Computer Organization X86 Assembly Language Mohammad Sharaf.
-
Upload
nicholas-burns -
Category
Documents
-
view
234 -
download
0
Transcript of Computer Organization X86 Assembly Language Mohammad Sharaf.
Computer Organization
X86 Assembly LanguageMohammad Sharaf
Handouts
+
IBM PC Assembly Language & Programming,
Peter Abel, Prentice Hall, 5th edition.
Chap.: 1, 4, 6, 7,8
Evolution of Microprocessor
Evolution of Microprocessor cont.
Basic Concepts
What is Registers? You can consider it as variables inside the CPU chip
They are all 16-bits
General Purpose Registers AX, BX, CX, and DX: They can be assigned to any
value you want
AX (Accumulator Register): Most of arithmetical operations are done with AX
BX (Base Register): Used to do array operations. BX is usually worked with other registers like SP to point to stacks
CX (Counter Register): Used for counter purposes
DX (Data Register). Used for storing data value
Index Registers SI and DI: Usually used to
process arrays or strings:
SI (Source Index): is always pointed to the source array
DI (Destination Index): is always pointed to the destination array
Segment Registers CS, DS, ES, and SS:
CS (Code Segment Register): Points to the segment of the running program. We may NOT modify CS directly
DS (Data Segment Register): Points to the segment of the data used by the running program. You can point this to anywhere you want as long as it contains the desired data
ES (Extra Segment Register): Usually used with DI and doing pointers things. The couple DS:SI and ES:DI are commonly used to do string operations
SS (Stack Segment Register): Points to stack segment
Pointer Registers BP, SP, and IP:
BP (Base Pointer): used for preserving space to use local variables
SP (Stack Pointer): used to point the current stack
IP (Instruction Pointer): denotes the current pointer of the running program. It is always coupled with CS and it is NOT Modifiable. So, the couple of CS:IP is a pointer pointing to the current instruction of running program. You can NOT access CS nor IP directly
16-bit Register The general registers AX, BX, CX, and DX are 16-bit
However, they are composed from two smaller registers For example: AX
The high 8-bit is called AH, and the low 8-bit is called AL Both AH and AL can be accessed directly
However, since they altogether embodied AX
Modifying AH is modifying the high 8-bit of AX
Modifying AL is modifying the low 8-bit of AX
AL occupy bit 0 to bit 7 of AX, AH occupy bit 8 to bit 15 of AX
Extended Register X386 processors introduce extended registers
Most of the registers, except segment registers are enhanced into 32-bit
So, we have extended registers EAX, EBX, ECX, and so on
AX is only the low 16-bit (bit 0 to 15) of EAX
There are NO special direct access to the upper 16-bit (bit 16 to 31) in extended register
Flag Register Flag is 16-bit register that contains CPU status
It holds the value of which the programmers may need to access. This involves detecting whether the last arithmetic holds zero result or may be overflow
Intel doesn't provide a direct access to it; rather it is accessed via stack. (via POPF and PUSHF)
You can access each flag attribute by using bitwise AND operation since each status is mostly represented by just 1 bit
Flag Register cont. C carry flag: is turned to 1 whenever the last arithmetical
operation, such as adding and subtracting, has carry or borrow otherwise 0
P parity flag: It will set to 1 if the last operation (any operation) results even number of bit 1
A auxiliary flag: It is set in Binary Coded Decimal (BCD) operations
Z zero flag: used to detect whether the last operation (any operation) holds zero result
S sign flag: used to detect whether the last operation holds negative result. It is set to 1 if the highest bit (bit 7 in bytes or bit 15 in words) of the last operation is 1
Flag Register cont.
