Intel x86 Memory. Architecture. The x86 isn't all that complex it just doesn't make a lot of sense. Program Segments. x86 Data and Address Ranges

Size: px

Start display at page:

Download "Intel x86 Memory. Architecture. The x86 isn't all that complex it just doesn't make a lot of sense. Program Segments. x86 Data and Address Ranges"

Barbra Hutchinson
6 years ago
Views:

1 1 2 Intel x86 Memory The x86 isn't all that complex it just doesn't make a lot of sense. Architecture Mike Johnson, Leader of 80x86 Design at AMD, Microprocessor Report (1994) 3 4 Program Segments x86 Data and Ranges Data and BSS sections Constants Initialized and uninitialized variables Tables, arrays, strings Structures Text section Procedures / functions / control blocks Data access Load operations to register Store operations register to Peripheral I/O operations Calculation Arithmetic operations Logic operations Stack section LIFO buffer accessible by PUSH / POP operations Data bits Unsigned Integer Signed Integer bits Memory x86 DOS 16 0 to 64K 32K to 32K to FFFFF 1 MB K = 2 10 = 1024 M = 2 20 = G = 2 30 = data physical address Windows/Linux 0 to 4G 2G to +2G to FFFFFFFF 4 GB 32 32

2 5 6 Logical CPU x86 Segment x86 access to physical CPU accesses external device Access by physical address 20 bits (8086) or 32 bits (IA-32) Programs do not see physical address Software address = logical address = SEG:OFF SEG Segment selector in CPU segment register Maps to Base Pointer to start of segment in memory OFF Offset formed by pointer arithmetic Pointer to in segment = Base + Offset x86 data address Offset Base x86 segments are sections of physical memory No one-to-one connection with program segments Six defined memory pointers (name ~ Data Segment) CS (name ~ Code Segment) SS (name ~ Stack Segment) ES (name ~ Extra Segment) FS, GS in IA-32 only Six segment registers GS selector GS FS selector FS ES selector ES SS selector SS CS selector CS selector 15 0 GS FS ES SS CS 7 8 Typical Segment Register Usage Mapping Segment 8086 segment mapping SEG = 16-bit segment SELECTOR in segment register SEG 10h = 20-bit physical base address = ES = CS = SS DOS *.com program One 64 KB segment SS CS ES DOS *.exe program Four defined segments Segment 64 KB = ES = CS = SS = FS = GS Linux software One 4 GB segment OS allocates memory to programs 16 bits SEG = segment selector segment register 4 bits 0 const IA-32 segment mapping SEG = 16-bit segment SELECTOR in segment register Selector is index to descriptor table Descriptor is table entry holding 32-bit or 64-bit physical base address Segment size selector Segment type physical base address Segment access rights descriptor descriptor descriptor descriptor descriptor descriptor

3 Segments 8086 Segment Four segment registers Extra Stack Code Data bits SEG = segment selector segment register ES SS CS 4 bits 0 const ES 10h SS 10h CS 10h 10h 20-bit segment base addresses 16-bit segment registers 4000 ES 3000 SS 2000 CS bit physical base address Extra Stack Code Data extra stack code data bit segment base addresses Offset IA-32 Offset Offset 16-bit number Combination of registers and immediate values Offset {0000, 0001, 0002,, FFFF} 2 16 possible offset values Maximum segment = 2 16 s = 64 KB Byte FFFF Offset 32-bit number Combination of registers and immediate values Offset { ,, FFFFFFFF} 2 32 possible offset values Maximum segment = 2 32 s = 4 GB Byte FFFFFFFF = physical base address + offset = physical base address + offset Logical = 1234:0005 Segment selector = 1234 base address = = = Offset Base Logical = 1234: Segment selector = 1234 descriptor table base address = = = Offset Base

