Principles of Computers 15th Lecture Pavel Ježek, Ph.D. pavel.jezek@d3s.mff.cuni.cz

Examples of CPU Architectures CPU name Logical address width Current instruction register(s) Physical address width Special mode 8-bit 6502 MOS 6502 16-bit PC (64 kB) x86-16 x86 Intel 8088 16 + 16 bit CS:IP 20-bit (1 MB) Intel 8086 Intel 80286 24-bit (16 MB) protected 16 (+ real) mode 32-bit IA-32 INTEL32 Intel 80386 EIP (4 GB) protected 32 mode Intel Pentium Pro 36-bit (64 GB) PAE 64-bit x64 x86-64 AMD64 INTEL64 EM64T AMD Opteron (Intel Pentium 4) RIP 40-bit (1 TB) long mode 2018 current (e.g. Core i7) AMD: 48b → 256 TB Intel: 46b → 64 TB 32-bit ARM 64-bit ARM 32b MIPS MIPS64 PowerPC (PPC) 32b Motorola 68000 (68k)

Basic Instructions (6502 vs. x86) 6502 machine code Intel x86 (IA-32) machine code Comment ← Offset from instruction’s start (base) address ← Actual bytes of instruction’s machine code

Basic Instructions (6502 vs. x86) 6502 machine code Intel x86 (IA-32) machine code Comment $EA $90 ← Offset from instruction’s start (base) address ← Actual bytes of instruction’s machine code No operation (just do nothing)

Basic Instructions (6502 vs. x86) 6502 machine code Intel x86 (IA-32) machine code Comment $EA PC := PC + 1 $90 EIP := EIP + 1 ← Offset from instruction’s start (base) address ← Actual bytes of instruction’s machine code No operation (just do nothing and continue to next instruction) Instruction size in bytes

Basic Instructions (6502 vs. x86) 6502 machine code Intel x86 (IA-32) machine code Comment $EA PC := PC + 1 $90 EIP := EIP + 1 ← Offset from instruction’s start (base) address ← Actual bytes of instruction’s machine code No operation (just do nothing and continue to next instruction) 0 1 2 $4C xx0 xx1 PC := $xx1xx0 0 1 2 3 4 $E9 xx0 xx1 xx2 xx3 EIP := $xx3xx2xx1xx0 Direct jump to target address x Jump/branch instruction

Basic Instructions (6502 vs. x86) 6502 machine code Intel x86 (IA-32) machine code Comment $EA PC := PC + 1 $90 EIP := EIP + 1 ← Offset from instruction’s start (base) address ← Actual bytes of instruction’s machine code No operation (just do nothing and continue to next instruction) 0 1 2 $4C xx0 xx1 PC := $xx1xx0 0 1 2 3 4 $E9 xx0 xx1 xx2 xx3 EIP := $xx3xx2xx1xx0 Direct jump to target address x 16-bit PC → 2 byte argument 32-bit EIP → 4 byte argument Jump/branch instruction

Basic Instructions (6502 vs. x86) 6502 machine code Intel x86 (IA-32) machine code Comment $EA PC := PC + 1 $90 EIP := EIP + 1 ← Offset from instruction’s start (base) address ← Actual bytes of instruction’s machine code No operation (just do nothing and continue to next instruction) 0 1 2 $4C xx0 xx1 PC := $xx1xx0 0 1 2 3 4 $E9 xx0 xx1 xx2 xx3 EIP := $xx3xx2xx1xx0 Direct jump to target address x 16-bit PC → 2 byte argument 32-bit EIP → 4 byte argument 6502 is LE CPU arch. x86 is LE CPU arch. Jump/branch instruction

Basic Instructions (6502 vs. x86) 6502 machine code Intel x86 (IA-32) machine code Comment $EA PC := PC + 1 6502 assembler: NOP $90 EIP := EIP + 1 Intel assembler: ← Offset from instruction’s start (base) address ← Actual bytes of instruction’s machine code No operation (just do nothing and continue to next instruction) 0 1 2 $4C xx0 xx1 PC := $xx1xx0 JMP $xx1xx0 0 1 2 3 4 $E9 xx0 xx1 xx2 xx3 EIP := $xx3xx2xx1xx0 JMP xx3xx2xx1xx0h Direct jump to target address x

