1 2 Intel x86 Memory The x86 isn't all that complex it just doesn't make a lot of sense. Architecture Mike Johnson, Leader of 80x86 Design at AMD, Microprocessor Report (1994) 3 4 Program Segments x86 Data and Ranges Data and BSS sections Constants Initialized and uninitialized variables Tables, arrays, strings Structures Text section Procedures / functions / control blocks Data access Load operations to register Store operations register to Peripheral I/O operations Calculation Arithmetic operations Logic operations Stack section LIFO buffer accessible by PUSH / POP operations Data bits Unsigned Integer Signed Integer bits Memory x86 DOS 16 0 to 64K 32K to 32K 1 20 00000 to FFFFF 1 MB K = 2 10 = 1024 M = 2 20 = 1024 2 G = 2 30 = 1024 3 data physical address Windows/Linux 0 to 4G 2G to +2G - 1 00000000 to FFFFFFFF 4 GB 32 32
5 6 Logical CPU x86 Segment x86 access to physical CPU accesses external device Access by physical address 20 bits (8086) or 32 bits (IA-32) Programs do not see physical address Software address = logical address = SEG:OFF SEG Segment selector in CPU segment register Maps to Base Pointer to start of segment in memory OFF Offset formed by pointer arithmetic Pointer to in segment = Base + Offset x86 data address Offset Base x86 segments are sections of physical memory No one-to-one connection with program segments Six defined memory pointers (name ~ Data Segment) CS (name ~ Code Segment) SS (name ~ Stack Segment) ES (name ~ Extra Segment) FS, GS in IA-32 only Six segment registers GS selector GS FS selector FS ES selector ES SS selector SS CS selector CS selector 15 0 GS FS ES SS CS 7 8 Typical Segment Register Usage Mapping Segment 8086 segment mapping SEG = 16-bit segment SELECTOR in segment register SEG 10h = 20-bit physical base address = ES = CS = SS DOS *.com program One 64 KB segment SS CS ES DOS *.exe program Four defined segments Segment 64 KB = ES = CS = SS = FS = GS Linux software One 4 GB segment OS allocates memory to programs 16 bits SEG = segment selector segment register 4 bits 0 const IA-32 segment mapping SEG = 16-bit segment SELECTOR in segment register Selector is index to descriptor table Descriptor is table entry holding 32-bit or 64-bit physical base address Segment size selector Segment type physical base address Segment access rights descriptor descriptor descriptor descriptor descriptor descriptor
9 10 8086 Segments 8086 Segment Four segment registers Extra Stack Code Data 15 0 16 bits SEG = segment selector segment register ES SS CS 4 bits 0 const ES 10h SS 10h CS 10h 10h 20-bit segment base addresses 16-bit segment registers 4000 ES 3000 SS 2000 CS 1000 15 0 20-bit physical base address 40000 Extra 30000 Stack 20000 Code 10000 Data extra stack code data 40000 30000 20000 10000 20-bit segment base addresses 11 12 8086 Offset IA-32 Offset Offset 16-bit number Combination of registers and immediate values Offset {0000, 0001, 0002,, FFFF} 2 16 possible offset values Maximum segment = 2 16 s = 64 KB Byte FFFF 0002 0001 0000 Offset 32-bit number Combination of registers and immediate values Offset {00000000,, FFFFFFFF} 2 32 possible offset values Maximum segment = 2 32 s = 4 GB Byte FFFFFFFF 00000002 00000001 00000000 = physical base address + offset = physical base address + offset Logical = 1234:0005 Segment selector = 1234 base address = 12340 = 12340 + 0005 = 12345 Offset Base Logical = 1234:11223344 Segment selector = 1234 descriptor table base address = 00000000 = 0 + 11223344 = 11223344 Offset Base
