Microprocessor

The 80386 is a 32-bit processor. Its register set is an extension of the 8086/80286 registers and is divided into the following groups.

1. General purpose registers (eight 32-bit). EAX, EBX, ECX, EDX, ESI, EDI, EBP, ESP. The lower 16 bits are accessible as AX, BX, CX, DX, SI, DI, BP, SP, and the low 16 bits of the first four split into 8-bit AH/AL, BH/BL, CH/CL, DH/DL, for compatibility with earlier processors. EAX is the accumulator, ECX the count, EDX the data register, ESP the stack pointer.

2. Segment registers (six 16-bit). CS (code), SS (stack), DS, ES, FS, GS (data). In protected mode they hold selectors; each has a hidden descriptor cache with the segment base, limit and attributes.

3. Instruction pointer and flags.

• EIP: 32-bit instruction pointer (IP is the lower 16 bits).
• EFLAGS: 32-bit flags register, containing the 8086 flags (CF, PF, AF, ZF, SF, TF, IF, DF, OF), the 80286 flags (IOPL, NT) and the new 80386 flags VM (virtual 8086 mode) and RF (resume flag).

4. Control registers (CR0-CR3).

• CR0: machine status; bits PE (protection enable), MP, EM, TS, ET and PG (paging enable).
• CR1: reserved.
• CR2: page fault linear address.
• CR3: page directory base register.

5. System address registers.

• GDTR (48-bit): base and limit of the Global Descriptor Table.
• IDTR (48-bit): base and limit of the Interrupt Descriptor Table.
• LDTR (16-bit): selector of the Local Descriptor Table.
• TR (16-bit): selector of the Task State Segment of the current task.

6. Debug registers (DR0-DR7). DR0-DR3 hold breakpoint linear addresses, DR6 is the status and DR7 the control register.

7. Test registers (TR6, TR7). Used to test the translation look-aside buffer (TLB), i.e. paging.

Problem: find the smallest number in an array of 15 bytes (8085).

Assumptions: the array is stored in memory from 2050H to 205EH (15 bytes). The result is stored at 2070H.

Algorithm

1. Point HL to the start of the array and load the first element into A (assume it is the smallest so far).
2. Set the counter to 14 (the remaining elements).
3. For each next element, compare it with A; if it is smaller, copy it into A.
4. After the loop A holds the minimum; store it at 2070H.

Program

        LXI  H, 2050H    ; HL points to start of array
        MVI  C, 0EH      ; counter = 15 - 1 = 14
        MOV  A, M        ; A = first element (current minimum)
LOOP:   INX  H           ; point to next element
        CMP  M           ; compare A with M (A - M); CY = 1 if A < M
        JC   SKIP        ; A already smaller, keep it
        MOV  A, M        ; otherwise M is smaller (or equal), A = M
SKIP:   DCR  C           ; decrement counter
        JNZ  LOOP        ; repeat until all elements are checked
        STA  2070H       ; store smallest number
        HLT

Sample data

Running the program gives A = 0FH, which is stored at 2070H (the smallest value in the table). The CMP M instruction does not alter A, only the flags: the carry flag is set when A < M (unsigned comparison).

Problem: find the greatest number in an array of 20 bytes (8085).

Assumptions: the array is stored from 2050H to 2063H (20 bytes); the result is stored at 2070H.

Algorithm

1. Point HL to the start of the array and load the first element into A (current maximum).
2. Set the counter to 19 (the number of remaining elements).
3. For each following element compare with A; if the element is greater, load it into A.
4. After the loop A holds the maximum, which is stored in memory.

Program

        LXI  H, 2050H    ; HL = start address of array
        MVI  C, 13H      ; counter = 20 - 1 = 19 (13H)
        MOV  A, M        ; A = first element (current maximum)
LOOP:   INX  H           ; next element
        CMP  M           ; A - M; CY = 1 if A < M
        JNC  SKIP        ; A >= M, A remains the maximum
        MOV  A, M        ; else A = M (new maximum)
SKIP:   DCR  C           ; decrement counter
        JNZ  LOOP        ; repeat until the count becomes zero
        STA  2070H       ; store the greatest number
        HLT

Sample data (20 bytes, in hex, at 2050H onward):

12 45 9A 3C 7F 21 B4 08 66 D3 4E 90 1B 5A C7 33 E8 29 74 A0

Run: A starts at 12H and is replaced by 45H, 9AH, B4H, D3H, and finally E8H. All later values are smaller, so A = E8H is stored in location 2070H. The CMP M instruction does not change A; it only sets the flags (carry set when A < M, unsigned comparison).

