UNIT IV

16 and 32 Microprocessors

IA 32

This chapter describes the basic execution environment of an IA-32 processor as seen by assembly-
language programmers. It describes how the processor executes instructions and how it stores and
manipulates data. The parts of the execution environment described here include memory (the address
space), the general-purpose data registers, the segment registers, the EFLAGS register, and the instruction
pointer register.

Any program or task running on an IA-32 processor is given a set of resources for executing instructions
and for storing code, data, and state information. These resources (described briefly in the following
paragraphs and shown in Figure 3-1) make up the basic execution environment for an IA-32 processor.
This basic execution environment is used jointly by the application programs and the operating-system or
executive running on the processor.
• Address Space: Any task or program running on an IA-32 processor can address a linear address space
of up to 4 GBytes (232 bytes) and a physical address space of up to 64 GBytes (236 bytes).
• Basic program execution registers: The eight general-purpose registers, the six segment registers, the
EFLAGS register, and the EIP (instruction pointer) register comprise a basic execution environment in
which to execute a set of general-purpose instructions. These instructions perform basic integer arithmetic
on byte, word, and doubleword integers, handle program flow control, operate on bit and byte strings, and
address memory.
• x87 FPU registers: The eight x87 FPU data registers, the x87 FPU control register, the status register,
the x87 FPU instruction pointer register, the x87 FPU operand (data) pointer register, the x87 FPU tag
register, and the x87 FPU opcode register provide an execution environment for operating on single-
precision, double-precision, and double extended precision floating-point values, word-, doubleword, and
quadword integers, and binary coded decimal (BCD) values.
• MMX™ registers: The eight MMX registers support execution of single-instruction, multiple-data
(SIMD) operations on 64-bit packed byte, word, and doubleword integers.
• XMM registers: The eight XMM data registers and the MXCSR register support execution of SIMD
operations on 128-bit packed single-precision and double-precision floating-point values and on 128-bit
packed byte, word, doubleword, and quadword integers.
• Stack: To support procedure or subroutine calls and the passing of parameters between procedures or
subroutines, a stack and stack management resources are included in the execution environment. The stack
(not shown in Figure 3-1) is located in memory. In addition to the resources provided in the basic
execution environment, the IA-32 architecture provides the following system resources. These resources
are part of the IA-32 architecture’s system-level architecture. They provide extensive support for
operating-system and system development software.
• I/O Ports: The IA-32 architecture supports transfers of data to and from input/output (I/O) ports
• Control registers: The five control registers (CR0 through CR5) determine the operating mode of the
processor and the characteristics of the currently executing task.

• Memory management registers: The GDTR, IDTR, task register, and LDTR specify the locations of
data structures used in protected mode memory management.

• Debug registers: The debug registers (DR0 through DR7) control and allows monitoring of the
processor’s debugging operations.

• Memory type range registers (MTRRs): The MTRRs are used to assign memory types to regions of
memory.

• Machine check registers (MCRs): The MCR registers consist of a set of control, status, and error-
reporting registers that are used to detect and report on hardware (machine) errors.

• Performance monitoring counters: The performance monitoring counters allow processor

performance events to be monitored.
Fig. 3.1 IA 32 Basic Execution Environment
Memory Organization
The memory that the processor addresses on its bus is called physical memory. Physical memory is
organized as a sequence of 8-bit bytes. Each byte is assigned a unique address, called a physical address.
The physical address space ranges from zero to a maximum of 236 – 1 (64 GBytes).

Virtually any operating system or executive designed to work with an IA-32 processor will use the
processor’s memory management facilities to access memory. These facilities provide features such as
segmentation and paging, which allow memory to be managed efficiently and reliably. When employing
the processor’s memory management facilities, programs do not directly address physical memory.
Instead, they access memory using any of three memory models: flat, segmented, or real-address mode.
With the flat memory model (see Figure 3-2), memory appears to a program as a single, continuous
address space, called a linear address space. Code (a program’s instructions), data, and the procedure
stack are all contained in this address space. The linear address space is byte addressable, with addresses
running contiguously from 0 to 232 1. An address for any byte in the linear address space is called a
linear address.