Basic Instructions (6502 vs. x86) 6502 machine code Intel x86 (IA-32) machine code Comment $EA PC := PC + 1 6502 assembler: NOP $90 EIP := EIP + 1 Intel assembler: ← Offset from instruction’s start (base) address ← Actual bytes of instruction’s machine code No operation (just do nothing and continue to next instruction) 0 1 2 $4C xx0 xx1 PC := $xx1xx0 JMP $xx1xx0 0 1 2 3 4 $E9 xx0 xx1 xx2 xx3 EIP := $xx3xx2xx1xx0 JMP xx3xx2xx1xx0h Direct jump to target address x JMP 00000005h in assembler is 15 bytes in UTF-8 encoding including newline: In machine code = 5 bytes: E9 05 00 00 00

Basic Instructions (6502 vs. x86) 6502 machine code Intel x86 (IA-32) machine code Comment $EA PC := PC + 1 6502 assembler: NOP $90 EIP := EIP + 1 Intel assembler: ← Offset from instruction’s start (base) address ← Actual bytes of instruction’s machine code No operation (just do nothing and continue to next instruction) 0 1 2 $4C xx0 xx1 PC := $xx1xx0 JMP $xx1xx0 0 1 2 3 4 $E9 xx0 xx1 xx2 xx3 EIP := $xx3xx2xx1xx0 JMP xx3xx2xx1xx0h Direct jump to target address x JMP 00000005h in assembler is 15 bytes in UTF-8 encoding: x86 assembler (compiler) In machine code = 5 bytes: E9 05 00 00 00

Basic Instructions (6502 vs. x86) 6502 machine code Intel x86 (IA-32) machine code Comment $EA PC := PC + 1 6502 assembler: NOP $90 EIP := EIP + 1 Intel assembler: ← Offset from instruction’s start (base) address ← Actual bytes of instruction’s machine code No operation (just do nothing and continue to next instruction) 0 1 2 $4C xx0 xx1 PC := $xx1xx0 JMP $xx1xx0 0 1 2 3 4 $E9 xx0 xx1 xx2 xx3 EIP := $xx3xx2xx1xx0 JMP xx3xx2xx1xx0h Direct jump to target address x $6C xx0 xx1 0 1 2 3 4 5 $FF $25 xx0 xx1 xx2 xx3

Basic Instructions (6502 vs. x86) 6502 machine code Intel x86 (IA-32) machine code Comment $EA PC := PC + 1 6502 assembler: NOP $90 EIP := EIP + 1 Intel assembler: ← Offset from instruction’s start (base) address ← Actual bytes of instruction’s machine code No operation (just do nothing and continue to next instruction) 0 1 2 $4C xx0 xx1 PC := $xx1xx0 JMP $xx1xx0 0 1 2 3 4 $E9 xx0 xx1 xx2 xx3 EIP := $xx3xx2xx1xx0 JMP xx3xx2xx1xx0h Direct jump to target address x $6C xx0 xx1 PC := (^word($xx1xx0))^ JMP ($xx1xx0) 0 1 2 3 4 5 $FF $25 xx0 xx1 xx2 xx3 EIP := (^longword($xx3xx2xx1xx0))^ JMP [xx3xx2xx1xx0h] Indirect jump to target address that is stored at address x

Basic Instructions (6502 vs. x86) 6502 machine code Intel x86 (IA-32) machine code Comment $EA PC := PC + 1 6502 assembler: NOP $90 EIP := EIP + 1 Intel assembler: ← Offset from instruction’s start (base) address ← Actual bytes of instruction’s machine code No operation (just do nothing and continue to next instruction) 0 1 2 $4C xx0 xx1 PC := $xx1xx0 JMP $xx1xx0 0 1 2 3 4 $E9 xx0 xx1 xx2 xx3 EIP := $xx3xx2xx1xx0 JMP xx3xx2xx1xx0h Absolute direct jump to target address x $6C xx0 xx1 PC := (^word($xx1xx0))^ JMP ($xx1xx0) 0 1 2 3 4 5 $FF $25 xx0 xx1 xx2 xx3 EIP := (^longword($xx3xx2xx1xx0))^ JMP [xx3xx2xx1xx0h] Indirect jump to target address that is stored at address x

