80286检测代码如何工作？

; ... stack setup omitted ...
pushfw

; ==========================================
; === CHECK #1 =============================
; ==========================================
; Sets FLAGS to 0x0 and then immediately reads it back. On an 8086/80186, bits
; 12-15 always come back set. On a 80286+ this is not the case.
; 8086/80186 behavior: jump to check 3.
; 80286+ behavior: fall through to check 2.
xor ax,ax      ; AX=0x0
push ax
popfw          ; pop 0x0 into FLAGS
pushfw
pop ax         ; pop FLAGS into AX

and ax,0xf000  ; bits 12-13: IOPL, always 1 on 86/186
cmp ax,0xf000  ; bit 14: NT, always 1 on 86/186
               ; bit 15: Reserved, always 1 on 86/186, always 0 on 286+
jz check3

; ==========================================
; === CHECK #2 =============================
; ==========================================
; Only runs if CPU is plausibly an 80286. Last check before returning.
; Sets DL=0x6 if IOPL and NT flag bits are all clear.
; Sets DL=0x7 if any bits in IOPL/NT flags are set.
mov dl,0x6     ; DL is the proc's return val
mov ax,0x7000
push ax
popfw          ; pop 0x7000 into FLAGS
pushfw
pop ax         ; pop FLAGS into AX

and ax,0x7000  ; bits 12-13: IOPL
               ; bit 14: NT
jz done
inc dl         ; DL=0x7 if any bit was set
jmp done
nop

; ==========================================
; === CHECK #3 =============================
; ==========================================
; Only runs if CPU seems to be an 8086/80186.
; Sets DL=0x4 and moves on to...
;   check 4 if 0xff >> 21 == 0
;   check 5 otherwise (how can this happen?)
check3:
mov dl,0x4     ; DL is the proc's return val
mov al,0xff
mov cl,0x21
shr al,cl      ; AL = 0xff >> 0x21
jnz check5     ; when does this happen?

; ==========================================
; === CHECK #4 =============================
; ==========================================
; At this point, DF is still 0. ES doesn't
; point to anything sensible.
; Sets DL=0x2 if the loop completes.
; Sets DL=0x0 if the loop does not complete.
; Moves onto check 5 unconditionally.
mov dl,0x2     ; DL is the proc's return val
sti            ; are interrupts important?
push si
mov si,0x0
mov cx,0xffff
rep lods [BYTE PTR es:si] ; read 64K, ES[SI]->AL, all junk?
pop si
or cx,cx       ; test if loop reached 0
jz check5
mov dl,0x0     ; didn't hit 0. interrupted?

; ==========================================
; === CHECK #5 =============================
; ==========================================
; Leaving memory addresses here because they seem important.
; Here, DL is either 0x0 or 0x2 from check 4, or 0x4 from check 3. Looks like,
; contingent on the INC instruction getting overwritten, DL either stays at
; 0x0/0x2/0x4, or becomes 0x1/0x3/0x5.
check5:
00000B74  push cs
00000B75  pop es        ; Set ES to CS. (why not mov es,cs? illegal?)
00000B76  std           ; DF=1, rep decrements CX
00000B77  mov di,0xb88
00000B7A  mov al,0xfb   ; is this just an STI opcode?
00000B7C  mov cx,0x3
00000B7F  cli           ; are interrupts undesired?
00000B80  rep stosb     ; write 3 bytes, AL->ES[DI]
00000B82  cld           ; DF=0, why does it matter now?
00000B83  nop
00000B84  nop
00000B85  nop
00000B86  inc dx        ; destination when CX=1. overwritten?
00000B87  nop           ; destination when CX=2
00000B88  sti           ; destination when CX=3

done:
popfw
xor dh,dh      ; only keep low bits
mov ax,dx      ; return through AX
; ... stack teardown omitted ...
retf

; Return values:
; AX == 0x0: 8086, normal right-shift, loop aborted, overwrites
; AX == 0x1: 8086, normal right-shift, loop aborted, did not overwrite
; AX == 0x2: 8086, normal right-shift, loop finished, overwrites
; AX == 0x3: 8086, normal right-shift, loop finished, did not overwrite
; AX == 0x4: 8086, weird right-shift, overwrites
; AX == 0x5: 8086, weird right-shift, did not overwrite
; AX == 0x6: 286, with clear IOPL/NT flags
; AX == 0x7: 286, with set IOPL/NT flags

; Is It an 80286?
; Determines whether processor is a 286 or higher. Going into subroutine ax = 2
; If the processor is a 386 or higher, ax will be 3 before returning. The
; method is to set ax to 7000h which represent the 386/486 NT and IOPL bits
; This value is pushed onto the stack and popped into the flags (with popf).
; The flags are then pushed back onto the stack (with pushf). Only a 386 or 486
; will keep the 7000h bits set. If it's a 286, those bits aren't defined and
; when the flags are pushed onto stack these bits will be 0. Now, when ax is
; popped these bits can be checked. If they're set, we have a 386 or 486.
IsItA286    proc
        pushf               ; Preserve the flags
        mov ax,7000h        ; Set the NT and IOPL flag
                            ; bits only available for
                            ; 386 processors and above
        push    ax          ; push ax so we can pop 7000h
                            ; into the flag register
        popf                ; pop 7000h off of the stack
        pushf               ; push the flags back on
        pop ax              ; get the pushed flags
                            ; into ax
        and ah,70h          ; see if the NT and IOPL
                            ; flags are still set
        mov ax,2            ; set ax to the 286 value
        jz  YesItIsA286     ; If NT and IOPL not set
                            ; it's a 286
        inc ax              ; ax now is 4 to indicate
                            ; 386 or higher
YesItIsA286:
        popf                ; Restore the flags

        ret                 ; Return to caller
IsItA286    endp

mov dl, 0x4     ; DL is the proc's return val
mov al, 0xff    ; al contains 0xff
mov cl, 0x21    ; According to the above explanation from Intel,
                ; this value in cl is in an 80186/188 converted to 1, by ANDing with 0x1F.
shr al, cl      ; 80186/188 => al = 0x7F
                ; other: al = 0
jnz check5      ; goto check5 if you have an 80186/188

; The CMOS 8088/6 had the bug with rep lods repaired.
cmos:   push si
    sti
    mov cx, #$FFFF
rep
    lodsb
    pop si
    or cx,cx
    jne test8
    mov bx,#2   ; Intel 80C88