4 13 14 Logical to Many to One Mapping 8086 PA = Logical address PA = SEG 10h + OFF SEG = PA / 10h = / 10h = 1234 OFF = PA % 10h = % 10h = 0005 Equivalent logical addresses for PA = :0005 = :0015 = :0025 = Offset Base SEG:OFF (SEG n):(off + 10h n) for integer 0 < n SEG and OFF + 10h n < 10000h PA (SEG n) 10h + (OFF + 10h n) = SEG 10h + OFF = PA Program Segments versus Memory Segments Segment Segment = any section, part, portion, subdivision Segment specific, 1-to-1 technical meaning Program segments (sections) Sections of assembly source code or executable program Data segment Space allocated for storing program data Text (code) segment Space allocated for program instructions Stack segment Space allocated for user stack operations x86 memory segments, CS, SS, ES, FS, GS Pointers to sections of physical memory () No one-to-one connection to program segments DOS Program Updates to Segments 8086 ing s for Data Programs can write to segment registers 256 KB = 4 64 KB of data = 40000h s Data occupies physical addresses to 4FFFF To access all data, program must update : 1000 Access 10000, 10001,, 1FFFF 2000 Access 20000, 20001,, 2FFFF 3000 Access 30000, 30001,, 3FFFF 4000 Access 40000, 40001,, 4FFFF Program Data Section ES SS CS Automatic Stack Automatic Register AX DX REGS[AX] REGS[DX] Immediate AX 1000 h REGS[AX] #1000 h Register Indirect AX [BX] REGS[AX] MEM[*10 + REGS[BX]] Absolute (Direct) AX [1000] REGS[AX] MEM[* ] Indexed (SI or DI) AX [SI + 6] REGS[AX] MEM[*10 + REGS[SI] + 6] Based (BX or BP) AX [BX + 6] REGS[AX] MEM[*10 + REGS[BX] + 6] Based and Indexed AX [BX + SI] REGS[AX] MEM[*10 + REGS[BX] + REGS[SI]] Based and Indexed AX [BX + SI + 6] with Displacement REGS[AX] MEM[*10 + REGS[BX] + REGS[SI] + 6]

5 Register ing 8086 Immediate ing ing Register ADD BX,AX REGS[BX] REGS[BX] + REGS[AX] Used for operands that the ALU is using now ing Immediate ADD BX,3 REGS[BX] REGS[BX] + 3 Used for constant operands C Absolute ing 8086 Absolute ing ing Direct Or Absolute ADD AL,[1001] REGS[AL] REGS[AL] + MEM[* ] Used for storing general data in main memory ing Direct Or Absolute ADD DI,[1001] REGS[DI] REGS[DI] + MEM[* ] Used for storing general data in main memory A D () FF E () FF E

6 Indexed ing 8086 Based ing ing Register Deferred ADD BX,[DI] REGS[BX] REGS[BX] + MEM[*10 + REGS[DI]] A pointer to data is kept in the register ing Register Deferred ADD BX,[BP] REGS[BX] REGS[BX] + MEM[SS*10 + REGS[BP]] A pointer to data is kept in the register FF 00FF () FF E 1002 A () FF BP forces access to SS Index with Displacement ing ing Displacement ADD BX,[DI+2] REGS[BX] REGS[BX] + MEM[*10 + REGS[DI] + 2] A constant offset is added to the pointer ing Indexed 8086 Based and Indexed ing ADD BL,[DI+BP] REGS[BL] REGS[BL]+ MEM[SS*10 + REGS[DI] + REGS[BP]] A stored offset or table index is added to the pointer EE () FF E 1002 A () BP forces access to SS

