Software of 80x86

Registers and Instructions Set

Registers

• General Registers

• Segment Registers

• Status Rgisters

8086

Pentium

• Control Registers

• Memory Management Registers

• FPU Registers

• Test Registers

8086 Registers

General Registers

16 15

Stack Mechanism

PUSH AX=======DEC SP[SP]=AHDEC SP[SP]=AL

Events on Visual C++

• int p; ESP=0x0012F3B8

• p=test(3,4,0x1235)– push 5 ESP=0x0012F3B4

• [0x0012F3B4]=0x35

– push 4 ESP=0x0012F3B0 – push 3 ESP=0x0012F3AC– call test ESP=0x0012F3A8

Inside the testint test(int x,int y,int z){x2F0 55 push ebp x2F1 8B EC mov ebp,esp x2F3 81 EC CC 00 00 00 sub esp,0CCh x2F9 53 push ebx x2FA 56 push esi x2FB 57 push edi x2FC 8D BD 34 FF FF FF lea edi,[ebp-0CCh] x302 B9 33 00 00 00 mov ecx,33h x307 B8 CC CC CC CC mov eax,0CCCCCCCCh x30C F3 AB rep stos dword ptr es:[edi]

int u;u=x;

x30E 8B 45 08 mov eax,dword ptr [x] x311 89 45 F8 mov dword ptr [u],eax

u=u+y;x314 8B 45 F8 mov eax,dword ptr [u] x317 03 45 0C add eax,dword ptr [y] x31A 89 45 F8 mov dword ptr [u],eax

u=u+z;x31D 8B 45 F8 mov eax,dword ptr [u] x320 03 45 10 add eax,dword ptr [z] x323 89 45 F8 mov dword ptr [u],eax

return u;x326 8B 45 F8 mov eax,dword ptr [u]

z

y

x

EIP

EBP

CC Bytes

SP new Position

EFLAG Register

FPU Registers

Memory Management Registers

Control Registers

Debug Registers

Bit and Byte Order

Data Types

• Signed (integer) or unsigned (ordinal)

• BCD : Packed (1 byte = 2 digits) or Unpacked

•Floating point

Memory Organization

• Physical MemoryByte order – from 0 to 0FFFFFH (1 Megabytes)

• Logical AddressSegmentation translates this to a Linear Address

SEGMENT:OFFSET

Segmentation• Linear Address = Segment * 16 (or 0x10) + Offset

– Example: Segment=0x2000 ; Offset = 0x444

– Linear Address = 0x2000*0x10+0x444=0x20444

• Segment Registers: CS, DS, SS, ES– Example CS=0x3000 ; DI=0x2345

– CS:DI=0x3000*0x10+0x2345=0x32345

• Mov AX , ES:DI ; AX = [ES*10H+DI]• Segment Size = 64K• Offset Size = from 0000 to FFFF)

Real Mode Segmentation

X Y Z W

T U V S

K N M SL1/0

16 bit Segment

16 bit Offset

Linear 20/21 bit Address

Always zero in 8086- A20M Pin determines the status in pentiumIf A20M = 0 then in real mode this bit is always Zero