Basic Instructions (6502 vs. x86) 6502 machine code Intel x86 (IA-32) machine code Comment $EA PC := PC + 1 6502 assembler: NOP $90 EIP := EIP + 1 Intel assembler: ← Offset from instruction’s start (base) address ← Actual bytes of instruction’s machine code No operation (just do nothing and continue to next instruction) 0 1 2 $4C xx0 xx1 PC := $xx1xx0 JMP $xx1xx0 0 1 2 3 4 $E9 xx0 xx1 xx2 xx3 EIP := EIP + longint($xx3xx2xx1xx0) JMP xx3xx2xx1xx0h Absolute direct jump to target address x Relative direct jump to target address that is x byte far from current instruction $6C xx0 xx1 PC := (^word($xx1xx0))^ JMP ($xx1xx0) 0 1 2 3 4 5 $FF $25 xx0 xx1 xx2 xx3 EIP := (^longword($xx3xx2xx1xx0))^ JMP [xx3xx2xx1xx0h] Indirect jump to target address that is stored at address x

Basic Instructions (6502 vs. x86) 6502 machine code Intel x86 (IA-32) machine code Comment $EA PC := PC + 1 6502 assembler: NOP $90 EIP := EIP + 1 Intel assembler: ← Offset from instruction’s start (base) address ← Actual bytes of instruction’s machine code No operation (just do nothing and continue to next instruction) 0 1 2 $4C xx0 xx1 PC := $xx1xx0 JMP $xx1xx0 0 1 2 3 4 $E9 xx0 xx1 xx2 xx3 EIP := EIP + 5 + longint($xx3xx2xx1xx0) JMP xx3xx2xx1xx0h Absolute direct jump to target address x Relative direct jump to target address that is x byte far from current instruction $6C xx0 xx1 PC := (^word($xx1xx0))^ JMP ($xx1xx0) 0 1 2 3 4 5 $FF $25 xx0 xx1 xx2 xx3 EIP := (^longword($xx3xx2xx1xx0))^ JMP [xx3xx2xx1xx0h] Indirect jump to target address that is stored at address x x86 is using address relative to instruction’s end (i.e. not relative to instruction’s start) → instruction size (5 bytes for this $E9 jump instruction) is added to x

Basic Instructions (6502 vs. x86) 6502 machine code Intel x86 (IA-32) machine code Comment $EA PC := PC + 1 6502 assembler: NOP $90 EIP := EIP + 1 Intel assembler: ← Offset from instruction’s start (base) address ← Actual bytes of instruction’s machine code No operation (just do nothing and continue to next instruction) 0 1 2 $4C xx0 xx1 PC := $xx1xx0 JMP $xx1xx0 0 1 2 3 4 $E9 xx0 xx1 xx2 xx3 EIP := EIP + 5 + longint($xx3xx2xx1xx0) JMP xx3xx2xx1xx0h Absolute direct jump to target address x Relative direct jump to target address that is x byte far from current instruction $6C xx0 xx1 PC := (^word($xx1xx0))^ JMP ($xx1xx0) 0 1 2 3 4 5 $FF $25 xx0 xx1 xx2 xx3 EIP := (^longword($xx3xx2xx1xx0))^ JMP [xx3xx2xx1xx0h] Indirect jump to target address that is stored at address x Single instruction unbreakable infinite cycle doing nothing :-) in Intel assembler: JMP -5 = JMP FFFFFFFBh in x86 machine code: E9 FB FF FF FF x86 is using address relative to instruction’s end (i.e. not relative to instruction’s start) → instruction size (5 bytes for this $E9 jump instruction) is added to x

