QM80C286_技术文档

M80C286

HIGH PERFORMANCE CHMOS MICROPROCESSOR

WITH MEMORY MANAGEMENT AND PROTECTION

Military

Y

High Speed CHMOS III Technology

10 MHz Clock Rate

Y

Pin for Pin, Clock for Clock, and

Functionally Compatible with the HMOS

M80286

68 Lead Pin Grid Array Package

68 Lead Ceramic Quad Flatpack

Package

Ý

(See M80286 Data Sheet, Order 271028-003)

Ý

(See Packaging Spec., Order 231369)

Y

Stop Clock Capability

Ð Uses Less Power (see I

Specification)

Y

Military Temperature Range:

b

CCS

a

55 C to 125 C (T )

§

C

INTRODUCTION

The M80C286 is an advanced 16 bit CHMOS III microprocessor designed for multi-user and multi-tasking

applications that require low power and high performance. The M80C286 is fully compatible with its predeces-

sor the HMOS M80286 and object-code compatible with the M8086 and M80386 family of products. In

addition, the M80C286 has a power down mode which uses less power, making it ideal for mobile applications.

The M80C286 has built-in memory protection that maintains a four level protection mechanism for task isola-

30

tion, a hardware task switching facility and memory mangement capabilities that map 2 bytes (one gigabyte)

24

of virtual address space per task (per user) into 2 bytes (16 megabytes) of physical memory.

The M80C286 is upward compatible with M8086 and M8088 software. Using M8086 real address mode, the

M80C286 is object code compatible with existing M8086, M8088 software. In protected virtual address mode,

the M80C286 is source code compatible with M8086, M8088 software which may require upgrading to use

virtual addresses supported by the M80C286’s integrated memory management and protection mechanism.

Both modes operate at full M80C286 performance and execute a superset of the M8086 and M8088 instruc-

tions.

The M80C286 provides special operations to support the efficient implementation and execution of operating

systems. For example, one instruction can end execution of one task, save its state, switch to a new task, load

its state, and start execution of the new task. The M80C286 also supports virtual memory systems by providing

a segment-not-present exception and restartable instructions.

271103–1

Figure 1. M80C286 Internal Block Diagram

February 1990

Order Number: 271103-001

M80C286

addressing modes. The M80C286 processor is up-

ward compatible with the M8086, M8088, and 80186

CPU’s and fully compatible with the HMOS M80286.

FUNCTIONAL DESCRIPTION

Introduction

The M80C286 is an advanced, high-performance mi-

croprocessor with specially optimized capabilities for

multiple user and multi-tasking systems. Depending

on the application, a 10 MHz M80C286’s perform-

ance is up to eight times faster than the standard 5

MHz M8086’s, while providing complete upward

software compatibility with Intel’s M8086, 88, and

186 family of CPU’s.

Register Set

The M80C286 base architecture has fifteen registers

as shown in Figure 2. These registers are grouped

into the following four categories:

General Registers: Eight 16-bit general purpose

registers used to contain arithmetic and logical oper-

ands. Four of these (AX, BX, CX, and DX) can be

used either in their entirety as 16-bit words or split

into pairs of separate 8-bit registers.

The M80C286 operates in two modes: M8086 real

address mode and protected virtual address mode.

Both modes execute a superset of the M8086 and

88 instruction set.

Segment Registers: Four 16-bit special purpose

registers select, at any given time, the segments of

memory that are immediately addressable for code,

stack, and data. (For usage, refer to Memory Organi-

zation.)

In M8086 real address mode programs use real ad-

dresses with up to one megabyte of address space.

Programs use virtual addresses in protected virtual

address mode, also called protected mode. In pro-

tected mode, the M80C286 CPU automatically maps

1 gigabyte of virtual addresses per task into a 16

megabyte real address space. This mode also pro-

vides memory protection to isolate the operating

system and ensure privacy of each tasks’ programs

and data. Both modes provide the same base in-

struction set, registers, and addressing modes.

Base and Index Registers: Four of the general pur-

pose registers may also be used to determine offset

addresses of operands in memory. These registers

may contain base addresses or indexes to particular

locations within a segment. The addressing mode

determines the specific registers used for operand

address calculations.

The following Functional Description describes first,

the base M80C286 architecture common to both

modes, second, M8086 real address mode, and

third, protected mode.

Status and Control Registers: The 3 16-bit special

purpose registers in Figure 3 record or control cer-

tain aspects of the M80C286 processor state includ-

ing the Instruction Pointer, which contains the offset

address of the next sequential instruction to be exe-

cuted.

M80C286 BASE ARCHITECTURE

The M8086, 88, 186, and 286 CPU family all contain

the same basic set of registers, instructions, and

16-BIT

REGISTER

NAME

SPECIAL

REGISTER

FUNCTIONS

15

0

CS

DS

SS

ES

CODE SEGMENT SELECTOR

DATA SEGMENT SELECTOR

STACK SEGMENT SELECTOR

EXTRA SEGMENT SELECTOR

7

0

7

0

BYTE

AX

DX

CX

AH

DH

CH

BH

AL

DL

CL

BL

MULTIPLY/DIVIDE

I/O INSTRUCTIONS

ADDRESSABLE

(8-BIT

*

(

REGISTER

NAMES

LOOP/SHIFT/REPEAT/COUNT

BASE REGISTERS

SHOWN)

SEGMENT REGISTERS

BX

%

BP

SI

15

0

*

F

STATUS WORD

INDEX REGISTERS

STACK POINTER

DI

IP

INSTRUCTION POINTER

*

SP

STATUS AND CONTROL

REGISTERS

(

15

0

GENERAL

REGISTERS

Figure 2. Register Set

2

M80C286

271103–2

Figure 3. Status and Control Register Bit Functions

Table 1. Flags Word Bit Functions

Flags Word Description

Bit

Position

The Flags word (Flags) records specific characteris-

tics of the result of logical and arithmetic instructions

(bits 0, 2, 4, 6, 7, and 11) and controls the operation

of the M80C286 within a given operating mode (bits

8 and 9). Flags is a 16-bit register. The function of

the flag bits is given in Table 1.

Name

Function

0

CF

Carry FlagÐSet on high-order bit

carry or borrow; cleared otherwise

2

PF

AF

Parity FlagÐSet if low-order 8 bits

of result contain an even number of

1-bits; cleared otherwise

4

Set on carry from or borrow to the

low order four bits of AL; cleared

otherwise

Instruction Set

The instruction set is divided into seven categories:

data transfer, arithmetic, shift/rotate/logical, string

manipulation, control transfer, high level instruc-

tions, and processor control. These categories are

summarized in Table 2.

6

7

ZF

SF

OF

Zero FlagÐSet if result is zero;

cleared otherwise

Sign FlagÐSet equal to high-order

bit of result (0 if positive, 1 if negative)

11

Overflow FlagÐSet if result is a too-

large positive number or a too-small

negative number (excluding sign-bit)

to fit in destination operand; cleared

otherwise

An M80C286 instruction can reference zero, one, or

two operands; where an operand resides in a regis-

ter, in the instruction itself, or in memory. Zero-oper-

and instructions (e.g. NOP and HLT) are usually one

byte long. One-operand instructions (e.g. INC and

DEC) are usually two bytes long but some are en-

coded in only one byte. One-operand instructions

may reference a register or memory location. Two-

operand instructions permit the following six types of

instruction operations:

8

9

TF

IF

Single Step FlagÐOnce set, a sin-

gle step interrupt occurs after the

next instruction executes. TF is

cleared by the single step interrupt.

Interrupt-enable FlagÐWhen set,

maskable interrupts will cause the

CPU to transfer control to an inter-

rupt vector specified location.

ÐRegister to Register

ÐMemory to Register

ÐImmediate to Register

ÐMemory to Memory

ÐRegister to Memory

ÐImmediate to Memory

10

DF

Direction FlagÐCauses string

instructions to auto decrement

the appropriate index registers

when set. Clearing DF causes

auto increment.

3

M80C286

Two-operand instructions (e.g. MOV and ADD) are

usually three to six bytes long. Memory to memory

operations are provided by a special class of string

instructions requiring one to three bytes. For de-

tailed instruction formats and encodings refer to the

instruction set summary at the end of this document.

For detailed operation and usage of each instruc-

tion, see Appendix B of the 80286/80287 Program-

mer’s Reference Manual (Order No. 210498).

Table 2. Instruction Set

GENERAL PURPOSE

Move byte or word

ADDITION

MOV

ADD

ADC

INC

Add byte or word

PUSH

POP

Push word onto stack

Pop word off stack

Add byte or word with carry

Increment byte or word by 1

ASCII adjust for addition

Decimal adjust for addition

SUBTRACTION

PUSHA

POPA

XCHG

XLAT

Push all registers on stack

Pop all registers from stack

Exchange byte or word

Translate byte

AAA

DAA

SUB

SBB

DEC

NEG

CMP

AAS

DAS

Subtract byte or word

INPUT/OUTPUT

Subtract byte or word with borrow

Decrement byte or word by 1

Negate byte or word

IN

Input byte or word

OUT

Output byte or word

ADDRESS OBJECT

Load effective address

Load pointer using DS

Load pointer using ES

FLAG TRANSFER

Compare byte or word

LEA

LDS

LES

ASCII adjust for subtraction

Decimal adjust for subtraction

MULTIPLICATION

MUL

IMUL

AAM

Multiple byte or word unsigned

Integer multiply byte or word

ASCII adjust for multiply

DIVISION

LAHF

SAHF

PUSHF

POPF

Load AH register from flags

Store AH register in flags

Push flags onto stack

Pop flags off stack

DIV

Divide byte or word unsigned

Integer divide byte or word

ASCII adjust for division

Convert byte to word

IDIV

AAD

CBW

CWD

Data Transfer Instructions

MOVS

Move byte or word string

Input bytes or word string

Output bytes or word string

Compare byte or word string

Scan byte or word string

Load byte or word string

Store byte or word string

Repeat

INS

Convert word to doubleword

OUTS

CMPS

SCAS

LODS

STOS

REP

Arithmetic Instructions

LOGICALS

NOT

‘‘Not’’ byte or word

AND

OR

‘‘And’’ byte or word

‘‘Inclusive or’’ byte or word

‘‘Exclusive or’’ byte or word

‘‘Test’’ byte or word

REPE/REPZ

Repeat while equal/zero

XOR

TEST

REPNE/REPNZ

Repeat while not equal/not zero

SHIFTS

String Instructions

SHL/SAL

SHR

Shift logical/arithmetic left byte or word

Shift logical right byte or word

Shift arithmetic right byte or word

ROTATES

SAR

ROL

ROR

RCL

RCR

Rotate left byte or word

Rotate right byte or word

Rotate through carry left byte or word

Rotate through carry right byte or word

Shift/Rotate Logical Instructions

4

M80C286

Table 2. Instruction Set (Continued)

CONDITIONAL TRANSFERS

FLAG OPERATIONS

Set carry flag

JA/JNBE

JAE/JNB

JB/JNAE

JBE/JNA

JC

Jump if above/not below nor equal

Jump if above or equal/not below

Jump if below/not above nor equal

Jump if below or equal/not above

Jump if carry

STC

CLC

CMC

STD

CLD

STI

Clear carry flag

Complement carry flag

Set direction flag

Clear direction flag

Set interrupt enable flag

JE/JZ

Jump if equal/zero

JG/JNLE

JGE/JNL

JL/JNGE

JLE/JNG

JNC

Jump if greater/not less nor equal

Jump if greater or equal/not less

Jump if less/not greater nor equal

Jump if less or equal/not greater

Jump if not carry

CLI

Clear interrupt enable flag

EXTERNAL SYNCHRONIZATION

Halt until interrupt or reset

Wait for BUSY not active

Escape to extension processor

Lock bus during next instruction

NO OPERATION

HLT

WAIT

ESC

JNE/JNZ

JNO

Jump if not equal/not zero

Jump if not overflow

LOCK

JNP/JPO

JNS

Jump if not parity/parity odd

Jump if not sign

NOP

No operation

EXECUTION ENVIRONMENT CONTROL

JO

Jump if overflow

LMSW

Load machine status word

Store machine status word

JP/JPE

JS

Jump if parity/parity even

Jump if sign

SMSW

Process Control Instructions

UNCONDITIONAL TRANSFERS

ENTER

LEAVE

Format stack for procedure entry

Restore stack for procedure exit

CALL

RET

JMP

Call procedure

Return from procedure

Jump

BOUND

Detects values outside

prescribed range

ITERATION CONTROLS

Loop

High Level Instructions

LOOP

LOOPE/LOOPZ

Loop if equal/zero

LOOPNE/LOOPNZ Loop if not equal/not zero

e

0

JCXZ

Jump if register CX

INTERRUPTS

Interrupt

INT

INTO

IRET

Interrupt if overflow

Interrupt return

Program Transfer Instructions

Memory Organization

Memory is organized as sets of variable length seg-

ments. Each segment is a linear contiguous se-

16

quence of up to 64K (2 ) 8-bit bytes. Memory is

addressed using a two component address (a point-

er) that consists of a 16-bit segment selector, and a

16-bit offset, see Figure 4. The segment selector in-

dicates the desired segment in memory. The offset

component indicates the desired byte address within

the segment.

271103–3

Figure 4. Two Component Address

5

M80C286

Table 3. Segment Register Selection Rules

Segment Register Implicit Segment

Used Selection Rule

Memory

Reference Needed

Instructions

Code (CS) Automatic with instruction prefetch

Stack

Stack (SS)

Data (DS)

Extra (ES)

All stack pushes and pops. Any memory reference which uses BP

as a base register.

Local Data

All data references except when relative to stack or

string destination

External (Global) Data

Alternate data segment and destination of string operation

All instructions that address operands in memory

must specify the segment and the offset. For speed

and compact instruction encoding, segment selec-

tors are usually stored in the high speed segment

registers. An instruction need specify only the de-

sired segment register and an offset in order to ad-

dress a memory operand.

Most instructions need not explicitly specify which

segment register is used. The correct segment reg-

ister is automatically chosen according to the rules

of Table 3. These rules follow the way programs are

written (see Figure 5) as independent modules that

require areas for code and data, a stack, and access

to external data areas.

Special segment override instruction prefixes allow

the implicit segment register selection rules to be

overridden for special cases. The stack, data, and

extra segments may coincide for simple programs.

To access operands not residing in one of the four

immediately available segments, a full 32-bit pointer

or a new segment selector must be loaded.

271103–4

Addressing Modes

Figure 5. Segmented Memory Helps

Structure Software

The M80C286 provides a total of eight addressing

modes for instructions to specify operands. Two ad-

dressing modes are provided for instructions that

operate on register or immediate operands:

the index (contents of either the SI or DI index

registers)

Register Operand Mode: The operand is locat-

ed in one of the 8 or 16-bit general registers.

Any carry out from the 16-bit addition is ignored.

Eight-bit displacements are sign extended to 16-bit

values.

Immediate Operand Mode: The operand is in-

cluded in the instruction.

Combinations of these three address elements de-

fine the six memory addressing modes, described

below.

Six modes are provided to specify the location of an

operand in a memory segment. A memory operand

address consists of two 16-bit components: seg-

ment selector and offset. The segment selector is

supplied by a segment register either implicitly cho-

sen by the addressing mode or explicitly chosen by

a segment override prefix. The offset is calculated

by summing any combination of the following three

address elements:

Direct Mode: The operand’s offset is contained in

the instruction as an 8 or 16-bit displacement ele-

ment.

Register Indirect Mode: The operand’s offset is in

one of the registers SI, DI, BX, or BP.

the displacement (an 8 or 16-bit immediate val-

ue contained in the instruction)

Based Mode: The operand’s offset is the sum of an

8 or 16-bit displacement and the contents of a base

register (BX or BP).

the base (contents of either the BX or BP base

registers)

6

M80C286

Indexed Mode: The operand’s offset is the sum of

an 8 or 16-bit displacement and the contents of an

index register (SI or DI).

either an 8-bit port address, specified in the instruc-

tion, or a 16-bit port address in the DX register. 8-bit

port addresses are zero extended such that A –A

15

8

are LOW. I/O port addresses 00F8(H) through

00FF(H) are reserved.

Based Indexed Mode: The operand’s offset is the

sum of the contents of a base register and an index

register.

Based Indexed Mode with Displacement: The op-

erand’s offset is the sum of a base register’s con-

tents, an index register’s contents, and an 8 or 16-bit

displacement.

Data Types

The M80C286 directly supports the following data

types:

Integer:

A signed binary numeric value con-

tained in an 8-bit byte or a 16-bit

word. All operations assume a 2’s

complement representation. Signed

32 and 64-bit integers are supported

using the Numeric Data Processor,

the M80C287.

Ordinal:

Pointer:

An unsigned binary numeric value

contained in an 8-bit byte or 16-bit

word.

A 32-bit quantity, composed of a

segment selector component and an

offset component. Each component

is a 16-bit word.

String:

ASCII:

A contiguous sequence of bytes or

words. A string may contain from 1

byte to 64K bytes.

A byte representation of alphanu-

meric and control characters using

the ASCII standard of character rep-

resentation.

BCD:

A byte (unpacked) representation of

the decimal digits 0–9.

Packed BCD: A byte (packed) representation of

two decimal digits 0–9 storing one

digit in each nibble of the byte.

Floating Point: A signed 32, 64, or 80-bit real num-

ber representation. (Floating point

operands are supported using the

M80C287 Numeric Processor).

Figure 6 graphically represents the data types sup-

ported by the M80C286.