T trap flag: used in debuggers to turn on the step-by-step feature
I interrupt flag: used to toggle the interrupt enable or not. If the bit is set (= 1), then the interrupts are enabled, otherwise disabled. The default is on
D direction flag: used for directions of string operations. If the bit is set, then all string operations are done backward. Otherwise, forward. The default is forward (0)
O the overflow flag: used to detect whether the last arithmetic operation result has overflowed or not. If the bit is set, then it has been an overflow
Memory X86 CPU only has 16-bit registers, so the maximum
amount of memory that can be addressed is:
216 = 65536 (64K)
However, after XT arrives, the memory is extended to 1 MB. That is 16 times bigger than the original
Segmentation: means the memory is divided virtually into several areas called Segment
The segment registers are 16 bit
The idea of the segmentation is NOT dividing 1 MB into 16 exact parts
Memory cont.
Interleaved: means that if we say the segment number 0, then we can access the memory 0 to 65536. Segment number 1 allows us to access memory number 16 to 65552. Segment 2 from 32 to 65568, and so on with the increment of 16
65536
Seg 0
0
65552
Seg 1
16
65568
Seg 2
32
Memory Interleaved
Why did they do that? It is for the sake of the operating
system OS memory management stuff
Therefore, OS align the executed code to the nearest 16 bytes alignment
Memory cont. The memory access must be done in a pair
of registers
The first is the segment register and next is any register, usually BX, DX, SI or DI
The register pair usually written like this: ES:DI with a colon between them
The pair is called the Segment:Offset pair
So, ES:DI means that the segment part is addressed by ES, and the offset part is addressed by DI
Memory cont.
Example:
If the ES contains 1, and DI is 5, means that we access the memory 5.
If ES:DI = 0001:0005 then it actually access the actual address 21
(1 * 16 + 5 = 21)
So, 0000:0021 and 0001:0005 is actually the same address
Logical address
Absoluteor Physical
address
Stacks The stack (LIFO) is a temporary area to
store temporary things
It is mainly used to pass the parameter value to procedures or functions
Sometimes, it also acts as temporary space to allocate for local variables. Therefore, the
role of the stack is very important
Interrupts Upon a request of an interrupt, the CPU usually stores
context of running program, then it goes to the interrupt routine
After processing the interrupt, the processor restores all states stored and resume the program. There are 3 kinds of interrupts:
Hardware interrupts occurs if one of the hardware inside your computer needs immediate processing
Software interrupts occurs if the running program requests the program to be interrupted and do something else
CPU-generated interrupts occurs if the processor knows that is something wrong with the running code. (Divide a number with 0)
Why Assembly?
It's difficult
Error prone
Hard to debug
Takes a lot of time to develop
Why Assembly?However:
Assembly is fast. A LOT faster than any compiler of any language could ever produce
Assembly is a lot closer to machine level than any language because the commands of assembly language are mapped 1-1 to machine instructions
Assembly code is a lot smaller than any compiler of any language could ever produce
In Assembly, we can do a lot of things that we can't do in any higher level language
Notes
The assembly language is NOT case-sensitive
A comment in assembly begins with a semicolon (;). Everything after a semicolon until the end of the line is ignored
COM Structure
ideal
p286n
model tiny
codeseg
org 100h
jmp start
; your data and subroutine here
start:
mov ax, 4c00h
int 21h
end
Com Program Explanation ideal says that we're using ideal syntax of TASM
p286n or .286 says that we're using 80286 processor instructions
model tiny or .model tiny says that we're using COM format
codeseg or .code says that this is the beginning of our code
org 100h
COM programs are almost always begin with a jump, i.e. jump to the beginning of the code. Between the jump and the beginning of your code, you place your variables here. The jump is denoted by the word jmp and followed with a label (here we call it start)
After the label start, the next two lines is just the code to terminate your program
end or .end entry specify the end point of your program
Making Labels Put any name and stick it with a colon (:)
Label usually serves as a tag of where you'd like to jump and so on
You have to pick unique names for each label, otherwise the assembler will fail
There is a way to make it local: to prefix it with a @@ in front of the label name and still end it with a colon
Variables in Assembly
Variables Declaration Our ideal syntax (TASM based) looks like this:
Ideal
p286n
model tiny
codeseg
org 100h
jmp start
; your data and subroutine here (this is a comment)
start:
mov ax, 4c00h
int 21h
end
Put variable declarations after the jmp start statement.