Default Segment Selection Rules

Instructions Set

Introduction to Instructions Set

8086 InstructionsAAA

AAD

AAM

AAS

ADC

ADD

AND

CALL

CBW

CLC

CLD

CLI

CMC

CMP

CMPSB

CMPSW

CWD

DAA

DAS

DEC

DIV

HLT

IDIV

IMUL

IN

INC

INT

INTO

IRET

JA

JAE

JB

JBE

JC

JCXZ

JE

JG

JGE

JL

JLE

JMP

JNA

JNAE

JNB

JNBE

JNC

JNE

JNG

JNGE

JNL

JNLE

JNO

JNP

JNS

JNZ

JO

JP

JPE

JPO

JS

JZ

LAHF

LDS

LEA

LES

LODSB

LODSW

LOOP

LOOPE

LOOPNE

LOOPNZ

LOOPZ

MOV

MOVSB

MOVSW

MUL

NEG

NOP

NOT

OR

OUT

POP

POPA

POPF

PUSH

PUSHA

PUSHF

RCL

RCR

REP

REPE

REPNE

REPNZ

REPZ

RET

RETF

ROL

ROR

SAHF

SAL

SAR

SBB

SCASB

SCASW

SHL

SHR

STC

STD

STI

STOSB

STOSW

SUB

TEST

XCHG

XLATB

XOR

Instruction References

• INTEGER INSTRUCTIONS

• MMX™ TECHNOLOGY INSTRUCTIONS

• FLOATING-POINT INSTRUCTIONS

• SYSTEM INSTRUCTIONS

System Instructions• LGDT Load global descriptor table (GDT) register• SGDT Store global descriptor table (GDT) register• LLDT Load local descriptor table (LDT) register• SLDT Store local descriptor table (LDT) register• LTR Load task register• STR Store task register• LIDT Load interrupt descriptor table (IDT) register• SIDT Store interrupt descriptor table (IDT) register• MOV Load and store control registers• LMSW Load machine status word : 286 Compatibility – 16 bits – Not to be used in pentium• SMSW Store machine status word• CLTS Clear the task-switched flag• ARPL Adjust requested privilege level• LAR Load access rights• LSL Load segment limit• VERR Verify segment for reading• VERW Verify segment for writing• MOV Load and store debug registers• INVD Invalidate cache, no writeback• WBINVD Invalidate cache, with writeback• INVLPG Invalidate TLB Entry• LOCK (prefix) Lock Bus• HLT Halt processor• RSM Return from system management mode (SSM)• RDMSR Read model-specific register• WRMSR Write model-specific register• RDPMC Read performance monitoring counters• RDTSC Read time stamp counter

Segment Descriptor

Application Descriptor Type

System Descriptor Type

Memory Management Registers

RSM

• Return From System Management Mode

• EDX:EAX TimeStampCounter

• Opcode : 0F 31

• An internal Counter

• A 64-bit MSR

• Incremened by every clock cycle

• Reset to 0 if CPU is reset

• Time Stamp Counter is read if

• CR4.TSD = 0 ; Time Stamp Disable

• CR4.TSD = 1 && CPL = 0 (Protected Mode)

• Exceptions

• #GP(0) Protected Mode if TSD = 1 && CPL > 0

• #GP Real Mode if TSD = 1

• #GP(0) Virtual 8086 Mode if TSD = 1

RDTSC

• Model Specific Registers

• 64 – bit

• Undefined after CPU Reset

• Unchanged on INIT

• WRMSR is a Serializing Instruction

• Purposes: testability, performance monitoring, and machine check errors

• RDMSR - WRMSR

• EDX:EAX MSR (ECX) ; Model Specific Register (64-bit)

• Opcode : 0F 32 / 0E 32

• MSR manipulation are privileged.

• Not Valid in Virtual Mode

• Always allowed in Real Mode

• If ECX Wrong Exception #GP(0) / #GP occurs

• CPUID: EDX.b5

MSR

MSR : Registers

Privileged Instructions• Instructions to be executed in Real Mode or

Protection Mode with CPL = 0– LIDT instructionLGDT instructionLMSW instructionMOV for control and debug registersCLTS instructionHLT instructionINVD instructionWBINVD instructionINVLPG instructionRDMSR instruction- WRMSR instruction- RSM

Serializing Instructions

Serializing : Any modifications to flags, registers, and memory for previous instructions are completed before the next instruction is fetched and executed.

CPUID INVD INVLPG

IRET IRETD LGDT

LIDT LLDT LTR

MOV to Debug Register

MOV to Control Register

RSM WBINVD WRMSR

Floating-Point Instructions

• DATA TRANSFER

• BASIC ARITHMETIC

• COMPARISON

• TRANSCENDENTAL

• LOAD CONSTANTS

• FPU CONTROL

FPU CONTROL• FINCSTP Increment FPU register stack pointer• FDECSTP Decrement FPU register stack pointer• FFREE Free floating-point register• FINIT Initialize FPU after checking error conditions• FNINIT Initialize FPU without checking error conditions• FCLEX Clear floating-point exception flags after checking for error• conditions• FNCLEX Clear floating-point exception flags without checking for error• conditions• FSTCW Store FPU control word after checking error conditions• FNSTCW Store FPU control word without checking error conditions• FLDCW Load FPU control word• FSTENV Store FPU environment after checking error conditions• FNSTENV Store FPU environment without checking error conditions• FLDENV Load FPU environment• FSAVE Save FPU state after checking error conditions• FNSAVE Save FPU state without checking error conditions• FRSTOR Restore FPU state• FSTSW Store FPU status word after checking error conditions• FNSTSW Store FPU status word without checking error conditions• WAIT/FWAIT Wait for FPU• FNOP FPU no operation