7 Effective for Data Access Effective (EA) OFFSET part of logical address for memory read/write Formed from immediate and register values SEG OFF 16-bit Displacement BX BX + Displacement SS BP BP + Displacement SI SI + Displacement DI DI + Displacement BX + SI BX + SI + Displacement BX + DI BX + DI + Displacement SS BP + SI BP + SI + Displacement SS BP + DI BP + DI + Displacement Summary of 8086 Types es for General Data Access Effective BP SI (EA) BX + DI + Displacement Default = 10h + Effective EA includes BP physical address = SS 10h + EA can override or SS to CS, ES, SS Automatic es (determined by operation) Memory Access Logical Fetch CS:IP CS 10h+IP Stack Operation SS:SP SS 10h+SP Destination ES:DI ES 10h+DI Source :SI 10h+SI Segmentation : Fetch Fetch -- Logical = CS:IP CS = Code Segment Base = h IP = 0057 Logical = CS:IP = 1000: Segmentation : MOV AX,[BX] MOV -- Effective = BX Logical = :BX = 2100:0123 Limit = 1FFFF h Code Byte Limit = 30FFF h Data Byte Offset = 0057 Code Segment Offset = 0123 Data Segment Byte = h Code Segment = h Byte = h Data Segment = h

8 Segmentation : MOV AX,[BX+SI+7] 8086 Segmentation : MOV AX,[BP+SI+2] MOV -- Effective = BX+SI+7 Logical = :BX+SI+7 = 2100: = 2100:112A MOV with BP -- SS Effective = BP+SI+2 Logical = SS:BP+SI+2 = 4100: = 4100:1242 Limit = 30FFF h Limit = 50FFF h Data Byte Stack Byte Offset = 112A Data Segment Offset = 1242 Stack Segment Byte = 2212A h Data Segment = h Byte = h Stack Segment = h Implementation Typical 8086 Implementation General Pointer and Segment AH BH CH DH IP CS SS ES BP SP SI DI OFF SEG AL BL CL DL BASE INDEX DISP Unit (PAU) AX BX CX DX PA = 10 SEG + BASE + INDEX + DISP System Bus PA Bus Control (MAR) ALU ALU_IN ALU Queue ALU_OUT Status Word Data Bus Control (MDR) Data Decoder and Control 20 bits 16 bits Control Decoder Execution Unit (EU) Bus Interface Unit (BIU) Fetch SEG CS ; OFF IP ; MAR PA IP IP + instruction length READ Queue MDR Decoder Queue : ADD AL, [BX+SI+1234] SEG ; OFF(BASE) BX OFF(INDEX) SI OFF(DISP) 1234 MAR PA READ ALU_IN MDR ALU AL ADD AL ALU_OUT

9 33 34 MOV in Stack Operations MOV MOV MOV MOV MOV dest, src dest src AX, [1234] REGS[AX] MEM[ * ] REGS[AL] MEM[* ] 8-bits REGS[AH] MEM[* ] 8-bits AL, [1234] REGS[AL] MEM[* ] 8-bits AX, [BX] REGS[AX] MEM[*10 + REGS[BX] ] AX, [BX+SI] REGS[AX] MEM[*10 + REGS[BX] + REGS[SI] ] PUSH src SP SP - 2 [ ] POP dest SS:SP src [ ] dest SS:SP SP SP + 2 MOV AX, [BX+ SI+12] REGS[AX] MEM[*10 + REGS[BX] + REGS[SI] + 12] Segment Override 8086 s 1 CS: MOV [BP],CX [CS:BP] CX ES: MOV [BP],CX [ES:BP] CX : MOV [BP],CX [:BP] CX SS: MOV [SI],CX [SS:SI] CX STOSB STOSW LOB LOW Store [ES:DI] AL DI DI+1 (default) Byte (DI DI-1 if flag DF = 1) [ES:DI] AL Store [ES:DI+1] AH Word DI DI+2 (default) (DI DI-2 if flag DF = 1) Load AL [:SI] SI SI+1 (default) Byte (SI SI-1 if flag DF = 1) Load Word AL [:SI] AH [:SI+1] SI SI+2 (default) (SI SI-2 if flag DF = 1) es defined by instruction

