LOADALL is the common name for two differentundocumented machine instructions ofIntel 80286 andIntel 80386 processors, which allow access to areas of the internal processor state that are normally outside of theIA-32API scope, likedescriptor cache registers. The LOADALL for 286 processors is encoded 0Fh 05h,^[1] while the LOADALL for 386 processors is 0Fh 07h.^[2]

Both variants – as the name implies – load all CPU internal registers in one operation. LOADALL had the unique ability to set up the visible part of the segment registers (selector) independently of their corresponding cached part, allowing the programmer to bring the CPU into states not otherwise allowed by the official programming model.

As an example of the usefulness of these techniques, LOADALL can set up the CPU to allow access to all memory fromreal mode, without having to switch it intounreal mode (which requires switching intoprotected mode, accessing memory and finally switching back to real mode). Programs such as the pre-XMS versions ofRAMDRIVE.SYS (1985),^[3][1][4]SMARTDRV.SYS (1986)^[4] as well asHIMEM.SYS (2.03, 1988-08-04; 2.04, 1988-08-17)^[4] drivers inMS-DOS,Uniform Software Systems'The Extender (1985) andThe Connector (1985) forLotus 1-2-3,Above Disk (1986)^[5] (aLIMulator by Above Software (formerlyTele-Ware West akaLos Angeles Securities Group) that convertedhard disk space orextended memory intoexpanded memory), andOS/2 1.0^[3][1] and1.1^[6] used the 286 LOADALL instruction. DOS 3.3 and 4.0 reserved a 102-byte buffer at 0070:0100h (which was normally occupied byDOS BIOS data) so that there was no need to save & restore it for LOADALL. Microsoft'sEMM386.EXE special-cases both the 286 and 386 LOADALL instructions in itsinvalid opcode handler.^[7] Examination of the virtual-machine monitor code inWindows/386 2.10 shows that it uses both the 286^{[citation needed]} and the even less known 386 variant^{[citation needed]}. Microsoft's HIMEM.SYS version 2.06^[8] also used LOADALL to quickly copy to and from extended memory on 286 systems.

Another interesting usage of LOADALL, laid out in the bookThe Design of OS/2,^[9] would have been to allow running former real-mode programs in 16-bit protected mode, as utilized byDigital Research'sConcurrent DOS 286 since 1985,^[10][11][12] as well asFlexOS 286^[13] andIBM 4680 OS^[14][15] since 1986. Marking all the descriptor caches in theGDT andLDTs "not present" would allow the operating system totrap segment-register reloads, as well as attempts at performing real-mode–specific "segment arithmetic" and emulate the desired behavior by updating the segment descriptors (LOADALL again). This "8086 emulation mode" for the 80286 was, however, too slow to be practical. The idea had to be mostly discarded due to errata in some early Intel 80286 processors before the E-2stepping.^[10][11][13] As a result, OS/2 1.x – and Windows in "standard" mode as well – had to run DOS programs in real mode. Nevertheless, the idea was not lost; it led Intel to introduce thevirtual 8086 mode of the 80386, allowing the implementation of "DOS boxes" at last in a relatively efficient and documented way.

Because LOADALL did not perform any checks on the validity of the data loaded into processor registers, it was possible to load a processor state that could not be normally entered, such as usingreal mode (PE=0) together with paging (PG=1) on 386-class CPUs.^[2]

Anin-circuit emulator (ICE) is a tool used for low-level debugging. On Intel 80386, asserting the undocumented pin at location B6 causes the microprocessor to halt execution and enter ICE mode. The microprocessor saves its entire state to an area of memory isolated from normal system memory. The layout of this area is suitable for the LOADALL instruction, and this instruction is used by ICE code to return to normal execution.

In later processors, this evolved intoSystem Management Mode (SMM). In SMM, the RSM instruction is used to load a full CPU state from a memory area. The layout of this memory area is similar to one used by the LOADALL instruction.^[16] 386-style LOADALL instruction can be executed on 486 too, but only in SMM mode. In later processors, the RSM instruction, with a different encoding, took its role.

Microsoft'sCodeview 3.0 and Borland'sTurbo Debugger 2.0 correctly decode 286 and 386 LOADALL instructions.^[1]

As the two LOADALL instructions were never documented and do not exist on later processors, the opcodes were reused in theAMD64 architecture.^[17] The opcode for the 286 LOADALL instruction, 0F05, became the AMD64 instruction SYSCALL; the 386 LOADALL instruction, 0F07, became the SYSRET instruction. These definitions were implemented even on Intel CPUs with the introduction of theIntel 64 implementation of AMD64.^[18]

Opcode 0F05. The instruction reads data from addresses 0x00800–0x00866, whatever the content of the segment registers.

The 80286 LOADALL instruction can not be used to switch from protected back to real mode^[19] (it can't clear the PE bit in the MSW). However, use of the LOADALL instruction can avoid the need to switch to protected mode altogether.

Opcode 0F07. The instruction loads data from address ES:EDI. It actually uses ES, not the ES descriptor.

• Concurrent DOS 286
• FlexOS 286
• IBM 4680 OS

• IBM Operating System/2 Technical Reference – Programming Family(PDF). Vol. 1 (1st ed.).IBM. September 1987 [1986].Archived(PDF) from the original on 2017-01-03.
• Chappell, Geoff (January 1994). Schulman, Andrew; Pedersen, Amorette (eds.).DOS Internals. The Andrew Schulman Programming Series (1st printing, 1st ed.).Addison Wesley Publishing Company. pp. 4, 21,100–106,127–129.ISBN 978-0-201-60835-9. (xxvi+738+iv pages, 3.5"-floppy[9][10]) Errata:[11][12][13]
• Chappell, Geoff (2008-10-03) [1997-03-18]."Strange Things LINK Knows about 80x86 Processors".Archived from the original on 2019-04-21. Retrieved2019-04-21.
• Necasek, Michal (2014-12-13)."Curious Instructions".OS/2 Museum.Archived from the original on 2019-04-21. Retrieved2019-04-21.
• Stiller, Andreas (1990). "Bitter für 32-Bitter".c't - magazin für computertechnik (in German). Vol. 1990, no. 8. p. 202.
• Juffa, Norbert; Siering, Peter (1990). "Wege über die Mauer. Loadall - Extended Memory im Real Mode des 80286".c't - magazin für computertechnik (in German). Vol. 1990, no. 11. pp. 362–366.

• X86 instructions

• All articles with dead external links
• Articles with dead external links from August 2024
• Articles with permanently dead external links
• Articles with short description
• Short description is different from Wikidata
• Use dmy dates from May 2019
• Use list-defined references from December 2021
• All articles with unsourced statements
• Articles with unsourced statements from February 2016
• CS1 German-language sources (de)