1. Chapter 4: Processor Architecture
How does the hardware execute the instructions?
We’ll see by studying an example system
Based on simple instruction set devised for this purpose
Y86, inspired by x86
Fewer data types, instructions, addressing modes
Simpler encodings
Reasonably complete for integer programs
We’ll design hardware to implement Y86 ISA
Basic building blocks
Sequential implementation
Pipelined implementation

2. Instruction Set Architecture
Defines interface between hardware and software
Software spec is assembly language
State: registers, memory
Instructions, encodings
Hardware must execute instructions correctly
May use variety of transparent tricks to make execution fast.
Results must match sequential execution.
ISA is a layer of abstraction
Above: how to program machine
Below: what needs to be built
ISA
Compiler OS
CPU
Design
Circuit
Chip
Layout
Application
Program

3. Where Are We Now? CS142 & 124 IT344 lib.o C program: foo.c Compiler
Memory
Loader
Executable (mach lang pgm): a.out
Linker
Object (mach lang module): foo.o
Assembler
Assembly program: foo.s
Compiler
C program: foo.c
Where Are We Now?
CS142 & 124
lib.o
IT344

4. Y86 Processor and System State
RF: Program registers
CC: Condition codes
Stat: Program Status
%eax
%ecx
%edx
%ebx
%esi
%edi
%esp
%ebp ZF SF OF
DMEM: Memory PC
Program Registers
Same 8 as with IA32. Each 32 bits
Condition Codes
Single-bit flags as in x86: OF (Overflow), ZF (Zero), SF (Negative)
Program Counter
Indicates address of instruction
Memory
Byte-addressable storage, words in little-endian byte order
Stat
Indicates exceptional outcomes (bad opcode, bad address, halt)

5. Y86 Instructions Format 1 to 6 bytes of information read from memory
Can determine instruction length from first byte
Not as many instruction types, and simpler encoding than IA32
Each accesses and modifies some portion of the CPU and system state
Program registers
Condition codes
Program counter
Memory contents

6. Encoding Registers Each register has 4-bit ID
Similar encoding used in IA32
But we never deciphered encoding to notice!
Register ID 0xF indicates “no register”
Will use this in our hardware design in multiple places
Could otherwise encode register # in 3 bits
Simplifies decoding of instructions
%eax
%ecx
%edx
%ebx
%esi
%edi
%esp
%ebp 1 2 3 6 7 4 5

7. Instruction Example Addition instruction
Add value in register rA to that in register rB
Store result in register rB
Y86 allows addition to be applied to register data only
Set condition codes based on result
Two-byte encoding
First byte indicates instruction type
Second gives source and destination registers
e.g., addl %eax,%esi has encoding 60 06
Generic Form
Encoded Representation
addl rA, rB 6 rA rB

8. Arithmetic and Logical Operations
Instruction Code
Function Code
Add
addl rA, rB 6 rA rB
Refer to generically as “OPl”
Encodings differ only by “function code”
Low-order 4 bits in first instruction word
All set condition codes as side effect
Subtract (rA from rB)
subl rA, rB 6 1 rA rB
And
andl rA, rB 6 2 rA rB
Exclusive-Or
xorl rA, rB 6 3 rA rB

9. Move Operations Similar to the IA32 movl instruction
Register --> Register
rrmovl rA, rB 2 rA rB
Immediate --> Register
irmovl V, rB 3 F rB V
Register --> Memory
rmmovl rA, D(rB) 4 rA rB D
Memory --> Register
mrmovl D(rB), rA 5 rA rB D
Similar to the IA32 movl instruction
Simpler format for memory addresses
Separated into different instructions to simplify hardware implementation

10. Move Instruction Examples
IA32
Y86
Encoding
movl $0xabcd, %edx
irmovl $0xabcd, %edx
30 82 cd ab 00 00
movl %esp, %ebx
rrmovl %esp, %ebx
20 43
movl -12(%ebp),%ecx
mrmovl -12(%ebp),%ecx
50 15 f4 ff ff ff
movl %esi,0x41c(%esp)
rmmovl %esi,0x41c(%esp) c
movl $0xabcd, (%eax) —
movl %eax, 12(%eax,%edx) —
movl (%ebp,%eax,4),%ecx —

11. Jump Instructions Refer to generically as “jXX”
jmp Dest 7
Jump Unconditionally
Dest
Refer to generically as “jXX”
Encodings differ only by “function code”
Based on values of condition codes
Same as IA32 counterparts
Encode full destination address
Unlike PC-relative addressing in IA32
jle Dest 7 1
Jump When Less or Equal
Dest
jl Dest 7 2
Jump When Less
Dest
je Dest 7 3
Jump When Equal
Dest
jne Dest 7 4
Jump When Not Equal
Dest
jge Dest 7 5
Jump When Greater or Equal
Dest
jg Dest 7 6
Jump When Greater
Dest

