Chapter 4: Processor Architecture How does the hardware execute the instructions? We’ll see by studying an example system Based on simple instruction set devised for this purpose Y86, inspired by x86 Fewer data types, instructions, addressing modes Simpler encodings Reasonably complete for integer programs We’ll design hardware to implement Y86 ISA Basic building blocks Sequential implementation Pipelined implementation

Instruction Set Architecture Defines interface between hardware and software Software spec is assembly language State: registers, memory Instructions, encodings Hardware must execute instructions correctly May use variety of transparent tricks to make execution fast. Results must match sequential execution. ISA is a layer of abstraction Above: how to program machine Below: what needs to be built ISA Compiler OS CPU Design Circuit Chip Layout Application Program

Where Are We Now? CS142 & 124 IT344 lib.o C program: foo.c Compiler Memory Loader Executable (mach lang pgm): a.out Linker Object (mach lang module): foo.o Assembler Assembly program: foo.s Compiler C program: foo.c Where Are We Now? CS142 & 124 lib.o IT344

Y86 Processor and System State RF: Program registers CC: Condition codes Stat: Program Status %eax %ecx %edx %ebx %esi %edi %esp %ebp ZF SF OF DMEM: Memory PC Program Registers Same 8 as with IA32. Each 32 bits Condition Codes Single-bit flags as in x86: OF (Overflow), ZF (Zero), SF (Negative) Program Counter Indicates address of instruction Memory Byte-addressable storage, words in little-endian byte order Stat Indicates exceptional outcomes (bad opcode, bad address, halt)

Y86 Instructions Format 1 to 6 bytes of information read from memory Can determine instruction length from first byte Not as many instruction types, and simpler encoding than IA32 Each accesses and modifies some portion of the CPU and system state Program registers Condition codes Program counter Memory contents

Encoding Registers Each register has 4-bit ID Similar encoding used in IA32 But we never deciphered encoding to notice! Register ID 0xF indicates “no register” Will use this in our hardware design in multiple places Could otherwise encode register # in 3 bits Simplifies decoding of instructions %eax %ecx %edx %ebx %esi %edi %esp %ebp 1 2 3 6 7 4 5

Instruction Example Addition instruction Add value in register rA to that in register rB Store result in register rB Y86 allows addition to be applied to register data only Set condition codes based on result Two-byte encoding First byte indicates instruction type Second gives source and destination registers e.g., addl %eax,%esi has encoding 60 06 Generic Form Encoded Representation addl rA, rB 6 rA rB

Arithmetic and Logical Operations Instruction Code Function Code Add addl rA, rB 6 rA rB Refer to generically as “OPl” Encodings differ only by “function code” Low-order 4 bits in first instruction word All set condition codes as side effect Subtract (rA from rB) subl rA, rB 6 1 rA rB And andl rA, rB 6 2 rA rB Exclusive-Or xorl rA, rB 6 3 rA rB

Move Operations Similar to the IA32 movl instruction Register --> Register rrmovl rA, rB 2 rA rB Immediate --> Register irmovl V, rB 3 F rB V Register --> Memory rmmovl rA, D(rB) 4 rA rB D Memory --> Register mrmovl D(rB), rA 5 rA rB D Similar to the IA32 movl instruction Simpler format for memory addresses Separated into different instructions to simplify hardware implementation

Move Instruction Examples IA32 Y86 Encoding movl $0xabcd, %edx irmovl $0xabcd, %edx 30 82 cd ab 00 00 movl %esp, %ebx rrmovl %esp, %ebx 20 43 movl -12(%ebp),%ecx mrmovl -12(%ebp),%ecx 50 15 f4 ff ff ff movl %esi,0x41c(%esp) rmmovl %esi,0x41c(%esp) 40 64 1c 04 00 00 movl $0xabcd, (%eax) — movl %eax, 12(%eax,%edx) — movl (%ebp,%eax,4),%ecx —

Jump Instructions Refer to generically as “jXX” jmp Dest 7 Jump Unconditionally Dest Refer to generically as “jXX” Encodings differ only by “function code” Based on values of condition codes Same as IA32 counterparts Encode full destination address Unlike PC-relative addressing in IA32 jle Dest 7 1 Jump When Less or Equal Dest jl Dest 7 2 Jump When Less Dest je Dest 7 3 Jump When Equal Dest jne Dest 7 4 Jump When Not Equal Dest jge Dest 7 5 Jump When Greater or Equal Dest jg Dest 7 6 Jump When Greater Dest