271103–5

Figure 6. M80C286 Supported Data Types

I/O Space

The I/O space consists of 64K 8-bit or 32K 16-bit

ports. I/O instructions address the I/O space with

7

M80C286

Table 4. Interrupt Vector Assignments

Does Return Address

Point to Instruction

Causing Exception?

Interrupt

Number

Instructions

Divide error exception

0

DIV, IDIV

Yes

Single step interrupt

1

All

NMI interrupt

2

INT 2 or NMI pin

INT 3

Breakpoint interrupt

3

4

INTO detected overflow exception

BOUND range exceeded exception

Invalid opcode exception

Processor extension not available exception

Intel reserved–do not use

Processor extension error interrupt

Intel reserved–do not use

User defined

INTO

No

5

BOUND

Yes

6

Any undefined opcode

ESC or WAIT

7

8-15

16

ESC or WAIT

17-31

32-255

by setting the interrupt flag bit (IF) in the flag word.

All 224 user-defined interrupt sources can share this

input, yet they can retain separate interrupt han-

dlers. An 8-bit vector read by the CPU during the

interrupt acknowledge sequence (discussed in Sys-

tem Interface section) identifies the source of the

interrupt.

Interrupts

An interrupt transfers execution to a new program

location. The old program address (CS:IP) and ma-

chine state (Flags) are saved on the stack to allow

resumption of the interrupted program. Interrupts fall

into three classes: hardware initiated, INT instruc-

tions, and instruction exceptions. Hardware initiated

interrupts occur in response to an external input and

are classified as non-maskable or maskable. Pro-

grams may cause an interrupt with an INT instruc-

tion. Instruction exceptions occur when an unusual

condition, which prevents further instruction pro-

cessing, is detected while attempting to execute an

instruction. The return address from an exception

will always point at the instruction causing the ex-

ception and include any leading instruction prefixes.

Further maskable interrupts are disabled while serv-

icing an interrupt by resetting the IF but as part of

the response to an interrupt or exception. The saved

flag word will reflect the enable status of the proces-

sor prior to the interrupt. Until the flag word is re-

stored to the flag register, the interrupt flag will be

zero unless specifically set. The interrupt return in-

struction includes restoring the flag word, thereby

restoring the original status of IF.

A table containing up to 256 pointers defines the

proper interrupt service routine for each interrupt. In-

terrupts 0–31, some of which are used for instruc-

tion exceptions, are reserved. For each interrupt, an

8-bit vector must be supplied to the M80C286 which

identifies the appropriate table entry. Exceptions

supply the interrupt vector internally. INT instructions

contain or imply the vector and allow access to all

256 interrupts. The Interrupt Vector Assignments are

listed in Table 4. Maskable hardware initiated inter-

rupts supply the 8-bit vector to the CPU during an

interrupt acknowledge bus sequence. Non-maska-

ble hardware interrupts use a predefined internally

supplied vector.

NON-MASKABLE INTERRUPT REQUEST (NMI)

A non-maskable interrupt input (NMI) is also provid-

ed. NMI has higher priority than INTR. A typical use

of NMI would be to activate a power failure routine.

The activation of this input causes an interrupt with

an internally supplied vector value of 2. No external

interrupt acknowledge sequence is performed.

While executing the NMI servicing procedure, the

M80C286 will service neither further NMI requests,

INTR requests, nor the processor extension seg-

ment overrun interrupt until an interrupt return (IRET)

instruction is executed or the CPU is reset. If NMI

occurs while currently servicing an NMI, its presence

will be saved for servicing after executing the first

IRET instruction. IF is cleared at the beginning of an

NMI interrupt to inhibit INTR interrupts.

MASKABLE INTERRUPT (INTR)

The M80C286 provides a maskable hardware inter-

rupt request pin, INTR. Software enables this input

8

M80C286

Table6.M80C286InitialRegisterStateafterRESET

SINGLE STEP INTERRUPT

Flag word

0002(H)

FFF0(H)

F000(H)

0000(H)

The M80C286 has an internal interrupt that allows

programs to execute one instruction at a time. It is

called the single step interrupt and is controlled by

the single step flag bit (TF) in the flag word. Once

this bit is set, an internal single step interrupt will

occur after the next instruction has been executed.

The interrupt clears the TF bit and uses an internally

supplied vector of 1. The IRET instruction is used to

set the TF bit and transfer control to the next instruc-

tion to be single stepped.

Machine Status Word

Instruction pointer

Code segment

Data segment

Extra segment

Stack segment

HOLD must not be active during the time from the

leading edge of RESET to 34 CLKs after the trailing

edge of RESET.

Machine Status Word Description

Interrupt Priorities

The machine status word (MSW) records when a

task switch takes place and controls the operating

mode of the M80C286. It is a 16-bit register of which

the lower four bits are used. One bit places the CPU

into protected mode, while the other three bits, as

shown in Table 7, control the processor extension

interface. After RESET, this register contains

FFF0(H) which places the M80C286 in M8086 real

address mode.

When simultaneous interrupt requests occur, they

are processed in a fixed order as shown in Table 5.

Interrupt processing involves saving the flags, return

address, and setting CS:IP to point at the first in-

struction of the interrupt handler. If other interrupts

remain enabled they are processed before the first

instruction of the current interrupt handler is execut-

ed. The last interrupt processed is therefore the first

one serviced.

Table 7. MSW Bit Functions

Bit

Table 5. Interrupt Processing Order

Name

Function

Position

Order

Interrupt

Instruction exception

0

PE Protected mode enable places the

M80C286 into protected mode and

cannot be cleared except by RESET.

1

2

3

4

5

6

Single step

NMI

1

2

MP Monitor processor extension allows

WAIT instructions to cause a processor

extension not present exception

(number 7).

Processor extension segment overrun

INTR

INT instruction

EM Emulate processor extension causes a

processor extension not present

exception (number 7) on ESC

instructions to allow emulating a

processor extension.

Initialization and Processor Reset

Processor initialization or start up is accomplished

by driving the RESET input pin HIGH. RESET forces

the M80C286 to terminate all execution and local

bus activity. No instruction or bus activity will occur

as long as RESET is active. After RESET becomes

inactive and an internal processing interval elapses,

the M80C286 begins execution in real address

mode with the instruction at physical location

FFFFF0(H). RESET also sets some registers to pre-

defined values as shown in Table 6.

3

TS Task switched indicates the next

instruction using a processor extension

will cause exception 7, allowing software

to test whether the current processor

extension context belongs to the current

task.

The LMSW and SMSW instructions can load and

store the MSW in real address mode. The recom-

mended use of TS, EM, and MP is shown in Table 8.

Table 8. Recommended MSW Encodings For Processor Extension Control

Instructions

Causing

Exception 7

TS

MP

EM

Recommended Use

0

1

0

1

Initial encoding after RESET. M80C286 operation is identical to M8086, 88.

No processor extension is available. Software will emulate its function.

None

ESC

No processor extension is available. Software will emulate its function. The current

processor extension context may belong to another task.

0

1

0

A processor extension exists.

None

A processor extension exists. The current processor extension context may belong to

another task. The Exception 7 on WAIT allows software to test for an error pending

from a previous processor extension operation.

ESC or

WAIT

9

M80C286

Halt

zation area and interrupt table area. Locations from

addresses FFFF0(H) through FFFFF(H) are re-

served for system initialization. Initial execution be-

gins at location FFFF0(H). Locations 00000(H)

through 003FF(H) are reserved for interrupt vectors.

The HLT instruction stops program execution and

prevents the CPU from using the local bus until re-

started. Either NMI, INTR with IF

e

1, or RESET will

force the M80C286 out of halt. If interrupted, the

saved CS:IP will point to the next instruction after

the HLT.

M8086 REAL ADDRESS MODE

The M80C286 executes a fully upward-compatible

superset of the M8086 instruction set in real address

mode. In real address mode the M80C286 is object

code compatible with M8086 and M8088 software.

The real address mode architecture (registers and

addressing modes) is exactly as described in the

M80C286 Base Architecture section of this Func-

tional Description.

Memory Size

Physical memory is a contiguous array of up to

1,048,576 bytes (one megabyte) addressed by pins

A

through A and BHE. A through A should be

19 20 23

0

ignored.

271103–6

Memory Addressing

Figure 7. M8086 Real Address Mode

Address Calculation

In real address mode physical memory is a contigu-

ous array of up to 1,048,576 bytes (one megabyte)

addressed by pins A through A and BHE. Ad-

0

19

dress bits A –A may not always be zero in real

20 23

mode. A –A should not be used by the system

20 23

while the M80C286 is operating in Real Mode.

The selector portion of a pointer is interpreted as the

upper 16 bits of a 20-bit segment address. The lower

four bits of the 20-bit segment address are always

zero. Segment addresses, therefore, begin on multi-

ples of 16 bytes. See Figure 7 for a graphic repre-

sentation of address information.

All segments in real address mode are 64K bytes in

size and may be read, written, or executed. An ex-

ception or interrupt can occur if data operands or

instructions attempt to wrap around the end of a

segment (e.g. a word with its low order byte at offset

FFFF(H) and its high order byte at offset 0000(H). If,

in real address mode, the information contained in a

segment does not use the full 64K bytes, the unused

end of the segment may be overlayed by another

segment to reduce physical memory requirements.

271103–7

Figure 8. M8086 Real Address Mode Initially

Reserved Memory Locations

The M80C286 reserves two fixed areas of memory

in real address mode (see Figure 8); system initiali-

10

M80C286

Table 9. Real Address Mode Addressing Interrupts

Interrupt

Number

Function

Instructions

Before Instruction?

Interrupt table limit too small exception

8

9

INT vector is not within table limit

Yes

No

Processor extension segment overrun

interrupt

ESC with memory operand extend-

ing beyond offset FFFF(H)

Segment overrun exception

13

Word memory reference with offset

e

Yes

FFFF(H) or an attempt to exe-

cute past the end of a segment

Interrupts

PROTECTED VIRTUAL ADDRESS

MODE

Table 9 shows the interrupt vectors reserved for ex-

ceptions and interrupts which indicate an addressing

error. The exceptions leave the CPU in the state ex-

isting before attempting to execute the failing in-

struction (except for PUSH, POP, PUSHA, or POPA).

Refer to the next section on protected mode initiali-

zation for a discussion on exception 8.

The M80C286 executes a fully upward-compatible

superset of the M8086 instruction set in protected

virtual address mode (protected mode). Protected

mode also provides memory management and pro-

tection mechanisms and associated instructions.

The M80C286 enters protected virtual address

mode from real address mode by setting the PE

(Protection Enable) bit of the machine status word

with the Load Machine Status Word (LMSW) instruc-

tion. Protected mode offers extended physical and

virtual memory address space, memory protection

mechanisms, and new operations to support operat-

ing systems and virtual memory.

Protected Mode Initialization

To prepare the M80C286 for protected mode, the

LIDT instruction is used to load the 24-bit interrupt

table base and 16-bit limit for the protected mode

interrupt table. This instruction can also set a base

and limit for the interrupt vector table in real address

mode. After reset, the interrupt table base is initial-

ized to 000000(H) and its size set to 03FF(H). These

values are compatible with M8086, 88 software.

LIDT should only be executed in preparation for pro-

tected mode.

All registers, instructions, and addressing modes de-

scribed in the M80C286 Base Architecture section

of this Functional Description remain the same. Pro-

grams for the M8086, 88, 186, and real address

mode M80C286 can be run in protected mode; how-

ever, embedded constants for segment selectors

are different.

Shutdown

Shutdown occurs when a severe error is detected

that prevents further instruction processing by the

CPU. Shutdown and halt are externally signalled via

a halt bus operation. They can be distinguished by

Memory Size

The protected mode M80C286 provides a 1 gigabyte

virtual address space per task mapped into a 16

megabyte physical address space defined by the ad-

A

1

HIGH for halt and A LOW for shutdown. In real

1

dress pin A

A

and BHE. The virtual address

address mode, shutdown can occur under two con-

ditions:

23–

0

space may be larger than the physical address

space since any use of an address that does not

map to a physical memory location will cause a re-

startable exception.

Exceptions 8 or 13 happen and the IDT limit does

not include the interrupt vector.

#

A CALL INT or PUSH instruction attempts to wrap

around the stack segment when SP is not even.

#

Memory Addressing

An NMI input can bring the CPU out of shutdown if

the IDT limit is at least 000F(H) and SP is greater

than 0005(H), otherwise shutdown can only be exit-

ed via the RESET input.

As in real address mode, protected mode uses 32-

bit pointers, consisting of 16-bit selector and offset

components. The selector, however, specifies an in-

dex into a memory resident table rather than the up-

per 16-bits of a real memory address. The 24-bit

base address of the desired segment is obtained

11

M80C286

from the tables in memory. The 16-bit offset is add-

ed to the segment base address to form the physical

address as shown in Figure 10. The tables are auto-

matically referenced by the CPU whenever a seg-

ment register is loaded with a selector. All M80C286

instructions which load a segment register will refer-

ence the memory based tables without additional

software. The memory based tables contain 8 byte

values called descriptors.

of control and task switching. The M80C286 has

segment descriptors for code, stack and data seg-

ments, and system control descriptors for special

system data segments and control transfer opera-

tions, see Figure 10. Descriptor accesses are per-

formed as locked bus operations to assure descrip-

tor integrity in multi-processor systems.

CODE AND DATA SEGMENT DESCRIPTORS

e

(S

1)

Besides segment base addresses, code and data

descriptors contain other segment attributes includ-

ing segment size (1 to 64K bytes), access rights

(read only, read/write, execute only, and execute/

read), and presence in memory (for virtual memory

systems) (See Figure 11). Any segment usage vio-

lating a segment attribute indicated by the segment

descriptor will prevent the memory cycle and cause

an exception or interrupt.

271103–8

271103–9

*Must be set to 0 for compatibility with 80386.

Figure 9. Protected Mode Memory Addressing

Figure 10. Code or Data Segment Descriptor

DESCRIPTORS

Descriptors define the use of memory. Special types

of descriptors also define new functions for transfer

Access Rights Byte Definition

Function

Bit

Position

Name

Present (P)

e

7

P

1

0

Segment is mapped into physical memory.

No mapping to physical memory exits, base and limit are

not used.

6–5

4

Descriptor Privilege

Level (DPL)

Segment Descrip-

tor (S)

Segment privilege attribute used in privilege tests.

e

S

1

0

Code or Data (includes stacks) segment descriptor

System Segment Descriptor or Gate Descriptor

e

3

2

Executable (E)

Expansion Direc-

tion (ED)

E

0

e

Data segment descriptor type is:

Expand up segment, offsets must be limit.

If

Data

Segment

s

Expand down segment, offsets must be limit.

ED

e

0

1

l

e

(S 1,

e

E 0)

1

Writeable (W)

W

0

1

Data segment may not be written into.

Data segment may be written into.

*

Type

e

3

2

Executable (E)

Conforming (C)

E

C

1

Code Segment Descriptor type is:

Code segment may only be executed

t

when CPL DPL and CPL

remains unchanged.

Code segment may not be read

Code segment may be read.

If

Field

Definition

Code

Segment

e

(S 1,

e

E 1)

1

0

Readable (R)

Accessed (A)

R

0

1

*

e

A

0

1

Segment has not been accessed.

Segment selector has been loaded into segment register

or used by selector test instructions.

Figure 11. Code and Data Segment Descriptor Formats

12

M80C286

Code and data (including stack data) are stored in

two types of segments: code segments and data

segments. Both types are identified and defined by

only used in Task State Segment descriptors and

indicates the privilege level at which the descriptor

may be used (see Privilege). Since the Local De-

scriptor Table descriptor may only be used by a spe-

cial privileged instruction, the DPL field is not used.

Bit 4 of the access byte is 0 to indicate that it is a

system control descriptor. The type field specifies

the descriptor type as indicated in Figure 12.

e

segment descriptors (S

1). Code segments are

identified by the executable (E) bit set to 1 in the

descriptor access rights byte. The access rights byte

of both code and data segment descriptor types

have three fields in common: present (P) bit, De-

scriptor Privilege Level (DPL), and accessed (A) bit.

System Segment Descriptor

e

If P

0, any attempted use of this segment will

cause a not-present exception. DPL specifies the

privilege level of the segment descriptor. DPL con-

trols when the descriptor may be used by a task

(refer to privilege discussion below). The A bit shows

whether the segment has been previously accessed

for usage profiling, a necessity for virtual memory

systems. The CPU will always set this bit when ac-

cessing the descriptor.

271103–10

*Must be set to 0 for compatibility with 80386.

e

0) may be either read-

Data segments (S

only or read-write as controlled by the W bit of the

1, E

System Segment Descriptor Fields

e

ments may not be written into. Data segments may

access rights byte. Read-only (W

0) data seg-

Name

TYPE

Value

Description

1

2

3

Available Task State Segment (TSS)

Local Descriptor Table

Busy Task State Segment (TSS)

grow in two directions, as determined by the Expan-

e

1) for a segment

sion Direction (ED) bit: upwards (ED

e

0) for data

segments, and downwards (ED

P

0

1

Descriptor contents are not valid

Descriptor contents are valid

containing a stack. The limit field for a data segment

descriptor is interpreted differently depending on the

ED bit (see Figure 11).