Variables Declaration There are 3 main types of
variable declarations in assembly:
db is to declare the 1-byte-length
dw is for the word (2 bytes) dd is for the double-word (4
bytes) The declaration syntax is as
follows: var_name db value
Ideal
P286n
model tiny
Codeseg
org 100h
jmp start
score db 100
year dw 2001
money dd 1000000
start:
mov ax, 4c00h
int 21h
end
:
bits db 101001b
var2 dw 4567h
var3 dw 0BABEh :
Variables Declaration cont.
Variable Limits and Negative Values
You can assign the variables as negative values, too. However, assembler will convert them to the corresponding 2’s complement value. For example: If you assign -1 to a db variable, assembler will convert it to 255 integer
Declaration Acronym Length Limit
db define byte 1 byte 0-255
dw define word 2 bytes 0-65535
dd define double 4 bytes 0-4294967295
2’s Complement
Moving Around Values If you need to do some calculations or commands
involving the variables you'll have to load the variable values to the registers
The syntax of the mov command is: mov a , b
which means assign b to a Var1
Var2
MM
Reg 1
Reg 2
mov ax, [var2]
mov [var1],ax
Moving Around Values: example :
jmp start
our_var dw 10
start:
mov bx, [our_var]
mov cx, bx
mov [our_var], cx
mov ax, 4c00h
int 21h
end
The square brackets [ ] are
to distinguish the variable from its address
Moving Around Values cont. When we deal with byte variables (i.e. db), we need
to use byte registers (e.g. AL, AH, BL, BH, and so on) to do our bidding
AX, BX, CX, DX, and so on are word registers
You can use double-word registers which is available in 80386 processors or better (use p386n instead of p286n to enable double-word registers)
The double-word registers includes EAX, EBX, ECX, EDX, and so on
Moving Around Values cont. We can assign variables with constants with mov
instruction. However, this will work only with 80286 or better processors:
mov [word ptr our_var], 1
Notice the word ptr modifier must be used when you assign constants to variables. Since our_var is a word variable, we need to use word ptr modifier
Likewise, byte variable uses byte ptr modifier and double-word variable uses dword ptr
Moving Around Values example
Notice the way that Intel assembler store a word value
It stores the least significant byte first, then the most significant byte later
Big-endian & Little-endian Describe the order in which a sequence of bytes is stored
in a computer’s memory
In a big-endian system, the most significant value in the sequence is stored at the lowest storage address (i.e., first)
In a little-endian system, the least significant value in the sequence is stored first
Moving Around Values cont.
Recall that variables in assembly are treated as addresses
AX 0502h
Moving Around Values cont.
Double-word variables are also stored similarly
my_var dd 1234BABEh
Impacts on Registers Recall that the word register AX consists of AH
and AL
Modifying either AH or AL will modify the contents of AX
Likewise, modifying AX will be likely modify AH and AL
Question Marks on Variables If you are not certain about the default value of a variable
you can give a question mark ("?") instead. For example:
another_var dw ?
String Variables You can define strings variables in assembly. It is as
follows:
message db "Hello World!$ "
String variables are required to be stored as db variables. The string is then surrounded by quotes, either single or double, up to you
String Variables
message db "Hello World!$"
•Why do we have to end our string with a dollar sign ("$")? •Each characters of the string is converted to its corresponding ASCII code
Multi-Valued Variables The variables defined
as db means each value is defined as bytes
However, there is no restriction on how many values we can define for each variable names
multivar db 12h, 34h, 56h, 78h, 00h, 11h, 22h, 00h
Multi-Valued Variables So multi valued variables are stored contiguously
multivar2 dw 1234h, 5678h, 0011h, 2200h
Using dup Another way to declare a multi-valued variables
are using dup command:
my_array db 5 dup (00h)
That example above is similar to:
my_array db 00h, 00h, 00h, 00h, 00h
dup is kind of shortcut to define variables with the same values
Of course you can define something like this:
bar_array db 10 dup (?)
