Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

66H and 67H override prefixes.

1,481 views
Skip to first unread message

HiSt

unread,
Feb 28, 2009, 7:05:57 PM2/28/09
to
Hello!

Interesting part of Barry B. Brey's "The Intel Microprocessors" Sixth
Edition, that tells how width of addresses and registers is toggled.
This permits the use of 16-bit instructions in 32-bit mode (protected
mode)
but also the use of 32-bits instructions in 16-bit mode (of course,
only 386
and above CPUs).

"The first two bytes of the 32-bit instruction mode format are called
OVERRIDE PREFIXES because they are not always present. The first
modifies
the size of the operand address used by the instruction and the second
modifies the register size. If the 80386 through the Pentium II
operate as
16-bit instruction mode machines (real or protected mode) and a 32-bit
register is used, the REGISTER-SIZE PREFIX (66H) is appended to the
front of
the instruction. If operated in the 32-bit instruction mode (protected
mode
only) and a 32-bit register is used, the register-size prefix is
absent. If
a 16-bit register appears in an instruction in the 32-bit instruction
mode,
the resgister-size prefix is present to select a 16-bit register.


(a) 16-bit instruction mode
_________ ___________ ____________ _________
| Opcode ||MOD-REG-R/M||Displacement||Immediate|
| || || ||0-4 bytes|
|1-2 bytes|| 0-1 bytes || || |
| || || || |
| || || || |
--------- ----------- ------------ ---------


(b) 32-bit instruction mode (80386 through Pentium 4 only)
........ ........ _________ ___________ ......... _________
_________
:Address ::Operand :| Opcode ||MOD-REG-R/M|:Scaled :|Displace-||
Immediate|
:size ::size :| || |:Index :|ment ||0-4
bytes|
:0-1bytes::0-1bytes:|1-2 bytes|| 0-1 bytes |:0-1 bytes:|
|| |
:Prefix :: :| || |: :|
|| |
:67H ::66H :| || |: :|
|| |
'''''''' '''''''' --------- ----------- ''''''''' ---------
---------

FIGURE 4-1 The formats of the 8086-Pentium 4 instructions (a) The 16-
bit
form and (b) the 32-bit form.