Fig.3.2: Three Memory Management Models

With the segmented memory model, memory appears to a program as a group of independent address
spaces called segments. When using this model, code, data, and stacks are typically contained in separate
segments. To address a byte in a segment, a program must issue a logical address, which consists of a
segment selector and an offset. (A logical address is often referred to as a far pointer) The segment
selector identifies the segment to be accessed and the offset identifies a byte in the address space of the
segment. The programs running on an IA-32 processor can address up to 16,383 segments of different
sizes and types, and each segment can be as large as 232 bytes.

Internally, all the segments that are defined for a system are mapped into the processor’s linear address
space. To access a memory location, the processor thus translates each logical address into a linear
address. This translation is transparent to the application program.

The primary reason for using segmented memory is to increase the reliability of programs and systems.
For example, placing a program’s stack in a separate segment prevents the stack from growing into the
code or data space and overwriting instructions or data, respectively. Placing the operating system’s or
executive’s code, data, and stack in separate segments also protects them from the application program
and vice versa.

With the flat or the segmented memory model, the linear address space is mapped into the processor’s
physical address space either directly or through paging. When using direct mapping (paging disabled),
each linear address has a one-to-one correspondence with a physical address (that is, linear addresses are
sent out on the processor’s address lines without translation). When using the IA-32 architecture’s paging
mechanism (paging enabled), the linear address space is divided into pages, which are mapped into
virtual memory. The pages of virtual memory are then mapped as needed into physical memory. When
an operating system or executive uses paging, the paging mechanism is transparent to an application
program; that is, all the application program sees is the linear address space.

The real-address mode model uses the memory model for the Intel 8086 processor. This memory model
is supported in the IA-32 architecture for compatibility with existing programs written to run on the Intel
8086 processor. The real-address mode uses a specific implementation of segmented memory in which
the linear address space for the program and the operating system/executive consists of an array of
segments of up to 64 KBytes in size each. The maximum size of the linear address space in real-address
mode is 220 bytes.
Modes of Operation vs. Memory Model
When writing code for an IA-32 processor, a programmer needs to know the operating mode the processor
is going to be in when executing the code and the memory model being used. The relationship between
operating modes and memory models is as follows:

• Protected mode. When in protected mode, the processor can use any of the memory models described
in this section. (The real-addressing mode memory model is ordinarily used only when the processor is
in the virtual-8086 mode.) The memory model used depends on the design of the operating system or
executive. When multitasking is imple- mented, individual tasks can use different memory models.

• Real-address mode. When in real-address mode, the processor only supports the real- address mode
memory model.

• System management mode. When in SMM, the processor switches to a separate address space, called
the system management RAM (SMRAM). The memory model used to address bytes in this address
space is similar to the real-address mode model.

32-Bit vs. 16-Bit Address and Operand Sizes

The processor can be configured for 32-bit or 16-bit address and operand sizes. With 32-bit address and
operand sizes, the maximum linear address or segment offset is FFFFFFFFH (232-1), and operand sizes
are typically 8 bits or 32 bits. With 16-bit address and operand sizes, the maximum linear address or
segment offset is FFFFH (216-1), and operand sizes are typically 8 bits or 16 bits. When using 32-bit
addressing, a logical address (or far pointer) consists of a 16-bit segment selector and a 32-bit offset; when
using 16-bit addressing, it consists of a 16-bit segment selector and a 16-bit offset. Instruction prefixes
allow temporary overrides of the default address and/or operand sizes from within a program.

When operating in protected mode, the segment descriptor for the currently executing code segment
defines the default address and operand size. A segment descriptor is a system data structure not normally
visible to application code. Assembler directives allow the default addressing and operand size to be
chosen for a program. The assembler and other tools then set up the segment descriptor for the code
segment appropriately.