13 14 Logical to Many to One Mapping 8086 PA = 12345 Logical address PA = SEG 10h + OFF SEG = PA / 10h = 12345 / 10h = 1234 OFF = PA % 10h = 12345 % 10h = 0005 Equivalent logical addresses for PA = 12345 1234:0005 = 12340 + 0005 1233:0015 = 12330 + 0015 1232:0025 = 12320 + 0025... Offset Base SEG:OFF (SEG n):(off + 10h n) for integer 0 < n SEG and OFF + 10h n < 10000h PA (SEG n) 10h + (OFF + 10h n) = SEG 10h + OFF = PA Program Segments versus Memory Segments Segment Segment = any section, part, portion, subdivision Segment specific, 1-to-1 technical meaning Program segments (sections) Sections of assembly source code or executable program Data segment Space allocated for storing program data Text (code) segment Space allocated for program instructions Stack segment Space allocated for user stack operations x86 memory segments, CS, SS, ES, FS, GS Pointers to sections of physical memory () No one-to-one connection to program segments 15 16 DOS Program Updates to Segments 8086 ing s for Data Programs can write to segment registers 256 KB = 4 64 KB of data = 40000h s Data occupies physical addresses 10000 to 4FFFF To access all data, program must update : 1000 Access 10000, 10001,, 1FFFF 2000 Access 20000, 20001,, 2FFFF 3000 Access 30000, 30001,, 3FFFF 4000 Access 40000, 40001,, 4FFFF Program Data Section ES SS CS 40000 30000 20000 10000 Automatic Stack Automatic Register AX DX REGS[AX] REGS[DX] Immediate AX 1000 h REGS[AX] #1000 h Register Indirect AX [BX] REGS[AX] MEM[*10 + REGS[BX]] Absolute (Direct) AX [1000] REGS[AX] MEM[*10 + 1000] Indexed (SI or DI) AX [SI + 6] REGS[AX] MEM[*10 + REGS[SI] + 6] Based (BX or BP) AX [BX + 6] REGS[AX] MEM[*10 + REGS[BX] + 6] Based and Indexed AX [BX + SI] REGS[AX] MEM[*10 + REGS[BX] + REGS[SI]] Based and Indexed AX [BX + SI + 6] with Displacement REGS[AX] MEM[*10 + REGS[BX] + REGS[SI] + 6]
17 18 8086 Register ing 8086 Immediate ing ing Register ADD BX,AX REGS[BX] REGS[BX] + REGS[AX] Used for operands that the ALU is using now ing Immediate ADD BX,3 REGS[BX] REGS[BX] + 3 Used for constant operands 0096 0096 0031 00C7 0003 0099 19 20 8086 Absolute ing 8086 Absolute ing ing Direct Or Absolute ADD AL,[1001] REGS[AL] REGS[AL] + MEM[*10 + 1001] Used for storing general data in main memory ing Direct Or Absolute ADD DI,[1001] REGS[DI] REGS[DI] + MEM[*10 + 1001] Used for storing general data in main memory 31 1004 29 5A 1029 202D () 1007 00 1006 58 1005 00 1004 FF 1003 9E 1002 10 1001 29 1000 45 () 1007 00 1006 58 1005 00 1004 FF 1003 9E 1002 10 1001 29 1000 45