Same stack conventions as IA32 Stack Operations pushl rA a rA 8 Decrement %esp by 4 Store word from rA to memory at %esp Like IA32 Read word from memory at %esp Save in rA Increment %esp by 4 popl rA b rA 8 Same stack conventions as IA32

Subroutine Call and Return call Dest 8 Dest Push address of next instruction onto stack Start executing instructions at Dest Like IA32 Pop value from stack Use as address for next instruction ret 9

Miscellaneous Instructions nop Don’t do anything Stop executing instructions IA32 has comparable instruction, but it can’t be executed in user mode We will use this instruction to stop the simulator halt 1

Y86 Instruction Set Byte 1 2 3 4 5 pushl rA A rA F jXX Dest 7 fn Dest 1 2 3 4 5 pushl rA A rA F jXX Dest 7 fn Dest popl rA B call Dest 8 rrmovl rA, rB rB irmovl V, rB V rmmovl rA, D(rB) D mrmovl D(rB), rA OPl rA, rB 6 ret 9 nop halt addl subl andl xorl jmp jle jl je jne jge jg

Writing Y86 Code Best to use C compiler as much as possible Write code in C Compile for IA32 with gcc -S Hand translate into Y86 Coding example Find number of elements in null-terminated list int len1(int a[]); 5043 6125 7395 a  3

Y86 Code Generation Example First try Write typical array code Compile with gcc -O2 -S Problem Hard to do array indexing on Y86: no scaled addressing modes /* Find number of elements in null-terminated list */ int len1(int a[]) { int len; for (len = 0; a[len]; len++) ; return len; } L18: incl %eax cmpl $0,(%edx,%eax,4) jne L18 x86 code

Y86 Code Generation Example #2 Second try Revise to use pointers Compile with gcc -O2 -S Result Doesn’t use indexed addressing /* Find number of elements in null-terminated list */ int len2(int a[]) { int len = 0; while (*a++) len++; return len; } L5: movl (%edx),%eax incl %ecx addl $4,%edx testl %eax,%eax jne L5 x86 code

Y86 Code Generation Example #3 IA32 code Setup Y86 code Setup len2: pushl %ebp xorl %ecx,%ecx movl %esp,%ebp movl 8(%ebp),%edx movl (%edx),%eax je L7 len2: pushl %ebp # Save %ebp xorl %ecx,%ecx # len = 0 rrmovl %esp,%ebp # Set frame mrmovl 8(%ebp),%edx # Get a mrmovl (%edx),%eax # Get *a je L7 # Goto exit Hand translation

Y86 Code Generation Example #4 IA32 code Loop + Finish Y86 code Loop + Finish L5: movl (%edx),%eax incl %ecx addl $4,%edx testl %eax,%eax jne L5 movl %ebp,%esp movl %ecx,%eax popl %ebp ret L5: mrmovl (%edx),%eax # Get *a irmovl $1,%esi addl %esi,%ecx # len++ irmovl $4,%esi addl %esi,%edx # a++ andl %eax,%eax # *a == 0? jne L5 # No--Loop rrmovl %ebp,%esp # Pop rrmovl %ecx,%eax # Rtn len popl %ebp ret Hand translation

Y86 Program Structure irmovl Stack,%esp # Set up stack rrmovl %esp,%ebp # Set up frame irmovl List,%edx pushl %edx # Push argument call len2 # Call Function halt # Halt .align 4 List: # List of elements .long 5043 .long 6125 .long 7395 .long 0 # Function len2: . . . # Allocate space for stack .pos 0x100 Stack: Programmer must do more work; no compiler, linker, run-time system Make program placement explicit Stack initialization must be explicit (addr. 0x100) Must ensure code is not overwritten! Must initialize data Can use symbolic names

Assembling Y86 Program Generates “object code” file eg.yo unix> yas eg.ys Generates “object code” file eg.yo Actually looks like disassembler output ASCII file to make it easy for you to read 0x000: 308400010000 | irmovl Stack,%esp # Set up stack 0x006: 2045 | rrmovl %esp,%ebp # Set up frame 0x008: 308218000000 | irmovl List,%edx 0x00e: a028 | pushl %edx # Push argument 0x010: 8028000000 | call len2 # Call Function 0x015: 10 | halt # Halt 0x018: | .align 4 0x018: | List: # List of elements 0x018: b3130000 | .long 5043 0x01c: ed170000 | .long 6125 0x020: e31c0000 | .long 7395 0x024: 00000000 | .long 0

