1. Processor Processor characterized by register set (state variables)
instruction set
includes addressing modes
interrupt mechanism (not here  )
will study p-86 processor
simplified subset of Intel 80x86 family
no segments – see the “real thing” in
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

2. p-86 Register Set AH AL BH BL CH CL DH DL AX BX CX DX 8 bits 8 bits
16-Bit General Purpose Registers
can access 16-bits, high (H) byte, low (L) byte AH AL BH BL CH CL DH DL AX BX CX DX
8 bits
8 bits
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

3. P-86 Register Set (contd)
16-Bit Addressing Registers (no 8-bit access)
IP Instruction Pointer
SP Stack Pointer
BP Base Pointer
SI Source Index
DI Destination Index
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

4. P-86 Register Set (contd)
FLAGS Register (status flags – one bit/flag)
16-bit reg, but only 4 bits have meaning
treat as individual bits, not 16-bit value
ignore unused bits
CF Carry Flag
SF Sign Flag
OF Overflow Flag
IF Interrupt Flag
data manipulation
& conditional control flow
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

5. P-86 Register Set (contd)
Other Registers in Programmer’s Model
support the execution of instructions
cannot be accessed directly by programmers
often larger than 16-bits
temporary reg’s (scratchpad values)
IR Instruction Register
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

6. P-86 Execution Cycle Processor executes instructions by repeating:
do {
IR := mem[ IP ] & adjust IP to point to next sequential instruction
Execute instruction in IR
} until HLT instruction has been executed
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

7. P-86 Execution Cycle (contd)
IP contains address of next instruction to execute
IR holds instruction in processor
instruction fetch from memory
load 1st byte; from encoding: decide how many more are needed (may need 2nd byte too!)
IP is adjusted as bytes are loaded
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

8. P86 Instruction Cycle (contd)
Before Fetch:
0000
3C08
3C09
3C0A
3C0B
3C0E
3 bytes of instruction
4 bytes
of next instruction
07 43 A6 12 IR IP 4B 36 FF
FFFF
Processor
Memory
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

9. P86 Instruction Cycle (contd)
After Fetch:
0000
3C08
3C09
3C0A
3C0B
3C0E
3 bytes of instruction
4 bytes
of next instruction
4B 36 FF IR IP 4B 36 FF
FFFF
Processor
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

10. Instruction Operations, Operands
operation: how to use state variable values
operands: which state variables to use
e.g. C = A + B
operations: addition (+) and assignment (=)
operands: state variables A, B & C
source operands: provide values to use (inputs)
C = A + B; A= A + A
destination operands: receive results (outputs)
C = A + B; A = A + A
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

11. Instruction Operations, Operands (contd)
human-oriented mnemonics for operations e.g.:
MOV (move)
SUB (subtract)
JMP (jump)
addressing modes: ways to specify operands
simple modes: register, immediate, direct
more powerful: indirect
instruction encoding includes both operation and operand information
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

12. Instruction Categories
data transfer: copies data among state variables
do not modify FLAGS
data manipulation: modify state variable values – including FLAGS
control-flow: determine “next” instruction to execute – allow non-sequential execution
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

13. MOV (Move) Instruction syntax: MOV dest , src semantics: dest := src
Data Transfer Example
MOV (Move) Instruction
syntax: MOV dest , src
semantics: dest := src
copy src value to dest state variable
register and memory operands only (I/O ??)
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

14. Register Addressing Mode
allows a register to be an operand
as source: copy register value
as destination: write value to register
e.g. MOV AX, DX ; value in DX is copied to AX
 AX := DX
register addressing mode for both dest and src
dest and src must be compatible (same size)
MOV AH, CL ; This is OK
MOV AL, CX ; This is not OK
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

15. Immediate Addressing Mode
allows constant to be specified as source
source value assembled into the instruction
loaded into IR as part of instruction
value obtained from IR as instruction executed
e.g. MOV AL, ; AL is 8 bit dest
instruction encoding includes 8-bit value 05h
what about: MOV AX, 5
16-bit dest: encoding includes 16-bit value 0005h
what about MOV 4, BH ;lets be ridiculous
dest as immediate value ?
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

16. Direct Addressing Mode
specify the address of a memory operand
specify address as a constant value
address gets encoded as part of instruction
must be known when program is assembled !
potential ambiguity? MOV AX, 3FC0H
is 3FC0H an immediate constant or address?
need syntax to clarify intention!
use square brackets “[” and “]”
[A] means A is the address of the operand
MOV AX, 3FC0H ;AX := 3FC0H
MOV AX, [ 3FC0H ] ;AX:= contents of cell 3FC0H
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