21 22 8086 Indexed ing 8086 Based ing ing Register Deferred ADD BX,[DI] REGS[BX] REGS[BX] + MEM[*10 + REGS[DI]] A pointer to data is kept in the register ing Register Deferred ADD BX,[BP] REGS[BX] REGS[BX] + MEM[SS*10 + REGS[BP]] A pointer to data is kept in the register 0096 0096 0195 0195 00FF 00FF () 1007 00 1006 58 1005 00 1004 FF 1003 9E 1002 A8 1001 29 1000 45 () 0007 12 0006 63 0005 24 0004 00 0003 FF 0002 23 0001 35 0000 34 BP forces access to SS 23 24 8086 Index with Displacement ing ing Displacement ADD BX,[DI+2] REGS[BX] REGS[BX] + MEM[*10 + REGS[DI] + 2] A constant offset is added to the pointer ing Indexed 8086 Based and Indexed ing ADD BL,[DI+BP] REGS[BL] REGS[BL]+ MEM[SS*10 + REGS[DI] + REGS[BP]] A stored offset or table index is added to the pointer 0096 + 96 00EE 96 0058 00 () +2 1007 00 1006 58 1005 00 1004 FF 1003 9E 1002 A8 1001 29 1000 45 () 1007 00 1006 23 1005 45 1004 34 1003 91 1002 38 1001 24 1000 35 BP forces access to SS
25 26 8086 Effective for Data Access Effective (EA) OFFSET part of logical address for memory read/write Formed from immediate and register values SEG OFF 16-bit Displacement BX BX + Displacement SS BP BP + Displacement SI SI + Displacement DI DI + Displacement BX + SI BX + SI + Displacement BX + DI BX + DI + Displacement SS BP + SI BP + SI + Displacement SS BP + DI BP + DI + Displacement Summary of 8086 Types es for General Data Access Effective BP SI (EA) BX + DI + Displacement Default = 10h + Effective EA includes BP physical address = SS 10h + EA can override or SS to CS, ES, SS Automatic es (determined by operation) Memory Access Logical Fetch CS:IP CS 10h+IP Stack Operation SS:SP SS 10h+SP Destination ES:DI ES 10h+DI Source :SI 10h+SI 27 8086 Segmentation : Fetch Fetch -- Logical = CS:IP CS = 1000 -- Code Segment Base = 10000 h IP = 0057 Logical = CS:IP = 1000:0057 28 8086 Segmentation : MOV AX,[BX] MOV -- Effective = BX Logical = :BX = 2100:0123 Limit = 1FFFF h Code Byte Limit = 30FFF h Data Byte Offset = 0057 Code Segment Offset = 0123 Data Segment Byte = 10057 h Code Segment = 10000 h Byte = 21123 h Data Segment = 21000 h
29 30 8086 Segmentation : MOV AX,[BX+SI+7] 8086 Segmentation : MOV AX,[BP+SI+2] MOV -- Effective = BX+SI+7 Logical = :BX+SI+7 = 2100:0123 + 1000 + 7 = 2100:112A MOV with BP -- SS Effective = BP+SI+2 Logical = SS:BP+SI+2 = 4100:0240 + 1000 + 2 = 4100:1242 Limit = 30FFF h Limit = 50FFF h Data Byte Stack Byte Offset = 112A Data Segment Offset = 1242 Stack Segment Byte = 2212A h Data Segment = 21000 h Byte = 42242 h Stack Segment = 41000 h 31 32 80186 Implementation Typical 8086 Implementation General Pointer and Segment AH BH CH DH IP CS SS ES BP SP SI DI OFF SEG AL BL CL DL BASE INDEX DISP Unit (PAU) AX BX CX DX PA = 10 SEG + BASE + INDEX + DISP System Bus PA Bus Control (MAR) ALU ALU_IN ALU 1 2 3 4 5 6 Queue ALU_OUT Status Word Data Bus Control (MDR) Data Decoder and Control 20 bits 16 bits Control Decoder Execution Unit (EU) Bus Interface Unit (BIU) Fetch SEG CS ; OFF IP ; MAR PA IP IP + instruction length READ Queue MDR Decoder Queue : ADD AL, [BX+SI+1234] SEG ; OFF(BASE) BX OFF(INDEX) SI OFF(DISP) 1234 MAR PA READ ALU_IN MDR ALU AL ADD AL ALU_OUT
