486 FPU Bug

[CPUShack]

So I did a quick write up on the introduction of the 486:
http://www.cpushack.com/2016/08/25/intel-i486-prototype-intels-gamble-with-cisc/

The original 486s had a pair of bugs in the FPU (B4 stepping) that was fixed in the B5 stepping (think this translates to the SX249-SX250 sspec)

Any one have further info on the stepping (or stepping as it relates to CPUID)

[bccwchan]

I don't know why I have great interests on Intel 486 cpus(Now I have 272). Intel made the wide range of different 486 cpu (SX, DX, DX2, overdrive).

It make us (all collectors) crazy to chase all spec for 486 series. We all know that it's almost impossbile to collect all spec. However, we're still chasing this impossible dream.

[rjluna2]

What makes it harder to to keep track of the same model, but different release year version with different design.

[debs3759]

486 A stepping can be detected by the presence of CMPXCHG instruction (0F A6 /r or 0F A7 /r)
There are various FPU (and integer) bugs in 486 processors, but I have no idea which steppings they affect. If you find out, please let me know as I have started rewriting and updating my CPUID code. I can send you my cpuid.txt file with all the info I have if it helps.

[frag_]

There is well known stepping list:
http://datasheets.chipdb.org/Intel/x86/486/Intel486.htm

Some revision specific bugs/quirks:

BSF r0, r/m1
This opcode finds the lowest set bit in the r/m1
and put it's number in the first r0.
But if r/m1 is zero then early 486's
will load garbage in r0, but later ones will not change r0.
Not a bug but quirk - this case is officially undefined.

CMPXCHG, as debs said.
Two opcodes (0fa6, 0fa7) reused early 386 discarded instructions XBTS and IBTS.
Some old software didn't like it and CMPXCHG opcodes
starting with B stepping were remapped to 0fb0, 0fb1.

INSD
Early 486s may hang if recieving buffer is unaligned to 4.

INVD (and WBINVD)
On some 486 has no effect if executed while filling a line of cache.

JMP short
Only A to C0 steppings affected.
Very unlikely to happen bug, things goes wrong if this jump causes GP Violation while recieving NMI on the sme clock.

MOV
Only A to C0 steppings affected.
MOV TR5, r32
Can hang cpu if r32 bits 0 and 1 are not both zeroes.

Also disabling cache by writing required value to CR0 can change cache data.
(Surprisingly it's a bug, even disabled cahce must hold unchanged data!)

There is also this TR related bug:
http://www.rcollins.org/secrets/TR4Bug.html

FDIV - B4 stepping (and earlier?) as mentioned by John.

FPATAN
Some 486 affected.
Rare combination of commands before (?) FPATAN and data corrupts FPU stack.

FSCALE
Some 486s are not set Invalid Operation exception when they should.

FSINCOS - like FPATAN

There was also FPU bug when FERR# and IGNNE# signal was not handleld properly by FPU on some 486s.

Also SL-enchanted 486SX with A stepping (?!) can hang under certain conditions while running Advanced Power Management mode.

Unfortunately most of it can hardly be used due to all this "can", "in some condidtions".
But at least BSF looks worth testing.