x86-session10.ppt

X86 Session_1080386 contd.

Property of Accel Technologies Ltd., Copyright protected

386 nonpipelined read cycles

CLK2(INPUT)VALID 1VALID 2BE0# - BE3# , A2-A31,M/IO# , D/C# , W/R#ADS#NA# I/PREADY#I/PLOCK#Out putD0-D31(Input during read)IN1ININVALID 1VALID 2 CYCLE 1CYCLE 2T1T1T2T2


386 nonpipelined read cyclesEach read operation requires two states , T1 & T2READY# is made low during T2 so that no wait states are inserted


386 nonpipelined read cyclesADS# is used for address pipelining Address is held by the latches386 address pins point to the next addressExternal circuitry asserts NA# signal to tell the 386 when to output the address for the next operation


80386 Functional Units

CONTROL UNITDATA UNITPROTECTION TEST UNITSEGMENT REGISTERSSEGMENT TRANSLATORTRANSLATION LOOKASIDEBUFFERPAGE TRANSLATORDECODERINSTRUCTION QUEUEPREFETCHQUEUEPREFETCHERBUS INTERFACEBUS UNITPREFETCH UNITDECODE UNITPAGE UNITSEGMENT UNITEXECUTION UNIT


80386 Functional Unit (Contd.)The BIU interfaces between the 80386 with memory and I / OThe code PREFETCH UNIT prefetches instructions ,stores them in a 16 byte queueThe INSTRUCTION DECODE UNIT translates instructions into microcodesThe EXECUTION UNIT acts on the microcodes from the instruction queue


80386 Functional Unit (Contd.)The SEGMENTATION UNIT translates logical addresses into linear addressesThe PAGING UNIT , if enabled , translates these linear addresses into physical addresses. If not enabled , then linear addresses and physical addresses are identical


80386 Functional Unit (Contd.)The Execution Unit comprises Control unit -having microcode and

parallel hardware Data unit - having ALU and 8 GPRs

and a 64 bit barrel shifter The protection unit checks for

segmentation violations under the control of microcode


Processing Modes of 80386 1. Protected mode [ normal 32 bit application of 80386 ] 2. Real address mode or Real mode [ A fast 8086 mode with a few new instructions] 3. Virtual 8086 mode or V86 mode [ goes back and forth between V86 mode and the protected mode ]


80386 Real ModeUpon reset or power - up , the 80386 operates in real modeIn this mode,it can access all the 8086 registers along with the 80386 32 -bit registersInstructions can refer to AL,AH,AX or EAXPhysical address is calculated with the segment base , offset mechanism

Property of Accel Technologies Ltd., Copyright protectedThe length of segments is limited to 64Kbytes and an attempt to access a location outside a segment will cause a type 13 exception.The maximum memory that can be accessed is 1 MB and hence A20 - A31 are normally low.But,during reset these address lines are made high to access the boot ROM at the highest locations in the 32 bit address space of the 386.

80386 Real ModeUses address space 00000 - 003FF for the IVT It has a set of debug registersA software debugger can load breakpoint addresses in these registers Control registers CR0 - CR3 are used and the lower 16 bits of CR0 correspond to machine Status word of 80286CR1 is reserved ; CR2 and CR3 are used for paging modeLinear addresses are the physical addresses


Real Mode (Contd.)Uses a combination of:16-bit segment registers (CS, DS, ES, FS, GS, SS)16-bit offsets (depends on addressing modes)Effective addresses are 20 bit That's 1MB address space (with a 16-bit processor!)

15 0


386 -Protected Mode386 is switched from real mode to protected mode by setting the LSB of the CR0 registerIncreases the linear space to 4GB and permits the execution of virtual memory programs of 64 tera bytes (2^46 bytes)


386 -Protected ModeCan run all existing 8086 and 80286 programs with on-chip memory management and protection featuresIncludes new instructions to support multitasking, multiuser operating systems


80386 Protected Mode

32-bit Address32-bit Offset


Descriptor TableTwo types of descriptor tablesglobal consisting of segment descriptors for the OS segmentsegment descriptors for the user tasks

and otherslocal descriptor table for each taskTasks share a GDT and the memory area defined in it


How Protection WorksEach time a task loads a segment register,

the CPU performs many checksif the descriptor table indexed contains a valid descriptorif the segment descriptor is of the right type to be loaded into the specified segment register cacheFor e.g. a descriptor for a read only data segment cannot be loaded into the SS register


How Protection WorksUser tasks are protected from one another by providing individual LDTsSystem software ,such as the OS kernel,is protected bymaking the code segments only executableBy having different privilege levelsOS kernel having the highest priority level 0,system services such as BIOS procedures at 1,custom device drivers at 2,application programs and user tasks at the lowest level


How Protection WorksThe descriptor privilege level is referred as the DPLThe privilege level of an executing task is the current privilege level CPLThe privilege level encoded when a program needs to access a data segment,is requesting privilege level RPLA task cannot directly access a segment that has a higher DPL


Call GatesA gate is a special type of descriptor put in the GDT or in an LDTWhen a program calls a procedure in another segment,the selector for the segments call gate is put in the CS register and the call gate descriptor in the hidden part of the CSThis indirect access through the call gate does another privilege check


The length of segments is limited to 64Kbytes and an attempt to access a location outside a segment will cause a type 13 exception.The maximum memory that can be accessed is 1 MB and hence A20 - A31 are normally low.But,during reset these address lines are made high to access the boot ROM at the highest locations in the 32 bit address space of the 386.

x86-session10.ppt

Documents

Transcript of x86-session10.ppt