---------------
| | | | | | |D|W|
---------------
| |
~~~~~~~~~
OpCode

FIGURE 4-2 Byte 1 of many machine language instructions, showing the
position of the D- and W-bits.


The ADDRESS SIZE-PREFIX (67H) is used in a similar fashion, as
explained later
in this chapter. THE PREFIXES TOGGLE THE SIZE OF THE REGISTER AND
OPERAND
ADDRESS FROM 16-BIT TO 32-BIT OR FROM 32-BIT TO 16-BIT FOR THE
PREFIXED
INSTRUCTION. [...]".


Greetings,
H.Samso (thebitsclub.tripod.com)

Tim Roberts

unread,
Feb 28, 2009, 9:26:28 PM2/28/09
to
HiSt <spam...@crayne.org> wrote:
>
>Interesting part of Barry B. Brey's "The Intel Microprocessors" Sixth
>Edition, that tells how width of addresses and registers is toggled.
>This permits the use of 16-bit instructions in 32-bit mode (protected
>mode) but also the use of 32-bits instructions in 16-bit mode (of course,
>only 386 and above CPUs).

Yes, this is all true, and it has been true since 1985. Did you have a
question about it?
--
Tim Roberts, ti...@probo.com
Providenza & Boekelheide, Inc.

Dirk Wolfgang Glomp

unread,
Mar 1, 2009, 4:39:43 AM3/1/09
to
Am Sat, 28 Feb 2009 16:05:57 -0800 (PST) schrieb HiSt:

> If operated in the 32-bit instruction mode (protected
> mode
> only)

It is also possible to use the 32-bit instruction mode beside the realmode.
I don´t know where this wrong definitation come from, that the 32-bit mode
is only possible in the protectmode. Sure the 32-bit realmode is not very
usefull, because most bios-implementation based on the 16bit-realmode
and 32bit-realmode-application in this field are not present today.

Dirk

Kiuhnm

unread,
Mar 1, 2009, 5:19:25 AM3/1/09
to
HiSt wrote:
> Hello!
>
> Interesting part of Barry B. Brey's "The Intel Microprocessors" Sixth
> Edition, that tells how width of addresses and registers is toggled.
> This permits the use of 16-bit instructions in 32-bit mode (protected
> mode)
> but also the use of 32-bits instructions in 16-bit mode (of course,
> only 386
> and above CPUs).

If you want more information:
http://www.intel.com/products/processor/manuals/index.htm

Kiuhnm

Kiuhnm

unread,
Mar 1, 2009, 7:55:37 AM3/1/09
to
Dirk Wolfgang Glomp wrote:
> Am Sat, 28 Feb 2009 16:05:57 -0800 (PST) schrieb HiSt:
>
>> If operated in the 32-bit instruction mode (protected
>> mode
>> only)
>
> It is also possible to use the 32-bit instruction mode beside the realmode.
> I don´t know where this wrong definitation come from, that the 32-bit mode
> is only possible in the protectmode.

The mode you're referring to is undocumented.
I would never base an important project on undocumented stuff.

Kiuhnm

Dirk Wolfgang Glomp

unread,
Mar 2, 2009, 12:53:15 AM3/2/09
to

OK.

Dirk

HiSt

unread,
Mar 5, 2009, 7:49:25 PM3/5/09
to
Hello!


Conclusion:
without changing to protected mode I can use
all of the memory using the opcodes of
32bits address and registers length proper of the i386.
For example I set segment register DS to 0
and then using one of the newer index registers,
for example, ESI, I have an address built like:

DS:ESI which accesses all of PC's memory.

I have to test this out!


Greetings!
Herman Samso (thebitsclub.tripod.com)

Dirk Wolfgang Glomp

unread,
Mar 6, 2009, 4:28:02 AM3/6/09
to
Am Thu, 5 Mar 2009 16:49:25 -0800 (PST) schrieb HiSt:

> Hello!
>
> Conclusion:
> without changing to protected mode I can use
> all of the memory using the opcodes of
> 32bits address and registers length proper of the i386.

Only in the GDP/LDP we can specify the length of a segment and if we want
to access all the memory up to 4GB, we can enhance the segment-size
(and load the GDT with the "lgdt" instruction + load the segment), but the
CPU must be in the PM for to do that and maybe can switch back in the
unrealmode when this job is done. Now we can enable the #A20-Line for those
access above the first MB+(64kb-1byte).

The 16/32bit instruction mode specify how the cpu handle instructions with
or without adress/operand-size-prefixes.

> For example I set segment register DS to 0
> and then using one of the newer index registers,
> for example, ESI, I have an address built like:
>
> DS:ESI which accesses all of PC's memory.
>
> I have to test this out!

No Problem to use both, a pointer to our datasegment and a pointer to a
high location:

mov esi, 00100000h * 64 ; (we let some space for himem.sys)
xor eax, eax
mov ax, @DATA
shl eax, 4
sub esi, eax

; DS:0 = datasegment
; DS:ESI = high location

Dirk

ArarghMail903NOSPAM

unread,
Mar 6, 2009, 2:02:48 AM3/6/09
to
On Thu, 5 Mar 2009 16:49:25 -0800 (PST), HiSt <spam...@crayne.org>
wrote:

>Hello!
>
>
>Conclusion:
>without changing to protected mode I can use
>all of the memory using the opcodes of
>32bits address and registers length proper of the i386.
>For example I set segment register DS to 0
>and then using one of the newer index registers,
>for example, ESI, I have an address built like:
>
>DS:ESI which accesses all of PC's memory.
>
>I have to test this out!
>

It's not that easy.

Search the web for "UnReal Mode" or "Big Real Mode".
--
ArarghMail903 at [drop the 'http://www.' from ->] http://www.arargh.com
BCET Basic Compiler Page: http://www.arargh.com/basic/index.html

To reply by email, remove the extra stuff from the reply address.

Kiuhnm

unread,
Mar 6, 2009, 8:18:48 AM3/6/09
to
Dirk Wolfgang Glomp wrote:
> Only in the GDP/LDP we can specify the length of a segment and if we want
> to access all the memory up to 4GB, we can enhance the segment-size