12. Same stack conventions as IA32
Stack Operations
pushl rA a rA 8
Decrement %esp by 4
Store word from rA to memory at %esp
Like IA32
Read word from memory at %esp
Save in rA
Increment %esp by 4
popl rA b rA 8
Same stack conventions as IA32

13. Subroutine Call and Return
call Dest 8
Dest
Push address of next instruction onto stack
Start executing instructions at Dest
Like IA32
Pop value from stack
Use as address for next instruction
ret 9

14. Miscellaneous Instructions
nop
Don’t do anything
Stop executing instructions
IA32 has comparable instruction, but it can’t be executed in user mode
We will use this instruction to stop the simulator
halt 1

15. Y86 Instruction Set Byte 1 2 3 4 5 pushl rA A rA F jXX Dest 7 fn Dest1 2 3 4 5
pushl rA A rA F
jXX Dest 7 fn
Dest
popl rA B
call Dest 8
rrmovl rA, rB rB
irmovl V, rB V
rmmovl rA, D(rB) D
mrmovl D(rB), rA
OPl rA, rB 6
ret 9
nop
halt
addl
subl
andl
xorl
jmp
jle jl je
jne
jge jg

16. Writing Y86 Code Best to use C compiler as much as possible
Write code in C
Compile for IA32 with gcc -S
Hand translate into Y86
Coding example
Find number of elements in null-terminated list
int len1(int a[]);
5043
6125
7395 a
 3

17. Y86 Code Generation Example
First try
Write typical array code
Compile with gcc -O2 -S
Problem
Hard to do array indexing on Y86: no scaled addressing modes
/* Find number of elements in
null-terminated list */
int len1(int a[]) {
int len;
for (len = 0; a[len]; len++) ;
return len; }
L18:
incl %eax
cmpl $0,(%edx,%eax,4)
jne L18
x86 code

18. Y86 Code Generation Example #2
Second try
Revise to use pointers
Compile with gcc -O2 -S
Result
Doesn’t use indexed addressing
/* Find number of elements in
null-terminated list */
int len2(int a[]) {
int len = 0;
while (*a++)
len++;
return len; }
L5:
movl (%edx),%eax
incl %ecx
addl $4,%edx
testl %eax,%eax
jne L5
x86 code

19. Y86 Code Generation Example #3
IA32 code
Setup
Y86 code
Setup
len2:
pushl %ebp
xorl %ecx,%ecx
movl %esp,%ebp
movl 8(%ebp),%edx
movl (%edx),%eax
je L7
len2:
pushl %ebp # Save %ebp
xorl %ecx,%ecx # len = 0
rrmovl %esp,%ebp # Set frame
mrmovl 8(%ebp),%edx # Get a
mrmovl (%edx),%eax # Get *a
je L7 # Goto exit
Hand translation

20. Y86 Code Generation Example #4
IA32 code
Loop + Finish
Y86 code
Loop + Finish
L5:
movl (%edx),%eax
incl %ecx
addl $4,%edx
testl %eax,%eax
jne L5
movl %ebp,%esp
movl %ecx,%eax
popl %ebp
ret
L5:
mrmovl (%edx),%eax # Get *a
irmovl $1,%esi
addl %esi,%ecx # len++
irmovl $4,%esi
addl %esi,%edx # a++
andl %eax,%eax # *a == 0?
jne L5 # No--Loop
rrmovl %ebp,%esp # Pop
rrmovl %ecx,%eax # Rtn len
popl %ebp
ret
Hand translation

21. Y86 Program Structure
irmovl Stack,%esp # Set up stack
rrmovl %esp,%ebp # Set up frame
irmovl List,%edx
pushl %edx # Push argument
call len2 # Call Function
halt # Halt
.align 4
List: # List of elements
.long 5043
.long 6125
.long 7395
.long 0
# Function
len2:
. . .
# Allocate space for stack
.pos 0x100
Stack:
Programmer must do more work; no compiler, linker, run-time system
Make program placement explicit
Stack initialization must be explicit (addr. 0x100)
Must ensure code is not overwritten!
Must initialize data
Can use symbolic names

22. Assembling Y86 Program Generates “object code” file eg.yo
unix> yas eg.ys
Generates “object code” file eg.yo
Actually looks like disassembler output
ASCII file to make it easy for you to read
0x000: | irmovl Stack,%esp # Set up stack
0x006: | rrmovl %esp,%ebp # Set up frame
0x008: | irmovl List,%edx
0x00e: a | pushl %edx # Push argument
0x010: | call len2 # Call Function
0x015: | halt # Halt
0x018: | .align 4
0x018: | List: # List of elements
0x018: b | .long 5043
0x01c: ed | .long 6125
0x020: e31c | .long 7395
0x024: | .long 0