LOAD CONSTANTS

• FLD1 Load +1.0

• FLDZ Load +0.0

• FLDPI Load • FLDL2E Load log2e

• FLDLN2 Load loge2

• FLDL2T Load log210

• FLDLG2 Load log102

TRANSCENDENTAL• FSIN Sine

• FCOS Cosine

• FSINCOS Sine and cosine

• FPTAN Partial tangent st(0)=tan(st(0)); 1push register stack

• FPATAN Partial arctangent

• F2XM1 st(0)=2^st(0) 1

• FYL2X ylog2x

• FYL2XP1 ylog2(x+1)

COMPARISON• FCOM m32/m64/st(I)/none st(0):src flags:c0,c1,c2• FCOMP Compare real and pop• FCOMPP Compare real and pop twice• FUCOM Unordered compare real Does not generate an invalid-

arithmetic-operand exception• FUCOMP Unordered compare real and pop• FUCOMPP Unordered compare real and pop twice• FICOM m16/m32 Compare with integer• FICOMP Compare integer and pop• FCOMI Compare real and set EFLAGS(Z,P,C)• FUCOMI Unordered compare real and set EFLAGS• FCOMIP Compare real, set EFLAGS, and pop• FUCOMIP Unordered compare real, set EFLAGS, and pop• FTST Test real Compare St(0):0.0• FXAM Examine real

FXAM

C1 sign bit of ST; (* 0 for positive, 1 for negative *)

BASIC ARITHMETICFloatng point Addition/subtractionFSUBR, FSUBRP, FISUBR Reverse SubtractionFMUL Multiply realFMULP Multiply real and popFIMUL Multiply integerFDIV Divide realFDIVP Divide real and popFIDIV Divide integerFDIVR, FDIVRP, FIDIVR Reverse DivisionFPREM Partial remainder FPREMI IEEE Partial remainder st(0)%=st(1)FABS Absolute valueFCHS Change signFRNDINT Round to integerFSCALE Scale by power of two st(0)=st(0)*2^st(1)FSQRT Square rootFXTRACT st(0)=exponent(st(0)) significandregister stack

Floating Point Addition/Subtraction

DATA TRANSFERFLD m32real/m64real/m80real/st(I) push onto FPU register stackFST m32real/m64real/st(I) store st(0) on m32…. FSTP m32real/m64real/m80real/st(I) FST & pop stackFILD m16/m32/m64 Load integer. push onto FPU register

stackFIST Store integerFISTP Store integer and popFBLD Load BCDFBSTP Store BCD and popFXCH st(I)/none Exchange registers st(0) and st(I)/st(1)FCMOVE Floating-point conditional move if equalFCMOVNE Floating-point conditional move if not equalFCMOVB Floating-point conditional move if belowFCMOVBE Floating-point conditional move if below or equalFCMOVNB Floating-point conditional move if not belowFCMOVNBE Floating-point conditional move if not below or equalFCMOVU Floating-point conditional move if unorderedFCMOVNU Floating-point

INTEGER INSTRUCTIONS• DATA TRANSFERINSTRUCTIONS• BINARY ARITHMETIC INSTRUCTIONS• DECIMAL ARITHMETIC INSTRUCTIONS• LOGIC INSTRUCTIONS• SHIFT AND ROTATE INSTRUCTIONS• BIT AND BYTE INSTRUCTIONS• CONTROL TRANSFER INSTRUCTIONS• STRING INSTRUCTIONS• FLAG CONTROL INSTRUCTIONS• SEGMENT REGISTER INSTRUCTIONS• MISCELLANEOUS INSTRUCTIONS

MISCELLANEOUS INSTRUCTIONS

• LEA Load effective address• NOP No operation• UB2 Undefined instruction• XLAT/XLATB Table lookup translation

• D7 XLAT m8 AL = DS:[(E)BX + unsigned AL]• D7 XLATB

• CPUID Processor Identification

CPUID

Input: EAX

Output: EAX, EBX, ECX, and EDX

Encoding of Cache and TLB Descriptors

CPUID : EAX =1

First One:

