Exercises — x86 architecture overview

x86 CISC hai (Complex Instruction Set Computer). Opposite family RISC (Reduced Instruction Set Computer) hai, jo fixed-length instructions use karti hai — dekho RISC vs CISC. Kyun: 1978 mein CISC ka poora selling point tha har byte mein zyada kaam fit karna, matlab variable length; baad mein RISC ne woh density trade ki ek regular fixed length ke liye jo decode aur pipeline karna aasaan hai.

Sabse chhota → sabse bada ($\subset$ = "andar nested hai", upar define kiya gaya): AL $\subset$ AX $\subset$ EAX $\subset$ RAX, jo 8, 16, 32, 64 bits expose karta hai. Kyun: har naam usi physical register ke low bits ka ek window hai. Kuch copy nahi hota; aap bas low end se kam bytes padhte hain. Figure s01 dekho — har layer agle ke andar nested hai jaise ek chest mein drawers.

1 aur 15 bytes ke beech (variable); ek typical RISC instruction exactly 4 bytes (fixed) ki hoti hai. 15-byte cap kyun matter karta hai: decoder ko pata hona chahiye ki instruction $n$ kahan khatam hoti hai, tabhi woh instruction $n+1$ dhundh sakta hai. 15 ki hard ceiling bound karti hai ki fetch/decode stage kitna scan kare.

Formula (parent note se) hai: $\text{PhysAddr}=(\text{Segment}\times 16)+\text{Offset}=(\text{Segment}\ll 4)+\text{Offset}.$ KYA karte hain: segment ko 4 bits left shift karo, phir offset add karo. KYUN: 8086 mein sirf 16-bit registers hain lekin 20-bit (1 MB) address chahiye. Segment ko 4 bits upar shift karne se woh 20-bit number ke high part mein place ho jaata hai; 16-bit offset low part fill karta hai. Figure s02 mein coloured bar shifted segment base pe shuru hoti hai aur offset woh arrow hai jo uske along chalta hai. $(0x2000\ll 4)+0x0345=0x20000+0x0345=0x20345.$ Decimal mein: $0x20345=131909$.

Ek caveat jo hum L5·2 mein fully exploit karenge: real-mode addresses ek 20-bit duniya mein rehte hain, isliye sum hamesha modulo $2^{20}$ (1 MB) liya jaata hai. Yahan $0x20345$ $0xFFFFF$ se kaafi neeche hai, to koi wrap nahi hoti — lekin woh modulo dimag mein rakhna.

Right-hand end se low bits padho:

• EAX = low 32 bits = 0xCAFEB0BA
• AX = low 16 bits = 0xB0BA
• AL = low 8 bits = 0xBA

Kyun: do hex digits = ek byte, isliye AL last 2 hex digits hai, AX last 4, EAX last 8. Koi arithmetic nahi, koi data movement nahi — bas ek narrower window.

Pehle, do encodings jo ye hardware actually "64-bit register mein constant daalo" ke liye offer karta hai (hum inhe yahan restate karte hain maanke nahi chalte; /0 slash notation upar box mein define hai):

• REX.W + C7 /0 + imm32 — immediate field hamesha 4 bytes (imm32) hoti hai; CPU phir ise 64 bits tak sign-extend karta hai. mov ke full register mein koi imm8 form nahi hota. Yaad raho /0 exactly ek ModR/M byte leta hai.
• REX.W + B8+rd + imm64 — immediate field puri 8 bytes (imm64) hai, tab use hota hai jab constant 32 bits mein fit na ho. (B8+rd matlab register number opcode byte mein hi baka hua hai, to yahan alag ModR/M byte nahi hai.)

Ab count karo (REX = 1 prefix byte, opcode = 1 byte):

• mov rcx, 0x11223344 = REX.W(1) + opcode C7(1) + ModR/M(1) + imm32(4) = 7 bytes.
• mov rcx, 0x1122334455667788 = REX.W(1) + opcode B8+rd(1) + imm64(8) = 10 bytes.

Doosra lambi hai. Kyun: immediate constant instruction bytes ke andar rehti hai. 4-byte-immediate form 7 bytes hai; ek 64-bit constant ke saare 8 bytes ki zaroorat imm64 form force karti hai aur instruction 10 bytes tak pahunch jaati hai. Bada baked-in constant ⇒ lambi instruction — variable length ka seedha, physical cause.

Dono compute karo: $(0x1000\ll 4)+0x0000=0x10000+0=0x10000.$ $(0x0F00\ll 4)+0x1000=0x0F000+0x1000=0x10000.$ Dono 0x10000 pe land karte hain — same byte, exactly figure s02 mein orange dashed line.

YE KYUN HOTA HAI: segment 16 se scale hota hai, isliye segment ko 1 increment karne se base 16 bytes move hota hai. Offset 0…65535 bytes tak range kar sakta hai — 16 se bahut zyada. To kai segment values ki ranges overlap karti hain, aur ek hi physical address ke multiple (segment, offset) naam hote hain. Ise aliasing kehte hain, aur ye $20=16+4$ ka seedha consequence hai: sirf 4 bits "new" range har segment step mein, lekin full 16-bit offset. Figure s02 mein teal aur plum bars overlap karte hain aur dono arrows 0x10000 pe milte hain.