When operating in real-address mode, the default addressing and operand size is 16 bits. An address-size
override can be used in real-address mode to enable 32-bit addressing; however, the maximum allowable
32-bit linear address is still 000FFFFFH (220-1).
Extended Physical Addressing

Beginning with the Pentium Pro processor, the IA-32 architecture supports addressing of up to 64
GBytes (236 bytes) of physical memory. A program or task cannot address locations in this address space
directly. Instead it addresses individual linear address spaces of up to 4 GBytes that are mapped to the
larger 64-GByte physical address space through the processor’s virtual memory management
mechanism. A program can switch between linear address spaces within this 64-GByte physical address
space by changing segment selectors in the segment registers. The use of extended physical addressing
requires the processor to operate in protected mode and the operating system to provide a virtual memory
management system.

Basic Program Execution Registers

The processor provides 16 registers basic program execution registers for use in general system and
application programming. As shown in Figure 3-3, these registers can be grouped as follows:

• General-Purpose Registers: These eight registers are available for storing operands and pointers.
• Segment Registers: These registers hold up to six segment selectors.
• EFLAGS (program status and control) Register: The EFLAGS register report on the status of the
program being executed and allows limited (application-program level) control of the processor.

• EIP (instruction pointer) Register: The EIP register contains a 32-bit pointer to the next instruction
to be executed.

General-Purpose Registers
The 32-bit general-purpose registers EAX, EBX, ECX, EDX, ESI, EDI, EBP, and ESP are provided for
holding the following items:

• Operands for logical and arithmetic operations

• Operands for address calculations
• Memory pointers.
Although all of these registers are available for general storage of operands, results, and pointers,
caution should be used when referencing the ESP register. The ESP register holds the stack pointer and
as a general rule should not be used for any other purpose.
 Fig.3.3: Application Programming Registers

Many instructions assign specific registers to hold operands. For example, string instructions use the
contents of the ECX, ESI, and EDI registers as operands. When using a segmented memory model,
some instructions assume that pointers in certain registers are relative to specific segments. For instance,
some instructions assume that a pointer in the EBX register points to a memory location in the DS
segment.

• EAX—Accumulator for operands and results data.

• EBX—Pointer to data in the DS segment.
• ECX—Counter for string and loop operations.
• EDX—I/O pointer.
• ESI—Pointer to data in the segment pointed to by the DS register; source pointer for string operations.
• EDI—Pointer to data (or destination) in the segment pointed to by the ES register; destination pointer
for string operations.

• ESP—Stack pointer (in the SS segment).

• EBP—Pointer to data on the stack (in the SS segment).
As shown in Figure 3-4, the lower 16 bits of the general-purpose registers map directly to the register set
found in the 8086 and Intel 286 processors and can be referenced with the names AX, BX, CX, DX, BP,
SP, SI, and DI. Each of the lower two bytes of the EAX, EBX, ECX, and EDX registers can be referenced
by the names AH, BH, CH, and DH (high bytes) and AL, BL, CL, and DL (low bytes).

Fig.3.4: Alternate General Purpose Registers

Segment Registers
The segment registers (CS, DS, SS, ES, FS, and GS) hold 16-bit segment selectors. A segment selector
is a special pointer that identifies a segment in memory. To access a particular segment in memory, the
segment selector for that segment must be present in the appropriate segment register.

When writing application code, programmers generally create segment selectors with assembler
directives and symbols. The assembler and other tools then create the actual segment selector values
associated with these directives and symbols. If writing system code, programmers may need to create
segment selectors directly. How segment registers are used depends on the type of memory management
model that the operating system or executive is using. When using the flat (unsegmented) memory
model, the segment registers are loaded with segment selectors that point to overlapping segments, each
of which begins at address 0 of the linear address space (as shown in Figure 3-5). These overlap- ping
segments then comprise the linear address space for the program. (Typically, two overlap- ping segments
are defined: one for code and another for data and stacks. The CS segment registers points to the code
segment and the other entire segment registers point to the data and stack segment).
When using the segmented memory model, each segment register is ordinarily loaded with a different
segment selector so that each segment register points to a different segment within the linear address
space (as shown in Figure 3-6). At any time, a program can thus access up to six segments in the linear
address space. To access a segment not pointed to by one of the segment registers, a program must first
load the segment selector for the segment to be accessed into a segment register.

