MicroprocessorsMicroprocessors

The ia32 User Instruction SetThe ia32 User Instruction Set

Jan 31st, 2002Jan 31st, 2002

User Instruction SetUser Instruction Set

This is the instructions that can be This is the instructions that can be used by applications programsused by applications programs

Operating in protection ring 3Operating in protection ring 3The most restricted instruction setThe most restricted instruction set

AddressingAddressing

Addresses are specified by aAddresses are specified by aSegment number, where the segment Segment number, where the segment

dictates the starting address and length dictates the starting address and length of the segment.of the segment.

A 32-bit offset within the segmentA 32-bit offset within the segment In user mode, a program cannot In user mode, a program cannot

change what segments are allocated change what segments are allocated or accessibleor accessible

Segments can be marked read-only, Segments can be marked read-only, or execute-onlyor execute-only

Addressing, continuedAddressing, continued

Usually, an program operates with Usually, an program operates with DS and SS set to a standard data DS and SS set to a standard data segment and CS set to a standard segment and CS set to a standard code segmentcode segment

Segment registers are never Segment registers are never modified or explicitly referencedmodified or explicitly referenced

All addressing then behaves like a All addressing then behaves like a simple 32-bit linear address, where simple 32-bit linear address, where code addresses and data addresses code addresses and data addresses are separate (cannot modify code)are separate (cannot modify code)

Addressing, continuedAddressing, continued

Addresses (offsets) are 32-bits and fit Addresses (offsets) are 32-bits and fit in a 32-bit register, segments are in a 32-bit register, segments are ignored, so we can think of these ignored, so we can think of these offsets as simply addresses.offsets as simply addresses.

In remainder of these slides we will In remainder of these slides we will use that conventionuse that convention

More on segmentation when we talk More on segmentation when we talk about the system level instruction about the system level instruction setset

Basic model of instructionsBasic model of instructions

Instructions tyipcally operateInstructions tyipcally operateRegister to registerRegister to registerRegister to memoryRegister to memoryMemory to registerMemory to registerBut not memory to memoryBut not memory to memoryThere are some memory/memory There are some memory/memory

instrucsinstrucs

The MOV instructionThe MOV instruction

Moves dataMoves dataFrom register to registerFrom register to registerFrom register to memoryFrom register to memoryFrom memory to registerFrom memory to register

It thus encompasses load and storeIt thus encompasses load and storeThe memory address if given allows The memory address if given allows

the full set of addressing modesthe full set of addressing modes

Addressing modesAddressing modes

Direct memory (32-bit address in Direct memory (32-bit address in instruction)instruction)

Simple indexingSimple indexing Indexing + offset (8 or 32 bits)Indexing + offset (8 or 32 bits) Double indexingDouble indexing Double indexing + offset (8 or 32 bits)Double indexing + offset (8 or 32 bits) Double indexing with scalingDouble indexing with scaling Double indexing with scaling and offsetDouble indexing with scaling and offset Scaling multiplies one index reg by 2,4,8Scaling multiplies one index reg by 2,4,8

The ADD instructionThe ADD instruction

ADD can operateADD can operatereg1 := reg1 + reg2reg1 := reg1 + reg2mem := mem + reg2mem := mem + reg2reg1 := reg1 + memreg1 := reg1 + mem

Full range of addressing modes if memFull range of addressing modes if memSame instruction for signed/unsignedSame instruction for signed/unsigned

Sets flags as a resultSets flags as a resultCan be used on any of the 8 registersCan be used on any of the 8 registers

Flag RegistersFlag Registers

CF, set if carry out from MSBCF, set if carry out from MSBZF, set if result is zeroZF, set if result is zeroOF, set if signed overflowOF, set if signed overflow

Carry in to sign /= Carry out of signCarry in to sign /= Carry out of signSF, set if result sign flag is 1SF, set if result sign flag is 1Other special purpose flagsOther special purpose flags