• Model—0001B

• Family—0110B

• Processor Type—00B

Feature Flags Returned in EDX Register

Processor Type

LEA

8D 00 lea eax,[eax]8D 3F lea edi,[edi]8D 03 lea eax,[ebx] ; EAX = EBX66 8D 03 lea ax,[ebx] ; AX = BX67 8D 03 lea eax,[bp+di] ; EAX = (bp + di)%65536

SEGMENT REGISTER INSTRUCTIONS• LDS Load far pointer using DS

• LES Load far pointer using ES

• LFS Load far pointer using FS

• LGS Load far pointer using GS

• LSS Load far pointer using SS

At XP: C5 00 lds eax,fword ptr [eax]C5 3F lds edi,fword ptr [edi]66 C5 3F lds di,dword ptr [edi]67 C5 3F lds edi,fword ptr [bx]

FLAG CONTROL INSTRUCTIONS

• STC Set carry flag• CLC Clear the carry flag• CMC Complement the carry flag• CLD Clear the direction flag• STD Set direction flag• LAHF AH = SF:ZF:0:AF:0:PF:1:CF

• SAHF Store AH register into flags• PUSHF/PUSHFD Push EFLAGS onto stack• POPF/POPFD Pop EFLAGS from stack• STI Set interrupt flag• CLI Clear the interrupt flag

STRING INSTRUCTIONS• MOVS/MOVSB Move string/Move byte string• MOVS/MOVSW Move string/Move word string• MOVS/MOVSD Move string/Move doubleword string• CMPS/CMPSB Compare string/Compare byte string• CMPS/CMPSW Compare string/Compare word string• CMPS/CMPSD Compare string/Compare doubleword string• SCAS/SCASB Scan string/Scan byte string• SCAS/SCASW Scan string/Scan word string• SCAS/SCASD Scan string/Scan doubleword string• LODS/LODSB Load string/Load byte string• LODS/LODSW Load string/Load word string• LODS/LODSD Load string/Load doubleword string• STOS/STOSB Store string/Store byte string• STOS/STOSW Store string/Store word string• STOS/STOSD Store string/Store doubleword string• REP Repeat while ECX not zero• REPE/REPZ Repeat while equal/Repeat while zero• REPNE/REPNZ Repeat while not equal/Repeat while not zero• INS/INSB Input string from port/Input byte string from port• INS/INSW Input string from port/Input word string from port• INS/INSD Input string from port/Input doubleword string from port• OUTS/OUTSB Output string to port/Output byte string to port• OUTS/OUTSW Output string to port/Output word string to port• OUTS/OUTSD Output string to port/Output doubleword string to

port

INS/INSB/INSW/INSD

At windows XP:

6C ins byte ptr [edi],dx

6D ins dword ptr [edi],dx

LODS/LODSB/LODSW/LODSD

At windows XP:

AC lods byte ptr [esi]

AD lods dword ptr [esi]

SCAS/SCASB/SCASW/SCASD

MOVS/MOVSB/MOVSW/MOVSD

Preceding words: REP/REPE/REPZ/REPNE /REPNZ

Always: [DS:(E)SI] to [ES:(E)DI]

Then (E)SI, (E)DI (+ | -)=(1 | 2 | 4)

CONTROL TRANSFER INSTRUCTIONS• JMP Jump

• JE/JZ Jump if equal/Jump if zero

• JNE/JNZ Jump if not equal/Jump if not zero

• JA/JNBE Jump if above/Jump if not below or equal

• JAE/JNB Jump if above or equal/Jump if not below

• JB/JNAE Jump if below/Jump if not above or equal

• JBE/JNA Jump if below or equal/Jump if not above

• JG/JNLE Jump if greater/Jump if not less or equal

• JGE/JNL Jump if greater or equal/Jump if not less

• JL/JNGE Jump if less/Jump if not greater or equal

• JLE/JNG Jump if less or equal/Jump if not greater

• JC Jump if carry

• JNC Jump if not carry

• JO Jump if overflow• JNO Jump if not overflow• JS Jump if sign (negative)• JNS Jump if not sign (non-negative)• JPO/JNP Jump if parity odd/Jump if not parity• JPE/JP Jump if parity even/Jump if parity• JCXZ/JECXZ Jump register CX zero/Jump register ECX zero• LOOP Loop with ECX counter• LOOPZ/LOOPE Loop with ECX and zero/Loop with ECX and equal• LOOPNZ/LOOPNE Loop with ECX and not zero/Loop with ECX and not

equal• CALL Call procedure• RET Return• IRET Return from interrupt• INT Software interrupt• INTO Interrupt on overflow• BOUND Detect value out of range• ENTER High-level procedure entry• LEAVE High-level procedure exit