10 s s 3 MOVSB MOVSW SCASB Move Byte Move Word Scan Byte [ES:DI] [:SI] DI DI+1 (default) SI SI+1 (DI DI-1 if DF = 1) (SI SI-1 if DF = 1) [ES:DI] [:SI] [ES:DI+1] [:SI+1] DI DI+2 (default) SI SI+2 (DI DI-2 if DF = 1) (SI SI-2 if DF = 1) AL-[ES:DI]; update flags DI DI+1 (default) (DI DI-1 if DF = 1) SCASW CMPSB CMPSW Scan Word Compare Byte Compare Word AX-[ES:DI+l.DI]; Update flags DI DI+2 (default) (DI DI-2 if DF = 1) [:SI]-[ES:DI]; Update flags DI DI+1 (default) SI SI+1 (DI DI-1 if DF = 1) (SI SI-1 if DF = 1) [:SI+1.SI]-[ES:DI+1.DI]; Update flags DI DI+2 (default) SI SI+2 (DI DI-2 if DF = 1) (SI SI-2 if DF = 1) s 4 REP STOSB REP STOSW REP MOVSB REP MOVSW STOSB CX CX - 1 Repeat until CX = 0 STOSW CX CX - 1 Repeat until CX = 0 MOVSB CX CX - 1 Repeat until CX = 0 MOVSW CX CX - 1 Repeat until CX = 0 Working with s PUSH ES ; SP SP 2 ; [SS:SP] ES PUSH ; SP SP 2 ; [SS:SP] POP ES ; ES ; SP SP + 2 MOV SI,0000 ; SI 0 MOV DI,1000 ; DI 1000 MOV CX,200 ; CX 200 REP MOVSB ; COPY 200 H BYTES FROM ; :0000 :01FF TO ; :1000 :11FF

11 41 42 Branch s Jump Distance Fall-through following branch in program listing Next instruction if branch not taken CS:IP points to fall-through Target Next instruction if branch taken CS:IP points to target Displacement Displacement = target IP fall-through IP Displacement > 0 is forward jump Displacement < 0 is backward jump branch fall through target branch taken Displacement target IP fall-through IP branch fall through short target Short Jump Target in same code segment near target Displacement is = 80 displacement 7F = Near Jump far target Target in same code segment Displacement is word (2 s) -32,768 = 8000 displacement 7FFF = 32,767 Far Jump Target in different code segment Pointer is double word (4 s) Displacement not relevant short jump near jump far jump Jump JMP target JMP near target (assembler chooses near or short) JMP FAR JMP target JMP far target JMP 1024 IP JMP NEAR [1024] IP 16 [1024] JMP NEAR [SI] IP 16 [:SI] JMP FAR 1122:3344 CS IP JMP FAR [1024] JMP FAR [SI] CS 16 [1026] IP 16 [1024] CS 16 [:SI+2] IP 16 [:SI] CALL near target PUSH IP IP target RET CALL 1024 CALL [SI] PUSH IP IP 1024 Call and Return PUSH IP IP [:SI] POP IP CALL far target PUSH CS PUSH IP CS SEG IP OFF CALL 1122:3344 PUSH CS PUSH IP CS 1122 IP 3344 CALL [SI] RETF PUSH CS PUSH IP CS [:SI+2] IP [:SI] POP IP POP CS

12 45 46 Indirect Far Call Interrupt Vector Table SP stack SP IP = 2211 CS = 4433 stack fall-through CS fall-through IP Transfers control to Interrupt Service Routine (ISR) ISR can be stored anywhere in memory Interrupt Vector Table Table Starts at physical address Vector = 4 s = CS (2 s) + IP (2 s) Vector 0 at physical address Vector 1 at physical address Vector 2 at physical address IP CS SI fall-through CALL [SI] SI fall-through CALL [SI] ISR vector address For interrupt N N N N N CS (h) CS (L) IP (H) IP (L) Software Interrupt s Interrupt INT type INT 21H PUSH flags IF 0 TF 0 PUSH CS PUSH IP CS [00087H.00086H] IP [00085H.00084H] IRET none IRET POP IP POP CS POP flags SP stack SP IP = 2211 CS = 4433 stack flags fall-through CS fall-through IP IP CS fall-through INT fall-through INT