33 34 MOV in 8086 8086 Stack Operations MOV MOV MOV MOV MOV dest, src dest src AX, [1234] REGS[AX] MEM[ * 10 + 1234] REGS[AL] MEM[*10 + 1234] 8-bits REGS[AH] MEM[*10 + 1235] 8-bits AL, [1234] REGS[AL] MEM[*10 + 1234] 8-bits AX, [BX] REGS[AX] MEM[*10 + REGS[BX] ] AX, [BX+SI] REGS[AX] MEM[*10 + REGS[BX] + REGS[SI] ] PUSH src SP SP - 2 [ ] POP dest SS:SP src [ ] dest SS:SP SP SP + 2 MOV AX, [BX+ SI+12] REGS[AX] MEM[*10 + REGS[BX] + REGS[SI] + 12] 35 36 8086 Segment Override 8086 s 1 CS: MOV [BP],CX [CS:BP] CX ES: MOV [BP],CX [ES:BP] CX : MOV [BP],CX [:BP] CX SS: MOV [SI],CX [SS:SI] CX STOSB STOSW LOB LOW Store [ES:DI] AL DI DI+1 (default) Byte (DI DI-1 if flag DF = 1) [ES:DI] AL Store [ES:DI+1] AH Word DI DI+2 (default) (DI DI-2 if flag DF = 1) Load AL [:SI] SI SI+1 (default) Byte (SI SI-1 if flag DF = 1) Load Word AL [:SI] AH [:SI+1] SI SI+2 (default) (SI SI-2 if flag DF = 1) es defined by instruction
37 38 8086 s 2 8086 s 3 MOVSB MOVSW SCASB Move Byte Move Word Scan Byte [ES:DI] [:SI] DI DI+1 (default) SI SI+1 (DI DI-1 if DF = 1) (SI SI-1 if DF = 1) [ES:DI] [:SI] [ES:DI+1] [:SI+1] DI DI+2 (default) SI SI+2 (DI DI-2 if DF = 1) (SI SI-2 if DF = 1) AL-[ES:DI]; update flags DI DI+1 (default) (DI DI-1 if DF = 1) SCASW CMPSB CMPSW Scan Word Compare Byte Compare Word AX-[ES:DI+l.DI]; Update flags DI DI+2 (default) (DI DI-2 if DF = 1) [:SI]-[ES:DI]; Update flags DI DI+1 (default) SI SI+1 (DI DI-1 if DF = 1) (SI SI-1 if DF = 1) [:SI+1.SI]-[ES:DI+1.DI]; Update flags DI DI+2 (default) SI SI+2 (DI DI-2 if DF = 1) (SI SI-2 if DF = 1) 39 40 8086 s 4 REP STOSB REP STOSW REP MOVSB REP MOVSW STOSB CX CX - 1 Repeat until CX = 0 STOSW CX CX - 1 Repeat until CX = 0 MOVSB CX CX - 1 Repeat until CX = 0 MOVSW CX CX - 1 Repeat until CX = 0 Working with s PUSH ES ; SP SP 2 ; [SS:SP] ES PUSH ; SP SP 2 ; [SS:SP] POP ES ; ES ; SP SP + 2 MOV SI,0000 ; SI 0 MOV DI,1000 ; DI 1000 MOV CX,200 ; CX 200 REP MOVSB ; COPY 200 H BYTES FROM ; :0000 :01FF TO ; :1000 :11FF
41 42 Branch s Jump Distance Fall-through following branch in program listing Next instruction if branch not taken CS:IP points to fall-through Target Next instruction if branch taken CS:IP points to target Displacement Displacement = target IP fall-through IP Displacement > 0 is forward jump Displacement < 0 is backward jump branch fall through target branch taken Displacement target IP fall-through IP branch fall through short target Short Jump Target in same code segment near target Displacement is -12810 = 80 displacement 7F = 12710 Near Jump far target Target in same code segment Displacement is word (2 s) -32,768 = 8000 displacement 7FFF = 32,767 Far Jump Target in different code segment Pointer is double word (4 s) Displacement not relevant 10 10 short jump near jump far jump 43 44 Jump JMP target JMP near target (assembler chooses near or short) JMP FAR JMP target JMP far target JMP 1024 IP 16 1024 JMP NEAR [1024] IP 16 [1024] JMP NEAR [SI] IP 16 [:SI] JMP FAR 1122:3344 CS 16 1122 IP 16 3344 JMP FAR [1024] JMP FAR [SI] CS 16 [1026] IP 16 [1024] CS 16 [:SI+2] IP 16 [:SI] CALL near target PUSH IP IP target RET CALL 1024 CALL [SI] PUSH IP IP 1024 Call and Return PUSH IP IP [:SI] POP IP CALL far target PUSH CS PUSH IP CS SEG IP OFF CALL 1122:3344 PUSH CS PUSH IP CS 1122 IP 3344 CALL [SI] RETF PUSH CS PUSH IP CS [:SI+2] IP [:SI] POP IP POP CS