Fig.3.5: Use of Segment Registers for Flat Memory Model

Fig.3.6: Use of Segment Registers in Segmented Memory Model

Each of the segment registers is associated with one of three types of storage: code, data, or stack). For
example, the CS register contains the segment selector for the code segment, where the instructions being
executed are stored. The processor fetches instructions from the code segment, using a logical address
that consists of the segment selector in the CS register and the contents of the EIP register. The EIP
register contains the offset within the code segment of the next instruction to be executed. The CS
register cannot be loaded explicitly by an application program. Instead, it is loaded implicitly by
instructions or internal processor operations that change program control (such as, procedure calls,
interrupt handling, or task switching).

The DS, ES, FS, and GS registers point to four data segments. The availability of four data segments
permits efficient and secure access to different types of data structures. For example, four separate data
segments might be created: one for the data structures of the current module, another for the data
exported from a higher-level module, a third for a dynamically created data structure, and a fourth for
data shared with another program. To access additional data segments, the application program must load
segment selectors for these segments into the DS, ES, FS, and GS registers, as needed.

The SS register contains the segment selector for a stack segment, where the procedure stack is stored for
the program, task, or handler currently being executed. All stack operations use the SS register to find
the stack segment. Unlike the CS register, the SS register can be loaded explicitly, which permits
application programs to set up multiple stacks and switch among them. The four segment registers CS,
DS, SS, and ES are the same as the segment registers found in the Intel 8086 and Intel 286 processors
and the FS and GS registers were introduced into the IA- 32 Architecture with the Intel386™ family of
processors.

EFLAGS Register
The 32-bit EFLAGS register contains a group of status flags, a control flag, and a group of system flags.
Figure 3-7 defines the flags within this register. Following initialization of the processor (either by
asserting the RESET pin or the INIT pin), the state of the EFLAGS register is 00000002H. Bits 1, 3, 5,
15, and 22 through 31 of this register are reserved. Software should not use or depend on the states of
any of these bits.

Some of the flags in the EFLAGS register can be modified directly, using special-purpose instructions
(described in the following sections). There are no instructions that allow the whole register to be
examined or modified directly. However, the following instructions can be used to move groups of flags
to and from the procedure stack or the EAX register: LAHF, SAHF, PUSHF, PUSHFD, POPF, and
POPFD. After the contents of the EFLAGS register have been transferred to the procedure stack or EAX
register, the flags can be examined and modified using the processor’s bit manipulation instructions (BT,
BTS, BTR, and BTC).

When suspending a task (using the processor’s multitasking facilities), the processor automatically saves
the state of the EFLAGS register in the task state segment (TSS) for the task being suspended. When
binding itself to a new task, the processor loads the EFLAGS register with data from the new task’s
TSS. When a call is made to an interrupt or exception handler procedure, the processor automatically
saves the state of the EFLAGS registers on the procedure stack. When an interrupt or exception is
handled with a task switch, the state of the EFLAGS register is saved in the TSS for the task being
suspended.

Fig.3.7: Eflags Register

 As the IA-32 Architecture has evolved, flags have been added to the EFLAGS register, but the function
and placement of existing flags have remained the same from one family of the IA-32 processors to the
next. As a result, code that accesses or modifies these flags for one family of IA-32 processors works as
expected when run on later families of processors.

STATUS FLAGS
The status flags (bits 0, 2, 4, 6, 7, and 11) of the EFLAGS register indicate the results of arithmetic
instructions, such as the ADD, SUB, MUL, and DIV instructions. The functions of the status flags are as
follows:

CF (bit 0) Carry flag. Set if an arithmetic operation generates a carry or borrow out of the most-
significant bit of the result; cleared otherwise. This flag indicates an overflow condition
for unsigned-integer arithmetic. It is also used in multiple-precision arithmetic.

PF (bit 2) Parity flag. Set if the least-significant byte of the result contains an even number of 1 bit;
cleared otherwise.
AF (bit 4) Adjust flag. Set if an arithmetic operation generates a carry or borrow out of bit 3 of the
result; cleared otherwise. This flag is used in binary- coded decimal (BCD) arithmetic.