Aliasing ka doosra, sneakier source: kyunki real address modulo $2^{20}$ liya jaata hai, koi bhi (segment, offset) jiska raw sum 0xFFFFF se upar jaata hai woh wapas neeche wrap ho jaata hai aur ek low address se collide karta hai. Woh case hum L5·2 mein face karenge.

Step 1 (KYA): x86 length variable hai (1–15). Step 2 (KYUN parallelism block hoti hai): yeh jaanne ke liye ki instruction #2 kahan shuru hoti hai, aapko pata hona chahiye instruction #1 kahan khatam hoti hai. Yeh jaanne ke liye ki #1 kahan khatam hoti hai, aapko uska opcode, uska ModR/M byte (jisme SIB byte ki demand ho sakti hai), aur koi bhi displacement/immediate parse karna hoga — matlab aapko #1 ko lagbhag fully decode karna hoga. Step 3 (consequence): decoding ek chain of dependencies hai: #1 ka end → #2 ka start → #2 ka end → #3 ka start. Aap aage nahi kood sakte. Contrast: RISC ki fixed length matlab instruction $k$ hamesha byte $4k$ pe shuru hoti hai — boundaries dhundhne ke liye koi parsing nahi chahiye, to saare decoders ek saath fire karte hain. Ye deep reason hai ki x86 complex parallel length-predecoders pe transistors spend karta hai, aur ye micro-ops mein translation ko feed karta hai.

Original 8086 opcode space mein R8–R15 registers naam karne ki jagah nahi thi (unka existence hi nahi tha) ya ye kehne ki "64 bits pe operate karo." REX prefix AMD64 ka ek extra leading byte hai jiske bits register-number fields (wahi fields jo ModR/M byte aur /r slot use karte hain) ko extend karte hain aur 64-bit operand size set karte hain.

• mov r8, r9 — REX chahiye kyunki R8/R9 naye registers hain; har register number ka extra high bit REX mein rehta hai (ModR/M byte akela sirf 0–7 count kar sakta hai).
• mov rax, rbx — REX chahiye 64-bit operand size select karne ke liye (iske bina aapko 32-bit eax, ebx milega).
• mov ax, bx — koi REX nahi chahiye: 16-bit ops aur registers AX/BX 8086 se exist karte hain, isliye purani encoding kaafi hai.

Ye fossil kyun hai: REX woh "koi jagah nahi bachi, to prefix bolt kar diya" solution hai — pure backward-compatibility engineering.

Hum magic constants nahi chahte, isliye sum se pehle har field ka maximum derive karte hain:

• Legacy prefixes ≤ 4 bytes. Legacy prefixes groups mein aate hain (operand-size, address-size, segment-override, lock/repeat). Ek sane instruction har group se ek se zyada nahi use karta, aur 4 groups hain — isliye at most 4 legacy prefix bytes.
• REX prefix = 1 byte (ek alag category). REX chaar legacy groups mein se ek nahi hai; ye ek paanchwa prefix type hai aur jab present hota hai, opcode ke bilkul pehle ek extra byte ke roop mein rehta hai. Ise apne aap count karna chahiye, isliye decoder jo prefix allowance face karta hai woh sach mein 4 (legacy) + 1 (REX) = 5 bytes hai.
• Opcode ≤ 3 bytes. Purane opcodes 1 byte ke hain. Jab Intel ki jagah khatam hui unhone ek 0F "escape" byte add kiya (2-byte opcodes), phir 0F 38 / 0F 3A escapes (3-byte opcodes). Teen sabse deep escape chain hai jo exist karti hai — isliye 3.
• ModR/M = 1 byte. Ek single byte jo operand register(s) aur addressing form naam karta hai. Exactly ek hai, isliye 1.
• SIB = 1 byte. "Scale-Index-Base" byte, sirf tab present jab ModR/M scaled-index addressing maange. At most ek — 1.
• Displacement ≤ 4 bytes. Ek constant address offset; iska sabse wide form 32-bit (4-byte) displacement hai — 4.
• Immediate ≤ 4 bytes is budget mein. Sabse wide ordinary immediate 32 bits = 4 bytes hai (L2·3 ka imm64 mov ek special one-off hai jo displacement slot trade kar deta hai, to woh yahan upar stack nahi hota).

