A few of the special registers (CRn, DRn, TRn) on the Intel386 that are documented as undefined have use. CR1, CR4-CR7, TR0-TR3 all produce an invalid op code exception. DR4 and DR5 are aliases for DR6 and DR7 respectively. DR7 has some undocumented bits that govern ICE behavior. TR4 and TR5 are the most interesting. It appears that these two registers (alias to each other) and point to the next prefetch address. This address is a 32-bit fully decoded address that would appear on the CPU bus during the next prefetch. Using TR4 can help determine the "low-water" point of the prefetch unit. By monitoring the rate of change of TR4, one can determine the granularity size of the prefetch unit. On early '386's (ID=303) this registers changes in 12-byte granularity; ID=305 changes in 8-byte granularity (but appears to have a 16-byte prefetch queue); ID=308 changes in 8-byte granularity (but has a 12-byte prefetch queue).
The Intel486 processor family uses TR4 and TR5. But internally, TR4/5
can still show it's ugly head as the next prefetch address. How can you
do this, if the Intel486 uses TR4/5 for something else? It's not easy.
In fact, it was a bug, which might have been fixed by now. Click here,
to find out more.