CONTROL TRANSFER INSTRUCTIONS

BIT AND BYTE INSTRUCTIONS• BT Bit test• BTS Bit test and set• BTR Bit test and reset• BTC Bit test and complement• BSF Bit scan forward• BSR Bit scan reverse• SETE/SETZ Set byte if equal/Set byte if zero• SETNE/SETNZ Set byte if not equal/Set byte if not zero• SETA/SETNBE Set byte if above/Set byte if not below or equal• SETAE/SETNB/SETNC Set byte if above/ not below/ not carry• SETB/SETNAE/SETC Set byte if below/not above or equal/carry• SETBE/SETNA Set byte if below or equal/Set byte if not above• SETG/SETNLE Set byte if greater/Set byte if not less or equal• SETGE/SETNL Set byte if greater or equal/Set byte if not less• SETL/SETNGE Set byte if less/Set byte if not greater or equal• SETLE/SETNG Set byte if less or equal/Set byte if not greater• SETS Set byte if sign (negative)• SETNS Set byte if not sign (non-negative)• SETO Set byte if overflow• SETNO Set byte if not overflow• SETPE/SETP Set byte if parity even/Set byte if parity• SETPO/SETNP Set byte if parity odd/Set byte if not parity• TEST Logical compare

SHIFT AND ROTATE INSTRUCTIONS

• SAR Shift arithmetic right• SHR Shift logical right• SAL/SHL Shift arithmetic left/Shift logical left• SHRD Shift right double• SHLD Shift left double• ROR Rotate right• ROL Rotate left• RCR Rotate through carry right• RCL Rotate through carry left

LOGIC INSTRUCTIONS

• AND And

• OR Or

• XOR Exclusive or

• NOT Not

DECIMAL ARITHMETIC INSTRUCTIONS

• DAA Decimal adjust after addition

• DAS Decimal adjust after subtraction

• AAA ASCII adjust after addition

• AAS ASCII adjust after subtraction

• AAM ASCII adjust after multiplication

• AAD ASCII adjust before division

BINARY ARITHMETIC INSTRUCTIONS

• ADD Integer add• ADC Add with carry• SUB Subtract• SBB Subtract with borrow• IMUL Signed multiply• MUL Unsigned multiply• IDIV Signed divide• DIV Unsigned divide• INC Increment• DEC Decrement• NEG Negate• CMP Compare

DATA TRANSFER INSTRUCTIONS

MOV Move

CMOVE/CMOVZ Conditional move if equal/Conditional move if zero

CMOVNE/CMOVNZ Conditional move if not equal/Conditional move if not zero

CMOVA/CMOVNBE Conditional move if above/Conditional move if not below or equal

CMOVAE/CMOVNB Conditional move if above or equal/Conditional move if not below

CMOVB/CMOVNAE Conditional move if below/Conditional move if not above or equal

CMOVBE/CMOVNA Conditional move if below or equal/Conditional move if not above

CMOVG/CMOVNLE Conditional move if greater/Conditional move if not less or equal

CMOVGE/CMOVNL Conditional move if greater or equal/Conditional move if not less

CMOVL/CMOVNGE Conditional move if less/Conditional move if not greater or equal

CMOVLE/CMOVNG Conditional move if less or equal/Conditional move if not greater

CMOVC Conditional move if carry

CMOVNC Conditional move if not carry

CMOVO Conditional move if overflow

CMOVNO Conditional move if not overflow

CMOVS Conditional move if sign (negative)

CMOVNS Conditional move if not sign (non-negative)

