Cx6x86 undocumented features

Last Update:
971014 - 6x86 info expanded (CCR7)
970903 - 6x86 info expanded (CCR7.7)
1997-06-02 6x86 and 6x86MX info added
1997-01-24..29 - includes new info on BTB, VIPERM and CPUID instruction - Many thanks to Mikael Johansson for info on the above.

6x86 processors have several registers and features which are not officially documented. Some documents uncover their existence, and some code can give some signs of their function.

The article below is for people who know the architecture of x86 CPUs and - particularly - Cyrix family CPUs. For those who don't know the latter but are desperate enough,  Data Books are suggested readings. The Data Books can be obtained in .PDF form from Cyrix and IBM.

TR1 and TR2

These are test registers which can be accessed using mov TRx, reg and mov reg, TRx. 6x86 uses 486-like mechanisms to access test registers, in this aspect (as in many others) it is not compatible with Pentium. TR1 and TR2 are related to BTB (Branch Target Buffer). Their purpose is to test and control the BTB. Access to TR1 and TR2 is allowed only after it is enabled using BTBTR_EN bit in register DBR0.

TR1 - BTB test index register


TR2 - BTB test data register

Contains data read from or to be written into BTB test register selected by index written to TR1.

BTB control space - 6x86

There are several control registers accessed through TR1 and TR2. Of these only one is (partially) known

Register 4 - unknown but existintg

Register 5

The table below is currently being created. Will be ready soon.
Name Index 6x86MX 6x86 5x86 Others Function
Counter 10..1F +
CSECTM ? + - - Cache Sector Map register, probably alias to one of RCRs.
DBR0 30 + + Debug Register
DBR1 31 +
DBR2 32 +
DBR3 33 +
34 + - -
38 + - -
DOR0 3C + + - -  Debug Opcode Register
+ - - -
CCR3 C3 bit 0 - SMILOCK
CCR4 E8 +
CCR5 E9 +
CCR7 EB + - - - MMX unit control and more 
bit 0 - MMXPLUS - enables Cyrix extended MMX instructions (3 argument operations) 
bit 1 - MMX reserved 
bit 2 - MMX reserved 
bits 3..6 - reserved 
bit 7 - Global Paging Enable - influences CPUID feature flags - enables GP extension
EC..EF + - - - ? may be scratchpad
DIR2 FB + - - - Sub-Rev ID.
DIR3 FC + + - - Family Code. May be written!
DIR4 FD + ? - - Model/Stepping
DIR0 FE + + + +
DIR1 FF + + + +

Counter registers (10h..1Fh) - 6x86

These registers form the event counter. Register 10h controls the counter, and regs 18..1B count the events. No more info available.

DBR0 (30h) - 6x86

This is register accessed at 30h in CPU control space. DBR0 is not officially documented. Access to DBR0 and to other registers described below requires setting MAPEN field in CCR3 to 0001. Presumably the meaning of bits in DBR0 is as follows:

?DBR1 (31h), ?DBR2 (32h), ?DBR3(33h)

The registers are used for performance control or CPU pipeline debugging. Setting to all zeros causes default CPU behavior. For serialization on a given opcode register 31h is loaded with 0B8h, 32h with 7Fh and 33h - with 0.


Control register with two most significant bits implemented.



??(3Ch) - opcode match register

When loaded with first byte of instruction's opcode, while registers 31h..33h contain proper (nonzero) values, causes the CPU to "trap" the instructions while they are executed and to change the normal instruction flow, presumably serializing execution. The exact behavior of CPU depends on contents of registers 31h..33h.

(Registers C0h..E3h - described in Data Book)

CCR5 (E9h)

The register was documented, but its description is still incomplete. To access CCR5, MAPEN must be set to 0001. Meaning of particular bits is described below:

CCR6 (EAh) - 6x86MX

Documented in the Data Book.

DIR3 (FCh) - CPUID family value register

On 6x86 the register contains 05h after RESET. It can be written (at least in CPU rev.2.7). The value read from this register is returned in AH by CPUID instrction with EAX=1. Normally CPUID returns 00000520 in EAX. After writing value XX to reg FC, CPUID returns 0000XX20. If VIPERM is set to 1 and MAPEN is not 1, the value of reg FC is read as FF, so cpuid returns value that looks like YYYYff20, where YYYY is not 0! On the CPU I tested it was 601Ch.

Note that if you set the register to 6, your CPU will be (mis)identified as some variety of M2.

DIR4 (FDh)

Seems to be read-only on 6x86, always read as 00.

The End