Simulating Y86 Program Instruction set simulator unix> yis eg.yo Instruction set simulator Computes effect of each instruction on processor state Prints changes in state from original Stopped in 41 steps at PC = 0x16. Exception 'HLT', CC Z=1 S=0 O=0 Changes to registers: %eax: 0x00000000 0x00000003 %ecx: 0x00000000 0x00000003 %edx: 0x00000000 0x00000028 %esp: 0x00000000 0x000000fc %ebp: 0x00000000 0x00000100 %esi: 0x00000000 0x00000004 Changes to memory: 0x00f4: 0x00000000 0x00000100 0x00f8: 0x00000000 0x00000015 0x00fc: 0x00000000 0x00000018

CISC vs. RISC CISC-like RISC-like Operate on memory directly Smaller code size RISC-like Can only operate on registers Load-store architecture Larger code size L5: movl (%edx),%eax incl %ecx addl $4,%edx testl %eax,%eax jne L5 L18: incl %eax cmpl $0,(%edx,%eax,4) jne L18

CISC Instruction Sets CISC: Complex Instruction Set Computer Dominant style of machines designed prior to ~1980 Stack-oriented instruction set Use stack to pass arguments, save program counter Explicit push and pop instructions Arithmetic instructions can access memory addl %eax, 12(%ebx,%ecx,4) Requires memory read and write + complex address calculation Condition codes Set as side effect of arithmetic and logical instructions Philosophy Add instructions to perform “typical” programming tasks

RISC Instruction Sets Reduced Instruction Set Computer Early projects at IBM, Stanford (Hennessy), and Berkeley (Patterson) Fewer, simpler instructions in ISA (initially) Takes more to perform same operations (relative to CISC) But an instruction can execute faster on simpler hardware Register-oriented instruction set Many more (typically  32) registers Used for arguments, return value and address, temporaries Only load and store instructions can access memory Similar to Y86 mrmovl and rmmovl No condition codes Test instructions return 0/1 in general purpose register

Example: MIPS Registers

Example: MIPS Instructions Op Ra Rb Rd Fn 00000 R-R addu $3,$2,$1 # Register add: $3 = $2+$1 Op Ra Rb Immediate R-I addu $3,$2,3145 # Immediate add: $3 = $2+3145 sll $3,$2,2 # Shift left: $3 = $2 << 2 Branch Op Ra Rb Offset beq $3,$2,dest # Branch when $3 = $2 Load/Store Op Ra Rb Offset lw $3,16($2) # Load Word: $3 = M[$2+16] sw $3,16($2) # Store Word: M[$2+16] = $3

CISC vs. RISC Debate Strong opinions at the time! Current status CISC arguments Easy for compiler (bridge semantic gap) Concise object code (memory was expensive) RISC arguments Simple is better for optimizing compilers A simple CPU can be made to run very fast Current status For desktop processors, choice of ISA not a technical issue With enough hardware, anything can be made to run fast Code compatibility more important For embedded processors, RISC makes sense Smaller, cheaper, less power

4.1 Summary Y86 instruction set architecture Similar state and instructions as IA32 Simpler encodings Small instruction set Y86 somewhere between CISC and RISC Changes from x86 consistent with RISC principles

4.2: Logic Design: A Brief Review Fundamental hardware requirements Communication How to get values from one place to another Computation Storage All are simplified by restricting to 0s and 1s Low or high voltage on wire Compute Boolean functions Store bits of information

Communication: Digital Signals Voltage Time 1 Use voltage thresholds to extract discrete values from continuous signal Simplest version: 1-bit signal Either high range (1) or low range (0) With guard range between them Not strongly affected by noise or low quality circuit elements Can make circuits simple, small, and fast

Computation: Logic Gates Outputs are Boolean functions of inputs Respond continuously to changes in inputs After some small delay a && b Rising Delay Falling Delay b Voltage a Time