> (and load the GDT with the "lgdt" instruction + load the segment), but the
> CPU must be in the PM for to do that [...]

You could use the (undoc.) LOADALL instruction.

> and maybe can switch back in the
> unrealmode when this job is done. Now we can enable the #A20-Line for those
> access above the first MB+(64kb-1byte).
>
> The 16/32bit instruction mode specify how the cpu handle instructions with
> or without adress/operand-size-prefixes.

The main problem is this: will I be able to use EIP instead of IP?
That is, will I be able to put my code in segments larger than 64KB?
I've never tried this myself, but someone told me it's possible. For
this to work, the CPU must honor the D bit in the code segment
descriptor even in real mode.

Kiuhnm

Wolfgang Kern

unread,
Mar 6, 2009, 1:57:09 PM3/6/09
to

Kiuhnm mentioned:

...
> You could use the (undoc.) LOADALL instruction.
...
This well known (olde 286/386) code had been reused for other
instructions with 486/K7/K8/P4/+.. meanwhile.

So LOADALL actually doesn't exist anymore, except in the museum :)

__
wolfgang


Wolfgang Kern

unread,
Mar 6, 2009, 1:51:33 PM3/6/09
to

"HiSt" said:

> Hello!

Hi!

> Conclusion:
> without changing to protected mode I can use
> all of the memory using the opcodes of
> 32bits address and registers length proper of the i386.
> For example I set segment register DS to 0
> and then using one of the newer index registers,
> for example, ESI, I have an address built like:
>
> DS:ESI which accesses all of PC's memory.
>
> I have to test this out!

Yes, but if you do so then you better rewrite all IRQ-
and exception-handlers to fit UNREAL/BIGREAL mode.
But wont work for PM-exceptions anyway, I'm afraid.
__
wolfgang

Rod Pemberton

unread,
Mar 6, 2009, 3:20:18 PM3/6/09
to
"HiSt" <spam...@crayne.org> wrote in message
news:88e30edd-a4aa-44b4...@o11g2000yql.googlegroups.com...

> Conclusion:
> without changing to protected mode I can use
> all of the memory using the opcodes of
> 32bits address and registers length proper of the i386.

The gerneral answer is:

No. You can't access "all of the memory" without switching to protected
mode. The exception is by using an ancient cpu.

But, yes, you can access "all of the memory" without switching to protected
mode, but only by using a 286 or 386 cpu which has the 286 or 386 LOADALL
instruction. You can also use larger operand and register sizes in 16-bit
real mode, by using address and override prefixes (0x66,0x67). But, you
can't access "all of the memory". IIRC, you're restricted to 16-bit real
mode segmented addressing which has a limit of 1Mb+64k or so. If you're
willing to switch to protected mode, you could access "all of memory", by
using "unreal mode" which increases the 16-bit segment sizes (undocumented).
The BIOS also has a function, which uses protected mode, to allow access to
more memory, int 15h, ah=0x87 . *Supposedly*, it's also possible
(undocumentd) to enable a true 32-bit unprotected real mode. However, this
requires switching through protected mode. Use Google Groups Advanced
search to find posts by "Rick Hohensee" on "Forreal". He also has example
code somewhere. I've never found confirmation of whether his claims are
true or false.


Rod Pemberton

Kiuhnm

unread,
Mar 6, 2009, 2:33:15 PM3/6/09
to

You're right. LOADALL is now *emulated* for retro-compatibility reasons.

Kiuhnm

Dirk Wolfgang Glomp

unread,
Mar 7, 2009, 2:59:19 AM3/7/09
to
Am Fri, 06 Mar 2009 14:18:48 +0100 schrieb Kiuhnm:

> Dirk Wolfgang Glomp wrote:
>> Only in the GDP/LDP we can specify the length of a segment and if we want
>> to access all the memory up to 4GB, we can enhance the segment-size
>> (and load the GDT with the "lgdt" instruction + load the segment), but the
>> CPU must be in the PM for to do that [...]
>
> You could use the (undoc.) LOADALL instruction.

I never try it, but you are right.

http://www.rcollins.org/articles/loadall/tspec_a3_doc.html
By manipulating the descriptor cache base registers, you can access the
entire address space without switching to protected mode....
...You can execute LOADALL in real or protected mode,...

>> and maybe can switch back in the
>> unrealmode when this job is done. Now we can enable the #A20-Line for those
>> access above the first MB+(64kb-1byte).
>>
>> The 16/32bit instruction mode specify how the cpu handle instructions with
>> or without adress/operand-size-prefixes.
>
> The main problem is this: will I be able to use EIP instead of IP?
> That is, will I be able to put my code in segments larger than 64KB?
> I've never tried this myself, but someone told me it's possible. For
> this to work, the CPU must honor the D bit in the code segment
> descriptor even in real mode.

Oh.

Dirk

Kiuhnm

unread,
Mar 7, 2009, 4:06:52 AM3/7/09
to
Dirk Wolfgang Glomp wrote:
> I never try it, but you are right.
>
> http://www.rcollins.org/articles/loadall/tspec_a3_doc.html
> By manipulating the descriptor cache base registers, you can access the
> entire address space without switching to protected mode....
> ...You can execute LOADALL in real or protected mode,...

But notice that on 486+ CPUs it's emulated by the BIOS, which will
switch to PMODE and back to RMODE for you.

Kiuhnm

Dirk Wolfgang Glomp

unread,
Mar 8, 2009, 4:17:34 AM3/8/09
to

Thanks for this information.

Dirk

Kiuhnm

unread,
Mar 8, 2009, 5:09:27 AM3/8/09
to

There's a small section about it ("LOADALL Emulation") in the page you
mentioned as well.

Kiuhnm

0 new messages