DPL

0–3

Descriptor Privilege Level

BASE

24-bit

number segment in real memory

Base Address of special system data

e

1) may be execute-

only or execute/read as determined by the Read-

A code segment (S

1, E

LIMIT

16-bit

number

Offset of last byte in segment

able (R) bit. Code segments may never be written

e

into and execute-only code segments (R

0) may

Figure 12. System Segment Descriptor Format

not be read. A code segment may also have an attri-

bute called conforming (C). A conforming code seg-

ment may be shared by programs that execute at

different privilege levels. The DPL of a conforming

code segment defines the range of privilege levels

at which the segment may be executed (refer to priv-

ilege discussion below). The limit field identifies the

last byte of a code segment.

e

4–7)

GATE DESCRIPTORS (S

0, TYPE

Gates are used to control access to entry points

within the target code segment. The gate descrip-

tors are call gates, task gates, interrupt gates and

trap gates. Gates provide a level of indirection be-

tween the source and destination of the control

transfer. This indirection allows the CPU to automati-

cally perform protection checks and control entry

point of the destination. Call gates are used to

change privilege levels (see Privilege), task gates

are used to perform a task switch, and interrupt and

trap gates are used to specify interrupt service rou-

tines. The interrupt gate disables interrupts (resets

IF) while the trap gate does not.

e

SYSTEM SEGMENT DESCRIPTORS (S

e

0,

TYPE

1–3)

In addition to code and data segment descriptors,

the protected mode M80C286 defines System Seg-

ment Descriptors. These descriptors define special

system data segments which contain a table of de-

scriptors (Local Descriptor Table Descriptor) or seg-

ments which contain the execution state of a task

(Task State Segment Descriptor).

Figure 13 shows the format of the gate descriptors.

The descriptor contains a destination pointer that

points to the descriptor of the target segment and

the entry point offset. The destination selector in an

interrupt gate, trap gate, and call gate must refer to a

code segment descriptor. These gate descriptors

contain the entry point to prevent a program from

constructing and using an illegal entry point. Task

gates may only refer to a task state segment. Since

task gates invoke a task switch, the destination off-

set is not used in the task gate.

Figure 12 gives the formats for the special system

data segment descriptors. The descriptors contain a

24-bit base address of the segment and a 16-bit lim-

it. The access byte defines the type of descriptor, its

state and privilege level. The descriptor contents are

e

valid and the segment is in physical memory if P 1.

0, the segment is not valid. The DPL field is

e

If P

13

M80C286

causes exception 11 if referenced. DPL is the de-

scriptor privilege level and specifies when this de-

scriptor may be used by a task (refer to privilege

discussion below). Bit 4 must equal 0 to indicate a

system control descriptor. The TYPE field specifies

the descriptor type as indicated in Figure 13.

Gate Descriptor

SEGMENT DESCRIPTOR CACHE REGISTERS

A segment descriptor cache register is assigned to

each of the four segment registers (CS, SS, DS, ES).

Segment descriptors are automatically loaded

(cached) into a segment descriptor cache register

(Figure 14) whenever the associated segment regis-

ter is loaded with a selector. Only segment descrip-

tors may be loaded into segment descriptor cache

registers. Once loaded, all references to that seg-

ment of memory use the cached descriptor informa-

tion instead of reaccessing the descriptor. The de-

scriptor cache registers are not visible to programs.

No instructions exist to store their contents. They

only change when a segment register is loaded.

271103–11

*Must be set to 0 for compatibility with 80386 (X is don’t care)

Gate Descriptor Fields

Name

TYPE

P

Value

Description

–Call Gate

–Task Gate

–Interrupt Gate

–Trap Gate

4

5

6

7

0

–Descriptor Contents are not

valid

1

–Descriptor Contents are

valid

DPL

0–3

Descriptor Privilege Level

SELECTOR FIELDS

WORD

COUNT

Number of words to copy

from callers stack to called

procedures stack. Only used

with call gate.

A protected mode selector has three fields: descrip-

tor entry index, local or global descriptor table indi-

cator (TI), and selector privilege (RPL) as shown in

Figure 15. These fields select one of two memory

based tables of descriptors, select the appropriate

table entry and allow highspeed testing of the selec-

tor’s privilege attribute (refer to privilege discussion

below).

0–31

Selector to the target code

segment (Call, Interrupt or

Trap Gate)

Selector to the target task

state segment (Task Gate)

DESTINATION

SELECTOR

16-bit

selector

DESTINATION

OFFSET

16-bit

offset

Entry point within the target

code segment

Figure 13. Gate Descriptor Format

Exception 13 is generated when the gate is used if a

destination selector does not refer to the correct de-

scriptor type. The word count field is used in the call

gate descriptor to indicate the number of parameters

(0–31 words) to be automatically copied from the

caller’s stack to the stack of the called routine when

a control transfer changes privilege levels. The word

count field is not used by any other gate descriptor.

271103–12

The access byte format is the same for all gate de-

e

0 indicates the contents are not valid and

scriptors. P

e

1 indicates that the gate contents are

Figure 15. Selector Fields

valid. P

271103–13

Figure 14. Descriptor Cache Registers

14

M80C286

The LDT instruction loads a selector which refers to

a Local Descriptor Table descriptor containing the

base address and limit for an LDT, as shown in Fig-

ure 16.

LOCAL AND GLOBAL DESCRIPTOR TABLES

Two tables of descriptors, called descriptor tables,

contain all descriptors accessible by a task at any

given time. A descriptor table is a linear array of up

to 8192 descriptors. The upper 13 bits of the selec-

tor value are an index into a descriptor table. Each

table has a 24-bit base register to locate the descrip-

tor table in physical memory and a 16-bit limit regis-

ter that confine descriptor access to the defined lim-

its of the table as shown in Figure 16. A restartable

exception (13) will occur if an attempt is made to

reference a descriptor outside the table limits.

271103–15

*Must be set to 0 for compatibility with 80386.

One table, called the Global Descriptor table (GDT),

contains descriptors available to all tasks. The other

table, called the Local Descriptor Table (LDT), con-

tains descriptors that can be private to a task. Each

task may have its own private LDT. The GDT may

contain all descriptor types except interrupt and trap

descriptors. The LDT may contain only segment,

task gate, and call gate descriptors. A segment can-

not be accessed by a task if its segment descriptor

does not exist in either descriptor table at the time of

access.

Figure 17. Global Descriptor Table and

Interrupt Descriptor Table Data Type

INTERRUPT DESCRIPTOR TABLE

The protected mode M80C286 has a third descriptor

table, called the Interrupt Descriptor Table (IDT)

(see Figure 18), used to define up to 256 interrupts.

It may contain only task gates, interrupt gates and

trap gates. The IDT (Interrupt Descriptor Table) has

a 24-bit physical base and 16-bit limit register in the

CPU. The privileged LIDT instruction loads these

registers with a six byte value of identical form to

that of the LGDT instruction (see Figure 17 and Pro-

tected Mode Initialization).

271103–16

Figure 18. Interrupt Descriptor Table Definition

References to IDT entries are made via INT instruc-

tions, external interrupt vectors, or exceptions. The

IDT must be at least 256 bytes in size to allocate

space for all reserved interrupts.

271103–14

Figure 16. Local and Global

Descriptor Table Definition

Privilege

The LGDT and LLDT instructions load the base and

limit of the global and local descriptor tables. LGDT

and LLDT are privileged, i.e. they may only be exe-

cuted by trusted programs operating at level 0. The

LGDT instruction loads a six byte field containing the

16-bit table limit and 24-bit physical base address of

the Global Descriptor Table as shown in Figure 17.

The M80C286 has a four-level hierarchical privilege

system which controls the use of privileged instruc-

tions and access to descriptors (and their associat-

ed segments) within a task. Four-level privilege, as

shown in Figure 19, is an extension of the user/su-

pervisor mode commonly found in minicomputers.

The privilege levels are numbered 0 through 3.

15

M80C286

byte. DPL specifies the least trusted task privilege

level (CPL) at which a task may access the descrip-

e

ed. Only tasks executing at privilege level

tor. Descriptors with DPL

0 are the most protect-

0

0) may access them. Descriptors with DPL

3 are the least protected (i.e. have the least re-

stricted access) since tasks can access them when

e

(CPL

e

tors, except LDT descriptors.

CPL

0, 1, 2, or 3. This rule applies to all descrip-

SELECTOR PRIVILEGE

Selector privilege is specified by the Requested Priv-

ilege Level (RPL) field in the least significant two bits

of a selector. Selector RPL may establish a less

trusted privilege level than the current privilege level

for the use of a selector. This level is called the

task’s effective privilege level (EPL). RPL can only

reduce the scope of a task’s access to data with this

selector. A task’s effective privilege is the numeric

271103–17

e

Figure 19. Privilege Levels

maximum of RPL and CPL. A selector with RPL

imposes no additional restriction on its use while a

0

Level 0 is the most privileged level. Privilege levels

provide protection within a task. (Tasks are isolated

by providing private LDT’s for each task.) Operating

system routines, interrupt handlers, and other sys-

tem software can be included and protected within

the virtual address space of each task using the four

levels of privilege. Each task in the system has a

separate stack for each of its privilege levels.

e

selector with RPL

3 can only refer to segments at

privilege Level 3 regardless of the task’s CPL. RPL

is generally used to verify that pointer parameters

passed to a more trusted procedure are not allowed

to use data at a more privileged level than the caller

(refer to pointer testing instructions).

Descriptor Access and Privilege

Validation

Tasks, descriptors, and selectors have a privilege

level attribute that determines whether the descrip-

tor may be used. Task privilege effects the use of

instructions and descriptors. Descriptor and selector

privilege only effect access to the descriptor.

Determining the ability of a task to access a seg-

ment involves the type of segment to be accessed,

the instruction used, the type of descriptor used and

CPL, RPL, and DPL. The two basic types of segment

accesses are control transfer (selectors loaded into

CS) and data (selectors loaded into DS, ES or SS).

TASK PRIVILEGE

A task always executes at one of the four privilege

levels. The task privilege level at any specific instant

is called the Current Privilege Level (CPL) and is de-

fined by the lower two bits of the CS register. CPL

cannot change during execution in a single code

segment. A task’s CPL may only be changed by con-

trol transfers through gate descriptors to a new code

segment (See Control Transfer). Tasks begin exe-

cuting at the CPL value specified by the code seg-

ment selector within TSS when the task is initiated

via a task switch operation (See Figure 20). A task

executing at Level 0 can access all data segments

defined in the GDT and the task’s LDT and is con-

sidered the most trusted level. A task executing a

Level 3 has the most restricted access to data and is

considered the least trusted level.

DATA SEGMENT ACCESS

Instructions that load selectors into DS and ES must

refer to a data segment descriptor or readable code

segment descriptor. The CPL of the task and the

RPL of the selector must be the same as or more

privileged (numerically equal to or lower than) than

the descriptor DPL. In general, a task can only ac-

cess data segments at the same or less privileged

levels than the CPL or RPL (whichever is numerically

higher) to prevent a program from accessing data it

cannot be trusted to use.

An exception to the rule is a readable conforming

code segment. This type of code segment can be

read from any privilege level.

If the privilege checks fail (e.g. DPL is numerically

less than the maximum of CPL and RPL) or an incor-

rect type of descriptor is referenced (e.g. gate de-

DESCRIPTOR PRIVILEGE

Descriptor privilege is specified by the Descriptor

Privilege Level (DPL) field of the descriptor access

16

M80C286

scriptor or execute only code segment) exception 13

occurs. If the segment is not present, exception 11

is generated.

ence to a valid Task State Segment descriptor caus-

es a task switch (see Task Switch Operation). Refer-

ence to a Task State Segment descriptor at a more

privileged level than the task’s CPL generates ex-

ception 13.

Instructions that load selectors into SS must refer to

data segment descriptors for writable data seg-

ments. The descriptor privilege (DPL) and RPL must

equal CPL. All other descriptor types or a privilege

level violation will cause exception 13. A not present

fault causes exception 12.

When an instruction or interrupt references a gate

descriptor, the gate DPL must have the same or less

privilege than the task CPL. If DPL is at a more privi-

leged level than CPL, exeception 13 occurs. If the

destination selector contained in the gate refer-

ences a code segment descriptor, the code seg-

ment descriptor DPL must be the same or more priv-

ileged than the task CPL. If not, Exception 13 is is-

sued. After the control transfer, the code segment

descriptors DPL is the task’s new CPL. If the desti-

nation selector in the gate references a task state

segment, a task switch is automatically performed

(see Task Switch Operation).

CONTROL TRANSFER

Four types of control transfer can occur when a se-

lector is loaded into CS by a control transfer opera-

tion (see Table 10). Each transfer type can only oc-

cur if the operation which loaded the selector refer-

ences the correct descriptor type. Any violation of

these descriptor usage rules (e.g. JMP through a call

gate or RET to a Task State Segment) will cause

exception 13.

The privilege rules on control transfer require:

Ð JMP or CALL direct to a code segment (code

segment descriptor) can only be to a conforming

segment with DPL of equal or greater privilege

than CPL or a non-conforming segment at the

same privilege level.

The ability to reference a descriptor for control trans-

fer is also subject to rules of privilege. A CALL or

JUMP instruction may only reference a code seg-

ment descriptor with DPL equal to the task CPL or a

conforming segment with DPL of equal or greater

privilege than CPL. The RPL of the selector used to

reference the code descriptor must have as much

privilege as CPL.

Ð interrupts within the task or calls that may

change privilege levels, can only transfer control

through a gate at the same or a less privileged

level than CPL to a code segment at the same or

more privileged level than CPL.

RET and IRET instructions may only reference code

segment descriptors with descriptor privilege equal

to or less privileged than the task CPL. The selector

loaded into CS is the return address from the stack.

After the return, the selector RPL is the task’s new

CPL. If CPL changes, the old stack pointer is popped

after the return address.

Ð return instructions that don’t switch tasks can

only return control to a code segment at the

same or less privileged level.

Ð task switch can be performed by a call, jump or

interrupt which references either a task gate or

task state segment at the same or less privileged

level.

When a JMP or CALL references a Task State Seg-

ment descriptor, the descriptor DPL must be the

same or less privileged than the task’s CPL. Refer-

Table 10. Descriptor Types Used for Control Transfer

Descriptor

Referenced

Descriptor

Table

Control Transfer Types

Operation Types

Intersegment within the same privilege level

JMP, CALL, RET, IRET*

Code Segment

Call Gate

GDT/LDT

IDT

Intersegment to the same or higher privilege level Interrupt

within task may change CPL.

CALL

Interrupt Instruction,

Exception, External

Interrupt

Trap or

Interrupt

Gate

Intersegment to a lower privilege level (changes task CPL)

RET, IRET*

Code Segment

GDT/LDT

GDT

CALL, JMP

Task State

Segment

CALL, JMP

Task Gate

GDT/LDT

IDT

Task Switch

IRET**

Interrupt Instruction,

Exception, External

Interrupt

Task Gate

e

*NT (Nested Task bit of flag word)

**NT (Nested Task bit of flag word)

0

1

17

M80C286

Table 11. Segment Register Load Checks

PRIVILEGE LEVEL CHANGES

Exception

Error Description

Any control transfer that changes CPL within the

task, causes a change of stacks as part of the oper-

ation. Initial values of SS:SP for privilege levels 0, 1,

and 2 are kept in the task state segment (refer to

Task Switch Operation). During a JMP or CALL con-

trol transfer, the new stack pointer is loaded into the

SS and SP registers and the previous stack pointer

is pushed onto the new stack.

Number

Descriptor table limit exceeded

Segment descriptor not-present

Privilege rules violated

13

11 or 12

13

Invalid descriptor/segment type seg-

ment register load:

ÐRead only data segment load to

SS

When returning to the original privilege level, its

stack is restored as part of the RET or IRET instruc-

tion operation. For subroutine calls that pass param-

eters on the stack and cross privilege levels, a fixed

number of words, as specified in the gate, are cop-

ied from the previous stack to the current stack. The

inter-segment RET instruction with a stack adjust-

ment value will correctly restore the previous stack

pointer upon return.

ÐSpecial Control descriptor load to

DS, ES, SS

ÐExecute only segment load to

DS, ES, SS

ÐData segment load to CS

ÐRead/Execute code segment

load to SS

13

Table 12. Operand Reference Checks

Exception

Number

Error Description

Protection

Write into code segment

Read from execute-only code

segment

13

The M80C286 includes mechanisms to protect crit-

ical instructions that affect the CPU execution state

(e.g. HLT) and code or data segments from improper

usage. These protection mechanisms are grouped

into three forms:

13

12 or 13

Write to read-only data segment

1

Segment limit exceeded

NOTE:

Carry out in offset calculations is ignored.

Restricted usage of segments (e.g. no write al-

lowed to read-only data segments). The only seg-

ments available for use are defined by descrip-

tors in the Local Descriptor Table (LDT) and

Global Descriptor Table (GDT).

Table 13. Privileged Instruction Checks

Exception

Number

Error Description

Restricted access to segments via the rules of

privilege and descriptor usage.

i

CPL 0 when executing the following

instructions:

13

Privileged instructions or operations that may

only be executed at certain privilege levels as de-

termined by the CPL and I/O Privilege Level

(IOPL). The IOPL is defined by bits 14 and 13 of

the flag word.

LIDT, LLDT, LGDT, LTR, LMSW,

CTS, HLT

l

CPL IOPL when executing the fol-

lowing instructions:

INS, IN, OUTS, OUT, STI, CLI,

LOCK

13

These checks are performed for all instructions and

can be split into three categories: segment load

checks (Table 11), operand reference checks (Table

12), and privileged instruction checks (Table 13).

Any violation of the rules shown will result in an ex-

ception. A not-present exception related to the stack

segment causes exception 12.

EXCEPTIONS

The M80C286 detects several types of exceptions

and interrupts, in protected mode (see Table 14).