45 46 Indirect Far Call Interrupt Vector Table SP stack SP IP = 2211 CS = 4433 stack fall-through CS fall-through IP Transfers control to Interrupt Service Routine (ISR) ISR can be stored anywhere in memory Interrupt Vector Table Table Starts at physical address 00000 Vector = 4 s = CS (2 s) + IP (2 s) Vector 0 at physical address 00000 Vector 1 at physical address 00004 Vector 2 at physical address 00008 IP CS SI fall-through CALL [SI] 44 33 22 11 SI fall-through CALL [SI] 44 33 22 11 ISR vector address For interrupt N N 4 + 3 N 4 + 2 N 4 + 1 N 4 + 0 CS (h) CS (L) IP (H) IP (L) 47 48 Software Interrupt s Interrupt INT type INT 21H PUSH flags IF 0 TF 0 PUSH CS PUSH IP CS [00087H.00086H] IP [00085H.00084H] IRET none IRET POP IP POP CS POP flags SP stack SP IP = 2211 CS = 4433 stack flags fall-through CS fall-through IP IP CS 00084 00000 fall-through INT 21 44 33 22 11 00084 00000 fall-through INT 21 44 33 22 11
49 50 Processor Control s LEA STC CF I Set carry flag CLC CF 0 Clear carry flag CMC CF not(cf) Complement carry flag STD DF 1 Set direction flag CLD DF 0 Clear direction flag STI IF I Set interrupt flag CLI IF 0 Clear interrupt flag HLT None CPU stops requires reset WAIT None Enter wait state NOP None No operation Load Effective Similar to MOV Copies address (pointer) of memory location Does not access memory LEA dest, [EA] dest EA LEA BX, [x] BX &(x) LEA AX, [1234] AX 1234 LEA DX, [BX +DI] DX LEA CX, [SI+12] CX SI+12 BX + DI 51 52 Moving Data Around L and LES MOV SI,1122 ; SI 1122 Loads 32-bit logical address of type :EA MOV [0000],SI ; [:0000] 1122 MOV BX,3344 ; BX 3344 MOV [BX],SI ; [:3344] 1122 L dest, [EA] dest [EA] [EA + 2] MOV [BX+SI],BX ; [:4466] 3344 LEA BX,[BX+SI] ; BX 4466 MOV CS,[BX] ; CS [:4466] MOV AX,[BX+2] ; AX [:4468] L BX, [SI] BX [:SI] [:SI+ 2] LES dest, [EA] dest [EA] ES [EA + 2] 11 22 33 44 55 :SI 66 77 88 99 AA 3344 BX 5566
53 54 Switching Data Tables Data Movement I/O Operations 1 /* DO ARITHMETIC WITH :BX = 1111:2222 */ /* SWITCH DATA TABLES */ MOV [SI], 4444 ; [SI] 4444 MOV [SI+2], 3333 ; [SI+2] 3333 PUSH ; SP SP 2 ; [SS:SP] 1111 PUSH BX ; SP SP 2 ; [SS:SP] 2222 L BX,[SI] ; BX 4444 ; 3333 /* DO ARITHMETIC WITH :BX = 3333:4444 */ /* SWITCH BACK TO FIRST DATA TABLE */ POP [SI] ; [SI] 2222 ; SP SP + 2 POP [SI+2] ; [SI+2] 1111 ; SP SP + 2 L BX,[SI] ; BX 2222 ; 1111 80x86 processors control an I/O signal on the memory bus I/O signal is off to select processor access to I/O signal is on to select processor access to I/O bus MOV selects access IN and OUT select I/O access AL or AX are always src/dest for I/O instructions I/O address is called a port can range from 0000 H to FFFF H direct mode 1 immediate address indirect mode 2 address s in DX 55 56 Data Movement I/O Operations 2 Data Movement I/O s 3 אפיק זיכרון Memory Bus זיכרון מטמון cache memory זיכרון ר א שי יהידת ה חישוב המ ר כזי Central Processing Unit (CPU) () I/O Bus מת אם א פי ק Bus Adapter א פי ק קלט/פ לט IN AL,26H IN AX,26H IN acc, port IN AL,DX IN AX,DX OUT port, acc OUT DX,AX AL port 26H AL port 26H; AH port 27H AL port DX AL port DX AH port DX+1 port DX AL port DX+1 AH input from port 0 255 input from port 0 65,535 (address in DX) output to port 0 65,535 (address in DX) בקר קלט/פ לט I/O Controller בקר קלט/פ לט I/O Controller בקר קלט/פ לט I/O Controller רשת תקש ורת communications network ממשק Disk משתמש