Test_register
A test register, in the Intel 80386 and Intel 80486 processor, was a register used by the processor, usually to do a self-test. Most of these registers were undocumented, and used by specialized software. The test registers were named TR3 to TR7. Regular programs don't usually require these registers to work. With the Pentium, the test registers were replaced by a variety of model-specific registers (MSRs).[1]
In the 80386, two test registers, TR6 and TR7, were provided for the purpose of TLB testing. TR6 was the test command register, and TR7 was the test data register. The 80486 provided three additional registers, TR3, TR4 and TR5, for testing of the L1 cache. TR3 was a data register, TR4 was an address register and TR5 was a command register. These registers were accessed by variants of the MOV instruction. A test register may either be the source operand or the destination operand. The MOV instructions are defined in both real-address mode and protected mode. The test registers are privileged resources. In protected mode, the MOV instructions that access them can only be executed at privilege level 0. An attempt to read or write the test registers when executing at any other privilege level causes a general protection exception. Also, those instructions generate invalid opcode exception on most CPUs newer than 80486.
The instruction is encoded in two ways, depending on the flow of data. Moving data from a general purpose register into a test register is encoded as 0F 26 /r
(with r/m
being the GPR, and reg
being the test register). Moving data the other way (i.e. from the test register into a general purpose register) is encoded as 0F 24 /r
(with r/m
being the GPR, and reg
being the test register).[2] Only register-register moves are allowed; memory forms of the ModR/M byte are undefined. In other words, the mod
field (the two MSBs) must be set to 1
.
The test registers and/or associated opcodes were supported in the following x86 processors:
- On the Intel 386, the TR4 and TR5 registers have been reported to act as undocumented read-only registers returning a data item related to instruction prefetch.[3]
- Cyrix manufacturing partner CPU models from IBM, TI and ST also all supported the same test registers as their corresponding Cyrix-branded CPU models.
- SoCs based on the Cyrix-derived ST486 CPU core also supported the same set of test registers as the Cyrix 486 - such SoCs include e.g. STPC Atlas and ZFMicro ZFx86.[7]
- On the Cyrix 6x86, the TR1 and TR2 registers could be enabled by setting bit 6 of Cyrix configuration register 30h. These registers are not documented, but example code using them has been published by Cyrix.[9]
- On the Cyrix 6x86, the TR6 and TR7 registers could be used not only to test the TLB, but also to configure the processor's VSPM (Variable-Size Paging Mechanism).[10] The VSPM was a 4-entry[11] software TLB with a per-entry mask to support all power-of-2 page sizes from to bytes. It was present in the Cyrix 6x86 only - it was removed in 6x86MX and later processors.
- On the 6x86MX, MII, and "Joshua" Cyrix III processors, the TR3-TR5 registers could be used not just to test the L1 cache but also to lock individual L1 cache-lines to specific addresses for scratchpad memory use.[12][13]