Most are restartable after the exceptional condition

is removed. Interrupt handlers for most exceptions

can read an error code, pushed on the stack after

the return address, that identifies the selector in-

volved (0 if none). The return address normally

points to the failing instruction, including all leading

prefixes. For a processor extension segment over-

run exception, the return address will not point at the

ESC instruction that caused the exception; however,

the processor extension registers may contain the

address of the failing instruction.

The IRET and POPF instructions do not perform

some of their defined functions if CPL is not of suffi-

cient privilege (numerically small enough). Precisely

these are:

l

The IF bit is not changed if CPL

IOPL.

#

The IOPL field of the flag word is not changed if

l

CPL

0.

No exceptions or other indication are given when

these conditions occur.

18

M80C286

Table 14. Protected Mode Exceptions

Return

Always

Restart-

able?

Error

Code

on Stack?

Interrupt

Vector

Address

At Falling

Instruction?

Function

2

8

9

10

11

12

13

Double exception detected

Yes

No

Yes

No

Yes

No

Yes

2

No

Processor extension segment overrun

Invalid task state segment

Segment not present

Stack segment overrun or stack segment not present

General protection

Yes

1

Yes

No

2

NOTE:

1. When a PUSHA or POPA instruction attempts to wrap around the stack segment, the machine state after the exception

will not be restartable because stack segment wrap around is not permitted. This condition is identified by the value of the

saved SP being either 0000(H), 0001(H), FFFE(H), or FFFF(H).

2. These exceptions indicate a violation to privilege rules or usage rules has occurred. Restart is generally not attempted

under those conditions.

These exceptions indicate a violation to privilege

rules or usage rules has occurred. Restart is gener-

ally not attempted under those conditions.

The IRET instruction is used to return control to the

task that called the current task or was interrupted.

Bit 14 in the flag register is called the Nested Task

(NT) bit. It controls the function of the IRET instruc-

e

All these checks are performed for all instructions

and can be split into three categories: segment load

checks (Table 11), operand reference checks (Table

12), and privileged instruction checks (Table 13).

Any violation of the rules shown will result in an ex-

ception. A not-present exception causes exception

11 or 12 and is restartable.

tion. If NT

regular current task by popping values off the stack;

when NT

0, the IRET instruction performs the

e

tion back to the previous task.

1, IRET performs a task switch opera-

When a CALL, JMP, or INT instruction initiates a

task switch, the old (except for case of JMP) and

new TSS will be marked busy and the back link field

of the new TSS set to the old TSS selector. The NT

bit of the new task is set by CALL or INT initiated

task switches. An interrupt that does not cause a

task switch will clear NT. NT may also be set or

cleared by POPF or IRET instructions.

Special Operations

TASK SWITCH OPERATION

The task state segment is marked busy by changing

the descriptor type field from Type 1 to Type 3. Use

of a selector that references a busy task state seg-

ment causes Exception 13.

The M80C286 provides a built-in task switch opera-

tion which saves the entire M80C286 execution

state (registers, address space, and a link to the pre-

vious task), loads a new execution state, and com-

mences execution in the new task. Like gates, the

task switch operation is invoked by executing an in-

ter-segment JMP or CALL instruction which refers to

a Task State Segment (TSS) or task gate descriptor

in the GDT or LDT. An INT n instruction, exception,

or external interrupt may also invoke the task switch

operation by selecting a task gate descriptor in the

associated IDT descriptor entry.

PROCESSOR EXTENSION CONTEXT

SWITCHING

The context of a processor extension (such as the

M80C287 numerics processor) is not changed by

the task switch operation. A processor extension

context need only be changed when a different task

attempts to use the processor extension (which still

contains the context of

a previous task). The

The TSS descriptor points at a segment (see Figure

20) containing the entire M80C286 execution state

while a task gate descriptor contains a TSS selector.

M80C286 detects the first use of a processor exten-

sion after a task switch by causing the processor

extension not present exception (7). The interrupt

handler may then decide whether a context change

is necessary.

l

The limit field of the descriptor must be 002B(H).

Each task must have a TSS associated with it. The

current TSS is identified by a special register in the

M80C286 called the Task Register (TR). This regis-

ter contains a selector referring to the task state

segment descriptor that defines the current TSS. A

hidden base and limit register associated with TR

are loaded whenever TR is loaded with a new selec-

tor.

Whenever the M80C286 switches tasks, it sets the

Task Switched (TS) bit of the MSW. TS indicates

that a processor extension context may belong to a

different task than the current one. The processor

extension not present exception (7) will occur when

attempting to execute an ESC or WAIT instruction if

e

TS 1 and a processor extension is present (MP

in MSW).

e

1

19

M80C286

instructions use the memory management hardware

to verify that a selector value refers to an appropri-

ate segment without risking an exception. A condi-

tion flag (ZF) indicates whether use of the selector

or segment will cause an exception.

POINTER TESTING INSTRUCTIONS

The M80C286 provides several instructions to

speed pointer testing and consistency checks for

maintaining system integrity (see Table 15). These

271103–18

Figure 20. Task State Segment and TSS Registers

20

M80C286

immediately execute an intra-segment JMP instruc-

tion to clear the instruction queue of instructions de-

coded in real address mode.

Table 15. M80C286 Pointer Test Instructions

Instruction

Operands

Function

ARPL

Selector,

Register

Adjust Requested Privilege

Level: adjusts the RPL of

the selector to the numeric

maximum of current selec-

tor RPL value and the RPL

value in the register. Set

zero flag if selector RPL

was changed by ARPL.

To force the M80C286 CPU registers to match the

initial protected mode state assumed by software,

execute a JMP instruction with a selector referring to

the initial TSS used in the system. This will load the

task register, local descriptor table register, segment

registers and initial general register state. The TR

should point at a valid TSS since any task switch

operation involves saving the current task state.

VERR

VERW

LSL

Selector

VERify for Read: sets the

zero flag if the segment re-

ferred to by the selector

can be read.

SYSTEM INTERFACE

VERify for Write: sets the

zero flag if the segment re-

ferred to by the selector

can be written.

The M80C286 system interface appears in two

forms: a local bus and a system bus. The local bus

consists of address, data, status, and control signals

at the pins of the CPU. A system bus is any buffered

version of the local bus. A system bus may also dif-

fer from the local bus in terms of coding of status

and control lines and/or timing and loading of sig-

nals. The M80C286 family includes several devices

to generate standard system buses such as the

IEEE 796 standard MULTIBUS.

Register,

Selector

Load Segment Limit: reads

the segment limit into the

register if privilege rules

and descriptor type allow.

Set zero flag if successful.

LAR

Register,

Selector

Load Access Rights: reads

the descriptor access

rights byte into the register

if privilege rules allow. Set

zero flag if successful.

Bus Interface Signals and Timing

The M80C286 microsystem local bus interfaces the

M80C286 to local memory and I/O components.

The interface has 24 address lines, 16 data lines,

and 8 status and control signals.

DOUBLE FAULT AND SHUTDOWN

If two separate exceptions are detected during a sin-

gle instruction execution, the M80C286 performs the

double fault exception (8). If an execution occurs

during processing of the double fault exception, the

M80C286 will enter shutdown. During shutdown no

further instructions or exceptions are processed. Ei-

ther NMI (CPU remains in protected mode) or RE-

SET (CPU exits protected mode) can force the

M80C286 out of shutdown. Shutdown is externally

The M80C286 CPU, M82C284 clock generator,

M82C288 bus controller, transceivers, and latches

provide a buffered and decoded system bus inter-

face. The M82C284 generates the system clock and

synchronizes READY and RESET. The M82C288

converts bus operation status encoded by the

M80C286 into command and bus control signals.

These components can provide the timing and elec-

trical power drive levels required for most system

bus interfaces including the Multibus.

signalled via a HALT bus operation with A LOW.

1

PROTECTED MODE INITIALIZATION

Physical Memory and I/O Interface

The M80C286 initially executes in real address

mode after RESET. To allow initialization code to be

placed at the top of physical memory, A –A will

A maximum of 16 megabytes of physical memory

can be addressed in protected mode. One mega-

byte can be addressed in real address mode. Memo-

ry is accessible as bytes or words. Words consist of

any two consecutive bytes addressed with the least

significant byte stored in the lowest address.

23

20

be HIGH when the M80C286 performs memory ref-

erences relative to the CS register until CS is

changed. A –A will be zero for references to the

23

20

DS, ES, or SS segments. Changing CS in real ad-

dress mode will force A –A LOW whenever CS is

Byte transfers occur on either half of the 16-bit local

data bus. Even bytes are accessed over D –D

23

20

used again. The initial CS:IP value of F000:FFF0

provides 64K bytes of code space for initialization

code without changing CS.

7

0

while odd bytes are transferred over D –D . Even-

15 8

addressed words are transferred over D –D in

15

0

one bus cycle, while odd-addressed word require

two bus operations. The first transfers data on

Protected mode operation requires several registers

to be initialized. The GDT and IDT base registers

must refer to a valid GDT and IDT. After executing

the LMSW instruction to set PE, the M80C286 must

D

15

–D , and the second transfers data on D –D .

8 7 0

Both byte data transfers occur automatically, trans-

parent to software.

21

M80C286

Two bus signals, A and BHE, control transfers over

0

the lower and upper halves of the data bus. Even

address byte transfers are indicated by A LOW and

0

BHE HIGH. Odd address byte transfers are indicat-

ed by A HIGH and BHE LOW. Both A and BHE are

0

LOW for even address word transfers.

The I/O address space contains 64K addresses in

both modes. The I/O space is accessible as either

bytes or words, as is memory. Byte wide peripheral

devices may be attached to either the upper or lower

byte of the data bus. Byte-wide I/O devices attached

271103–20

to the upper data byte (D –D ) are accessed with

8

15

odd I/O addresses. Devices on the lower data byte

are accessed with even I/O addresses. An interrupt

controller such as Intel’s 82C59A-2 must be con-

Figure 22. M80C286 Bus States

Bus States

The idle (T ) state indicates that no data transfers

nected to the lower data byte (D –D ) for proper

0

7

i

are in progress or requested. The first active state

return of the interrupt vector.

T

is signaled by status line S1 or S0 going LOW

and identifying phase 1 of the processor clock. Dur-

S

Bus Operation

The M80C286 uses a double frequency system

clock (CLK input) to control bus timing. All signals on

the local bus are measured relative to the system

CLK input. The CPU divides the system clock by 2 to

produce the internal processor clock, which deter-

mines bus state. Each processor clock is composed

of two system clock cycles named phase 1 and

phase 2. The M82C284 clock generator output

(PCLK) identifies the next phase of the processor

clock. (See Figure 21.)

ing T , the command encoding, the address, and

S

data (for a write operation) are available on the

M80C286 output pins. The M82C288 bus controller

decodes the status signals and generates Multibus

compatible read/write command and local trans-

ceiver control signals.

After T , the perform command (T ) state is en-

C

S

tered. Memory or I/O devices respond to the bus

operation during T , either transferring read data to

the CPU or accepting write data. T states may be

C

repeated as often as necessary to assure sufficient

time for the memory or I/O device to respond. The

READY signal determines whether T is repeated. A

C

repeated T state is called a wait state.

C

During hold (T ), the M80C286 will float* all address,

h

data, and status output pins enabling another bus

master to use the local bus. The M80C286 HOLD

input signal is used to place the M80C286 into the

271103–19

T

h

state. The M80C286 HLDA output signal indi-

cates that the CPU has entered T .

h

Figure 21. System and Processor

Clock Relationships

Pipelined Addressing

Six types of bus operations are supported; memory

read, memory write, I/O read, I/O write, interrupt ac-

knowledge, and halt/shutdown. Data can be trans-

ferred at a maximum rate of one word per two proc-

essor clock cycles.

The M80C286 uses a local bus interface with pipe-

lined timing to allow as much time as possible for

data access. Pipelined timing allows a new bus oper-

ation to be initiated every two processor cycles,

while allowing each individual bus operation to last

for three processor cycles.

The M80C286 bus has three basic states: idle (T ),

i

send status (T ), and perform command (T ). The

s

c

M80C286 CPU also has a fourth local bus state

called hold (T ). T indicates that the M80C286 has

surrendered control of the local bus to another bus

master in response to a HOLD request.

The timing of the address outputs is pipelined such

that the address of the next bus operation becomes

available during the current bus operation. Or in oth-

er words, the first clock of the next bus operation is

overlapped with the last clock of the current bus op-

eration. Therefore, address decode and routing logic

can operate in advance of the next bus operation.

h

Each bus state is one processor clock long. Figure

22 shows the four M80C286 local bus states and

allowed transitions.

*NOTE:

See section on bus hold circuitry.

22

M80C286

271103–21

Figure 23. Basic Bus Cycle

External address latches may hold the address sta-

Command Timing Controls

ble for the entire bus operation, and provide addi-

tional AC and DC buffering.

Two system timing customization options, command

extension and command delay, are provided on the

M80C286 local bus.

The M80C286 does not maintain the address of the

current bus operation during all T states. Instead,

c

the address for the next bus operation may be emit-

Command extension allows additional time for exter-

nal devices to respond to a command and is analo-

gous to inserting wait states on the M8086. External

logic can control the duration of any bus operation

such that the operation is only as long as necessary.

The READY input signal can extend any bus opera-

tion for as long as necessary, see Figure 23.

ted during phase 2 of any T . The address remains

c

valid during phase 1 of the first T to guarantee hold

c

time, relative to ALE, for the address latch inputs.

Bus Control Signals

The M82C288 bus controller provides control sig-

nals; address latch enable (ALE), Read/Write com-

mands, data transmit/receive (DT/R), and data en-

able (DEN) that control the address latches, data

transceivers, write enable, and output enable for

memory and I/O systems.

Command delay allows an increase of address or

write data setup time to system bus command active

for any bus operation by delaying when the system

bus command becomes active. Command delay is

controlled by the M82C288 CMDLY input. After T ,

S

The Address Latch Enable (ALE) output determines

when the address may be latched. ALE provides at

least one system CLK period of address hold time

from the end of the previous bus operation until the

address for the next bus operation appears at the

latch outputs. This address hold time is required to

support MULTIBUS and common memory systems.

the bus controller samples CMDLY at each failing

edge of CLK. If CMDLY is HIGH, the M82C288 will

not activate the command signal. When CMDLY is

LOW, the M82C288 will activate the command sig-

nal. After the command becomes active, the CMDLY

input is not sampled.

When a command is delayed, the available re-

sponse time from command active to return read

data or accept write data is less. To customize sys-

tem bus timing, an address decoder can determine

which bus operations require delaying the com-

mand. The CMDLY input does not affect the timing

of ALE, DEN, or DT/R.

The data bus transceivers are controlled by

M82C288 outputs Data Enable (DEN) and Data

Transmit/Receive (DT/R). DEN enables the data

transceivers; while DT/R controls tranceiver direc-

tion. DEN and DT/R are timed to prevent bus con-

tention between the bus master, data bus transceiv-

ers, and system data bus transceivers.

23

M80C286

271103–22

Figure 24. CMDLY Controls the Leading Edge of Command Signal

Figure 24 illustrates four uses of CMDLY. Example 1

shows delaying the read command two system

CLKs for cycle N-1 and no delay for cycle N, and

example 2 shows delaying the read command one

system CLK for cycle N-1 and one system CLK de-

lay for cycle N.

of the READY signal, thereby requiring READY be

synchronous to the system clock.

Synchronous Ready

The M82C284 clock generator provides READY

synchronization from both synchronous and asyn-

chronous sources (see Figure 25). The synchronous

ready input (SRDY) of the clock generator is sam-

pled with the falling edge of CLK at the end of phase

1 of each T . The state of SRDY is then broadcast to

c

the bus master and bus controller via the READY

output line.

Bus Cycle Termination

At maximum transfer rates, the M80C286 bus alter-

nates between the status and command states. The

bus status signals become inactive after T so that

s

they may correctly signal the start of the next bus

operation after the completion of the current cycle.

No external indication of T exists on the M80C286

c

Asynchronous Ready

local bus. The bus master and bus controller enter

directly after T and continue executing T cycles

Many systems have devices or subsystems that are

asynchronous to the system clock. As a result, their

ready outputs cannot be guaranteed to meet the

M82C284 SRDY setup and hold time requirements.

But the M82C284 asynchronous ready input (ARDY)

is designed to accept such signals. The ARDY input

T

c

until terminated by READY.

s

c

READY Operation

The current bus master and M82C288 bus controller

terminate each bus operation simultaneously to

achieve maximum bus operation bandwidth. Both

are informed in advance by READY active (open-

collector output from M82C284) which identifies the

is sampled at the beginning of each T cycle by

C

M82C284 synchronization logic. This provides one

system CLK cycle time to resolve its value before

broadcasting it to the bus master and bus controller.

last T cycle of the current bus operation. The bus

C

master and bus controller must see the same sense

24

M80C286

NOTES:

1. SRDYEN is active low.

271103–23

2. If SRDYEN is high, the state of SRDY will no affect READY.

3. ARDYEN is active low.

Figure 25. Synchronous and Asynchronous Ready

ARDY or ARDYEN must be HIGH at the end of T .

S

ARDY cannot be used to terminate bus cycle with no

wait states.