Other arithmetic and logicOther arithmetic and logic

SUB – subtract, like ADDSUB – subtract, like ADD ADC/SBB – input the CF at low orderADC/SBB – input the CF at low order

Used for multiple precisionUsed for multiple precision OR, AND, XOROR, AND, XOR CMP (like SUB but no result set)CMP (like SUB but no result set)

Just flagsJust flags TEST (like AND, but on result set)TEST (like AND, but on result set)

Just flagsJust flags

The flags after a CMPThe flags after a CMP

CMP is basically subtractCMP is basically subtractCF set if opnd2 > opnd1 unsignedCF set if opnd2 > opnd1 unsignedZF set if operands equalZF set if operands equalOF set if subtraction caused overflowOF set if subtraction caused overflowSF set if result sign bit is setSF set if result sign bit is setCombinations of these flags provide Combinations of these flags provide

testing of the entire range of signed testing of the entire range of signed and unsigned comparison resultsand unsigned comparison results

An example of test after CMPAn example of test after CMP

Consider comparison of two signed Consider comparison of two signed valuesvalues

If the subtraction does not overflow, If the subtraction does not overflow, then the result is negative if opnd2 > then the result is negative if opnd2 > opnd1opnd1

But if the result overflow, the sign is But if the result overflow, the sign is wrongwrong

Therefore condition for opnd2>opnd1 isTherefore condition for opnd2>opnd1 isSF xor OFSF xor OF

Full set of shiftsFull set of shifts

Logical (shift in zero bits)Logical (shift in zero bits)Arithmetic (shift in sign bits)Arithmetic (shift in sign bits)Double shift (uses EAX/EDX)Double shift (uses EAX/EDX)Operand can be 1, or value in ECXOperand can be 1, or value in ECXCan shift register or memoryCan shift register or memory

8-Bit operands8-Bit operands

All arithmetic and logical operations All arithmetic and logical operations can operate on the 8-bit registers can operate on the 8-bit registers AL,BL,CL,DL,AH,BH,CH,DHAL,BL,CL,DL,AH,BH,CH,DH

This is mostly for back compatibility but This is mostly for back compatibility but can be useful, e.g. for 8-bit arithmetic can be useful, e.g. for 8-bit arithmetic with carry/overflow detectionwith carry/overflow detection

Instructions for sign/zero extending 8-Instructions for sign/zero extending 8-bits to 32-bits (these are generally bits to 32-bits (these are generally useful)useful)

16-bit operands16-bit operands

For further back compatibility, if a For further back compatibility, if a special 16-bit operand prefix special 16-bit operand prefix precedes the instruction, then the precedes the instruction, then the instruction is interpreted in old 8086 instruction is interpreted in old 8086 style, and can operate on style, and can operate on AX,BX,CX,DX,SP,BP,SI,DIAX,BX,CX,DX,SP,BP,SI,DI

This is the low order 16-bits of each This is the low order 16-bits of each registerregister

Alignment RequirementsAlignment Requirements

Data does not have to be aligned, it Data does not have to be aligned, it can be on any byte boundary.can be on any byte boundary.

But machine operates more But machine operates more efficiently if data is naturally alignedefficiently if data is naturally alignedE.g. 32-bit integer on four byte E.g. 32-bit integer on four byte

boundaryboundaryWhich means last 2 bits of address are Which means last 2 bits of address are

0000

Jump InstructionsJump Instructions

The unconditional jump instruction can The unconditional jump instruction can jump anywhere in the 32-bit code jump anywhere in the 32-bit code segment (full 32-bit offset in instruction)segment (full 32-bit offset in instruction)

There is also a 7 byte jump instruction There is also a 7 byte jump instruction that includes a segment numberthat includes a segment number

But we don’t often need to change code But we don’t often need to change code segments for a jump, so seldom used.segments for a jump, so seldom used.

