msr.lst

A Programmer s Reference to BIOS, DOS, and Third-Party Calls

MODEL-SPECIFIC REGISTERS	Release 61		Last change 16jul00
Copyright (c) 1996,1997,1998,1999,2000 Ralf Brown

--------!---Note-----------------------------
Note:	except where mentioned otherwise, Pentium information also applies to
	  the PentiumMMX; Pentium Pro information also applies to the
	  Pentium II; and AMD K6 information also applies to the K6-2 and
	  K6-III
----------S00000000--------------------------
MSR 00000000h - Pentium, Pentium Pro - MACHINE CHECK EXCEPTION ADDRESS
Size:	32-36 bits
Access:	Read
Desc:	on any Machine Check exception (INT 12), this MSR contains the physical
	  address at which the exception occurred
Notes:	also supported by AMD Am5k86, K5, and K6; however, the K6 does not
	  actually support the machine check -- this register may be written
	  on the K6 to emulate that functionality
	this register does not exist on the Pentium Pro/Pentium II, but will
	  not cause an exception when accessed
SeeAlso: MSR 00000001h,MSR 80000000h,INT 12"MACHINE CHECK"
----------S00000001--------------------------
MSR 00000001h - Pentium, Pentium Pro - MACHINE CHECK EXCEPTION TYPE
Size:	6 bits
Access:	Read
Desc:	when a Machine Check exception occurs, this register contains the
	  reason for the exception
Notes:	also supported by AMD Am5k86, K5, and K6; however, the K6 does not
	  actually support the machine check -- this register may be written
	  on the K6 to emulate that functionality
	this register does not exist on the Pentium Pro/Pentium II, but will
	  not cause an exception when accessed
SeeAlso: MSR 00000000h,MSR 80000001h,INT 12"MACHINE CHECK"

Bitfields for Machine Check Exception type (MSR 00000001h):
Bit(s)	Description	(Table R0001)
 63-6	reserved (0)
 5	"FERI" Fan Error Indicator (Pentium OverDrive only) -- CPU overheated
	(once set, this bit remains set even through CPU reset)
 4	bus cycle causing exception was locked
 3	state of M/IO# pin during bus cycle
 2	state of D/C# pin during bus cycle
 1	state of W/R# pin during bus cycle
 0	Machine Check pending (cleared by reading this MSR)
----------S00000002--------------------------
MSR 00000002h - Pentium - (TR1) PARITY REVERSAL TEST REGISTER
Size:	14 bits
Access:	Write
SeeAlso: MSR 00000004h,MSR 80000002h

Bitfields for Parity Reversal Test Register (TR1):
Bit(s)	Description	(Table R0002)
 63-14	reserved (0)
 13	microcode
 12	Data TLB data
 11	Data TLB tag
 10	Data Cache data
 9	Data Cache tag
 8	Code TLB data
 7	Code TLB tag
 6	"ID3" data cache odd bits 129-255
 5	"ID2" data cache even bits 128-254
 4	"ID1" data cache odd bits 1-127
 3	"ID0" data cache even bits 0-126
 2	instruction cache tag
 1	do not go into SHUTDOWN mode on parity error
 0	(read/write-clear) "Parity Error Summary" set on any parity error
Notes:	bits 2-13 indicate that the parity should be reversed for the given
	  subsystem, thus always forcing a parity error
	the Centaur (IDT) WinChip C6 supports bit 1 (no shutdown)
----------S00000003--------------------------
MSR 00000003h - Pentium - INVALID
Note:	attempted accesses to this MSR cause an exception
SeeAlso: MSR 80000003h,MSR 0000000Fh
----------S00000003--------------------------
MSR 00000003h - Cyrix 6x86MX - TEST DATA
SeeAlso: MSR 00000004h"Cyrix"

Bitfields for Cyrix 6x86MX Test Data:
Bit(s)	Description	(Table R0062)
 63-32	reserved
 31-0	cache data, similar to that for Pentium TR3 (see #R0004)
SeeAlso: #R0004,#R0063,#R0064
----------S00000004--------------------------
MSR 00000004h - Pentium - (TR2) INSTRUCTION CACHE END BITS
Size:	4 bits
Access:	Read/Write
Note:	documented as reserved on Pentium MMX
SeeAlso: MSR 00000002h,MSR 00000005h,MSR 80000004h

Bitfields for Instruction Cache End Bits (TR2):
Bit(s)	Description	(Table R0003)
 63-4	reserved (0)
 3-0	end bits (each set bit indicates the last byte of an instruction in
	  TR3 during code cache access)
Note:	when a new line is written into the code cache, all end bits are set;
	  the instruction decoder then clears those bits corresponding to
	  bytes which are not the last byte of an instruction
SeeAlso: #R0004
----------S00000004--------------------------
MSR 00000004h - Cyrix 6x86MX - TEST ADDRESS
SeeAlso: MSR 00000003h"Cyrix",MSR 00000005h"Cyrix"

