Cx6x86 undocumented features

Last Update:
971014 - 6x86 info expanded (CCR7)
History:
970903 - 6x86 info expanded (CCR7.7)
1997-06-02 6x86 and 6x86MX info added
1997-01-24..29 - includes new info on BTB, VIPERM and CPUID instruction - Many thanks to Mikael Johansson for info on the above.

6x86 processors have several registers and features which are not officially documented. Some documents uncover their existence, and some code can give some signs of their function.

The article below is for people who know the architecture of x86 CPUs and - particularly - Cyrix family CPUs. For those who don't know the latter but are desperate enough, Data Books are suggested readings. The Data Books can be obtained in .PDF form from Cyrix and IBM.

TR1 and TR2

These are test registers which can be accessed using mov TRx, reg and mov reg, TRx. 6x86 uses 486-like mechanisms to access test registers, in this aspect (as in many others) it is not compatible with Pentium. TR1 and TR2 are related to BTB (Branch Target Buffer). Their purpose is to test and control the BTB. Access to TR1 and TR2 is allowed only after it is enabled using BTBTR_EN bit in register DBR0.

TR1 - BTB test index register

bits:

0..2 - unknown
3..5 (or more) - index in BTB control space. This hold the number of register to be accessed using read from or write to TR2
rest - unknown

TR2 - BTB test data register

Contains data read from or to be written into BTB test register selected by index written to TR1.

BTB control space - 6x86

There are several control registers accessed through TR1 and TR2. Of these only one is (partially) known

bit 0 - BTB disable
bit 1 - far BTB COF hits enable. When set to 0 enables BTB to predict intersegment jumps.
bit 2 - return stack enable
bit 3 - Data Bypassing control

The table below is currently being created. Will be ready soon.

Name	Index	6x86MX	6x86	5x86	Others	Function
Counter	10..1F		+
CSECTM	?	+		-	-	Cache Sector Map register, probably alias to one of RCRs.
DBR0	30	+	+			Debug Register
DBR1	31	+
DBR2	32	+
DBR3	33	+
	34		+	-	-
	38		+	-	-
DOR0	3C	+	+	-	-	Debug Opcode Register
		+	-	-	-
CCR0	C0
CCR1	C1
CCR2	C2
CCR3	C3					bit 0 - SMILOCK
CCR4	E8		+
CCR5	E9		+
CCR6	EA
CCR7	EB	+	-	-	-	MMX unit control and more bit 0 - MMXPLUS - enables Cyrix extended MMX instructions (3 argument operations) bit 1 - MMX reserved bit 2 - MMX reserved bits 3..6 - reserved bit 7 - Global Paging Enable - influences CPUID feature flags - enables GP extension
	EC..EF	+	-	-	-	? may be scratchpad
ARR0..7
RCR0..7
DIR2	FB	+	-	-	-	Sub-Rev ID.
DIR3	FC	+	+	-	-	Family Code. May be written!
DIR4	FD	+	?	-	-	Model/Stepping
DIR0	FE	+	+	+	+
DIR1	FF	+	+	+	+

Counter registers (10h..1Fh) - 6x86

These registers form the event counter. Register 10h controls the counter, and regs 18..1B count the events. No more info available.

DBR0 (30h) - 6x86

This is register accessed at 30h in CPU control space. DBR0 is not officially documented. Access to DBR0 and to other registers described below requires setting MAPEN field in CCR3 to 0001. Presumably the meaning of bits in DBR0 is as follows:

bit 0
bit 1
bit 2
bit 3
bit 4
bit 5 - data bypassing and forwarding enable, normally set to 1
bit 6 - BTB TR access enable, must be 0 for normal operation, 1 enables MOV to/from TR1/2 instructions
bit 7 - used

?DBR1 (31h), ?DBR2 (32h), ?DBR3(33h)

The registers are used for performance control or CPU pipeline debugging. Setting to all zeros causes default CPU behavior. For serialization on a given opcode register 31h is loaded with 0B8h, 32h with 7Fh and 33h - with 0.

?(34h)

Control register with two most significant bits implemented.

?(38h)

???

??(3Ch) - opcode match register

When loaded with first byte of instruction's opcode, while registers 31h..33h contain proper (nonzero) values, causes the CPU to "trap" the instructions while they are executed and to change the normal instruction flow, presumably serializing execution. The exact behavior of CPU depends on contents of registers 31h..33h.

(Registers C0h..E3h - described in Data Book)

CCR5 (E9h)

The register was documented, but its description is still incomplete. To access CCR5, MAPEN must be set to 0001. Meaning of particular bits is described below:

bit 7 - not implemented up to v.2.7
bit 6 - VIPERM - if set to one prevents any access to control registers outside of range C0..CF if MAPEN in CCR3 has the value other than 1. (Note that to change CCR5, MAPEN must be set to 1.) This has the effect of disabling CPU identification via DIR0 and DIR1 registers (they read as FF while VIPERM=1 and MAPEN != 1), and also influences CPUID instruction (see reg. FC).
bit 5 - ARREN - documented in Data Book
bit 4 - LBR1 - documented in Data Book
bits 3, 2 - not implemented up to v.2.7
bit 1 - SLOP - Slow LOoP instructions - implemented in "classic" 6x86 v2.7 (the "right" version) and newer, and in 6x86L prior to version 4.0 (which means that no commercially available 6x86L have this bit). Slows down the execution of LOOP instruction to make the CPU more compatible with iPentium for timing-critical routines. Setting the bit has similar effect to trapping LOOP instructions using opcode matching, but is much, much simpler.
bit 0 - WT_ALLOC - documented in Data Book

CCR6 (EAh) - 6x86MX

Documented in the Data Book.

DIR3 (FCh) - CPUID family value register

On 6x86 the register contains 05h after RESET. It can be written (at least in CPU rev.2.7). The value read from this register is returned in AH by CPUID instrction with EAX=1. Normally CPUID returns 00000520 in EAX. After writing value XX to reg FC, CPUID returns 0000XX20. If VIPERM is set to 1 and MAPEN is not 1, the value of reg FC is read as FF, so cpuid returns value that looks like YYYYff20, where YYYY is not 0! On the CPU I tested it was 601Ch.

Note that if you set the register to 6, your CPU will be (mis)identified as some variety of M2.

DIR4 (FDh)

Seems to be read-only on 6x86, always read as 00.

The End