The data bus is driven with write data during the

second phase of T . The delay in write data timing

allows the read data drivers, from a previous read

cycle, sufficient time to enter 3-state OFF* before

the M80C286 CPU begins driving the local data bus

for write operations. Write data will always remain

s

Each ready input of the M82C284 has an enable pin

(SRDYEN and ARDYEN) to select whether the cur-

rent bus operation will be terminated by the synchro-

nous or asynchronous ready. Either of the ready in-

puts may terminate a bus operation. These enable

inputs are active low and have the same timing as

their respective ready inputs. Address decode logic

usually selects whether the current bus operation

should be terminated by ARDY or SRDY.

valid for one system clock past the last T to provide

c

sufficient hold time for Multibus or other similar

memory or I/O systems. During write-read or write-

idle sequences the data bus enters 3-state OFF*

during the second phase of the processor cycle after

the last T . In a write-write sequence the data bus

c

does not enter 3-state OFF* between T and T .

c

s

Data Bus Control

Bus Usage

Figures 26, 27, and 28 show how the DT/R, DEN,

data bus, and address signals operate for different

combinations of read, write, and idle bus operations.

DT/R goes active (LOW) for a read operation. DT/R

remains HIGH before, during, and between write op-

erations.

The M80C286 local bus may be used for several

functions: instruction data transfers, data transfers

by other bus masters, instruction fetching, processor

extension data transfers, interrupt acknowledge, and

halt/shutdown. This section describes local bus ac-

tivities which have special signals or requirements.

*NOTE:

See section on bus hold circuitry.

25

M80C286

271103–24

Figure 26. Back to Back Read-Write Cycles

271103–25

Figure 27. Back to Back Write-Read Cycles

26

M80C286

271103–26

Figure 28. Back to Back Write-Write Cycles

prefix may be used with the following ASM-286 as-

sembly instructions; MOVS, INS, and OUTS. For bus

cycles other than Interrupt-Acknowledge cycles,

Lock will be active for the first and subsequent cy-

cles of a series of cycles to be locked. Lock will not

be shown active during the last cycle to be locked.

For the next-to-last cycle, Lock will become inactive

HOLD and HLDA

HOLD AND HLDA allow another bus master to gain

control of the local bus by placing the M80C286 bus

into the T state. The sequence of events required

h

to pass control between the M80C286 and another

local bus master are shown in Figure 29.

at the end of the first T regardless of the number of

c

In this example, the M80C286 is initially in the T

h

state as signaled by HLDA being active. Upon leav-

ing T , as signaled by HLDA going inactive, a write

h

wait-states inserted. For Interrupt-Acknowledge cy-

cles, Lock will be active for each cycle, and will be-

come inactive at the end of the first T for each cy-

c

operation is started. During the write operation an-

other local bus master requests the local bus from

the M80C286 as shown by the HOLD signal. After

completing the write operation, the M80C286 per-

cle regardless of the number of wait-states inserted.

Instruction Fetching

forms one T bus cycle, to guarantee write data hold

The M80C286 Bus Unit (BU) will fetch instructions

ahead of the current instruction being executed. This

activity is called prefetching. It occurs when the local

bus would otherwise be idle and obeys the following

rules:

i

time, then enters T as signaled by HLDA going ac-

tive.

h

The CMDLY signal and ARDY ready are used to

start and stop the write bus command, respectively.

Note that SRDY must be inactive or disabled by

SRDYEN to guarantee ARDY will terminate the cy-

cle.

A prefetch bus operation starts when at least two

bytes of the 6-byte prefetch queue are empty.

The prefetcher normally performs word prefetches

independent of the byte alignment of the code seg-

ment base in physical memory.

HOLD must not be active during the time from the

leading edge of RESET until 34 CLKs following the

trailing edge of RESET.

The prefetcher will perform only a byte code fetch

operation for control transfers to an instruction be-

ginning on a numerically odd physical address.

Lock

The CPU asserts an active lock signal during Inter-

rupt-Acknowledge cycles, the XCHG instruction, and

during some descriptor accesses. Lock is also as-

serted when the LOCK prefix is used. The LOCK

Prefetching stops whenever a control transfer or

HLT instruction is decoded by the IU and placed into

the instruction queue.

27

M80C286

In real address mode, the prefetcher may fetch up to

6 bytes beyond the last control transfer or HLT in-

struction in a code segment.

execute beyond the last full instruction in the code

segment.

If the last byte of a code segment appears on an

even physical memory address, the prefetcher will

read the next physical byte of memory (perform a

word code fetch). The value of this byte is ignored

and any attempt to execute it causes exception 13.

In protected mode, the prefetcher will never cause a

segment overrun exception. The prefetcher stops at

the last physical memory word of the code segment.

Exception 13 will occur if the program attempts to

271103–27

NOTES:

1. Status lines are not driven by M80C286, yet remain high due to internal pullup resistors during HOLD state. See

section on bus hold circuitry.

2. Address, M/IO and COD/INTA may start floating during any T depending on when internal M80C286 bus arbiter

C

decides to release bus to external HOLD. The float starts in w2 of T . See section on bus hold circuitry.

C

3. BHE and LOCK may start floating after the end of any T depending on when internal M80C286 bus arbiter decides

C

to release bus to external HOLD. The float starts in w1 of T . See section on bus hold circuitry.

C

4. The minimum HOLD to HLDA time is shown. Maximum is one T longer.

H

5. The earliest HOLD time is shown. It will always allow a subsequent memory cycle if pending is shown.

6. The minimum HOLD to HLDA time is shown. Maximum is a function of the instruction, type of bus cycle and other

machine state (i.e., Interrupts, Waits, Lock, etc.).

7. Asynchronous ready allows termination of the cycle. Synchronous ready does not signal ready in this example. Syn-

chronous ready state is ignored after ready is signaled via the asynchronous input.

Figure 29. MULTIBUS Write Terminated by Asynchronous Ready with Bus Hold

28

M80C286

an INTR input. An interrupt acknowledge sequence

consists of two INTA bus operations. The first allows

a master M8259A Programmable Interrupt Control-

ler (PIC) to determine which if any of its slaves

should return the interrupt vector. An eight bit vector

is read on D0–D7 of the M80C286 during the sec-

ond INTA bus operation to select an interrupt han-

dler routine from the interrupt table.

Processor Extension Transfers

The processor extension interface uses I/O port ad-

dresses 00F8(H), 00FA(H), and 00FC(H) which are

part of the I/O port address range reserved by Intel.

An ESC instruction with Machine Status Word bits

e

to one or more of these I/O port addresses indepen-

EM

0 and TS

0 will perform I/O bus operations

dent of the value of IOPL and CPL.

The Master Cascade Enable (MCE) signal of the

M82C288 is used to enable the cascade address

drivers, during INTA bus operations (See Figure 30),

onto the local address bus for distribution to slave

interrupt controllers via the system address bus. The

M80C286 emits the LOCK signal (active LOW) dur-

ing T of the first INTA bus operation. A local bus

s

‘‘hold’’ request will not be honored until the end of

the second INTA bus operation.

ESC instructions with memory references enable the

CPU to accept PEREQ inputs for processor exten-

sion operand transfers. The CPU will determine the

operand starting address and read/write status of

the instruction. For each operand transfer, two or

three bus operations are performed, one word trans-

fer with I/O port address 00FA(H) and one or two

bus operations with memory. Three bus operations

are required for each word operand aligned on an

odd byte address.

Three idle processor clocks are provided by the

M80C286 between INTA bus operations to allow for

the minimum INTA to INTA time and CAS (cascade

address) out delay of the M8259A. The second INTA

bus operation must always have at least one extra

NOTE:

Odd-aligned numerics instructions should be avoid-

ed when using an M80C286 system running six or

more memory-write wait-states. The M80C286 can

generate an incorrect numerics address if all the

following conditions are met:

T

c

state added via logic controlling READY. This is

needed to meet the M8259A minimum INTA pulse

width.

Ð Two floating point (FP) instructions are fetched

and in the M80C286 queue.

Local Bus Usage Priorities

Ð The first FP instruction is any floating point store

except FSTSW AX.

The M80C286 local bus is shared among several

internal units and external HOLD requests. In case

of simultaneous requests, their relative priorities are:

Ð The second FP instruction is any floating point

store except FSTSW AX.

(Highest) Any transfers which assert LOCK either

explicitly (via the LOCK instruction prefix)

or implicitly (i.e. some segment descriptor

accesses, interrupt acknowledge se-

quence, or an XCHG with memory).

Ð The second FP instruction accesses memory.

Ð The operand of the first instruction is aligned on

an odd memory address.

Ð More than five wait-states are inserted during ei-

ther of the last two memory write transfers

(transferred as two bytes for odd aligned oper-

ands) of the first instruction.

The second of the two byte bus opera-

tions required for an odd aligned word op-

erand.

The second FP instruction operand address will be

incremented by one if these conditions are met.

These conditions are most likely to occur in a multi-

master system. For a hardware solution, contact

your local Intel representative.

The second or third cycle of a processor

extension data transfer.

Local bus request via HOLD input.

Processor extension data operand trans-

fer via PEREQ input.

Ten or more command delays should not be used

when accessing the numerics coprocessor. Exces-

sive command delays can cause the M80C286 and

M80C287 to lose synchronization.

Data transfer performed by EU as part of

an instruction.

(Lowest) An instruction prefetch request from BU.

The EU will inhibit prefetching two proc-

essor clocks in advance of any data

transfers to minimize waiting by EU for a

prefetch to finish.

Interrupt Acknowledge Sequence

Figure 30 illustrates an interrupt acknowledge se-

quence performed by the M80C286 in response to

29

M80C286

271103–28

NOTES:

1. Data is ignored, upper data bus, D –D , should not change state during this time.

8

15

2. First INTA cycle should have at least one wait state inserted to meet M8259A minimum INTA pulse width.

3. Second INTA cycle should have at least one wait state inserted to meet M8259A minimum INTA pulse width.

4. LOCK is active for the first INTA cycle to prevent a bus arbiter from releasing the bus between INTA cycles in a multi-

master system. LOCK is also active for the second INTA cycle.

5. A –A exits 3-state OFF during w2 of the second T in the INTA cycle. See section on bus hold circuitry.

23

0

C

6. Upper data bus should not change state during this time.

Figure 30. Interrupt Acknowledge Sequence

During halt or shutdown, the M80C286 may service

PEREQ or HOLD requests. A processor extension

segment overrun exception during shutdown will in-

hibit further service of PEREQ. Either NMI or RESET

will force the M80C286 out of either halt or shut-

down. An INTR, if interrupts are enabled, or a proc-

essor extension segment overrun exception will also

force the M80C286 out of halt.

Halt or Shutdown Cycles

The M80C286 externally indicates halt or shutdown

conditions as a bus operation. These conditions oc-

cur due to a HLT instruction or multiple protection

exceptions while attempting to execute one instruc-

tion. A halt or shutdown bus operation is signalled

when S1, S0 and COD/INTA are LOW and M/IO is

HIGH. A HIGH indicates halt, and A LOW indi-

1

cates shutdown. The 82288 bus controller does not

issue ALE, nor is READY required to terminate a halt

or shutdown bus operation.

30

M80C286

271103–29

Figure 31. Example Power-Down Sequence

When coming out of power-down mode, the system

CLK must be started with the same polarity in which

it was stopped. An example power down sequence

is shown in Figure 31.

THE POWER-DOWN FEATURE OF

THE M80C286

The M80C286, unlike the HMOS part, can enter into

a power-down mode. By stopping the processor

CLK, the processor will enter a power-down mode.

Once in the power-down mode, all M80C286 outputs

remain static (the same state as before the mode

BUS HOLD CIRCUITRY

To avoid high current conditions caused by floating

inputs to peripheral CMOS devices and eliminate the

need for pull-up/down resistors, ‘‘bus-hold’’ circuitry

has been used on all tri-state M80C286 outputs. See

Table 16 for a list of these pins and Figures 32 and

33 for a complete description of which pins have bus

hold circuitry. These circuits will maintain the last

valid logic state if no driving source is present (i.e.,

an unconnected pin or a driving source which goes

to a high impedance state). To overdrive the ‘‘bus

hold’’ circuits, an external driver must be capable of

supplying the maximum ‘‘Bus Hold Overdrive’’ sink

or source current at valid input voltage levels. Since

was entered). The M80C286 D.C. specification I

CCS

rates the amount of current drawn by the processor

when in the power-down mode. When the CLK is

reapplied to the processor, it will resume execution

where it was interrupted.

In order to obtain maximum benefits from the power-

down mode, certain precautions should be taken.

When in the power-down mode, all M80C286 out-

puts remain static and any output that is turned on

and remains in a HIGH condition will source current

when loaded. Best low-power performance can be

obtained by first putting the processor in the HOLD

condition (turning off all of the output buffers), and

then stopping the processor CLK in the phase 2

state. In this condition, any output that is loaded will

source only the ‘‘Bus Hold Sustaining Current’’.

this ‘‘bus hold’’ circuitry is active and not

a

Pull-Up/Pull-Down

When stopping the processor clock, minimum clock

high and low times cannot be violated (no glitches

on the clock line).

Violating this condition can cause the M80C286 to

erase its internal register states. Note that all inputs

to the M80C286 (CLK, HOLD, PEREQ, RESET,

READY, INTR, NMI, BUSY, and ERROR) should be

at V

or V ; any other value will cause the

CC SS

M80C286 to draw additional current.

271103–30

Figure 32. Bus Hold Circuitry Pins 36–51, 66–67

31

M80C286

‘‘resistive’’ type element, the associated power sup-

ply current is negligible and power dissipation is sig-

nificantly reduced when compared to the use of pas-

sive pull-up resistors.

The M80C287 NPX can perform numeric calcula-

tions and data transfers concurrently with CPU pro-

gram execution. Numerics code and data have the

same integrity as all other information protected by

the M80C286 protection mechanism.

Table 16. Bus Hold Circuitry on the M80C286

The M80C286 can overlap chip select decoding and

address propagation during the data transfer for the

previous bus operation. This information is latched

Polarity Pulled to

Signal

Location when tri-stated

by ALE during the middle of a T cycle. The latched

s

S1, S0, PEACK, LOCK 4–6, 68 Hi, See Figure 33

chip select and address information remains stable

during the bus operation while the next cycle’s ad-

dress is being decoded and propagated into the sys-

tem. Decode logic can be implemented with a high

speed PROM or PAL.

Data Bus (D –D

0

)

15

36–51

Hi/Lo,

See Figure 32

COD/INTA, M/IO

66–67

Hi/Lo,

See Figure 32

The optional decode logic shown in Figure 32 takes

advantage of the overlap between address and data

of the M80C286 bus cycle to generate advanced

memory and lO-select signals. This minimizes sys-

tem performance degradation caused by address

propagation and decode delays. In addition to se-

lecting memory and I/O, the advanced selects may

be used with configurations supporting local and

system buses to enable the appropriate bus inter-

face for each bus cycle. The COD/INTA and M/IO

signals are applied to the decode logic to distinguish

between interrupt, I/O, code and data bus cycles.

Pull-Up

271103–31

By adding a bus arbiter, the M80C286 provides a

MULTIBUS system bus interface as shown in Figure

35. The ALE output of the M82C288 for the

MULTIBUS bus is connected to its CMDLY input to

delay the start of commands one system CLK as

required to meet MULTIBUS address and write data

setup times. This arrangement will add at least one

Figure 33. Bus Hold Circuitry Pins 4–6, 68

SYSTEM CONFIGURATIONS

The versatile bus structure of the M80C286 micro-

system, with a full complement of support chips, al-

lows flexible configuration of a wide range of sys-

tems. The basic configuration, shown in Figure 34, is

similar to an M8086 maximum mode system. It in-

cludes the CPU plus an M8259A interrupt controller,

M82C284 clock generator, and the M82C288 Bus

Controller.

extra T state to each bus operation which uses the

c

MULTIBUS.

A second M82C288 bus controller and additional

latches and transceivers could be added to the local

bus of Figure 35. This configuration allows the

M80C286 to support an on-board bus for local mem-

ory and peripherals, and the MULTIBUS for system

bus interfacing.

As indicated by the dashed lines in Figure 34, the

ability to add processor extensions is an integral fea-

ture of M80C286 microsystems. The processor ex-

tension interface allows external hardware to per-

form special functions and transfer data concurrent

with CPU execution of other instructions. Full system

integrity is maintained because the M80C286 super-

vises all data transfers and instruction execution for

the processor extension.

32

M80C286

Figure 34. Basic M80C286 System Configuration

33

M80C286

271103–33

Figure 35. MULTIBUS System Bus Interface

34

M80C286

271103–34

Figure 36. M80C286 System Configuration with Dual-Ported Memory

Figure 36 shows the addition of dual ported dynamic

Mechanical Data

memory between the MULTIBUS system bus and

the M80C286 local bus. The dual port interface is

provided by the 8207 Dual Port DRAM Controller.

The 8207 runs synchronously with the CPU to maxi-

mize throughput for local memory references. It also

arbitrates between requests from the local and sys-

tem buses and performs functions such as refresh,

initialization of RAM, and read/modify/write cycles.

The 8207 combined with the 8206 Error Checking

and Correction memory controller provide for single

bit error correction. The dual-ported memory can be

combined with a standard MULTIBUS system bus

interface to maximize performance and protection in

multiprocessor system configurations.

The M80C286 pinout for both the Ceramic Quad

Flatpack, CQFP, and Pin Grid Array, PGA, packages

are shown in Figure 37. V

CC

must be made to mutiple V

and GND connections

and V (GND) pins.

CC

SS

Each V

and V MUST be connected to the ap-

SS

CC

propriate voltage level. The circuit board should in-

clude V and GND planes for power distribution

and all V pins must be connected to the appropri-

CC

ate plane.

Table 17 shows the pin assignments for both the

CQFP and PGA components.

NOTE:

Pins identified as ‘‘N.C.’’ should remain completely

unconnected.

