IA-32

1. IA-32

2. IA family • IA (Intel Architecture) is a family of processors • 80386 (1985), 80486 (1989), • Pentium-line (1993-2000) • Each processor has the same architecture, but different organization • same instruction set • different performance levels • 32-bit memory addresses and variable length instructions • Very large instruction set (not really RISC)

4. Instruction unit instructions instructions Floating-point unit Integer unit Cache main memory Other Example: PowerPC

5. Floorplan PowerPC

6. Registers Load/Store Unit Data Cache MMU Instr. Cache FPU

7. FP0 floating - point registers FP7 R0 general- purpose registers R7 IA register structure

8. Special registers Code Segment CS Stack Segment SS DS ES FS GS Data Segments

9. Status Register Status Register 0 31 13 12 11 9 8 7 6 OF IF TF SF ZF CF IOPL • CF Carry • ZF Zero • SF Sign • IOPL I/O privilege level • OF Overflow • IF Interrupt enable

10. Addressable data units Bit 31 0 byte 3 byte 0 Byte Doubleword 0

11. Memory • Memory is byte addressable • Doublewords can start at any byte location • Data Operands are 8 or 32 bits wide • Mode is little-endian scheme (cf big-endian PowerPC)

12. Register Naming R0 EAX R1 ECX R2 EDX R3 EBX R4 ESP R5 EBP R6 ESI R7 EDI EIP EFLAGS Data registers Pointer registers Index registers Instruction Pointer Status Register

13. Instructions • Variable length instructions 1-12 bytes • Five typeof instructions • Copy instructions (MOV) • Arithmetic and logic instructions • Flow control • Processor control instructions • I/O instructions • Format: INSTRRdst,Rsrc

14. Instruction Format Opcode Addressing Displacement Immediate 1 or 2 bytes 1 or 2 bytes 1 or 4 bytes 1 or 4 bytes

15. Addressing modes • Many addressing modes: • Immediate value • Direct M(value) • Register [reg] • Register Indirect M([reg]) • Base with displacement M([reg]) +Disp • Index with displacement M([reg]S +Disp) • Base with index M([reg]+[reg]S) • Base with index and M([reg]+[reg]S+Disp) displacement S=1,2,4 or 8 Disp= 8 or 32-bit signed number

16. Immediate and Direct • Immediate MOV EAX, 25 [EAX]  #25 MOV EAX, 3FA00H [EAX]  # 3FA00H • Direct MOV EAX, loc [EAX]  M(loc) or MOV EAX, [loc][EAX]  M(loc)

17. Register indirect • Register MOV EBX,OFFSET loc [EBX]  #loc or LEA EBX,loc[EBX]  #loc • Register indirect MOV EAX,[EBX] [EAX]  M(EBX)

18. Base with Index and Displacement • MOV EAX,[EBP+ESI*4+200] EAX  M([EBP] + [ESI]*4 + #200) EBP 1000 1000 40 ESI 1200 1360 Operand

19. Arithmetic instructions • May have one or two operands ADD dst,scr meaning [dst] [dst] + [src]

20. Summation example LEA EBX, NUM1 [EBX]  #NUM1 MOV ECX, N [EXC]  M(N) MOV EAX, 0 [EAX]  #0 MOV EDI, 0 [EDI]  #0 L: ADD EAX, [EBX+EDI*4] Add next number to EAX INC EDI [EDI]  [EDI] +1 DEC ECX [ECX]  [ECX] -1 JG L Branch if [ECX]>0 MOV SUM, EAX M(SUM)  [EAX]

21. Flow control • Two basic branch instructions: • JMP [loc]Branch unconditionally • JG, JZ, JS, etc Branch if condition is satisfied

22. Compare • Used to compare values and leave register contents unchanged CMP dst, src [dst] - [src]

23. Sorting example int[] listarray = new list[n]; int temp; for(j=n-1, j>0, j--){ for(k=j-1, k>=0, k--){ if(list[j] > list[k]) { temp = list[k]; list[k] = list[j]; list[j] = temp; } } }

24. Assembler code LEA EAX, list [EAX]  #list MOV EDI, N [EDI]  n DEC EDI [EDI]  n-1 init(j) outer: MOV ECX, EDI [ECX] j DEC ECX [ECX] j-1 init (k) MOV DL, [EAX+EDI] load list(j) into DL inner: CMP [EAX+ECX], DL compare list(k) to list(j) JLE next if list(j) >= list(k) XCNG [EAX+ECX], DL swap MOV [EAX+ECX], DL new list(j) in DL next: DEC ECX decrement k JGE inner repeat or terminate DEC EDI decrement j JGE outer repeat or terminate

25. Question • Why is this assembler program an incorrect translation of the Java program?

26. Subroutines • CALL sub [EIP] #sub • Return address is saved in on stack (ESP register) • Return is RET [EIP]  [EDI]

27. Stack instructions • ESP register is used as stack pointer • PUSH src [ESP]  [ESP] - #4 M([ESP])  [src] • POP dst [dst]  M([ESP]) [ESP]  [ESP] + #4 • PUSHAD (POPAD): push (pop) all 8 registers on (from) stack

28. Stack frames .... PUSH N Parameter n on stack 2000 CALL Sub1 Call subroutine at 2400 ........... Stack 10052 EDI Stack Pointer 2400 EPI 10052 Sub1 starts at address 2400

29. Subroutine Sub1 Sub1: PUSH EDA Save EDA PUSH EDB Save EDB MOV EDA, [EDI + 12] n to EDA DEC EDA .... PUSH EDA Load n-1 on stack L: CALL Sub2 Call subroutine POP N Put result in M(N) POP EDB Restore EDA POP EDA Restore EDB RET return

30. Stack frame in Sub1 Stack frame at arrow previous slide EDI 10036 EDB 10036 EDA Return Address n ? EIP 10052

31. Question • What is the value op EIP?

32. Subroutine Sub1 2400 PUSH EDA Save EDA PUSH EDB Save EDB MOV EDA, [EDI + 12] n to EDA DEC EDA .... PUSH EDA Load n-1 on stack L: CALL Sub2 Call subroutine POP N Put result in M(N) POP EDB Restore EDA POP EDA Restore EDB RET return

33. Stack frame in Sub1 Stack frame at arrow previous slide 10036 EIP [EDB] 10036 [EDA] EDA n-1 Return Address n ? EIP 10052

34. Subroutine Sub1 2400 PUSH EDA Save EDA PUSH EDB Save EDB MOV EDA, [EDI + 12] n to EDA DEC EDA .... PUSH EDA Load n-1 on stack L: CALL Sub2 Call subroutine POP N Put result in M(N) POP EDB Restore EDA POP EDA Restore EDB RET return

35. Stack frame in Sub1 Stack frame at arrow previous slide n-1 10032 EIP [EDB] 10036 [EDA] EDA n-1 Return Address n ? EIP 10052

36. Subroutine Sub2 Sub2: MOV EDA, [EDI+4] DEC EDA MOV [EDI+4], EDA RET

37. Stack frame in Sub2 Stack frame at arrow previous slide Return Address n-1 10028 EIP [EDB] 10036 [EDA] EDA n-2 Return Address n ? EIP 10052

38. Subroutine Sub2 Sub2: POP EDA DEC EDA PUSH EDA RET return Sub2: MOV EDA, [EDI+4] DEC EDA MOV [EDI+4], EDA RET

39. Stack frame in Sub2 Stack frame at arrow previous slide Return Address n-2 10028 EIP [EDB] 10036 [EDA] EDA n-2 Return Address n ? EIP 10052