Basic Instructions (6502 vs. x86) 6502 machine code Intel x86 (IA-32) machine code Comment $EA PC := PC + 1 6502 assembler: NOP $90 EIP := EIP + 1 Intel assembler: ← Offset from instruction’s start (base) address ← Actual bytes of instruction’s machine code No operation (just do nothing and continue to next instruction) 0 1 2 $4C xx0 xx1 PC := $xx1xx0 JMP $xx1xx0 0 1 2 3 4 $E9 xx0 xx1 xx2 xx3 EIP := EIP + 5 + longint($xx3xx2xx1xx0) JMP xx3xx2xx1xx0h Absolute direct jump to target address x Relative direct jump to target address that is x byte far from current instruction $6C xx0 xx1 PC := (^word($xx1xx0))^ JMP ($xx1xx0) 0 1 2 3 4 5 $FF $25 xx0 xx1 xx2 xx3 EIP := (^longword($xx3xx2xx1xx0))^ JMP [xx3xx2xx1xx0h] Indirect jump to target address that is stored at address x 0 1 $EB xx0 EIP := EIP + 2 + longint(shortint($xx0)) Intel assembler: JMP xx0h Smaller relative jump instruction (only from -128 to +127 bytes) Instrution size = 2 bytes

program PascalProgram; type PProc = procedure; procedure P1; begin α end; procedure P2; β var i : word; ptr : PProc; j : word; γ1 ptr := @P1; ptr; P2; γ2 end.

A B C1 C2 program PascalProgram; type PProc = procedure; procedure P1; begin α end; procedure P2; β var i : word; ptr : PProc; j : word; γ1 ptr := @P1; ptr; indirect jump P2; direct jump γ2 end. A B C1 C2

A B C1 C2 program PascalProgram; type PProc = procedure; procedure P1; begin α end; jmp back procedure P2; β var i : word; ptr : PProc; j : word; γ1 ptr := @P1; ptr; indirect jump P2; direct jump γ2 end. A B C1 C2

... $00007A00 B $00002100 A $00002000 C2 ?? JMP E9 $00001306 indir 25 FF $00001300 C1 $00001000 program PascalProgram; type PProc = procedure; procedure P1; begin α end; jmp back procedure P2; β var i : word; ptr : PProc; j : word; γ1 ptr := @P1; ptr; P2; γ2 end. A procedure P2 procedure P1 B main program C1 C2

... 00 $00007A08 00 (00) 00 (20) $00007A04 $00007A02 $00007A00 B $00002100 A $00002000 C2 ?? JMP E9 $00001306 indir 25 FF $00001300 C1 $00001000 variable j program PascalProgram; type PProc = procedure; procedure P1; begin α end; jmp back procedure P2; β var i : word; ptr : PProc; j : word; γ1 ptr := @P1; ptr; P2; γ2 end. variable ptr padding variable i A procedure P2 procedure P1 B main program C1 C2

... 00 $00007A08 00 (00) 00 (20) $00007A04 $00007A02 $00007A00 B $00002100 A $00002000 C2 21 JMP E9 $00001306 7A 04 indir 25 FF $00001300 C1 $00001000 variable j program PascalProgram; type PProc = procedure; procedure P1; begin α end; jmp back procedure P2; β var i : word; ptr : PProc; j : word; γ1 ptr := @P1; ptr; P2; γ2 end. variable ptr padding variable i A procedure P2 procedure P1 B $00002100 main program $00007A04 C1 C2

... 00 $00007A08 00 (00) 00 (20) $00007A04 $00007A02 $00007A00 B $00002100 A $00002000 C2 21 JMP E9 $00001306 7A 04 indir 25 FF $00001300 C1 $00001000 variable j program PascalProgram; type PProc = procedure; procedure P1; begin α end; jmp back procedure P2; β var i : word; ptr : PProc; j : word; γ1 ptr := @P1; ptr; P2; γ2 end. variable ptr padding variable i A procedure P2 procedure P1 B $00002100 ← $00002100 – ($001306 + 5) E9 = relative jump main program $00007A04 C1 C2

... 00 $00007A08 00 (00) 00 (20) $00007A04 $00007A02 $00007A00 B $00002100 A $00002000 C2 0D F5 JMP E9 $00001306 7A 04 indir 25 FF $00001300 C1 $00001000 variable j program PascalProgram; type PProc = procedure; procedure P1; begin α end; jmp back procedure P2; β var i : word; ptr : PProc; j : word; γ1 ptr := @P1; ptr; P2; γ2 end. variable ptr padding variable i A procedure P2 procedure P1 B $00002100 ← $00002100 – ($001306 + 5) = $00002100 – $0000130B = $00000DF5 E9 = relative jump main program $00007A04 C1 C2