23. Simulating Y86 Program Instruction set simulator
unix> yis eg.yo
Instruction set simulator
Computes effect of each instruction on processor state
Prints changes in state from original
Stopped in 41 steps at PC = 0x16. Exception 'HLT', CC Z=1 S=0 O=0
Changes to registers:
%eax: 0x x
%ecx: 0x x
%edx: 0x x
%esp: 0x x000000fc
%ebp: 0x x
%esi: 0x x
Changes to memory:
0x00f4: 0x x
0x00f8: 0x x
0x00fc: 0x x

24. CISC vs. RISC CISC-like RISC-like Operate on memory directly
Smaller code size
RISC-like
Can only operate on registers
Load-store architecture
Larger code size
L5:
movl (%edx),%eax
incl %ecx
addl $4,%edx
testl %eax,%eax
jne L5
L18:
incl %eax
cmpl $0,(%edx,%eax,4)
jne L18

25. CISC Instruction Sets CISC: Complex Instruction Set Computer
Dominant style of machines designed prior to ~1980
Stack-oriented instruction set
Use stack to pass arguments, save program counter
Explicit push and pop instructions
Arithmetic instructions can access memory
addl %eax, 12(%ebx,%ecx,4)
Requires memory read and write + complex address calculation
Condition codes
Set as side effect of arithmetic and logical instructions
Philosophy
Add instructions to perform “typical” programming tasks

26. RISC Instruction Sets Reduced Instruction Set Computer
Early projects at IBM, Stanford (Hennessy), and Berkeley (Patterson)
Fewer, simpler instructions in ISA (initially)
Takes more to perform same operations (relative to CISC)
But an instruction can execute faster on simpler hardware
Register-oriented instruction set
Many more (typically  32) registers
Used for arguments, return value and address, temporaries
Only load and store instructions can access memory
Similar to Y86 mrmovl and rmmovl
No condition codes
Test instructions return 0/1 in general purpose register

27. Example: MIPS Registers

28. Example: MIPS InstructionsOp Ra Rb Rd Fn
00000
R-R
addu $3,$2,$1 # Register add: $3 = $2+$1 Op Ra Rb
Immediate
R-I
addu $3,$2,3145 # Immediate add: $3 = $2+3145
sll $3,$2,2 # Shift left: $3 = $2 << 2
Branch Op Ra Rb
Offset
beq $3,$2,dest # Branch when $3 = $2
Load/Store Op Ra Rb
Offset
lw $3,16($2) # Load Word: $3 = M[$2+16]
sw $3,16($2) # Store Word: M[$2+16] = $3

29. CISC vs. RISC Debate Strong opinions at the time! Current status
CISC arguments
Easy for compiler (bridge semantic gap)
Concise object code (memory was expensive)
RISC arguments
Simple is better for optimizing compilers
A simple CPU can be made to run very fast
Current status
For desktop processors, choice of ISA not a technical issue
With enough hardware, anything can be made to run fast
Code compatibility more important
For embedded processors, RISC makes sense
Smaller, cheaper, less power

30. 4.1 Summary Y86 instruction set architecture
Similar state and instructions as IA32
Simpler encodings
Small instruction set
Y86 somewhere between CISC and RISC
Changes from x86 consistent with RISC principles

31. 4.2: Logic Design: A Brief Review
Fundamental hardware requirements
Communication
How to get values from one place to another
Computation
Storage
All are simplified by restricting to 0s and 1s
Low or high voltage on wire
Compute Boolean functions
Store bits of information

32. Communication: Digital Signals
Voltage
Time 1
Use voltage thresholds to extract discrete values from continuous signal
Simplest version: 1-bit signal
Either high range (1) or low range (0)
With guard range between them
Not strongly affected by noise or low quality circuit elements
Can make circuits simple, small, and fast

33. Computation: Logic Gates
Outputs are Boolean functions of inputs
Respond continuously to changes in inputs
After some small delay
a && b
Rising Delay
Falling Delay b
Voltage a
Time

34. Combinational Circuits
Acyclic Network
Primary
Inputs
Outputs
Acyclic network of logic gates
Continuously responds to changes on primary inputs
Primary outputs become (after some delay) Boolean functions of primary inputs

35. bool eq = (a&&b)||(!a&&!b)
Bit Equality
Bit equal a b eq
HCL Expression
bool eq = (a&&b)||(!a&&!b)
Generate 1 if a and b are equal
Hardware control language (HCL)
Very simple hardware description language
Boolean operations have syntax similar to C logical operations
We’ll use it to describe control logic for processors
Much more convenient than drawing gates
Assumes compiler exists to turn HCL into gate equivalent