ZF (bit 6) Zero flag. Set if the result is zero; cleared otherwise.

SF (bit 7) Sign flag. Set equal to the most-significant bit of the result, which is the sign bit of a
signed integer. (0 indicates a positive value and 1 indicates a negative value.)

OF (bit 11) Overflow flag. Set if the integer result is too large a positive number or too small a
negative number (excluding the sign-bit) to fit in the destination operand; cleared
otherwise. This flag indicates an overflow condition for signed-integer (two’s
complement) arithmetic.

Of these status flags, only the CF flag can be modified directly, using the STC, CLC, and CMC
instructions. Also the bit instructions (BT, BTS, BTR, and BTC) copy a specified bit into the CF flag.

The status flags allow a single arithmetic operation to produce results for three different data types:
unsigned integers, signed integers, and BCD integers. If the result of an arithmetic operation is treated as
an unsigned integer, the CF flag indicates an out-of-range condition (carry or borrow); if treated as a
signed integer (two’s complement number), the OF flag indicates a carry or borrow; and if treated as a
BCD digit, the AF flag indicates a carry or borrow. The SF flag indicates the sign of a signed integer. The
ZF flag indicates either a signed- or an unsigned- integer zero.

When performing multiple-precision arithmetic on integers, the CF flag is used in conjunction with add
with carry (ADC) and subtract with borrow (SBB) instructions to propagate a carry or borrow from one
computation to the next. The condition instructions Jcc (jump on condition code cc), SETcc (byte set on
condition code cc), LOOPcc, and CMOVcc (conditional move) use one or more of the status flags as
condition codes and test them for branch, set-byte, or end-loop conditions.

DF FLAG

The direction flag (DF, located in bit 10 of the EFLAGS register) controls the string instructions (MOVS,
CMPS, SCAS, LODS, and STOS). Setting the DF flag causes the string instructions to auto-decrement
(that is, to process strings from high addresses to low addresses). Clearing the DF flag causes the string
instructions to auto-increment (process strings from low addresses to high addresses). The STD and
CLD instructions set and clear the DF flag, respectively.

System Flags and IOPL Field

The system flags and IOPL field in the EFLAGS register control operating-system or executive
operations. They should not be modified by application programs. The functions of the system flags are
as follows:

IF (bit 9) Interrupt enable flag. Controls the response of the processor to maskable interrupt
requests. Set to respond to maskable interrupts; cleared to inhibit maskable interrupts.

TF (bit 8) Trap flag. Set to enable single-step mode for debugging; clear to disable single-step
mode.

IOPL I/O privilege level field. Indicates the I/O privilege level of the currently running program
or task. The current privilege level (CPL) of the currently running program or task must be
less than or equal to the I/O privilege level to access the I/O address space. This field can
only be modified by the POPF and IRET instructions when operating at a CPL of 0.

NT (bit 14) Nested task flag. Controls the chaining of interrupt called tasks. Set when the current task
 is linked to the previously executed task; cleared when the current task is not linked to
another task.

RF (bit 16) Resume flag. Controls the processor’s response to debug exceptions.

VM (bit 17) Virtual-8086 mode flag. Set to enable virtual-8086 mode; clear to return to protected
mode.

AC (bit 18) Alignment check flag. Set this flag and the AM bit in the CR0 register to enable
alignment checking of memory references; clear the AC flag and/or the AM bit to disable
alignment checking.

VIF (bit 19) Virtual interrupt flag. Virtual image of the IF flag. Used in conjunction with the VIP flag.
(To use this flag and the VIP flag the virtual mode extensions are enabled by setting the
VME flag in control register CR4.)

VIP (bit 20) Virtual interrupt pending flag. Set to indicate that an interrupt is pending; clear when no
interrupt is pending. (Software sets and clears this flag; the processor only reads it.) Used
in conjunction with the VIF flag.

ID (bit 21) Identification flag. The ability of a program to set or clear this flag indicates support for
the CPUID instruction.