Bitfields for Cyrix 6x86MX Test Address:
Bit(s)	Description	(Table R0063)
 63-32	reserved
 31-0	cache address, like Pentium TR4 (see #R0005)
SeeAlso: #R0062,#R0064
----------S00000005--------------------------
MSR 00000005h - Pentium - (TR3) CACHE DATA TEST REGISTER
Size:	32 bits
Access:	Read/Write
SeeAlso: MSR 00000004h,MSR 00000006h,MSR 80000005h

Bitfields for Cache Data Test Register (TR3):
Bit(s)	Description	(Table R0004)
 63-32	reserved (0)
 31-0	data read/written from/to cache (code or data)
SeeAlso: #R0005,#R0062
----------S00000005--------------------------
MSR 00000005h - Cyrix 6x86MX - TEST COMMAND/STATUS
SeeAlso: MSR 00000004h"Cyrix"

Bitfields for 6x86MX Test Command/Status:
Bit(s)	Description	(Table R0064)
 63-32	reserved
 31-0	command, similar to Pentium TR5 (see #R0006)
 31-24	reserved
 23	"SMI" select SMI memory space
 22-20	reserved
 19	valid data
 18-16	"MESI"
	bits 19-16 together specify state of cache line
	    1000 modified
	    1001 shared
	    1010 exclusive
	    0011 invalid
	    1100 locked valid
	    0111 locked invalid
 15-12	reserved
 11-8	"MRU" used to determine LRU line
 7-6	reserved
 5-4	SET
 3-2	reserved
 1-0	control field
	00 flush cache without invalidation
	01 write cache
	10 read cache
	11 no cache or test register modification
SeeAlso: #R0062,#R0063
----------S00000006--------------------------
MSR 00000006h - Pentium - (TR4) CACHE TAG
Size:	32 bits
Access:	Read/Write
SeeAlso: MSR 00000005h,MSR 00000007h,MSR 80000006h

Bitfields for Cache Tag Test Register (TR4):
Bit(s)	Description	(Table R0005)
 63-32	reserved (0)
 31-8	cache tag (bits 35-12 of address)
 7-5	reserved (0)
 4-3	reserved (0) (P54C [non-MMX Pentium])
 2	LRU (P54C)
	=0  Way 0
	=1  Way 1
 4-2	LRU (P55C [PentiumMMX])
	=X00  Way 0
	=X10  Way 1
	=0X1  Way 2
	=1X1  Way 3
 1-0	Valid
	---code cache (selected by TR5)---
	x0 cache line invalid
	x1 cache line valid
	---data cache (selected by TR5)---
	00 cache line invalid
	01 cache line shared
	10 cache line exclusive
	11 cache line modified
SeeAlso: #R0004,#R0006,#R0063
----------S00000007--------------------------
MSR 00000007h - Pentium - (TR5) CACHE CONTROL
Size:	15 bits
Access:	Write
SeeAlso: MSR 00000006h,MSR 00000008h,MSR 80000007h

Bitfields for Cache Control Test Register (TR5):
Bit(s)	Description	(Table R0006)
 63-20	reserved (0)
 19	entry[1] (PentiumMMX only)
	combined with bit 12, selects Way within cache set
 18-15	reserved (0)
 14	cache write-back mode (instead of write-through) enabled
 13	select data cache instead of code cache
 12	select Way within cache set
 11-5	cache set number
 4-2	buffer select (specify which 32-bit portion of cache line to access)
 1-0	control
	00 normal operation
	01 test write
	10 test read
	11 flush (action controlled by TR7)
		TR7.CD/TR7.WD	Action
		 0	x	invalidate code cache line
		 1	0	invalidate data cache line, but don't writeback
		 1	1	invalidate data cache line, writeback if dirty
SeeAlso: #R0004,#R0005,#R0064
----------S00000008--------------------------
MSR 00000008h - Pentium, PentiumMMX - (TR6) TLB COMMAND
Size:	32 bits
Access:	Read/Write
SeeAlso: MSR 00000007h,MSR 00000009h,MSR 80000008h

Bitfields for Pentium TLB Command Test Register:
Bit(s)	Description	(Table R0007)
 63-32	reserved (0)
 31-12	linear address
 11	TLB entry is valid
 10	page is dirty (has been written to)
 9	page may only be accessed from Ring 0
 8	page may be written
 7-3	reserved (0)
 2	page is 4M instead of 4K
 1	data TLB instead of code TLB
 0	operation (0=write, 1=read)
SeeAlso: #R0008
----------S00000009--------------------------
MSR 00000009h - Pentium, PentiumMMX - (TR7) TLB DATA
Size:	32 bits
Access:	Read/Write
SeeAlso: MSR 00000008h,MSR 0000000Bh,MSR 80000009h