35

M80C286

Component Pad ViewsÐAs viewed from underside of

component when mounted on the board.

P.C. Board ViewsÐAs viewed from the component

side of the P.C. board.

Ceramic Quad Flatpack

271103–35

Pin Grid Array

NOTE:

N.C. signals must not be connected

271103–36

Figure 37. M80C286 Pin Configuration

36

M80C286

Table 17. Pin Cross Reference for M80C286

Signal

A0

CQFP

44

45

46

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

2

PGA

34

33

32

28

27

26

25

24

23

22

21

20

19

18

17

16

15

14

13

12

11

10

8

Signal

A23

D0

CQFP

3

PGA

7

Signal

LOCK

CQFP

PGA

68

67

66

65

64

63

61

59

57

54

53

52

9

10

11

12

13

14

15

17

19

21

24

25

26

1

A1

42

40

38

36

34

32

30

28

41

39

37

35

33

31

29

27

47

49

9

36

38

40

42

44

46

48

50

37

39

41

43

45

47

49

51

31

29

1

M/IO

A2

D1

COD/INTA

HLDA

HOLD

READY

PEREQ

NMI

A3

D2

A4

D3

A5

D4

A6

D5

A7

D6

A8

D7

INTR

A9

D8

BUSY

ERROR

CAP

A10

A11

A12

A13

A14

A15

A16

A17

A18

A19

A20

A21

A22

D9

D10

D11

D12

D13

D14

D15

CLK

RESET

BHE

S1

V

SS

CC

18

43

16

48

7

35

60

30

62

2

N.C.

8

3

20

22

23

55

56

58

6

4

S0

5

PEACK

4

6

Table 18. Pin Description

The following pin function descriptions are for the M80C286 microprocessor :

Symbol

Type

Name and Function

SYSTEM CLOCK provides the fundamental timing for M80C286 systems. It is

CLK

I

divided by two inside the M80C286 to generate the processor clock. The internal

divide-by-two circuitry can be synchronized to an external clock generator by a

LOW to HIGH transition on the RESET input.

D

–D

I/O

O

DATA BUS inputs data during memory, I/O, and interrupt acknowledge read

cycles; outputs data during memory and I/O write cycles. The data bus is active

HIGH and floats to 3-state OFF* during bus hold acknowledge.

15

0

A

–A

ADDRESS BUS outputs physical memory and I/O port addresses. A0 is LOW

. A –A are LOW during I/O

23

0

when data is to be transferred on pins D

7–0 23

16

transfers. The address bus is active HIGH and floats to 3-state OFF* during bus

hold acknowledge.

BHE

O

BUS HIGH ENABLE indicates transfer or data on the upper byte of the data bus.

. Eight-bit oriented devices assigned to the upper byte of the data bus would

D

normally use BHE to condition chip select functions. BHE is active LOW and floats

15–8

to 3-state OFF* during bus hold acknowledge.

*See bus hold circuitry section.

37

M80C286

Table 18. Pin Description (Continued)

Symbol

Type

Name and Function

BHE

(Continued)

BHE and A0 Encodings

BHE Value

A0 Value

Function

0

1

0

1

0

1

Word transfer

Transfer on upper half of data bus (D –D )

15 8

Byte transfer on lower half of data bus (D –D )

Will never occur

7

0

S1, S0

O

BUS CYCLE STATUS indicates initiation of a bus cycle and, along with M/IO and COD/

INTA, defines the type of bus cycle. The bus is in a T state whenever one or both are LOW,

s

S1 and S0 are active LOW and float to 3-state OFF* during bus hold acknowledge.

M80C286 Bus Cycle Status Definition

COD/INTA

0 (LOW)

0

M/IO

S1

S0

Bus Cycle Initiated

Interrupt acknowledge

Will not occur

None; not a status cycle

0

1

0

1

0

1

0

1

0

1

0

1

0

1

0

1

0

1

0

1

0

1

0

1

0

1

0

1

e

IF A1

1 then halt; else shutdown

Memory data read

Memory data write

None; not a status cycle

Will not occur

I/O read

I/O write

None; not a status cycle

Will not occur

Memory instruction read

Will not occur

None; not a status cycle

0

1 (HIGH)

1

M/IO

O

MEMORY I/O SELECT distinguishes memory access from I/O access. If HIGH during T , a

s

memory cycle or a halt/shutdown cycle is in progress. If LOW, an I/O cycle or an interrupt

acknowledge cycle is in progress. M/IO floats to 3-state OFF* during bus hold

acknowledge.

COD/INTA

LOCK

O

CODE/INTERRUPT ACKNOWLEDGE distinguishes instruction fetch cycles from memory

data read cycles. Also distinguishes interrupt acknowledge cycles from I/O cycles. COD/

INTA floats to 3-state OFF* during bus hold acknowledge. Its timing is the same as M/IO.

BUS LOCK indicates that other system bus masters are not to gain control of the system

bus for the current and the following bus cycle. The LOCK signal may be activated explicitly

by the ‘‘LOCK’’ instruction prefix or automatically by M80C286 hardware during memory

XCHG instructions, interrupt acknowledge, or descriptor table access. LOCK is active LOW

and floats to 3-state OFF* during bus hold acknowledge.

READY

I

BUS READY terminates a bus cycle. Bus cycles are extended without limit until terminated

by READY LOW. READY is an active LOW synchronous input requiring setup and hold

times relative to the system clock be met for correct operation. READY is ignored during

bus hold acknowledge.

HOLD

HLDA

I

O

BUS HOLD REQUEST AND HOLD ACKNOWLEDGE control ownership of the M80C286

local bus. The HOLD input allows another local bus master to request control of the local

bus. When control is granted, the M80C286 will float its bus drivers to 3-state OFF* and

then activate HLDA, thus entering the bus hold acknowledge condition. The local bus will

remain granted to the requesting master until HOLD becomes inactive which results in the

M80C286 deactivating HLDA and regaining control of the local bus. This terminates the bus

hold acknowledge condition. HOLD may be asynchronous to the system clock. These

signals are active HIGH.

INTR

I

INTERRUPT REQUEST requests the M80C286 to suspend its current program execution

and service a pending external request. Interrupt requests are masked whenever the

interrupt enable bit in the flag word is cleared. When the M80C286 responds to an interrupt

request, it performs two interrupt acknowledge bus cycles to read an 8-bit interrupt vector

that identifies the source of the interrupt. To assure program interruption, INTR must remain

active until the first interrupt acknowledge cycle is completed. INTR is sampled at the

beginning of each processor cycle and must be active HIGH at least two processor cycles

before the current instruction ends in order to interrupt before the next instruction. INTR is

level sensitive, active HIGH, and may be asynchronous to the system clock.

*See bus hold circuitry section.

38

M80C286

Table 18. Pin Description (Continued)

Name and Function

Symbol

Type

NMI

I

NON-MASKABLE INTERRUPT REQUEST interrupts the M80C286 with an

internally supplied vector value of 2. No interrupt acknowledge cycles are

performed. The interrupt enable bit in the M80C286 flag word does not affect

this input. The NMI input is active HIGH, may be asynchronous to the system

clock, and is edge triggered after internal synchronization. For proper

recognition, the input must have been previously LOW for at least four system

clock cycles and remain HIGH for at least four system clock cycles.

PEREQ

PEACK

I

O

PROCESSOR EXTENSION OPERAND REQUEST AND ACKNOWLEDGE

extend the memory management and protection capabilities of the M80C286

to processor extensions. The PEREQ input requests the M80C286 to perform

a data operand transfer for a processor extension. The PEACK output signals

the processor extension when the requested operand is being transferred.

PEREQ is active HIGH and floats to 3-state OFF* during bus hold

acknowledge. PEACK may be asynchronous to the system clock. PEACK is

active LOW.

BUSY

ERROR

I

PROCESSOR EXTENSION BUSY AND ERROR indicate the operating

condition of a processor extension to the M80C286. An active BUSY input

stops M80C286 program execution on WAIT and some ESC instructions until

BUSY becomes inactive (HIGH). The M80C286 may be interrupted while

waiting for BUSY to become inactive. An active ERROR input causes the

M80C286 to perform a processor extension interrupt when executing WAIT or

some ESC instructions. These inputs are active LOW and may be

asynchronous to the system clock. These inputs have internal pull-up

resistors.

RESET

I

SYSTEM RESET clears the internal logic of the M80C286 and is active HIGH.

The M80C286 may be reinitialized at any time with a LOW to HIGH transition

on RESET which remains active for more than 16 system clock cycles. During

RESET active, the output pins of the M80C286 enter the state shown below:

M80C286 Pin State During Reset

Pin Value

1 (HIGH)

0 (LOW)

Pin Names

S0, S1, PEACK, A23–A0, BHE, LOCK

M/IO, COD/INTA, HLDA (Note 1)

3-state OFF*

D –D

15 0

Operation of the M80C286 begins after a HIGH to LOW transition on RESET.

The HIGH to LOW transition of RESET must be synchronous to the system

clock. Approximately 38 CLK cycles from the trailing edge of RESET are

required by the M80C286 for internal initialization before the first bus cycle, to

fetch code from the power-on execution address, occurs.

A LOW to HIGH transition of RESET synchronous to the system clock will

end a processor cycle at the second HIGH to LOW transition of the system

clock. The LOW to HIGH transition of RESET may be asynchronous to the

system clock; however, in this case it cannot be predetermined which phase

of the processor clock will occur during the next system clock period.

Synchronous LOW to HIGH transitions of RESET are required only for

systems where the processor clock must be phase synchronous to another

clock.

V

I

SYSTEM GROUND: 0 Volts.

SS

a

SYSTEM POWER: 5 Volt Power Supply.

CC

g

CAP

SUBSTRATE FILTER CAPACITOR: a 0.047 mF 20% 12V capacitor can

be connected between this pin and ground for compatibility with the HMOS

M80286. For systems using only an M80C286, this pin can be left floating.

*See bus hold circuitry section.

NOTE:

1. HLDA is only Low if HOLD is inactive (Low).

39

M80C286

Table 19. M80C286 Systems Recommended Pull Up Resistor Values

M80C286 Pin and Name Pullup Value

Purpose

4ÐS1

Pull S0, S1, and PEACK inactive during M80C286 hold periods

(Note 1)

g

20 KX 10%

5ÐS0

6ÐPEACK

e

Pull READY inactive within required minimum time (C

s

150 pF,

L

g

910X 5%

63ÐREADY

l

R

7 mA)

NOTE:

1. Pullup resistors are not required for S0 and S1 when the corresponding pins on the M82C284 are connected to S0 and

S1.

e

a

b

a

T

P * i

J

C

JC

M80286 IN-CIRCUIT EMULATION

CONSIDERATIONS

T

A

C

J

JA

b

i

JC

[

]

T

P *

i

A

JA

One of the advantages of using the M80C286 is that

full in-circuit emulation development support is avail-

2

able thru either the I ICE 80286 probe for

Values for i and i are given in Table 20. Table

JC

21 shows the maximum T allowable (without ex-

ceeding T ).

C

JA

A

8 MHz/10 MHz or ICE286 for 12.5 MHz designs. To

utilize these powerful tools it is necessary that the

designer be aware of a few minor parametric and

functional differences between the M80C286 and

Junction temperature calculations should use an I

CC

value that is measured without external resistive

loads. The external resistive loads dissipate addi-

tional power external to the M80C286 and not on

the die. This increases the resistor temperature, not

the die temperature. The full capacitive load (C

100 pF) should be applied during the I

ment.

2

the in-circuit emulators. The I ICE datasheet (I ICE

Integrated Instrumentation and In-Circuit Emulation

Ý

System, order 210469) contains a detailed de-

scription of these design considerations. The

e

measure-

L

Ý

ICE286 Fact Sheet ( 280718) and User’s Guide

452317) contain design considerations for the

CC

Ý

(

80286 12.5 MHz microprocessor. It is recommended

that the appropriate document be reviewed by the

80286 system designer to determine whether or not

these differences affect the design.

Table 20. Thermal Resistances ( C/W)

§

Package

i

JC

68-Lead PGA

68-Lead CQFP

5.5

11

30

32

PACKAGE THERMAL

SPECIFICATIONS

NOTE:

The numbers in Table 20 were calculated using an

of 150 mA, which is representative of the worst

The M80C286 Microprocessor is specified for opera-

tion when case temperature (T ) is within the range

C

of 55 C– 125 C. Case temperature, unlike ambi-

I

CC

b

a

§

e

case I

at T

125 C with the outputs unloaded.

§

CC

C

ent temperature, is easily measured in any environ-

ment to determine whether the M80C286 Microproc-

essor is within the specified operating range. The

case temperature should be measured at the center

of the top surface of the component.

Table 21. Maximum (T )

A

Package

T ( C)

A

§

68-Lead PGA

68-Lead CQFP

105

108

The maximum ambient temperature (T ) allowable

A

without violating T specifications can be calculated

C

from the equations shown below. T is the 80C286

J

junction temperature. P is the power dissipated by

the M80C286.

40

M80C286

ABSOLUTE MAXIMUM RATINGS*

NOTICE: This data sheet contains information on

products in the sampling and initial production phases

of development. The specifications are subject to

change without notice. Verify with your local Intel

Sales office that you have the latest data sheet be-

fore finalizing a design.

b

a

Case Temperature under Bias ÀÀÀ 55 C to 125 C

§

b

a

Storage Temperature ÀÀÀÀÀÀÀÀÀÀÀ 65 C to 150 C

§

Voltage on Any Pin with

Respect to GroundÀÀÀÀÀÀÀÀÀÀÀÀÀÀ 1.0V to 7V

b

a

*WARNING: Stressing the device beyond the ‘‘Absolute

Maximum Ratings’’ may cause permanent damage.

These are stress ratings only. Operation beyond the

‘‘Operating Conditions’’ is not recommended and ex-

tended exposure beyond the ‘‘Operating Conditions’’

may affect device reliability.

Power DissipationÀÀÀÀÀÀÀÀÀÀÀÀÀÀÀÀÀÀÀÀÀÀÀÀÀÀ1.1W

Operating Conditions

Symbol

Description

Min

Max

Units

b

a

125

T

C

Case Temperature (Instant On)

Digital Supply Voltage

55

C

§

V

4.50

5.50

V

CC

D.C. CHARACTERISTICS Over Specified Operating Conditions

Symbol

Parameter

Supply Current

Min

Max

200

5

Unit

Comments

100 pF (Note 6)

e

C

L

I

mA

CC

Supply Current (Static)

CLK Input Capacitance

Other Input Capacitance

Input/Output Capacitance

Input LOW Voltage

mA (Note 7)

CCS

e

C

20

10

20

0.8

a

pF FREQ

1 MHz

2 MHz

CLK

IN

e

O

b

V

0.5

V

FREQ

IL

Input HIGH Voltage

2.0

V

0.5

IH

CC

b

CLK Input LOW Voltage

CLK Input HIGH Voltage

Output LOW Voltage

Output HIGH Voltage

0.5

0.8

ILC

IHC

OL

OH

a

3.8

CC

e

0.45

I

2.0 mA, FREQ

2 MHz

OL

e b

e

3.0

b

V

I

2.0 mA, FREQ

100 mA, FREQ

2 MHz

OH

V

0.5

CC

e

g

I

Input Leakage Current

Output Leakage Current

Input Sustaining Current on

10

mA

V

GND or V (Note 6)

CC

LI

IN

O

e

GND or V (Note 1)

CC

LO

IL

b

30

500

0V (Note 1)

IN

Ý

BUSY and ERROR Pins

e

I

Input Sustaining Current

(Bus Hold LOW)

35

200

mA

V

1.0V (Notes 1, 2)

3.0V (Notes 1, 3)

BHL

BHH

IN

b

Input Sustaining Current

(Bus Hold HIGH)

50

400

V

I

Bus Hold LOW Overdrive

Bus Hold HIGH Overdrive

250

mA (Notes 1, 4)

mA (Notes 1, 5)

BHLO

BHHO

b

420

NOTES:

1. Tested with the clock stopped.

2. I

3. I

should be measured after lowering V to GND and then raising to 1.0V on the following pins: 36–51, 66, 67.

IN

BHL

BHH

should be measured after raising V to V

IN

and then lowering to 3.0V on the following pins: 4–6, 36–51, 66–68.

CC

to switch this node from LOW to HIGH.

4. An external driver must source at least I

BHLO

to switch this node from HIGH to LOW.

5. An external driver must sink at least I

BHHO

6. Tested with outputs unloaded and at maximum frequency.

7. Tested while clock stopped in phase 2 and inputs at V or V with the outputs unloaded.

CC

SS

41

M80C286

A.C. CHARACTERISTICS Over Specified Operating Conditions

A.C. timings are referenced to 1.5V points of signals as illustrated in datasheet waveforms, unless otherwise

noted.

10 MHz

Symbol

Parameter

Unit

Comments

Min

50

Max

1

2

System Clock (CLK) Period

System Clock (CLK) LOW Time

System Clock (CLK) HIGH Time

System Clock (CLK) Rise Time

System Clock (CLK) Fall Time

Asynchronous Inputs Setup Time

Asynchronous Inputs Hold Time

RESET Setup Time

DC

ns

12

at 1.0V

3

16

at 3.6V

17

18

4

8

1.0V to 3.6V

3.6V to 1.0V

(Note 1)

20

23

5

(Note 1)

6

7

RESET Hold Time

8

Read Data Setup Time

Read Data Hold Time

8

9

8

10

11

12a1

12a2

12b

13

14

15

16

19

READY Setup Time

26

25

5

READY Hold Time

Status Active Delay

22

30

35

40

47

(Notes 2, 3)

(Notes 2, 4)

(Notes 2, 3)

PEACK Active Delay

5

Status/PEACK Inactive Delay

Address Valid Delay

3

4

Write Data Valid Delay

3

Address/Status/Data Float Delay

HLDA Valid Delay

2

3

Address Valid To Status

Valid Setup Time

27

NOTES:

1. Asynchronous inputs are INTR, NMI, HOLD, PEREQ, ERROR, and BUSY. This specification is given only for testing

purposes, to assure recognition at a specific CLK edge.