17. Indirect Addressing Mode
simple form: use current contents of a register as the address of an operand
only these registers can be used:
for memory operands: BX, BP, SI, DI
for I/O operands: DX
e.g. MOV CX, [ BX ]
contents of BX are used as the memory address of value (16-bit, little endian) to load into CX
only makes any sense if earlier instruction(s) put a useful address into BX!
more complex forms later!
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

18. Indirect Addressing Mode (contd)
potential ambiguity?
MOV CX, [ BX ] v.s. MOV CX, BX
register, immediate and direct are static modes
operand bound to instruction at assemble-time
indirect is a dynamic mode
operand bound to instruction at run-time
depends on values at time instruction executed
more powerful!  more complicated! 
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

19. Manipulating I/O Ports
MOV allows only register and memory operands
so what accesses I/O ports?
IN read a value from a port
OUT write a value to a port
IN / OUT: always use AL (or AX) and [DX]
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

20. I/O Port Example For now: OUT [DX], AL
the 8-bit value in AL is written to the I/O port addressed by the contents of DX (indirect mode!)
Display character at the “current” cursor position:
write 7-bit ASCII encoded char to port 04E9H
must set up DX to point to I/O port
must set up AL to contain char
write: display char and “advance” cursor
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

21. I/O Example (contd) MOV DX, 04E9H ; set display port address
MOV AL, 30H ; char = ‘0’
OUT [DX], AL ; put char on display
(whew!)
Enough for a simple program?
     MOV and OUT
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

22. Assembler Program comments start with “ ; ” label definition
; simple program that displays 'Hi'
start:
mov dx, 04E9H ; get display port address
mov al, 'H' ; display 'H'
out [dx], al  ;
mov al, 'i' ; display 'i'
hlt ; STOP!
end start
Where pgm starts
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

23. above is “source” code – human-oriented
Assembler Program
above is “source” code – human-oriented
must be converted to binary values for loading into memory
ASSEMBLER is a program that encodes / translates this sort of repr. of a program into the internal repr. required to run it.
CROSS ASSEMBLERS translate into internal repr. for different machines
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

24. Operand Compatibility
operands must have compatible sizes
if register mode is used, then no ambiguity
 operand size = register size
But no register operands  potential ambiguity!
Consider:
MOV AX, 1
MOV [ BX ], 1
MOV [1234H], 0
16-bit operand
no ambiguity!
8-bit or 16-bit moves?
default?
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

25. Operand Compatibility (contd)
need syntax to remove ambiguity
qualify off-processor access using:
WORD PTR word pointer – 16-bit operand
BYTE PTR byte pointer – 8-bit operand
e.g. no ambiguity with:
MOV BYTE PTR [ BX ], 1 ;8 bit dest
MOV WORD PTR [1234H], 0 ;16 bit dest
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

26. Data Manipulation Instructions
use state variable values to compute new values
modify state variables to hold results (incl FLAGS)
ADD dest, src
 dest := dest + src (bitwise add)
dest is both a source and destination operand
also modifies FLAGS as part of instruction execution:
ZF := 1 if-and-only-if (iff) result = 0
SF := 1 iff msbit of result = 1 (sign = negative)
CF := 1 iff carry out of msbit
OF := 1 iff result overflowed signed capacity
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

27. Data Manipulation Example
Suppose that AH contains 73H, when
IP  ADD AH, 40H
results: AH := 0B3H
ZF := 0 result  0
SF := 1 result is negative (signed)
CF := 0 (no carry out of msbit)
OF := ve + +ve = ve
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

28. More Data Manipulation Instructions
SUB dest, src (Subtract)
 dest := dest – src
like ADD, but bitwise subtract
modifies flags as in ADD, except:
CF := 1 iff borrow into msbit 
CMP dest, src (Compare)
like SUB, except dest is not modified
modifies FLAGS ONLY !
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

29. More Data Manipulation Instructions
DIV src (Unsigned Integer Divide)
where src may be specified using:
register, direct or indirect mode, NOT immediate mode!
size of divisor (8-bit or 16-bit) is determined by size of src
if direct or indirect used for src, must clarify size using BYTE PTR or WORD PTR
e.g. DIV WORD PTR [BX ]
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

30. More Data Manipulation Instructions
16-bit dividend
8-bit divisor (src)
DIV src
for 8-bit src: divide src into 16-bit value in AX
two 8-bit results
AL := AX  src (unsigned divide)
AH := AX mod src ( unsigned modulus)
flags are undefined after DIV (values may have changed, no meaning)
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

