x86 architecture overview: Question bank — Hardware deep dive

This page assumes the vocabulary already built in the parent: CISC (pack much work into one instruction), register (fastest on-CPU storage), variable-length encoding (1–15 bytes), segmentation (two 16-bit numbers combined into a 20-bit address), and µops (the small RISC-like steps a CISC instruction is broken into). If any of those feels shaky, re-read the parent before you fight these traps.

Three terms the parent uses inside instruction encoding are worth pinning down before you start, because several traps below rely on them:

Notation used on this page: all hex constants are written like $0x1000$ inside math, e.g. $Segment = 0x1000$ , so they parse at a glance and never get mistaken for prose.

Every figure below shares the site's pastel-soft look so the pictures read as one family. Refer to them as you answer — the geometry is the explanation.

The pictures behind the traps

Before the questions, hold these five diagrams in your head. Almost every trap is a misreading of one of them.

The register window hierarchy — one physical cell, four addressable widths. Look at how AL sits inside AX inside EAX inside RAX, and notice the red note: a write to EAX clears the grey upper half.

Segment:offset → physical address — watch the lavender segment slide left by 4 bits and the coral offset drop into the low bits, adding up to a 20-bit address.

Aliasing — two different segment:offset pairs, one arrow landing on the same byte. This is designed, not a bug.

One CISC instruction → many µops — the mint boxes are the small RISC-like steps the coral CISC instruction is split into inside the CPU.

The 15-byte instruction layout — every optional field drawn to scale, so you can see how prefixes, opcode, ModR/M, SIB, displacement, and immediate must sum to at most 15.

True or false — justify

Recall Reveal each after you've answered aloud

x86 was 64-bit from the very first chip. ::: False. The 8086 was 16-bit; 32-bit arrived with the 80386 ("IA-32") in 1985 and 64-bit only with AMD64 in 2003 — three decades of growth, not one design. Writing to AL changes the value stored in AX. ::: True in the sense that AL is the low byte of AX (see figure s01) — they share silicon — so changing AL changes what you read back from AX. But it leaves the high byte of AX untouched. Because x86 is CISC, it can never be pipelined as efficiently as RISC. ::: False. Modern x86 decodes each CISC instruction into RISC-like µops (figure s04) and pipelines those out-of-order, so the internal engine is RISC-ish despite the CISC face. "Segment × 16" means the CPU runs a multiply on every memory access. ::: False. ×16 is a fixed left-shift by 4 bits (figure s02), which in hardware is just wires routed to higher positions — no multiplier, essentially free. In modern 64-bit long mode, segment registers no longer exist. ::: False. Segmentation is mostly disabled (flat memory), but CS, DS, SS, ES, FS, GS still exist as fossils — FS/GS are even actively used for thread-local storage. Every field of an x86 instruction is optional. ::: False. Only the opcode is mandatory (see figure s05); prefixes, ModR/M, SIB, displacement, and immediate are each optional depending on what the instruction needs. A fixed-length RISC ISA can always decode instruction $n + 1$ before finishing instruction $n$ . ::: True — the boundary is at a known fixed stride (e.g. every 4 bytes), so the fetch unit knows every start position immediately. x86 cannot, because it must parse $n$ to learn where $n$ ends. RAX and EAX are two separate registers you can use independently. ::: False. EAX is a window onto the low 32 bits of the single physical RAX (figure s01). There is one storage cell, addressable at four widths (RAX/EAX/AX/AL).

Spot the error

Recall Each statement contains one mistake — name it

"An x86 instruction can be up to 15 bytes because the immediate field alone can be 15 bytes." ::: Wrong cause. The 15-byte figure is the sum of prefixes, opcode, ModR/M, SIB, displacement, and immediate (figure s05); the immediate alone is at most 8 bytes. Intel simply caps the total at 15. "In 64-bit mode every immediate can be a full 8-byte constant." ::: Oversimplified. Most 64-bit-mode immediates are still only 4 bytes (32-bit, sign-extended to 64); the sole common instruction taking a full $8$ -byte literal is MOV r64, imm64. That is exactly why arbitrary 64-bit constants make that one MOV so long. "The 8086 needed segmentation because 16-bit registers can only address 16 KB." ::: Arithmetic slip. 16 bits address $2^{16} = 64$ KB, not 16 KB. Segmentation was needed to reach the desired 20-bit / 1 MB space, not to escape a 64 KB limit alone. "AMD64 was Intel's 64-bit design, later licensed to AMD." ::: Reversed. AMD designed the 64-bit extension (AMD64, 2003); Intel adopted a compatible version. The parent note flags this exact trap. "Because RCX is the counter register, the CPU forces all loops to use RCX." ::: Overstated. RCX is the traditional/implicit counter for LOOP and REP string ops, but ordinary loops can use any general-purpose register. "PhysAddr = Offset × 16 + Segment." ::: Operands swapped. It is Segment that is shifted: $(Segment ≪ 4) + Offset$ . Shifting the offset would misplace it in the high bits. "REX prefix makes instructions run in 64-bit mode by widening the opcode." ::: Wrong mechanism. REX is a one-byte prefix ( $0x40$ – $0x4F$ , not part of the opcode) that selects 64-bit operand size and unlocks the extra registers R8–R15.