Arithmetic Instructions
Addition & Subtraction
Addition & Subtraction You may actually add or subtract variables with
constants. But don't forget to add the word ptr or dword ptr as appropriate
If the result of an addition overflows, the carry flag is set to 1, otherwise it is 0
Similarly, if the result of subtraction requires a borrow, then the carry flag is also set to 1, otherwise it is 0
Addition & Subtraction Suppose you'd like to add a 32-bit integers
with 16-bit registers
Intel processor has a special instruction called adc
For the subtraction, we have similar instruction called sbb
Multiplication & Division Multiplication and division always assume AX as
the place holder
If there is an overflow in multiplication, the overflow flag will be set
Note: mul and div will treat every numbers as positive. If you have negative values, you'll need to replace them imul and idiv respectively
Increment & Decrement Often times, we'd like to incrementing something
by 1 or decrement thing by 1
You can use add x, 1 or sub x, 1 if you'd like to, but Intel x86 assembly has a special instruction for them
Instead of add x, 1 we use inc x. These are equivalent
Likewise in subtraction, you can use dec x
Beware that neither inc nor dec instruction sets the carry flag as add and sub do
Tips The arithmetic operations can have special
properties
For example: add x, x is actually equal to multiplying x by 2
Similarly, sub x, x is actually setting x to 0
In 8086 processor, these arithmetic is faster than doing mul or doing mov x, 0. Even more, its code size is smaller
Bitwise Operations
And, Or, Xorand, or, and xor takes two operands
You can have both operands as registers, one of them as variables, etc.
The syntax is as follows:
And, Or, Xor: example
AH = 76 and AL = 45
AH = 01001100 and AL = 00101101
Not
The not operation takes a single operand
Bit Masking & Flipping Sometimes, one byte can contain several information
decoded in bits (like flag register)
Example: Suppose AL = 00101100. However you only need the lower four bits (i.e. 1100)
This can be done creating a mask based on the and behavior
Since we need only the lower four bits, the mask would be: 00001111
Bit Masking example
Suppose you have AL = 00101100. Now, you'd like to store the lower 4 bits of your data in CL = 00000011 into the lower 4 bits of AL
Bit Masking & Flipping There are times we only want to flip the bits around
We can use xor with it. You can observe that anything xorred with 1 will be flipped
Suppose, we'd like to flip the middle four bits of AL:
Bit Shifting Shifting left one position means take one bit at the left,
then shift the remaining bits, then add one 0 at the end
Shifting right is analogous
The x and y usage is just like add or sub, you can have registers, variables or constants. Of course the x part cannot be a constant
What happened to the missing bits that get shifted out?
The carry flag will hold the last shifted-out bit
Shift and Rotate
Bit Rolling Bit rolling is similar to bit-shifting. Instead of shifted out,
the bits gets rolled back
Rolling to the right is similar
There is another variant on rolling bits, using carry flag. Rolling bits using carry flag is done by rcl and rcr
Shift and Rotate cont.
Branching & Loop
Instructions
Unconditional & Conditional Jumps
Conditional jumps always consider some condition
If the condition is satisfied, then the jump is taken, otherwise it is not
The conditions are usually reflected in the processor flags
On the other hand, unconditional jumps do not regard any conditions
So, it is more like goto in a sense
Making Labels Labels are essential to jump instructions
It marks the destination. Of course you need to set where to jump, Making labels in assembly are easy
Labels can be made like this:
example:
So, we can pick out any names and stick a colon after it (:)
You must make sure that all label names throughout your program are unique, no duplicates
Unconditional Jumps For unconditional jump, the instruction is jmp
unconditional jumps takes no regard on conditions. So, whenever the processor arrives at the instruction jmp somewhere, it will directly skip all the instructions below it up to until the instruction marked by the label somewhere
Conditional Jumps Before the jump instruction, we (usually)
have to put a comparison or testing instruction
The comparison instruction is cmp
Conditional Jumps cont.
Conditional Jumps cont.
