bp) a (di) a disp if r/m e 100 then ea e (si) a disp if r/m e 101 then ea e (di) a disp if r/m e 110 then ea e (bp) a disp * if r/m e 111 then ea e (bx) a disp disp follows 2nd byte of instruction (before data if required) * except if mod e 00 and r/m e 110 then eq e disp-high: disp-low. segment override prefix 001reg110 reg is assigned according to the following: segment reg register 00 es 01 cs 10 ss 11 dc reg is assigned according to the following table: 16-bit (w e 1) 8-bit (w e 0) 000 ax 000 al 001 cx 001 cl 010 dx 010 dl 011 bx 011 bl 100 sp 100 ah 101 bp 101 ch 101 si 110 dh 111 di 111 bh the physical addresses of all operands addressed by the bp register are computed using the ss seg- ment register. the physical addresses of the desti- nation operands of the string primitive operations (those addressed by the di register) are computed using the es segment, which may not be overridden. intel corporation, 2200 mission college blvd., santa clara, ca 95052; tel. (408) 765-8080 intel corporation (u.k.) ltd., swindon, united kingdom; tel. (0793) 696 000 intel japan k.k., ibaraki-ken; tel. 029747-8511

▲Up To Search▲

Price & Availability of MQ80C286

	To Download MQ80C286 Datasheet File
If you can't view the Datasheet, Please click here to try to view without PDF Reader .