Branch InstructionsBranch Instructions

The conditional branch instructions allow The conditional branch instructions allow an 8-bit offset (-128 to +127 bytes)an 8-bit offset (-128 to +127 bytes)

Can always combine with jumpCan always combine with jumpInstead of BNE target which is out of rangeInstead of BNE target which is out of range

UseUseBE next JMP target next:BE next JMP target next:

Assembler can take care of thisAssembler can take care of this Idea is to keep branch instructions smallIdea is to keep branch instructions small

Branch ConditionsBranch Conditions

Full set of branch conditionsFull set of branch conditionsDirect test of flagDirect test of flag

JO target – jumps if OF flag is setJO target – jumps if OF flag is setCombinations of flags for comparisonsCombinations of flags for comparisons

JL target – jumps if opnd1 < opnd2 signedJL target – jumps if opnd1 < opnd2 signed(corresponds to jump if OF xor SF)(corresponds to jump if OF xor SF)

Full set of conditions for signed/unsignedFull set of conditions for signed/unsigned

Hardware StackHardware Stack

ESP is used as a hardware stack pointerESP is used as a hardware stack pointerPUSH and POP instructions push data PUSH and POP instructions push data

onto this stack, or POP data off, from/to onto this stack, or POP data off, from/to register or memoryregister or memory

Used for temp storage, saving of Used for temp storage, saving of registers and passing of parameters to registers and passing of parameters to proceduresprocedures

Stack builds down (PUSH decrements Stack builds down (PUSH decrements ESP)ESP)

CALL InstructionCALL Instruction

Most usual form is 5 bytes, opcode plus Most usual form is 5 bytes, opcode plus 32-bit offset into code segment.32-bit offset into code segment.Return point automatically pushed onto Return point automatically pushed onto

stackstackRET instruction returns via pushed returnRET instruction returns via pushed return

Can also give segment number for Can also give segment number for intersegment callingintersegment callingCan be used to call system routines (more Can be used to call system routines (more

on that when we discuss system on that when we discuss system instructions)instructions)

The Calling SequenceThe Calling Sequence

Arguments are pushed on to stackArguments are pushed on to stackSeries of push instructions one for each Series of push instructions one for each

argargProcedure establishes stack frame Procedure establishes stack frame

usingusingPUSH EBP (save old frame pointer)PUSH EBP (save old frame pointer)MOV EBP,ESP (set new frame pointer)MOV EBP,ESP (set new frame pointer)SUB ESP, 44 (establish local frame)SUB ESP, 44 (establish local frame)

What a Stack Frame Looks What a Stack Frame Looks LikeLike

High memory at top of slideHigh memory at top of slide first pushed parameter first pushed parameter

… … last pushed parameter last pushed parameter

EBP EBP saved EBP (old frame pointer) saved EBP (old frame pointer) first variable first variable

… …ESP ESP last local variable last local variable

Address params with positive offsets from EBPAddress params with positive offsets from EBP Address locals with negative offsets from EBPAddress locals with negative offsets from EBP

Returning from a ProcedureReturning from a Procedure

Remove stack frameRemove stack frameMOV ESP,EBPMOV ESP,EBP

Restore EBPRestore EBPPOP EBPPOP EBPAbove two instructions can be given as Above two instructions can be given as

a single instruction LEAVEa single instruction LEAVEReturnReturn

RET if caller strips parametersRET if caller strips parametersRET 8 to strip 8 bytes after returnRET 8 to strip 8 bytes after return

More on calling sequencesMore on calling sequences

STDCALLSTDCALLThis is the PASCAL calling sequence, This is the PASCAL calling sequence,

parameters are pushed from left to right parameters are pushed from left to right and the caller is expected to pop the and the caller is expected to pop the parametersparameters

CCIn the C calling sequence, parameters are In the C calling sequence, parameters are

pushed from right to left, and the caller pushed from right to left, and the caller does NOT pop the parameters (allows does NOT pop the parameters (allows variable number of parameters).variable number of parameters).