Why questions

Recall Answer in one or two sentences of causation

Why does one physical register carry four different names (RAX/EAX/AX/AL)? ::: Because the register grew by extension across generations, each new width wrapping the older one (figure s01); the names let you address any nested layer of the same fossilised cell. Why is variable-length encoding the "fundamental tax" of CISC? ::: Because the decoder must fully parse instruction $n$ to find where instruction $n + 1$ begins, serialising a step that fixed-length RISC does trivially in parallel. Why did early CISC designers want dense, multi-step instructions? ::: Memory and disk were tiny and expensive, so fewer instruction bytes meant smaller programs and cheaper storage — see RISC vs CISC. Why does a bigger immediate constant physically lengthen an instruction? ::: The constant is baked inside the instruction bytes (figure s05), so an 8-byte constant literally adds 8 bytes to that instruction's length. Why can a modern x86 chip still boot 1980s DOS code? ::: Backward compatibility is the family's top rule; new chips extended the old ISA rather than replacing it, so every legacy opcode still decodes. Why does segmentation give a 20-bit range from 16-bit numbers? ::: Shifting the segment left by 4 bits stretches it into the high bits, overlapping with the 16-bit offset's range: $20 = 16 + 4$ (figure s02). Why does the parent describe x86 as "CISC outside, RISC inside"? ::: The ISA the programmer sees is CISC, but the microarchitecture translates it into µops and runs those RISC-style — two different layers. Why do all the prefix families still fit under the 15-byte cap? ::: Because Intel limits an instruction to at most four prefix bytes total (operand-size, address-size, segment, lock/rep, REX combined), so prefixes contribute a bounded slice of the 15.

Edge cases

Recall The boundary and degenerate scenarios

What specific fault fires when an encoding exceeds 15 bytes? ::: A #GP (General Protection fault) — the decoder rejects the over-long encoding before executing it. (A different fault, #UD, the Undefined-opcode fault, is for illegal opcodes, not over-length; don't conflate them.) 15 bytes is a hard ceiling, not a soft target. With Segment $= 0x0000$ and Offset $= 0x0000$ , what is the physical address? ::: $0x00000$ . The shift of a zero segment is still zero and adding a zero offset leaves the very first byte of real-mode memory. Two different (segment, offset) pairs can point to the same physical byte — is that a bug? ::: No, it's inherent aliasing (figure s03): because segments overlap every 16 bytes, $0x1000 : 0x0000$ and $0x0FFF : 0x0010$ both resolve to $0x10000$ . Real-mode programmers relied on this. What is the maximum real-mode physical address, and does it fit in 20 bits? ::: With max segment $0xFFFF$ and offset $0xFFFF$ you get $0xFFFF0 + 0xFFFF = 0x10FFEF$ , which exceeds 20 bits — the famous "A20 line" wrap-around the 8086 exhibited. If an instruction has no memory operand, does it still need a ModR/M byte? ::: Not always — register-only or implicit-operand instructions may omit ModR/M (and therefore SIB) entirely, which is exactly why lengths are variable. On x86-64, does writing to EAX leave the upper 32 bits of RAX unchanged, like AL does to AX? ::: No — this is the trap (see the red note in figure s01). A 32-bit write to EAX zero-extends, clearing the top 32 bits of RAX, whereas an 8- or 16-bit write preserves the surrounding bits. How does a fixed-width ISA like ARM handle a 64-bit constant it can't fit in one instruction? ::: It cannot bake it inline; it builds the constant across several instructions (e.g. MOVZ/MOVK) or loads it from a nearby data pool — the price RISC pays for fixed length. Does the Fetch-Decode-Execute Cycle itself differ on x86 versus RISC? ::: The cycle is the same fetch→decode→execute→write-back; only the decode stage is heavier on x86 because it must first determine the instruction's length and split it into µops.

Back to x86 architecture overview.