2. Delay from 1.0V on the CLK, to 1.5V or float on the output as appropriate for valid or floating condition.

e

3. Output load: C

100 pF.

L

4. Float condition occurs when output current is less than I in magnitude.

LO

42

M80C286

A.C. CHARACTERISTICS (Continued)

271103–37

NOTE:

AC Test Loading on Outputs

271103–38

NOTE:

AC Drive and Measurement PointsÐCLK Input

271103–39

NOTE:

AC Setup, Hold and Delay Time MeasurementÐGeneral

43

M80C286

Typical Capacitive Derating Curves

271103–40

Typical CMOS Level Slew Rates for Address/Data Buffers

271103–41

44

M80C286

Typical TTL Level Slew Rates for Address/Data Buffers

271103–42

Typical I vs Frequency for Different Output Loads

CC

271103–43

45

M80C286

A.C. CHARACTERISTICS (Continued)

M82C284 Timing Requirements

M82C284-10

Symbol

Parameter

Unit

Comments

Min

Max

11

12

13

14

19

SRDY/SRDYEN Setup Time

SRDY/SRDYEN Hold Time

ARDY/ARDYEN Setup Time

ARDY/ARDYEN Hold Time

PCLK Delay

17.5

2

ns

0

(Note 1)

30

0

e

35

C

75 pF

5 mA

L

e

I

OL

OH

e b

1 mA

NOTE:

1. These times are given for testing purposes to assure a predetermined action.

M82C288 Timing Requirements

M82C288-10

Symbol

Parameter

Unit

Comments

Min

15

1

Max

12

13

30

CMDLY Setup Time

CMDLY Hold Time

ns

e

Command

Delay

from CLK

Command Inactive

Command Active

5

20

21

C

300 pF max

32 mA max

L

e

ns

I

OL

OH

3

e b

29

16

17

19

22

20

21

23

24

5 mA max

ALE Active Delay

3

16

19

23

20

21

23

19

ns

ALE Inactive Delay

DT/R Read Active Delay

DT/R Read Inactive Delay

DEN Read Active Delay

DEN Read Inactive Delay

DEN Write Active Delay

DEN Write Inactive Delay

e

C

150 pF

16 mA max

L

5

3

e

I

OL

OH

e b

1 mA max

3

46

M80C286

WAVEFORMS

MAJOR CYCLE TIMING

271103–44

NOTE:

1. The modified timing is due to the CMDLY signal being active.

47

M80C286

WAVEFORMS (Continued)

M80C286 ASYNCHRONOUS

INPUT SIGNAL TIMING

M80C286 RESET INPUT TIMING AND

SUBSEQUENT PROCESSOR CYCLE PHASE

271103–46

NOTE:

1. When RESET meets the setup time shown, the next

271103–45

NOTES:

1. PCLK indicates which processor cycle phase will oc-

cur on the next CLK. PCLK may not indicate the cor-

rect phase until the first bus cycle is performed.

CLK will start or repeat w2 of a processor cycle.

2. These inputs are asynchronous. The setup and hold

times shown assure recognition for testing purposes.

EXITING AND ENTERING HOLD

271103–47

NOTES:

1. These signals may not be driven by the M80C286 during the time shown. The worst case in terms of latest float time

is shown.

2. The data bus will be driven as shown if the last cycle before T in the diagram was a write T .

I

C

3. The M80C286 floats its status pins during T . External 20 KX resistors keep these signals high (see Table 16).

H

4. For HOLD request set up to HLDA, refer to Figure 29.

5. BHE and LOCK are driven at this time but will not become valid until T .

S

6. The data bus will remain in 3-state OFF if a read cycle is performed.

48

M80C286

WAVEFORMS (Continued)

M80C286 PEREQ/PEACK TIMING FOR ONE TRANSFER ONLY

NOTES:

271103–48

1. PEACK always goes active during the first bus operation of a processor extension data operand transfer sequence.

The first bus operation will be either a memory read at operand address or I/O read at port address OOFA(H).

2. To prevent a second processor extension data operand transfer, the worst case maximum time (Shown above) is:

c

b

j.

b

c

b

a

3

j

2

12a2

m

.

The actual, configuration dependent, maximum time is:

3

j

12a2

m

max.

min.

max.

min.

c

A is the number of extra T states added to either the first or second bus operation of the processor extension data

A

C

operand transfer sequence.

INITIAL M80C286 PIN STATE DURING RESET

NOTES:

271103–49

1. Setup time for RESET

system CLK period later.

2. Setup and hold times for RESET

may be violated with the consideration that w1 of the processor clock may begin one

u

must be met for proper operation, but RESET

may occur during w1 or w2.

v

3. The data bus is only guaranteed to be in 3-state OFF at the time shown.

49

M80C286

271103–50

Figure 35. M80C286 Instruction Format Examples

M80C286 INSTRUCTION SET

SUMMARY

Instruction Set Summary Notes

Addressing displacements selected by the MOD

field are not shown. If necessary they appear after

the instruction fields shown.

Instruction Timing Notes

The instruction clock counts listed below establish

the maximum execution rate of the M80C286. With

no delays in bus cycles, the actual clock count of an

M80C286 program will average 5% more than the

calculated clock count, due to instruction sequences

which execute faster than they can be fetched from

memory.

Above/below refers to unsigned value

Greater refers to positive signed value

Less refers to less positive (more negative) signed

values

e

0 then from register

if d

1

then to register; if d

e

0 then byte

if w

1

then word instruction; if w

instruction

To calculate elapsed times for instruction se-

quences, multiply the sum of all instruction clock

counts, as listed in the table below, by the processor

clock period. A 10 MHz processor clock has a clock

period of 100 nanoseconds and requires an

M80C286 system clock (CLK input) of 20 MHz.

e

if s

0

1

then 16-bit immediate data form the oper-

and

then an immediate data byte is sign-ex-

tended to form the 16-bit operand

x

z

don’t care

used for string primitives for comparison with

ZF FLAG

Instruction Clock Count Assumptions

1. The instruction has been prefetched, decoded,

and is ready for execution. Control transfer in-

struction clock counts include all time required to

fetch, decode, and prepare the next instruction for

execution.

If two clock counts are given, the smaller refers to a

register operand and the larger refers to a memory

operand

e

*

add one clock if offset calculation requires

summing 3 elements

2. Bus cycles do not require wait states.

3. There are no processor extension data transfer or

local bus HOLD requests.

e

n

number of times repeated

e

m

number of bytes of code in next instruction

4. No exceptions occur during instruction execution.

Level (L)ÐLexical nesting level of the procedure

50

M80C286

The following comments describe possible excep-

tions, side effects, and allowed usage for instruc-

tions in both operating modes of the M80C286.

avoid a not-present exception (11). If the SS reg-

ister is the destination, and a segment not-pres-

ent violation occurs, a stack exception (12) oc-

curs.

11. All segment descriptor accesses in the GDT or

LDT made by this instruction will automatically

assert LOCK to maintain descriptor integrity in

multiprocessor systems.

REAL ADDRESS MODE ONLY

1. This is a protected mode instruction. Attempted

execution in real address mode will result in an

undefined opcode exception (6).

12. JMP, CALL, INT, RET, IRET instructions refer-

ring to another code segment will cause a gener-

al protection exception (13) if any privilege rule is

violated.

2. A segment overrun exception (13) will occur if a

word operand reference at offset FFFF(H) is at-

tempted.

3. This instruction may be executed in real address

mode to initialize the CPU for protected mode.

13. A general protection exception (13) occurs if

i

CPL

0.

4. The IOPL and NT fields will remain 0.

14. A general protection exception (13) occurs if

l

5. Processor extension segment overrun interrupt

(9) will occur if the operand exceeds the seg-

ment limit.

CPL

IOPL.

15. The IF field of the flag word is not updated if CPL

l

CPL

IOPL. The IOPL field is updated only if

e

0.

EITHER MODE

16. Any violation of privilege rules as applied to the

selector operand do not cause a protection ex-

ception; rather, the instruction does not return a

result and the zero flag is cleared.

6. An exception may occur, depending on the value

of the operand.

7. LOCK is automatically asserted regardless of the

presence or absence of the LOCK instruction

prefix.

17. If the starting address of the memory operand

violates a segment limit, or an invalid access is

attempted, a general protection exception (13)

will occur before the ESC instruction is execut-

ed. A stack segment overrun exception (12) will

occur if the stack limit is violated by the oper-

and’s starting address. If a segment limit is vio-

lated during an attempted data transfer then a

processor extension segment overrun exception

(9) occurs.

8. LOCK does not remain active between all oper-

and transfers.

PROTECTED VIRTUAL ADDRESS MODE ONLY

9. A general protection exception (13) will occur if

the memory operand cannot be used due to ei-

ther a segment limit or access rights violation. If

a stack segment limit is violated, a stack seg-

ment overrun exception (12) occurs.

18. The destination of an INT, JMP, CALL, RET or

IRET instruction must be in the defined limit of a

code segment or a general protection exception

(13) will occur.

10. For segment load operations, the CPL, RPL, and

DPL must agree with privilege rules to avoid an

exception. The segment must be present to

51

M80C286

M80C286 INSTRUCTION SET SUMMARY

CLOCK COUNT

COMMENTS

Protected

Real

Address

Mode

FUNCTION

FORMAT

Virtual

Address

Mode

Address

Mode

DATA TRANSFER

e

MOV Move:

Register to Register/Memory

Register/memory to register

Immediate to register/memory

Immediate to register

1 0 0 0 1 0 0 w mod reg r/m

1 0 0 0 1 0 1 w mod reg r/m

1 1 0 0 0 1 1 w mod 0 0 0 r/m

2,3*

2,5*

2,3*

2

2,3*

2,5*

2,3*

2

9

e

1

data

data if w

e

1

1 0 1 1 w reg

1 0 1 0 0 0 0 w

1 0 1 0 0 0 1 w

data

data if w

Memory to accumulator

addr-low

addr-high

5

2

9

Accumulator to memory

3

9

9,10,11

9

Register/memory to segment register

Segment register to register/memory

1 0 0 0 1 1 1 0 mod 0 reg r/m

1 0 0 0 1 1 0 0 mod 0 reg r/m

2,5*

2,3*

17,19*

2,3*

e

PUSH Push:

Memory

1 1 1 1 1 1 1 1 mod 1 1 0 r/m

0 1 0 1 0 reg

5*

3

5*

3

2

9

Register

Segment register

Immediate

0 0 0 reg 1 1 0

3

e

0 1 1 0 1 0 s 0

0 1 1 0 0 0 0 0

data

data if s

0

3

e

PUSHA Push All

17

e

POP Pop:

Memory

1 0 0 0 1 1 1 1 mod 0 0 0 r/m

0 1 0 1 1 reg

5*

5

5*

5

2

9

Register

9

9,10,11

9

Segment register

0 0 0 reg 1 1 1

0 1 1 0 0 0 0 1

(regⁱ01)

5

20

19

e

POPA Pop All

19

e

XCHG Exhcange:

Register/memory with register

Register with accumulator

1 0 0 0 0 1 1 w mod reg

1 0 0 1 0 reg

r/m

3,5*

2,7

7,9

3

e

IN Input from:

Fixed port

1 1 1 0 0 1 0 w

1 1 1 0 1 1 0 w

port

5

14

Variable port

e

OUT Output to:

Fixed port

1 1 1 0 0 1 1 w

1 1 1 0 1 1 1 w

1 1 0 1 0 1 1 1

port

3

14

9

Variable port

e

XLAT Translate byte to AL

5

e

LEA Load EA to register

1 0 0 0 1 1 0 1 mod reg

1 1 0 0 0 1 0 1 mod reg

1 1 0 0 0 1 0 0 mod reg

r/m

3*

7*

3*

21*

(modⁱ11)

(modⁱ1)

2

9,10,11

e

LDS Load pointer to DS

e

LES Load pointer to ES

Shaded areas indicate instructions not available in M8086, 88 microsystems.

52

M80C286

M80C286 INSTRUCTION SET SUMMARY (Continued)

CLOCK COUNT

COMMENTS

Protected

Real

FUNCTION

FORMAT

Virtual

Address

Mode

Address

Mode

Address

Mode

DATA TRANSFER (Continued)

LAHF Load AH with flags

1 0 0 1 1 1 1 1

1 0 0 1 1 1 1 0

1 0 0 1 1 1 0 0

1 0 0 1 1 1 0 1

2

3

5

2

3

5

e

SAHF Store AH into flags

e

PUSHF Push flags

2

9

e

POPF Pop flags

2,4

9,15

ARITHMETIC

e

ADD Add:

Reg/memory with register to either

Immediate to register/memory

Immediate to accumulator

0 0 0 0 0 0 d w mod reg r/m

1 0 0 0 0 0 s w mod 0 0 0 r/m

2,7*

3,7*

3

2,7*

3,7*

3

2

9

e

data

data if s w

01

e

0 0 0 0 0 1 0 w

data

data if w

1

e

ADC Add with carry:

Reg/memory with register to either

Immediate to register/memory

Immediate to accumulator

0 0 0 1 0 0 d w mod reg r/m

1 0 0 0 0 0 s w mod 0 1 0 r/m

2,7*

3,7*

3

2,7*

3,7*

3

2

9

data

data if s w

01

0 0 0 1 0 1 0 w

data

data if w

1

e

INC Increment:

Register/memory

Register

1 1 1 1 1 1 1 w mod 0 0 0 r/m

0 1 0 0 0 reg

2,7*

2

9

2

e

SUB Subtract:

Reg/memory and register to either

Immediate from register/memory

Immediate from accumulator

0 0 1 0 1 0 d w mod reg r/m

1 0 0 0 0 0 s w mod 1 0 1 r/m

2,7*

3,7*

3

2,7*

3,7*

3

2

9

e

data

data if s w

01

e

0 0 1 0 1 1 0 w

data

data if w

1

e

SBB Subtract with borrow:

Reg/memory and register to either

Immediate from register/memory

0 0 0 1 1 0 d w mod reg r/m

1 0 0 0 0 0 s w mod 0 1 1 r/m

2,7*

3,7*

2,7*

3,7*

2

9

e

data if s w 01

data

Immediate from accumulator

0 0 0 1 1 1 0 w

data

data if w

1

3

e

DEC Decrement

Register/memory

Register

1 1 1 1 1 1 1 w mod 0 0 1 r/m

0 1 0 0 1 reg

2,7*

2

9

2

e

CMP Compare

Register/memory with register

Register with register/memory

Immediate with register/memory

Immediate with accumulator

0 0 1 1 1 0 1 w mod reg

0 0 1 1 1 0 0 w mod reg

r/m

2,6*

2,7*

3,6*

3

2,6*

2,7*

3,6*

3

2

9

e

data if s w 01

1 0 0 0 0 0 s w mod 1 1 1 r/m

0 0 1 1 1 1 0 w data

data

e

data if w

1

e

NEG Change sign

1 1 1 1 0 1 1 w mod 0 1 1 r/m

0 0 1 1 0 1 1 1

2

7*

2

9

e

AAA ASCII adjust for add

3

e

DAA Decimal adjust for add

0 0 1 0 0 1 1 1

3

53

M80C286

M80C286 INSTRUCTION SET SUMMARY (Continued)

CLOCK COUNT

Protected

COMMENTS

Protected

Real

Address

Mode

Real

Address

Mode

FUNCTION

FORMAT

Virtual

Address

Mode

Virtual

Address

Mode

ARITHMETIC (Continued)

e

AAS ASCII adjust for subtract

0 0 1 1 1 1 1 1

3

e

DAS Decimal adjust for subtract

0 0 1 0 1 1 1 1

e

MUL Multiply (unsigned):

1 1 1 1 0 1 1 w mod 1 0 0 r/m

Register-Byte

Register-Word

Memory-Byte

Memory-Word

13

21

13

21

16*

24*

16*

24*

2

9

e

IMUL Integer multiply (signed):

1 1 1 1 0 1 1 w mod 1 0 1 r/m

Register-Byte

Register-Word

Memory-Byte

Memory-Word

13

21

13

21

16*

24*

16*

24*

2

9

e

IMUL Integer immediate multiply

e

0

0 1 1 0 1 0 s 1 mod reg

r/m

data

data if s

21,24*

2

9

(signed)

e

DIV Divide (unsigned)

1 1 1 1 0 1 1 w mod 1 1 0 r/m

Register-Byte

Register-Word

Memory-Byte

Memory-Word

14

22

14

22

6

17*

25*

17*

25*

2,6

6,9

e

IDIV Integer divide (signed)

1 1 1 1 0 1 1 w mod 1 1 1 r/m

Register-Byte

Register-Word

Memory-Byte

Memory-Word

17

25

17

25

6

20*

28*

20*

28*

2,6

6,9

e

AAM ASCII adjust for multiply

1 1 0 1 0 1 0 0

1 1 0 1 0 1 0 1

1 0 0 1 1 0 0 0

1 0 0 1 1 0 0 1

0 0 0 0 1 0 1 0

16

14

2

16

14

2

e

AAD ASCII adjust for divide

e

CBW Convert byte to word

e

CWD Convert word to double word

2

LOGIC

Shift/Rotate Instructions:

Register/Memory by 1

Register/Memory by CL

Register/Memory by Count

1 1 0 1 0 0 0 w mod TTT

1 1 0 1 0 0 1 w mod TTT

1 1 0 0 0 0 0 w mod TTT

r/m

2,7*

2

9

a

n,8 n*

a

n,8 n*

5

a

n,8 n*

a

n,8 n*

count

TTT

0 0 0

Instruction

ROL

ROR

RCL

RCR

0 0 1

0 1 0

0 1 1

1 0 0 SHL/SAL

1 0 1

1 1 1

SHR

SAR

Shaded areas indicate instructions not available in M8086, 88 microsystems.