13 49 50 Processor Control s LEA STC CF I Set carry flag CLC CF 0 Clear carry flag CMC CF not(cf) Complement carry flag STD DF 1 Set direction flag CLD DF 0 Clear direction flag STI IF I Set interrupt flag CLI IF 0 Clear interrupt flag HLT None CPU stops requires reset WAIT None Enter wait state NOP None No operation Load Effective Similar to MOV Copies address (pointer) of memory location Does not access memory LEA dest, [EA] dest EA LEA BX, [x] BX &(x) LEA AX, [1234] AX 1234 LEA DX, [BX +DI] DX LEA CX, [SI+12] CX SI+12 BX + DI Moving Data Around L and LES MOV SI,1122 ; SI 1122 Loads 32-bit logical address of type :EA MOV [0000],SI ; [:0000] 1122 MOV BX,3344 ; BX 3344 MOV [BX],SI ; [:3344] 1122 L dest, [EA] dest [EA] [EA + 2] MOV [BX+SI],BX ; [:4466] 3344 LEA BX,[BX+SI] ; BX 4466 MOV CS,[BX] ; CS [:4466] MOV AX,[BX+2] ; AX [:4468] L BX, [SI] BX [:SI] [:SI+ 2] LES dest, [EA] dest [EA] ES [EA + 2] :SI AA 3344 BX 5566

14 53 54 Switching Data Tables Data Movement I/O Operations 1 /* DO ARITHMETIC WITH :BX = 1111:2222 */ /* SWITCH DATA TABLES */ MOV [SI], 4444 ; [SI] 4444 MOV [SI+2], 3333 ; [SI+2] 3333 PUSH ; SP SP 2 ; [SS:SP] 1111 PUSH BX ; SP SP 2 ; [SS:SP] 2222 L BX,[SI] ; BX 4444 ; 3333 /* DO ARITHMETIC WITH :BX = 3333:4444 */ /* SWITCH BACK TO FIRST DATA TABLE */ POP [SI] ; [SI] 2222 ; SP SP + 2 POP [SI+2] ; [SI+2] 1111 ; SP SP + 2 L BX,[SI] ; BX 2222 ; x86 processors control an I/O signal on the memory bus I/O signal is off to select processor access to I/O signal is on to select processor access to I/O bus MOV selects access IN and OUT select I/O access AL or AX are always src/dest for I/O instructions I/O address is called a port can range from 0000 H to FFFF H direct mode 1 immediate address indirect mode 2 address s in DX Data Movement I/O Operations 2 Data Movement I/O s 3 אפיק זיכרון Memory Bus זיכרון מטמון cache memory זיכרון ר א שי יהידת ה חישוב המ ר כזי Central Processing Unit (CPU) () I/O Bus מת אם א פי ק Bus Adapter א פי ק קלט/פ לט IN AL,26H IN AX,26H IN acc, port IN AL,DX IN AX,DX OUT port, acc OUT DX,AX AL port 26H AL port 26H; AH port 27H AL port DX AL port DX AH port DX+1 port DX AL port DX+1 AH input from port input from port 0 65,535 (address in DX) output to port 0 65,535 (address in DX) בקר קלט/פ לט I/O Controller בקר קלט/פ לט I/O Controller בקר קלט/פ לט I/O Controller רשת תקש ורת communications network ממשק Disk משתמש

INSTRUCTOR: ABDULMUTTALIB A. H. ALDOURI

INSTRUCTOR: ABDULMUTTALIB A. H. ALDOURI Note: PUSHF / POPF have no operands The figure below shows that if (SS) = 3000H, (SP) = 0042H, so the execution of POP CX loads CX by the word 4050H form the stack segment. The SP is incremented by 2.