CMOVP/CMOVPE Conditional move if parity/Conditional move if parity evenCMOVNP/CMOVPO Conditional move if not parity/Conditional move if parity oddXCHG ExchangeBSWAP Byte swapXADD Exchange and addCMPXCHG Compare and exchangeCMPXCHG8B Compare and exchange 8 bytesPUSH Push onto stackPOP Pop off of stackPUSHA/PUSHAD Push general-purpose registers onto stackPOPA/POPAD Pop general-purpose registers from stackIN Read from a portOUT Write to a portCWD/CDQ Convert word to doubleword/Convert doubleword to quadwordCBW/CWDE Convert byte/word to word/doubleword in EAX registerMOVSX Move and sign extendMOVZX Move and zero extend

DATA TRANSFER INSTRUCTIONS

MMX™ Technology Instructions

• MMX™ DATA TRANSFER INSTRUCTIONS• MMX™ CONVERSION INSTRUCTIONS• MMX™ PACKED ARITHMETIC INSTRUCTIONS• MMX™ COMPARISON INSTRUCTIONS• MMX™ LOGIC INSTRUCTIONS• MMX™ SHIFT AND ROTATE INSTRUCTIONS• MMX™ STATE MANAGEMENT

MMX™ DATA TRANSFER INSTRUCTIONS

• MOVD Move doubleword• MOVQ Move quadword

0F 6E 00 movd mm0,dword ptr [eax] 0F 6F 00 movq mm0,mmword ptr [eax]0F 6F 03 movq mm0,mmword ptr [ebx]0F 6F 04 0F movq mm0,mmword ptr [edi+ecx]0F 6E 04 0F movd mm0,dword ptr [edi+ecx]0F 6F 04 00 movq mm0,mmword ptr [eax+eax]0F 6F 04 01 movq mm0,mmword ptr [ecx+eax]0F 6F 04 09 movq mm0,mmword ptr [ecx+ecx]0F 6F 05 01 0F 6F 04 movq mm0,mmword ptr ds:[46F0F01h]

MMX CONVERSION INSTRUCTIONS

PACKSSWB Pack words into bytes with signed saturation

PACKSSDW Pack doublewords into words with signed saturation

PACKUSWB Pack words into bytes with unsigned saturation

PUNPCKHBW Unpack high-order bytes from words

PUNPCKHWD Unpack high-order words from doublewords

PUNPCKHDQ Unpack high-order doublewords from quadword

PUNPCKLBW Unpack low-order bytes from words

PUNPCKLWD Unpack low-order words from doublewords

PUNPCKLDQ Unpack low-order doublewords from quadword

MMX™ PACKED ARITHMETIC INSTRUCTIONS

PADDB Add packed bytesPADDW Add packed wordsPADDD Add packed doublewordsPADDSB Add packed bytes with saturationPADDSW Add packed words with saturationPADDUSB Add packed unsigned bytes with saturationPADDUSW Add packed unsigned words with saturationPSUBB Subtract packed bytesPSUBW Subtract packed wordsPSUBD Subtract packed doublewordsPSUBSB Subtract packed bytes with saturationPSUBSW Subtract packed words with saturationPSUBUSB Subtract packed unsigned bytes with saturationPSUBUSW Subtract packed unsigned words with saturationPMULHW Multiply packed words and store high resultPMULLW Multiply packed words and store low resultPMADDWD Multiply and add packed words

MMX™ COMPARISON INSTRUCTIONS

PCMPEQB Compare packed bytes for equal

PCMPEQW Compare packed words for equal

PCMPEQD Compare packed doublewords for equal

PCMPGTB Compare packed bytes for greater than

PCMPGTW Compare packed words for greater than

PCMPGTD Compare packed doublewords for greater than

MMX™ LOGIC INSTRUCTIONS

PAND Bitwise logical and

PANDN Bitwise logical and not

POR Bitwise logical or

PXOR Bitwise logical exclusive or0F EF /r PXOR mm, mm/m640F EF 0A pxor mm1,mmword ptr [edx]

MMX™ SHIFT AND ROTATE INSTRUCTIONS

• PSLLW Shift packed words left logical• PSLLD Shift packed doublewords left logical• PSLLQ Shift packed quadword left logical• PSRLW Shift packed words right logical• PSRLD Shift packed doublewords right logical• PSRLQ Shift packed quadword right logical• PSRAW Shift packed words right arithmetic• PSRAD Shift packed doublewords right arithmetic

MMX™ STATE MANAGEMENT

• EMMS Empty MMX state

FPUTagWord FFFFH;

MM Registers would be available for floating point calculations