Bitfields for Pentium TLB Data Test Register (TR7):
Bit(s)	Description	(Table R0008)
 63-32	reserved (0)
 31-12	physical address
 11	"CD" Page Cache Disable
 10	"WB" Page Write-Through
 9-7	TLB Least-Recently Used value (non-MMX Pentium only)
 6-5	reserved (0) (P54C)
 6-5	bits 5-4 of TLB entry number (PentiumMMX only)
 4	Hit Indicator
 3-0	bits 3-0 of TLB entry number (PentiumMMX only)
 3-2	TLB entry number (non-MMX Pentium)
 1-0	reserved (0) (non-MMX Pentium)
Note:	if a write with bit 4 (Hit Indicator) set is followed by a read, the
	  value returned in bit 4 indicates whether the selected address was
	  found in the TLB; if found, bits 3-2 indicate which entry contained
	  the hit
SeeAlso: #R0007,#R0009
----------S0000000A--------------------------
MSR 0000000Ah O - Pentium A-step - (TR8) 36-BIT TLB DATA TEST REGISTER
Size:	4 bits
Note:	attempted accesses to this MSR cause an exception on any Pentium except
	  A-step chips, since the 36-bit physical addressing feature was
	  removed from the Pentium prior to general release
SeeAlso: MSR 8000000Ah

Bitfields for Pentium A-step 36-bit addressing Test Register (TR8):
Bit(s)	Description	(Table R0009)
 63-4	reserved (0)
 3-0	high bits of physical address (A35-A32)
SeeAlso: #R0008
----------S0000000B--------------------------
MSR 0000000Bh - Pentium, PentiumMMX - (TR9) BRANCH TARGET BUFFER TAG
Size:	32 bits
Access:	Read/Write
SeeAlso: MSR 00000009h,MSR 0000000Ch,MSR 8000000Bh

Bitfields for non-MMX Pentium Branch Target Buffer Tag (TR9):
Bit(s)	Description	(Table R0010)
 63-32	reserved (0)
 31-6	tag address (bits 31-6 of last byte of branch)
 5-2	reserved (0)
 1-0	history (state of current branch)
SeeAlso: #R0012,#R0013,#R0011

Bitfields for PentiumMMX Branch Target Buffer Tag (TR9):
Bit(s)	Description	(Table R0011)
 63-32	reserved
 31-8	tag address (bits 31-8 of last byte of branch)
 7-6	offset (bits 1-0 of last byte of branch)
 5	valid BTB entry
 4	branch is predicted as taken
 3-0	history (state of current branch)
SeeAlso: #R0010
----------S0000000C--------------------------
MSR 0000000Ch - Pentium, PentiumMMX - (TR10) BRANCH TARGET BUFFER TARGET
Size:	32 bits
Access:	Read/Write
SeeAlso: MSR 0000000Bh,MSR 0000000Dh,MSR 8000000Ch

Bitfields for Pentium Branch Target Buffer Target (TR10):
Bit(s)	Description	(Table R0012)
 63-32	reserved (0)
 31-0	target address
SeeAlso: #R0010,#R0013
----------S0000000D--------------------------
MSR 0000000Dh - Pentium, PentiumMMX - (TR11) BRANCH TARGET BUFFER CONTROL
Size:	12 bits
Access:	Write
SeeAlso: MSR 0000000Ch,MSR 0000000Eh,MSR 8000000Dh

Bitfields for Pentium Branch Target Buffer Control (TR11):
Bit(s)	Description	(Table R0013)
 63-26	reserved (0)
 25-24	branch type (PentiumMMX only)
	00 conditional branch
	01 unconditional jump
	10 call
	11 return
 23-13	reserved (0)
 12	bit 2 of test command (PentiumMMX only)
 11-8	BTB set number to access (non-MMX)
 11-8	BTB set number to access (PentiumMMX only)
 7-6	BTB bank (PentiumMMX only)
 5-4	reserved (0)
 3-2	BTB entry (way) within set
 1-0	test command
	00 normal operation
	01 test write
	10 test read
	11 flush
	101 test read tag (PentiumMMX only)
SeeAlso: #R0010,#R0012
----------S0000000E--------------------------
MSR 0000000Eh - Pentium, K6, C6 - (TR12) NEW FEATURE CONTROL
Size:	10 bits
Access:	Write
SeeAlso: MSR 0000000Dh,MSR 8000000Eh

Bitfields for Pentium New Feature Control (TR12):
Bit(s)	Description	(Table R0014)
 63-22	reserved (0)
 21	low-power mode enable
 20	(PentiumMMX only) Data Cache Inhibit (disable internal data cache)
 19	(PentiumMMX only) Code Cache Inhibit (disable internal code cache)
 18-15	reserved (0)
 14	(CPUID=052Bh/052Ch) ignore interrupt immediately after CLI and before
	  STI
 13-10	reserved (0)
 9	enable I/O instruction restart for SMM and use different interrupt
	  priority
 8	generate fast branch-trace message bus cycles
 7	"FTR" ??? (documented as reserved) (0)
 6	disable auto-halt feature (P54C only)
 5	??? (documented as reserved) (0)
 4	disable internal APIC (non-MMX Pentium only)
 3	Cache Inhibit (disable internal L1 cache)