36. Word-Level Representation
Word Equality
Word-Level Representation
b31
Bit equal
a31
eq31
b30
a30
eq30 b1 a1
eq1 b0 a0
eq0 Eq = B A Eq
HCL Representation
bool Eq = (A == B)
32-bit word size
HCL representation
Equality operation
Generates Boolean value

37. Bit-Level Multiplexers
Bit MUX
HCL Expression
bool out = (s&&a)||(!s&&b) b
out a
Control signal s
Data signals a and b
Output a when s=1, b when s=0

38. Word-Level Representation
Word Multiplexer
Word-Level Representation
b31 s
a31
out31
b30
a30
out30 b0 a0
out0 s B A
Out
MUX
HCL Representation
int Out = [
s : A;
1 : B; ];
Select input word A or B depending on control signal s
HCL representation
Case expression
Series of test : value pairs
Result value determined by first successful test

39. Arithmetic and Logical Operations
Instruction Code
Function Code
Add
addl rA, rB 6 rA rB
Refer to generically as “OPl”
Encodings differ only by “function code”
Low-order 4 bits in first instruction word
All set condition codes as side effect
Subtract (rA from rB)
subl rA, rB 6 1 rA rB
And
andl rA, rB 6 2 rA rB
Exclusive-Or
xorl rA, rB 6 3 rA rB

40. Arithmetic Logic Unit Combinational logicY X
X + Y A L U Y X
X - Y 1 A L U Y X
X & Y 2 A L U Y X
X ^ Y 3 A B A B A B A B OF ZF CF OF ZF CF OF ZF CF OF ZF CF
Combinational logic
Continuously responding to inputs
Control signal selects function computed
Corresponding to 4 arithmetic/logical operations in Y86
Also computes values for condition codes

41. Edge-Triggered Latch (Flip Flop)
Data Q+ Q– C S T
Clock
Trigger
Only in latching mode for brief period
On rising clock edge
Value latched depends on data as clock rises
Output remains stable at all other times C D Q+
Time T

42. Storage: Registers
Structure D C Q+ i7 i6 i5 i4 i3 i2 i1 i0 o7 o6 o5 o4 o3 o2 o1 o0
Clock I O
Clock
Each stores word of data (one byte in above register)
Different from program registers (e.g., %eax)
Collection of edge-triggered latches
Loads input on rising edge of clock

43. Register Operation   y x Stores data bits
State = x 
State = y
Output = y y
Rising
clock  x
Input = y
Output = x
Stores data bits
For most of time acts as barrier between input and output
As clock rises, loads input

44. State Machine Example Accumulator circuit
Comb. Logic A L U
Out
MUX 1
Clock In
Load
Accumulator circuit
Load or accumulate on each cycle x0 x1 x2 x3 x4 x5
x0+x1
x0+x1+x2
x3+x4
x3+x4+x5
Clock
Load In
Out

45. Storage: Random-Access Memory
Register
file A B W
dstW
srcA
valA
srcB
valB
valW
Read ports
Write port
Clock
Stores multiple words of memory
Address input specifies which word to read or write
Register file
Holds values of program registers
%eax, %esp, etc.
Register identifier serves as address
ID 0xF implies no read or write performed
Multiple Ports
Can read and/or write multiple words simultaneously
Each has separate address and data input/output

46. Register File Timing   Reading Writing Like combinational logic
Output data generated based on input address
After some delay
Writing
Like register (a few slides ago)
Update only as clock rises
Register
file A B
srcA
valA
srcB
valB 2 x x 2 y 2
Register
file W
dstW
valW
Clock x 
Register
file W
dstW
valW
Clock y 2
Rising
clock 

47. Administrivia Lab 4 – Farmer Game in VHDL HW 5 – Farmer Game in C
HW 5 – Buffer Overflow #1
Quiz 3 – due Feb 7
Quiz 4 – due Feb 14
Quiz 5 – due Feb 21
Midterm – available after class on Feb 28
No class Mar 1, work on the exam
Due 5PM Monday Mar 5
Take home, open book, open notes, open lecture slides
NO COLLABORATION

48. FPGA in IT Network switch Security gateway System on a chip
Embedded system …

49. 4.2 Summary Computation Storage Performed by combinational logic
Computes Boolean functions
Continuously reacts to input changes
Storage
Registers
Hold single words
Loaded as clock rises
Random-access memories
Hold multiple words
Multiple read and write ports possible
Read word anytime address input changes
Write word only on rising clock edge