Test register

A test register, in the Intel 80386 and Intel 80486 processor, was a register used by the processor, usually to do a self-test. Most of these registers were undocumented, and used by specialized software. The test registers were named TR3 to TR7. Regular programs don't usually require these registers to work. With the Pentium, the test registers were replaced by a variety of model-specific registers (MSRs). ^[1]

In the 80386, two test registers, TR6 and TR7, were provided for the purpose of TLB testing. TR6 was the test command register, and TR7 was the test data register. The 80486 provided three additional registers, TR3, TR4 and TR5, for testing of the L1 cache. TR3 was a data register, TR4 was an address register and TR5 was a command register. These registers were accessed by variants of the MOV instruction. A test register may either be the source operand or the destination operand. The MOV instructions are defined in both real-address mode and protected mode. The test registers are privileged resources. In protected mode, the MOV instructions that access them can only be executed at privilege level 0. An attempt to read or write the test registers when executing at any other privilege level causes a general protection exception. Also, those instructions generate invalid opcode exception on most CPUs newer than 80486.

The instruction is encoded in two ways, depending on the flow of data. Moving data from a general purpose register into a test register is encoded as 0F 26 /r (with r/m being the GPR, and reg being the test register). Moving data the other way (i.e. from the test register into a general purpose register) is encoded as 0F 24 /r (with r/m being the GPR, and reg being the test register). ^[2] Only register-register moves are allowed; memory forms of the ModR/M byte are undefined. In other words, the mod field (the two MSBs) must be set to 1.

The test registers and/or associated opcodes were supported in the following x86 processors:

Processors	—			Cache Test Registers			TLB Test Registers
	TR0	TR1	TR2	TR3	TR4	TR5	TR6	TR7
Intel 386 (all models)	No			No	undoc [lower-alpha 1]		Yes
Intel 486 (all models)	No			Yes			Yes
AMD 386 (all models) AMD Élan SC3xx	No			No	?		Yes [4]
AMD 486 (all models) AMD 5x86 AMD Élan SC4xx,SC5xx	No			Yes [5]			Yes
Cyrix [lower-alpha 2] 486 (all models [lower-alpha 3] ) Cyrix 5x86	No			Yes [7]			Yes
Cyrix 6x86	No	undoc [lower-alpha 4]		Yes			Yes (VSPM [lower-alpha 5] )
Cyrix 6x86MX, MII VIA Cyrix III [lower-alpha 6]	No			Yes (scratchpad) [lower-alpha 7]			Yes
Cyrix MediaGX NatSemi Geode GX	No			Yes [13]			Yes
NatSemi Geode GX2 AMD Geode GX, LX	TR0-TR7 registers present as 32-bit read/write data registers without any cache/TLB test functionality. [14]
IDT WinChip (all models)	Registers not present. The MOV TRx opcodes can be enabled with the WinChip's FCR.EMOVTR [15] bit, but will act as NOPs.
Intel Quark X1000	No			Yes [16]			Yes

1. On the Intel 386, the TR4 and TR5 registers have been reported to act as undocumented read-only registers returning a data item related to instruction prefetch. ^[3]
2. Cyrix manufacturing partner CPU models from IBM, TI and ST also all supported the same test registers as their corresponding Cyrix-branded CPU models.
3. SoCs based on the Cyrix-derived ST486 CPU core also supported the same set of test registers as the Cyrix 486 - such SoCs include e.g. STPC Atlas and ZFMicro ZFx86. ^[6]
4. On the Cyrix 6x86, the TR1 and TR2 registers could be enabled by setting bit 6 of Cyrix confguration register 30h. These registers are not documented, but example code using them has been published by Cyrix. ^[8]
5. On the Cyrix 6x86, the TR6 and TR7 registers could be used not only to test the TLB, but also to configure the processor's VSPM (Variable-Size Paging Mechanism). ^[9] The VSPM was a 4-entry ^[10] software TLB with a per-entry mask to support all power-of-2 page sizes from ${\displaystyle 2^{12}}$ to ${\displaystyle 2^{32}}$ bytes. It was present in the Cyrix 6x86 only - it was removed in 6x86MX and later processors.
6. "Joshua" core only. "Samuel" core variants of Cyrix III did not support the TRx test registers.
7. On the 6x86MX, MII, and "Joshua" Cyrix III processors, the TR3-TR5 registers could be used not just to test the L1 cache but to lock individual L1 cache-lines to specific addresses for scratchpad memory use. ^{[11] [12]}

See also

• Control register
• Debug register

References

1. Intel, Pentium® Processor Family Developer’s Manual, order no. 241428-005, 1997, section 16.1.2, page 442 - provides a list of Pentium MSRs that provide the same functionality as the 386/486 TRx registers.
2. Introduction to the 80386 Including the 80386 Data Sheet. Intel. April 1986. p. 122.
3. Robert Collins, Move Special Registers, archived on 5 Jun 1997.
4. AMD, Am386 Microprocessors Data Book, 1992, pages 21 and 151
5. AMD, Am486® Microprocessor Software User’s Manual, rev.1, 1994, section 1.59, p. 82
6. ZFMicro, ZFx86 Data Book 1.0 Rev D, 5 June 2006, page 101
7. Cyrix, Cx486DLC Microprocessor Data Sheet, order no. 94706-01, May 1992, section 2.3.2.6, p.37
8. Cyrix, 6x86 BIOS Writer’s Guide, revision 4.1, 29 July 1996, page 43.
9. Cyrix, 6x86 Processor data book, order no. 94175-01, March 1996, section 2.6.5, p. 74
10. Linux kernel archive, Re: Cyrix 6x86 Patch.., 4 Nov 1996
11. Cyrix, 6x86MX Processor Data Book, order no. 94329-00, 15 July 1997, section 2.13.1.1, page 87
12. VIA-Cyrix Corp., Cyrix III Processor Data Book, v1.0, 25 January 2000, section 2.9.1.1, page 86
13. Cyrix, MediaGX Processor Data Book, rev 2.0, 29 October 1998, section 3.3.2.4, p.59
14. AMD, Geode™ LX Processors Data Book, publication ID: 33234H, February 2009, section 8.3.4.3, p.648
15. IDT, WinChip C6 Processor Data Sheet, section A.2, p.79
16. Intel, Quark SOC X1000 Core Developer's Manual, order no. 329679-001, October 2013, appendix B, page 296