54

M80C286

M80C286 INSTRUCTION SET SUMMARY (Continued)

CLOCK COUNT

Protected

COMMENTS

Protected

Real

Address

Mode

Real

FUNCTION

FORMAT

Virtual

Address

Mode

Virtual

Address

Mode

Address

Mode

ARITHMETIC (Continued)

e

AND And:

Reg/memory and register to either

Immediate to register/memory

Immediate to accumulator

0 0 1 0 0 0 d w mod reg r/m

1 0 0 0 0 0 0 w mod 1 0 0 r/m

2,7*

3,7*

3

2,7*

3,7*

3

2

9

e

data

data if w

1

e

0 0 1 0 0 1 0 w

data

data if w

1

e

TEST And function to flags, no result:

Register/memory and register

1 0 0 0 0 1 0 w mod reg r/m

1 1 1 1 0 1 1 w mod 0 0 0 r/m

2,6*

3,6*

2,6*

3,6*

2

9

Immediate data and register/memory

data

data if w

1

e

Immediate data and accumulator

1 0 1 0 1 0 0 w

data

data if w

1

3

e

OR Or:

Reg/memory and register to either

Immediate to register/memory

Immediate to accumulator

0 0 0 0 1 0 d w mod reg r/m

1 0 0 0 0 0 0 w mod 0 0 1 r/m

2,7*

3,7*

3

2,7*

3,7*

3

2

9

e

data

data if w

1

0 0 0 0 1 1 0 w

data

data if w

1

e

XOR Exclusive or:

Reg/memory and register to either

Immediate to register/memory

Immediate to accumulator

0 0 1 1 0 0 d w mod reg r/m

1 0 0 0 0 0 0 w mod 1 1 0 r/m

2,7*

3,7*

3

2,7*

3,7*

3

2

9

data

data if w

1

0 0 1 1 0 1 0 w

data

data if w

1

e

NOT Invert register/memory

1 1 1 1 0 1 1 w mod 0 1 0 r/m

2,7*

2

9

STRING MANIPULATION:

e

MOVS Move byte/word

1 0 1 0 0 1 0 w

1 0 1 0 0 1 1 w

1 0 1 0 1 1 1 w

1 0 1 0 1 1 0 w

1 0 1 0 1 0 1 w

0 1 1 0 1 1 0 w

0 1 1 0 1 1 1 w

5

8

7

5

3

5

8

7

5

3

5

2

9

e

CMPS Compare byte/word

e

SCAS Scan byte/word

9

e

LODS Load byte/wd to AL/AX

9

e

STOS Stor byte/wd from AL/A

9

e

INS Input byte/wd from DX port

9,14

e

OUTS Output byte/wd to DX port

Repeated by count in CX

e

a

MOV

Move string

1 1 1 1 0 0 1 1

1 1 1 1 0 0 1 z

1 1 1 1 0 0 1 1

1 0 1 0 0 1 0 w

1 0 1 0 0 1 1 w

1 0 1 0 1 1 1 w

1 0 1 0 1 1 0 w

1 0 1 0 1 0 1 w

0 1 1 0 1 1 0 w

0 1 1 0 1 1 1 w

5

4

5

4n

9n

8n

4n

3n

4n

5

4

5

4n

9n

8n

4n

3n

4n

2

9

5

e

CMPS Compare string

2,8

2

8,9

e

SCAS Scan string

8,9

e

LODS Load string

8,9

e

STOS Store string

8,9

e

INS Input string

9,14

e

OUTS Output string

2

Shaded areas indicate instructions not available in M8086, 88 microsystems.

55

M80C286

M80C286 INSTRUCTION SET SUMMARY (Continued)

CLOCK COUNT

Protected

COMMENTS

Protected

Real

Address

Mode

Real

Address

Mode

FUNCTION

FORMAT

Virtual

Address

Mode

Virtual

Address

Mode

CONTROL TRANSFER

e

CALL Call:

a

m

Direct within segment

1 1 1 0 1 0 0 0

disp-low

disp-high

7

m

7

2

18

a

Register/memory

1 1 1 1 1 1 1 1 mod 0 1 0 r/m

7

m, 11 m*

7

m, 11 m*

2,8

8,9,18

indirect within segment

a

Direct intersegment

1 0 0 1 1 0 1 0

segment offset

segment selector

13

m

26

m

2

11,12,18

Protected Mode Only (Direct intersegment):

Via call gate to same privilege level

Via call gate to different privilege level, no parameters

Via call gate to different privilege level, x parameters

Via TSS

a

41

82

m

8,11,12,18

a

86 4x

a

m

a

177

182

Via task gate

(modⁱ11)

16

m

2

8,9,11,12,18

a

29 m*

Indirect intersegment

1 1 1 1 1 1 1 1 mod 0 1 1 r/m

Protected Mode Only (Indirect intersegment):

Via call gate to same privilege level

Via call gate to different privilege level, no parameters

Via call gate to different privilege level, x parameters

Via TSS

a

44 m*

8,9,11,12,18

a

83 m*

a

90 4x m*

a

180 m*

a

185 m*

Via task gate

e

JMP Unconditional jump:

a

Short/long

1 1 1 0 1 0 1 1

1 1 1 0 1 0 0 1

disp-low

7

m

7

m

18

a

7

Direct within segment

Register/memory indirect within segment

Direct intersegment

disp-high

m

a

1 1 1 1 1 1 1 1 mod 1 0 0 r/m

1 1 1 0 1 0 1 0 segment offset

segment selector

7

m, 11 m*

7

m, 11 m*

2

9,18

a

11

m

23

m

11,12,18

Protected Mode Only (Direct intersegment):

Via call gate to same privilege level

Via TSS

a

38

m

8,11,12,18

a

175

180

m

a

Via task gate

(modⁱ11)

2

8,9,11,12,18

a

15 m*

a

26 m*

Indirect intersegment

1 1 1 1 1 1 1 1 mod 1 0 1 r/m

Protected Mode Only (Indirect intersegment):

Via call gate to same privilege level

Via TSS

a

41 m*

8,9,11,12,18

a

178 m*

a

183 m*

Via task gate

e

RET Return from CALL:

a

Within segment

1 1 0 0 0 0 1 1

1 1 0 0 0 0 1 0

1 1 0 0 1 0 1 1

1 1 0 0 1 0 1 0

11

15

m

11

25

m

2

8,9,18

Within seg adding immed to SP

Intersegment

data-low

data-high

8,9,11,12,18

Intersegment adding immediate to SP

Protected Mode Only (RET):

a

To different privilege level

55

m

9,11,12,18

56

M80C286

M80C286 INSTRUCTION SET SUMMARY (Continued)

CLOCK COUNT

Protected

COMMENTS

Protected

Virtual

Real

Address

Mode

Real

Address

Mode

FUNCTION

FORMAT

Virtual

Address

Mode

Address

Mode

CONTROL TRANSFER (Continued)

e

JE/JZ Jump on equal zero

a

0 1 1 1 0 1 0 0

0 1 1 1 1 1 0 0

0 1 1 1 1 1 1 0

0 1 1 1 0 0 1 0

0 1 1 1 0 1 1 0

0 1 1 1 1 0 1 0

0 1 1 1 0 0 0 0

0 1 1 1 1 0 0 0

0 1 1 1 0 1 0 1

0 1 1 1 1 1 0 1

0 1 1 1 1 1 1 1

0 1 1 1 0 0 1 1

0 1 1 1 0 1 1 1

disp

7

m or 3

7

m or 3

18

e

JL/JNGE Jump on less/not greater or equal

e

JLE/JNG Jump on less or equal/not greater

e

JB/JNAE Jump on below/not above or equal

e

JBE/JNA Jump on below or equal/not above

e

JP/JPE Jump on parity/parity even

e

JO Jump on overflow

a

m or 3

e

JS Jump on sign

a

7

e

JNE/JNZ Jump on not equal/not zero

a

e

JNL/JGE Jump on not less/greater or equal

e

JNLE/JG Jump on not less or equal/greater

e

JNB/JAE Jump on not below/above or equal

e

JNBE/JA Jump on not below or equal/above

e

JNP/JPO Jump on not par/par odd

a

0 1 1 1 1 0 1 1

0 1 1 1 0 0 0 1

0 1 1 1 1 0 0 1

1 1 1 0 0 0 1 0

1 1 1 0 0 0 0 1

1 1 1 0 0 0 0 0

1 1 1 0 0 0 1 1

1 1 0 0 1 0 0 0

disp

7

8

m or 3

7

8

m or 3

m or 4

18

e

JNO Jump on not overflow

e

JNS Jump on not sign

a

disp

m or 3

m or 4

e

LOOP Loop CX times

disp

e

LOOPZ/LOOPE Loop while zero/equal

a

disp

e

LOOPNZ/LOOPNE Loop while not zero/equal

disp

e

JCXZ Jump on CX zero

a

m or 4

disp

e

ENTER Enter Procedure

data-low

data-high

L

2,8

8,9

e

l

L

0

1

11

15

11

15

2,8

8,9

a b a b

16 4(L 1) 16 4(L 1)

1

e

LEAVE Leave Procedure

1 1 0 0 1 0 0 1

5

e

INT Interrupt:

a

Type specified

Type 3

1 1 0 0 1 1 0 1

1 1 0 0 1 1 0 0

1 1 0 0 1 1 1 0

type

23

m

2,7,8

2,6,8

e

INTO Interrupt on overflow

a

24 m or 3

(3 if no

interrupt)

Shaded areas indicate instructions not available in M8086, 88 microsystems.

57

M80C286

M80C286 INSTRUCTION SET SUMMARY (Continued)

CLOCK COUNT

Protected

COMMENTS

Protected

Real

Address

Mode

FUNCTION

FORMAT

Virtual

Address

Mode

Virtual

Address

Mode

Address

Mode

CONTROL TRANSFER (Continued)

Protected Mode Only:

a

Via interrupt or trap gate to same privilege level

Via interrupt or trap gate to fit different privilege level

Via Task Gate

40

78

m

7,8,11,12,18

a

167

m

e

IRET Interrupt return

a

1 1 0 0 1 1 1 1

17

m

31

m

2,4

2,6

8,9,11,12,15,18

Protected Mode Only:

a

To different privilege level

55

m

8,9,11,12,15,18

8,9,11,12,18

e

To different task (NT 1)

a

169

m

e

BOUND Detect value out of range

0 1 1 0 0 0 1 0

mod reg r/m

13*

6,8,9,11,12,18

(Use INT clock

count if

exception 5)

PROCESSOR CONTROL

e

CLC Clear carry

1 1 1 1 1 0 0 0

1 1 1 1 0 1 0 1

1 1 1 1 1 0 0 1

1 1 1 1 1 1 0 0

1 1 1 1 1 1 0 1

1 1 1 1 1 0 1 0

1 1 1 1 1 0 1 1

1 1 1 1 0 1 0 0

1 0 0 1 1 0 1 1

1 1 1 1 0 0 0 0

0 0 0 0 1 1 1 1

2

e

CMC Complement carry

2

e

STC Set carry

2

e

CLD Clear direction

2

e

STD Set direction

2

e

CLI Clear interrupt

3

14

13

e

STI Set interrupt

2

e

HLT Halt

2

e

WAIT Wait

3

e

LOCK Bus lock prefix

0

2

0

2

14

13

e

CTS Clear task switched flag

0 0 0 0 0 1 1 0

3

e

ESC Processor Extension Escape

1 1 0 1 1 T T T mod LLL r/m

9–20*

5,8

8,17

(TTT LLL are opcode to processor extension)

e

SEG Segment Override Prefix

001 reg 110

0

PROTECTION CONTROL

e

LGDT Load global descriptor table register

0 0 0 0 1 1 1 1

0 0 0 0 0 0 0 1 mod 0 1 0 r/m

0 0 0 0 0 0 0 1 mod 0 0 0 r/m

0 0 0 0 0 0 0 1 mod 0 1 1 r/m

0 0 0 0 0 0 0 1 mod 0 0 1 r/m

11*

12*

11*

12*

2,3

9,13

9

e

SGDT Store global descriptor table register

e

LIDT Load interrupt descriptor table register

9,13

9

e

SIDT Store interrupt descriptor table register 0 0 0 0 1 1 1 1

e

LLDT Load local descriptor table register

from register memory

0 0 0 0 1 1 1 1

0 0 0 0 0 0 0 0 mod 0 1 0 r/m

0 0 0 0 0 0 0 0 mod 0 0 0 r/m

17,19*

2,3*

1

9,11,13

9

e

SLDT Store local descriptor table register

to register/memory

Shaded areas indicate instructions not available in M8086, 88 microsystems.

58

M80C286

M80C286 INSTRUCTION SET SUMMARY (Continued)

CLOCK COUNT

Protected

COMMENTS

Protected

Real

Address

Mode

Real

FUNCTION

FORMAT

Virtual

Address

Mode

Virtual

Address

Mode

Address

Mode

PROTECTION CONTROL (Continued)

e

LTR Local task register

from register/memory

0 0 0 0 1 1 1 1

0 0 0 0 0 0 0 0

mod 0 1 1 r/m

mod 0 0 1 r/m

17,19*

2,3*

1

9,11,13

9

e

STR Store task register

to register memory

e

LMSW Load machine status word

from register/memory

0 0 0 0 1 1 1 1

0 0 0 0 0 0 0 1

mod 1 1 0 r/m

mod 1 0 0 r/m

3,6*

2,3*

3,6*

2,3*

2,3

9,13

9

e

SMSW Store machine status word

e

LAR Load access rights

from register/memory

0 0 0 0 1 1 1 1

0 0 0 0 0 0 1 0

mod reg

r/m

14,16*

1

9,11,16

e

LSL Load segment limit

from register/memory

0 0 0 0 0 0 1 1

0 1 1 0 0 0 1 1

14,16*

1

2

9,11,16

8,9

e

ARPL Adjust requested privilege level:

mod reg r/m

10*,11*

from register/memory

e

VERR Verify read access: register/memory

0 0 0 0 1 1 1 1

0 0 0 0 0 0 0 0

mod 1 0 0 r/m

mod 1 0 1 r/m

14,16*

1

9,11,16

e

VERR Verify write access:

Shaded areas indicate instructions not available in M8086, 88 microsystems.

59

M80C286

Footnotes

The Effective Address (EA) of the memory operand

is computed according to the mod and r/m fields:

REG is assigned according to the following table:

e

0)

e

16-Bit (w

1)

8-Bit (w

000 AX

001 CX

010 DX

011 BX

100 SP

101 BP

101 SI

111 DI

000 AL

001 CL

010 DL

011 BL

100 AH

101 CH

110 DH

111 BH

e

if mod

11 then r/m is treated as a REG field

e

00 then DISP

0*, disp-low and disp-high

are absent

e

16 bits, disp-high is absent

if mod

01 then DISP

disp-low sign-extended to

e

disp-high: disp-low

if mod

10 then DISP

e

a

if r/m

000 then EA

001 then EA

010 then EA

011 then EA

100 then EA

101 then EA

110 then EA

111 then EA

(BX)

(BP)

(SI)

(DI)

DISP

e

The physical addresses of all operands addressed

by the BP register are computed using the SS seg-

ment register. The physical addresses of the desti-

nation operands of the string primitive operations

(those addressed by the DI register) are computed

using the ES segment, which may not be overridden.

(SI)

(DI)

DISP

(DI)

a

(BP)

(BX)

DISP*

DISP

DISP follows 2nd byte of instruction (before data if

required)

e

110 then EQ disp-high: disp-low.

*except if mod

00 and r/m

SEGMENT OVERRIDE PREFIX

0 0 1 reg 1 1 0

reg is assigned according to the following:

Segment

reg

00

01

10

11

Register

ES

CS

SS

DC

INTEL CORPORATION, 2200 Mission College Blvd., Santa Clara, CA 95052; Tel. (408) 765-8080

INTEL CORPORATION (U.K.) Ltd., Swindon, United Kingdom; Tel. (0793) 696 000

INTEL JAPAN k.k., Ibaraki-ken; Tel. 029747-8511


型号：	QM80C286
厂家：	INTEL
描述：	Microprocessor, 16-Bit, 10MHz, CMOS, CQFP68, CERAMIC, QFP-68 时钟外围集成电路
文件：	总60页 (文件大小：957K)
中文：	中文翻译
下载：	下载PDF数据表文档文件

QM80C286 [INTEL]

相关型号：

QM80DY-3H

QM8B

QMA6351A2-003-3GT50G-50

QMB-032-00ENN-3BA

QMB-032-11C3N-3BA

QMB-052-00ENN-3BA

QMB-052-11C3N-3BA

QMB-072-00ENN-3BA

QMB-072-11C3N-3BA

QMB-102-00ENN-3BA

QMB-102-11C3N-3BA

QMB-122-00ENN-3BA