Identification of Cyrix/TI/IBM/ST CPUs

Copyright 1996-7 by Grzegorz Mazur
All the brand names used here belong to their owners.

Last update: 1997-01-29

Changes:
971014 - some updates on new Cyrix CPUs
970129 - M2, Gx86 and 6x86 info added/corrected
970127 - 6x86 info corrected and expanded
961126 - TI 486 SXL identification described
961119 - 6x86 info expanded
1996-05-20 - numbers corrected for 5x86, 6x86

If got this far, we are sure we have Cyrix or alike (TI, SGS-Thomson) - we performed the appropriate tests before. The following checks were performed:

  • CPU compatibility is at least 486 (AC bit in EFLAGS can be toggled).
  • Divide test gives value 0000, 0004, 0044 (or different from 0095 and 0010).
  • CPUID is not supported or vendor ID string is "CyrixInstead".

    • Accessing CPU control registers

    Our CPU has several internal registers. The registers are byte-wide and areaccessed using non-interrupted sequence of two instructions: We shall write two routines (read and write) providing a convenient means for accessing the registers.

    Checking for DIRs

    Now we can perform a simple test: if bit 4 of regiter C3 (MAPEN in CCR3) in CPU control space can be toggled, we are happy to have Device Identification Registers on chip. So we should read DIRs and look-up the DIR table below.

    Detecting Cx486S with no DIRs

    If there are no DIRs and bit 2 of register C2 can be toggled, we have a rare variety - early Cx486S.

    Detecting Cx/TI 486 SLC/DLC and TI 486SXLC/SXL

    If there are no DIRs and the CPU is not Cx486s, it may be one of the following:
  • Cx/TI 486 SLC/DLC
  • TI 486 SXLC/SXL
  • IBM 486SLC/SLC2

    • IBM CPUs have MSRs and can be detected based on their presence. (This will be described...)

    If there are no MSRs, we should perform two tests: SXL detection and bus width.

    SXL family has 8 KB on-chip cache, SLC/DLC - only 1KB. Cache size can be detected using cache test mechanism (registers TR4 and TR5). The procedure is as follows:

  • disable cache
  • write 200h to TR4
  • write 1 to TR5
  • write 2 to TR5
  • read TR4
  • if bit 9 of TR4 is set, the CPU has 1 KB cache, otherwise it is SXL-family chip with 8 KB cache.

    • Then look up the following table:
     
    16-bit bus 32-bit bus
    1KB cache Cx486SLC Cx486DLC
    8 KB cache TI486SXLC TI486SXL
    If we want to be very precise, we can try to distinguish A/B steppings of these chips by checking for SMM support.

    Identification of A/B stepping of 486 SLC/DLC/SXLC/SXL

    A-step chips do not support SMM, B-step chips do. The method (published by TI) enables SMM instructions and checks if a particular SMM instruction is legal. (Coming soon...)

    Identifying the CPU based on DIR contents

    There are two DIR registers present in most Cyrix chips: DIR0 holds CPU type and DIR1 holds mask revision info. DIR0 is located at FEh in CPU control register set. DIR1 is located at FFh.
    Newer chips may contain three more DIR registers - described in Cx undocumented section.

    On 6x86 CPU DIR access may be blocked, so first we have to enable DIR accesss by setting MAPEN field of CCR3 register to 0001. The value of CCR3 should be restored after reading DIRs.

    Note that info returned by RESET signature or CPUID may or may NOT resemble DIR0:DIR1, depending on particular chip type and revision.

    The following table lists all the values of DIR0 known to me.

    Copyright 1996-7 by Grzegorz Mazur