Note that jg, jge, jl, and jle will work for signed variables only
For unsigned variables, use ja "jump if above", jae, jb "jump if below", and jbe as the substitution respectively
The rest (i.e. je, jne, and jc) work with both signed and unsigned variables
Testing Instruction The syntax of test instruction:
test x, y
It behaves like an and but it does not store the result back to x
So it is more like x and y
Usually after this instruction, we usually check whether the result of the and-ing is zero or not using jz or jnz (i.e. "jump if zero")
Testing Instruction example 1
Add 1+2+3+...+10
Testing Instruction example 2
8! Factorial
Loop Construct
This structure is just like do..while construct in C/Java
When the processor takes loop instruction, it will first decrease the register CX by one
After that, CX is tested whether it is zero or not. If it is not zero, then jump to mylabel
It's kind of countdown counter
Loop Construct example
Let's take 1+2+...+10 example
Interrupt Essentials
Introduction to Interrupt Interrupt is just like a procedure provided by the system
and You can invoke it
These two lines actually request the operating system to terminate the program
The interrupt is called using int instruction with a number after it
This number is referred as Interrupt Number
Introduction to Interrupt cont.
Interrupt number alone is not enough
Interrupt behaves differently depending on which Service Number is called
Service numbers are usually placed in AH
Sub-Service number is usually placed in AL
This interrupt mechanism is pretty much like a phone number
Output to Screen
Output to Screen After the start label we are invoking interrupt number
21h, service 09h
Interrupt 21h is reserved for Operating System calls
When you look up what service 09h does on interrupt 21h in interrupt list
To insert a new line simply change the message declaration into:
Input from KeyboardInterrupt 21h service 0Ah offers a
mean to input from keyboard. The interrupt lists say:
Input from keyboard example
Buffer
Output: A Better Version There is one way to cope with “$” issue by output
characters one by one using a loop
The loop terminates if the character being read is 0
Zero in ASCII number is defined as a blank and usually used to terminate stuffs
Interrupt 21h, service 06h used to print one character on screen
Input one Character
Number to StringThe output routines we discussed so
far are intended only for outputting strings
How can we output numbers?
We have to convert the numbers to string first
Stacks
Why Stack?There are several reasons why we need stacks:
To save register values if we ran out of registers
To pass parameters to subroutines
To make space for local variables in subroutines
To preserve original register values if we change them in a subroutine
To fetch processor flag status
Stack Operations last in first out (LIFO)
Stack operations mainly done by two instructions either push or pop
The instruction push will push values into the stack, while pop will pop it out
The syntax is like this:
The operand X is a 16-bit
You can push 8-bit too, but the processor will push a 16-bit value anyway
Memory Layout You should know that register CS by default points to the
segment where the code resides. DS will point to the data segment. ES usually pointed to data segment too. SS will point to stack segment. Since CS, DS, ES, and SS point to the same segment, it means code, data, and stack resides in the same region
Code Seg.
---------------------
Data Seg.
---------------------
Extended Seg.
---------------------
Stack Seg.
CS
SS
ES
DS
Code Seg.
&
Data Seg.
&
Extra Seg.
&
Stack Seg.
MM
How can we manage this? The stack is not only pointed by SS register. But
also SP register
So, the pair SS:SP points the top of the stack. Initially, SP is set to the very bottom of the segment in "tiny" mode, at address FFFEh
Each time we push something into the stack, this SP register will be decremented up by 2. If we pop something, SP will be incremented down by 2
Whereas, our code and our data starts at offset 100h
So, the layout looks something like this:
Application
Other Uses Can we push a constant? In 8086 NO. In 80286 or above
YES. So, doing push 1, this will be treated as if a 16-bit value. No need to specify word ptr and stuff
The more useful usage of push and pop is to push flag and then pop it into register. That way, we can examine the flag content directly. Look at the following code:
pushf ; top stack flag register
pop AX ; AX stack top There we can examine the flag values in register AX, The
net effect is the same like assigning AX with flags
Likewise, you can set the flag values using push AX then popf
Subroutines
&
Macros
Subroutine Syntax
More on Parameters & Local Variables
• Note that we can not initialize local variables• Of course you can do a mov to assign it with a value later on• The parameters are passed down through stack using push and pop
A Word of Caution Since procedures are built with the help of
stacks, you have to remember not to modify SP and BP anytime in the subroutines
It's because SP is used to store stack position and BP is used to store the stack position before entering the subroutine
Moreover, when you modify certain registers in a subroutine, it is likely you interfering the main program
How to cope this situation then?