Combinational Circuits Acyclic Network Primary Inputs Outputs Acyclic network of logic gates Continuously responds to changes on primary inputs Primary outputs become (after some delay) Boolean functions of primary inputs

bool eq = (a&&b)||(!a&&!b) Bit Equality Bit equal a b eq HCL Expression bool eq = (a&&b)||(!a&&!b) Generate 1 if a and b are equal Hardware control language (HCL) Very simple hardware description language Boolean operations have syntax similar to C logical operations We’ll use it to describe control logic for processors Much more convenient than drawing gates Assumes compiler exists to turn HCL into gate equivalent

Word-Level Representation Word Equality Word-Level Representation b31 Bit equal a31 eq31 b30 a30 eq30 b1 a1 eq1 b0 a0 eq0 Eq = B A Eq HCL Representation bool Eq = (A == B) 32-bit word size HCL representation Equality operation Generates Boolean value

Bit-Level Multiplexer s Bit MUX HCL Expression bool out = (s&&a)||(!s&&b) b out a Control signal s Data signals a and b Output a when s=1, b when s=0

Word-Level Representation Word Multiplexer Word-Level Representation b31 s a31 out31 b30 a30 out30 b0 a0 out0 s B A Out MUX HCL Representation int Out = [ s : A; 1 : B; ]; Select input word A or B depending on control signal s HCL representation Case expression Series of test : value pairs Result value determined by first successful test

Arithmetic and Logical Operations Instruction Code Function Code Add addl rA, rB 6 rA rB Refer to generically as “OPl” Encodings differ only by “function code” Low-order 4 bits in first instruction word All set condition codes as side effect Subtract (rA from rB) subl rA, rB 6 1 rA rB And andl rA, rB 6 2 rA rB Exclusive-Or xorl rA, rB 6 3 rA rB

Arithmetic Logic Unit Combinational logic Y X X + Y A L U Y X X - Y 1 A L U Y X X & Y 2 A L U Y X X ^ Y 3 A B A B A B A B OF ZF CF OF ZF CF OF ZF CF OF ZF CF Combinational logic Continuously responding to inputs Control signal selects function computed Corresponding to 4 arithmetic/logical operations in Y86 Also computes values for condition codes

Edge-Triggered Latch (Flip Flop) Data Q+ Q– C S T Clock Trigger Only in latching mode for brief period On rising clock edge Value latched depends on data as clock rises Output remains stable at all other times C D Q+ Time T

Storage: Registers Structure D C Q+ i7 i6 i5 i4 i3 i2 i1 i0 o7 o6 o5 o4 o3 o2 o1 o0 Clock I O Clock Each stores word of data (one byte in above register) Different from program registers (e.g., %eax) Collection of edge-triggered latches Loads input on rising edge of clock

Register Operation   y x Stores data bits State = x  State = y Output = y y Rising clock  x Input = y Output = x Stores data bits For most of time acts as barrier between input and output As clock rises, loads input

State Machine Example Accumulator circuit Comb. Logic A L U Out MUX 1 Clock In Load Accumulator circuit Load or accumulate on each cycle x0 x1 x2 x3 x4 x5 x0+x1 x0+x1+x2 x3+x4 x3+x4+x5 Clock Load In Out

Storage: Random-Access Memory Register file A B W dstW srcA valA srcB valB valW Read ports Write port Clock Stores multiple words of memory Address input specifies which word to read or write Register file Holds values of program registers %eax, %esp, etc. Register identifier serves as address ID 0xF implies no read or write performed Multiple Ports Can read and/or write multiple words simultaneously Each has separate address and data input/output

Register File Timing   Reading Writing Like combinational logic Output data generated based on input address After some delay Writing Like register (a few slides ago) Update only as clock rises Register file A B srcA valA srcB valB 2 x x 2 y 2 Register file W dstW valW Clock x  Register file W dstW valW Clock y 2 Rising clock 

Administrivia Lab 4 – Farmer Game in VHDL HW 5 – Farmer Game in C HW 5 – Buffer Overflow #1 Quiz 3 – due Feb 7 Quiz 4 – due Feb 14 Quiz 5 – due Feb 21 Midterm – available after class on Feb 28 No class Mar 1, work on the exam Due 5PM Monday Mar 5 Take home, open book, open notes, open lecture slides NO COLLABORATION

FPGA in IT Network switch Security gateway System on a chip Embedded system …

4.2 Summary Computation Storage Performed by combinational logic Computes Boolean functions Continuously reacts to input changes Storage Registers Hold single words Loaded as clock rises Random-access memories Hold multiple words Multiple read and write ports possible Read word anytime address input changes Write word only on rising clock edge