INSTRUCTION POINTER

The instruction pointer (EIP) register contains the offset in the current code segment for the next
instruction to be executed. It is advanced from one instruction boundary to the next in straight- line code
or it is moved ahead or backwards by a number of instructions when executing JMP, Jcc, CALL, RET,
and IRET instructions.

The EIP register cannot be accessed directly by software; it is controlled implicitly by control- transfer
instructions (such as JMP, Jcc, CALL, and RET), interrupts, and exceptions. The only way to read the
EIP register is to execute a CALL instruction and then read the value of the return instruction pointer
from the procedure stack. The EIP register can be loaded indirectly by modifying the value of a return
instruction pointer on the procedure stack and executing a return instruction (RET or IRET).
All IA-32 processors prefetch instructions. Because of instruction prefetching, an instruction address
read from the bus during an instruction load does not match the value in the EIP register. Even though
different processor generations use different prefetching mechanisms, the function of EIP register to
direct program flow remains fully compatible with all software written to run on IA-32 processors.

OPERAND ADDRESSING
IA32 machine-instructions act on zero or more operands. Some operands are specified explicitly in an
instruction and others are implicit to an instruction. An operand can be located in any of the following
places:
• The instruction itself (an immediate operand).
• A register.
• A memory location.
• An I/O port.
Immediate Operands

Some instructions use data encoded in the instruction itself as a source operand. These operands are called
immediate operands (or simply immediates). For example, the following ADD instruction adds an
immediate value of 14 to the contents of the EAX register:

ADD EAX, 14

All the arithmetic instructions (except the DIV and IDIV instructions) allow the source operand to be an
immediate value. The maximum value allowed for an immediate operand varies among instructions, but
can never be greater than the maximum value of an unsigned doubleword integer (232).

Register Operands

Source and destination operands can be located in any of the following registers, depending on the
instruction being executed:

• The 32-bit general-purpose registers (EAX, EBX, ECX, EDX, ESI, EDI, ESP, or EBP).
• The 16-bit general-purpose registers (AX, BX, CX, DX, SI, DI, SP, or BP).
• The 8-bit general-purpose registers (AH, BH, CH, DH, AL, BL, CL, or DL).
• The segment registers (CS, DS, SS, ES, FS, and GS).
• The EFLAGS register.
• System registers, such as the global descriptor table (GDTR) or the interrupt descriptor table
register (IDTR).

Some instructions (such as the DIV and MUL instructions) use quadword operands contained in a pair
of 32-bit registers. Register pairs are represented with a colon separating them. For example, in the
register pair EDX:EAX, EDX contains the high order bits and EAX contains the low order bits of a
quadword operand.

Several instructions (such as the PUSHFD and POPFD instructions) are provided to load and store the
contents of the EFLAGS register or to set or clear individual flags in this register. Other instructions (such
as the Jcc instructions) use the state of the status flags in the EFLAGS register as condition codes for
branching or other decision making operations.

The processor contains a selection of system registers that are used to control memory manage- ment,
interrupt and exception handling, task management, processor management, and debug- ging activities.
Some of these system registers are accessible by an application program, the operating system, or the
executive through a set of system instructions. When accessing a system register with a system
instruction, the register is generally an implied operand of the instruction.

Memory Operands

Source and destination operands in memory are referenced by means of a segment selector and an offset
(see Figure 3-8). The segment selector specifies the segment containing the operand and the offset (the
number of bytes from the beginning of the segment to the first byte of the operand) specifies the linear
or effective address of the operand.

Fig.3.8: Memory Operand Address

I/O Port Addressing

The processor supports an I/O address space that contains up to 65,536 8-bit I/O ports. Ports that are 16-bit
and 32-bit may also be defined in the I/O address space. An I/O port can be addressed with either an
immediate operand or a value in the DX register.
Note: IA-64 is an upgraded version of IA-32 model. Different modes depend upon the
basic IA-32 architecture and hence can be studied by making comparison between the
two register sets. For detailed information and analysis refer the following link:

https://www.intel.com/content/dam/support/us/en/documents/processors/pentium4/sb/253
66521.pdf