pusha "push all " :
which basically stores (almost) all registers
popa "pop all" :
to pop into the appropriate registers
How About Functions? Subroutines that can return some values too
Usually, we designate registers to hold the output or result for our subroutine
Many programmers tend to choose AX for this purpose. If you have more than one output from the subroutine, you can select multiple registers to hold the results
Due to this nature, the output registers need not to be saved nor restored because the caller itself expects those designated registers to change
Functions example
Let's make a subroutine to calculate 1+2+...+n
Document a Subroutine It is a good habit to document a subroutine. At
least give a comment above it
Routine Placement
Macros
Notice : •We use macro and endm keyword instead •We may not specify the parameter type •There is no ret instruction at the end•There is no call keyword
RecapThe main differences (behavior-wise) are:
Macros use String replacement for its invocation whereas subroutines use Calls
Due to replacement nature, macro can exist Multiple copies in the programs whereas subroutine can exist only in One copy
Because of multiple copies possibility, you cannot obtain a macro's Address, whereas you can obtain a subroutine's address
Macros can be faster since it doesn't have calling and return time penalty
Macros can be harder to debug
Arrays
Array Revisited To refresh our mind, declaring a ten-byte array is like this:
To load the 1st element of the array into register al is like this:
Accessing the 2nd, the 3rd, and the 4th element
is like this:
MM
100 05101 02102 08103 09104 01105 07106 03107 00108 04109 06
Access Array through a loop MM
100 05101 02102 08103 09104 01105 07106 03107 00108 04109 06
Reverse array example
MM
100 05101 02102 08103 09104 01105 07106 03107 00108 04109 06
Note: BX is nicked as ‘Base register' SI as ‘Source Index' DI as ‘Destination Index'
String Instructions
5 There are five basic string instructions:
1. LES, LDS
2. MOVS
3. CMPS
4. SCAS
5. STOS , LODS These instructions can be "emulated“ with mov, cmp,
loop and jmp. However, these five brothers are a lot faster since they are "built-in" instructions
LES DI and LDS SI String instructions typically uses DS:SI pair to
denote the source string and ES:DI pair to denote the destination string
The only thing we care is to set the register SI and DI to point to the source and destination offset respectively
LES DI, [SomeStringVar]
LDS SI, [OtherStringVar]
These instructions are used to set both ES and DI or both DS and SI respectively
Direction Flag After setting source and/or destination register pairs, you may
want to specify on how the string instruction is performed: Should it be performed Backwards or Forwards?
Assembly can do these instructions in both directions
Determining which way to go involves setting the direction flag. Intel x86 assembly has two instructions for this:
CLD ; Clear Direction Flag
STD ; Set Direction Flag
Clearing direction flag will cause the string instructions done forward. Setting it will make a reverse direction
MOVS The instruction movs is used to copy source string into
the destination. This instruction comes in two variants: movsb and movsw
Since we'd like to move several bytes at a time, these movs instructions are done in batches using rep prefix. The number of movements is specified by CX register
CMPS The instruction cmps is used to compare two strings. It
also has two variants: cmpsb and cmpsw
After the rep cmpsb, the zero flag is set if the result is equal
SCAS The instruction scas is used to scan a string pointed by ES:DI Typically used for searching a particular character in a string
scas has two variants: scasb and scasw. In scasb, the string ES:DI is searched for the occurrence of the element specified by the register AL, whereas in scasw, the element to be searched is in AX
STOS The stos instruction fill the string pointed by ES:DI
pair with the value in AX. So, it is great when you'd like to initialize arrays (usually with zeroes)
It has two variants: stosb and stosw. In stosb, all bytes in the string ES:DI is replaced with whatever AL contains. In stosw, the initializator is AX contains
LODS The lods instruction will load a chunk (either a byte
or a word) from the string pointed by DS:SI into AX
It has two variants: lodsb and lodsw