31. More Data Manipulation Instructions
32-bit dividend
16-bit divisor (src)
DIV src
for 16-bit src:
divide src into 32-bit value obtained by concatenating DX and AX (written DX:AX)
AX := DX:AX  src (unsigned divide)
DX := DX:AX mod src (unsigned modulus)
flags are undefined after DIV
what if result is too big to fit in destination?
e.g. AX  1 ?? AL = ?? overflow trap – more later!
in assignment 2: use 16-bit source form. Why?
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

32. Control Flow Instructions
See Instruction Reference (posted) for more complete list of instructions – includes effects on FLAGS !!
execution may change value in IP
changes address for fetch of next instruction
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

33. High Level Language Example
Why is C++ called a structured language?  e.g.: C++ control flow
if ( condition )
{ block T: do this if condition true; }
else { block F: do this if condition false;}
next_statement;
if condition is true  continue sequentially into block T, at end of block T, must skip to next_statement
if condition false  skip past block T to block F, then continue sequentially through block F and on to next_statement
May use data manipulation
to decide condition
Need control flow instructions to ‘skip’
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

34. JMP Instruction JMP target (Unconditional JUMP)  IP := IP + target
control is always transferred to the specified target
target operand is assembled as an immediate, 16-bit, signed value
relative offset (in bytes) from the end of the JMP instruction to the start of the next instruction to be fetched
16-bit signed value
+ve allows JMP forward (to higher address)
–ve allows jump backwards (to lower address) e.g. loop back
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

35. Execution of JMP Address Contents 0034H 0E9H 0035H 10H 0036H 00H
start of fetch: IP = 0034H IR = ????????
after fetch: IP = 0037H IR = E9 0010
after execute: IP = 0047H IR = E9 0010
16-bit relative offset
JMP 0010H
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

36. label: identifies an address
Conditional Jumps
specify condition in terms of FLAG values
e.g. JZ JumpZero
 if ZF==1: then jump to JumpZero else continue
e.g.: looping example
MOV CX,5 ;loop 5 times
DoLoop:
SUB CX, 1
JNZ DoLoop
many possible conditions - see Instruction Reference
label: identifies an address
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

37. Conditional Jumps (contd)
often condition and “not” condition are valid instr
e.g. JZ dest (Jump Zero)
JNZ dest (Jump Not Zero)
JC dest (Jump Carry)
more too! (Instruction Reference!)
Conditional Jump often follows CMP
CMP AL, 10
JL LessThanTen
; some code here
LessThanTen:
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

38. Conditional Jumps (contd)
CMP dest, src (Compare)
performs dest – src and sets FLAGS
often useful to think of combination as:
CMP dest, src
Jxx jmpdest
jump is taken if “dest xx src” condition holds
Some conditions for xx:
JE Jump Equal (opposite is JNE)
JL Jump Less Than (JNL)
JLE Jump Less Than or Equal (JNLE)
JG Jump Greater Than
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

39. Conditional Jumps (contd)
processor provides FLAGS to reflect results of (binary) manipulation under both signed and unsigned interpretations
instructions for different interpretations! 
Unsigned Signed
JA Above JG Greater
JAE Above or Equal JGE Greater or Equal
JB Below JL Less
JBE Below or Equal JLE Less or Equal
(instructions for Not conditions too!)
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

40. Conditional Jumps (contd)
Suppose AX contains 7FFFH:
Scenario 1 Scenario 2
CMP AX, 8000H CMP AX, 8000H
JA Bigger JG Bigger
In each scenario, is the jump taken? Why?
Programmer MUST know how binary values are to be interpreted! (e.g. value in AX above)
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

41. Conditional Jumps (contd)
Conditional jump limitation: uses 8-bit signed relative offset!
IP := IP + offset
can’t jump very far! – 128  +127 bytes
example: JL Less
Less:
MOV . . .
8 bits, ‘sign extended to 16 bits’
some code
here
maximum possible distance = 127 bytes
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor

42. Conditional Jumps (contd)
One possible workaround if distance is greater than 127 bytes (but not the only one!):
JNL Continue
JMP Less
Continue:
Less:
MOV . . .
16-bit relative offset
lots of
code here
distance >> 127 bytes
01 Oct-01
Fall 2001: copyright ©T. Pearce, D. Hutchinson, L. Marshall Sept. 2001
94201.lecture9-12-processor