Ab derived maxima sum karo (note karo REX 4 legacy prefixes se alag count hai): $L=\underset{\text{legacy pfx}}{\underbrace{4}}+\underset{\text{REX}}{\underbrace{1}}+\underset{\text{opcode}}{\underbrace{3}}+\underset{\text{ModR/M}}{\underbrace{1}}+\underset{\text{SIB}}{\underbrace{1}}+\underset{\text{disp}}{\underbrace{4}}+\underset{\text{imm}}{\underbrace{4}}=18.$ Naive sum 18 hai, lekin koi bhi single legal instruction actually har field ko simultaneously uske maximum pe use nahi karta (e.g. ek instruction jo 4-byte immediate carry karta hai rarely 4-byte displacement aur full prefix stack bhi carry karta hai). Intel isliye ek hard cap of 15 bytes laaga karta hai; 15 se zyada koi bhi encoding fault raise karta hai. 15 enforce karna (naive 18 ki jagah) exactly woh hai jisse Intel decoder ka scan window bounded rehta hai, bhaale fields higher sum kar sakein. Synthesis point: cap ek pragmatic decode-cost limit hai, natural sum nahi. Ye kehti hai "predecoder ko boundary dhundhne ke liye kabhi 15 se zyada bytes scan nahi karne padenge," worst case bound karta hai uss problem ka jo aapne L3·2 mein analyse kiya.

Struct ka base physical address: $(0x3000\ll 4)+0x0100=0x30000+0x0100=0x30100.$ Field 0x0C aur aage hai: $0x30100+0x0C=0x3010C.$ (Modulo world mein sanity check: $0x3010C$ $0xFFFFF$ se kaafi neeche hai, to koi wrap nahi — ye ek plain in-range address hai.)

Woh mode jo [base + displacement] express karta hai woh base-plus-displacement hai (register-indirect with displacement), e.g. mov eax, [rbx + 0x0C]. Kyun fit karta hai: struct ka start ek base register mein jaata hai, aur constant field offset displacement hai jo instruction mein baka hua hai — exactly length budget ke ModR/M + Displacement fields. Yahan 0x0C itna chhota hai ki ek single-byte (disp8) displacement mein aa jaata hai, isliye resulting instruction chhoti rehti hai.

Internally CPU ek CISC instruction ko µops (micro-ops) ki ek chhoti sequence mein crack karta hai, har ek RISC-like aur simple, roughly:

1. load tmp ← [rbx] (memory read)
2. add tmp ← tmp + rax (arithmetic)
3. store [rbx] ← tmp (memory write)

Ye µops phir out-of-order pipeline se flow karte hain aur doosre kaam ke saath parallel mein (dekho Micro-operations (µops)). Reconciliation: ISA CISC rehti hai backward compatibility ke liye (programmers/binaries abhi bhi ek dense instruction dekhte hain), jabki microarchitecture speed ke liye RISC-like hai. "x86 is CISC" aur "x86 is fast" do alag layers describe karte hain — front-end contract vs. back-end execution engine. Compare karo ARM Architecture se, jo dono layers pe RISC hai.

Extending ke liye argument: x86 ka sabse valuable asset woh enormous installed base hai jo software unchanged run hota hai. Ek clean, incompatible ISA ko developers, compilers, aur users scratch se jeetne hote — historically ek graveyard (Intel ka apna clean 64-bit Itanium exactly isi wajah se struggle kiya). Purani encodings valid rakhke aur REX + 64-bit + R8–R15 upar se add karke, AMD ne existing 32-bit code ko instantly run karne diya jabki 64-bit upgrade path bhi diya. Compatibility → adoption → market win. Locked-in cost: fossils hamesha ke liye rehte hain. Variable-length decoding (L3·2 serial-boundary tax), legacy segment registers (CS/DS/SS/ES/FS/GS) flat long mode mein bhi, aur ek irregular register set permanent liabilities hain jo decoder har chip pe pay karta hai. Mastery insight: ye ek classic path-dependence trade hai — aap aaj ki compatibility se adoption khareedte ho aur decades tak decode complexity mein interest pay karte ho. 2003 mein x86 ki position dekhte hue, ye sahi call tha.

Raw sum pehle: $(0xFFFF\ll 4)+0xFFFF=0xFFFF0+0xFFFF=0x10FFEF.$ Woh value 20-bit maximum 0xFFFFF (1 MB − 1) se zyada hai. Real 8086 pe, physical addresses mein sirf 20 wires the, isliye top bit simply drop ho jaata tha — matlab address modulo $2^{20}$ liya jaata hai aur ek low address pe wrap around ho jaata hai: $\text{20-bit address}=0x10FFEF\mathrm{mod}{2}^{20}=0x10FFEF-0x100000=0x0FFEF.$ To segment 0xFFFF, offset 0xFFFF memory ke top ke paas nahi point karta — ye 0x0FFEF pe land karta hai, bilkul neeche near bottom. Ye fossil kyun hai: kuch 8086 programs is wrap-around pe depend karte the (unhone high segment ke through low memory address kiya tha purpose se). Jab 80286 ne 21st address wire add ki aur wrap karna band kiya, to un programs toot gaye, isliye hardware makers ne infamous A20 gate add kiya taaki purani wrap wapas force ho compatibility ke liye. Ye mastery theme ka perfect illustration hai: yahan ek hardware overflow quirk bhi ek permanent feature ban gaya kyunki software ne isme rely kiya — aur ye L2·1 aur L3·1 mein flag kiye gaye modulo-$2^{20}$ aliasing ka extreme case hai.