Instruction cycle. The time taken to fetch and execute one complete instruction. It consists of one or more machine cycles.

Machine cycle. The time required to complete one basic operation of the processor such as an opcode fetch, memory read, memory write, I/O read or I/O write. It consists of 3 to 6 T-states.

T-state. One clock period of the processor clock. It is the smallest unit of time in the timing diagram. If the clock frequency is 3 MHz, one T-state is $1/(3\times10^6) \approx 0.33\ \mu s$.

$\text{Instruction cycle} \supseteq \text{Machine cycles} \supseteq \text{T-states}$

Timing diagram of IN port (8085). IN 80H is a 2-byte instruction (opcode DBH, port address) that needs 3 machine cycles and 10 T-states:

1. Opcode fetch (4 T-states, T1-T4). PC is put on $A_{15}$-$A_8$ and $AD_7$-$AD_0$; ALE goes high in T1 to latch the low byte. $IO/\overline{M}=0$, $S_1=S_0=1$. $\overline{RD}$ goes low in T2-T3 and the opcode DBH is read into the instruction register; T4 is used for decoding.
2. Memory read (3 T-states). PC+1 is placed on the address bus ($IO/\overline{M}=0$, $S_1=1$, $S_0=0$), $\overline{RD}$ is low, and the port address (e.g. 80H) is read from memory into the Z register.
3. I/O read (3 T-states). The 8-bit port address is placed on both $A_{15}$-$A_8$ and $AD_7$-$AD_0$ (ALE high in T1). $IO/\overline{M}=1$, $S_1=1$, $S_0=0$. $\overline{IOR}$ (RD low with IO/M = 1) goes active in T2-T3 and the data from the port is placed on $AD_7$-$AD_0$ and loaded into the accumulator.

        |   M1 (opcode fetch)  |  M2 (mem read)  |   M3 (I/O read)   |
        | T1  | T2  | T3 | T4  | T1  | T2  | T3  | T1  | T2  | T3    |
CLK     _|-|_|-|_|-|_|-|_|-|_|-|_|-|_|-|_|-|_|-|_|-|_|-|_|-|_|-|_
A15-A8  [   PC high   ......   ][ PC+1 high  ....][ port addr ......]
AD7-AD0 [PCl]<--- DBH ---->  ...[PC+1 l]<--80H-->.. [port]<--data-->
ALE     _|-|_______________  ...|-|_____________  ..|-|____________
IO/M    ______0 (low) ______ ......0 ____________ ....1 (high) ____
RD      ----\______/--------  ...-\_______/------  ..-\_______/-----
S1,S0   11 (fetch)              10 (read)          10 (read)

Total = 4 + 3 + 3 = 10 T-states. For a 3 MHz clock this is about 3.33 $\mu s$.

Approach (8085). Assume the array of 15 (0FH) 8-bit numbers is stored from 9000H onwards. The first element is taken as the current maximum. Each remaining element is compared with A using CMP M; if the element is larger (carry set because A < M) it replaces A. The largest number is stored in 9100H.

        LXI  H, 9000H     ; HL -> start of array
        MVI  C, 0FH       ; array size = 15
        MOV  A, M         ; A = first element (assumed largest)
        DCR  C            ; 14 elements remain to be compared
NEXT:   INX  H            ; point to next element
        CMP  M            ; A - M : CY = 1 if A < M
        JNC  SKIP         ; A >= M -> keep A
        MOV  A, M         ; else A = M (new largest)
SKIP:   DCR  C
        JNZ  NEXT
        STA  9100H        ; store the largest number
        HLT

Sample data. Memory 9000H-900EH holds: 12H, 5AH, 03H, 7FH, 21H, 9CH, 44H, 0AH, B3H, 67H, 18H, E1H, 2DH, 8EH, 50H.

Trace of A: 12H $\rightarrow$ 5AH $\rightarrow$ 5AH (03H smaller) $\rightarrow$ 7FH $\rightarrow$ 7FH (21H) $\rightarrow$ 9CH $\rightarrow$ 9CH (44H, 0AH) $\rightarrow$ B3H $\rightarrow$ B3H (67H, 18H) $\rightarrow$ E1H $\rightarrow$ E1H (2DH, 8EH, 50H).

Result: location 9100H = E1H, the largest value.

If an unsigned comparison is not wanted, the same method works for signed numbers only when values are of the same sign; here unsigned 8-bit data is assumed.

PUSH and POP are the stack-handling instructions. The stack is a LIFO region of memory addressed by the stack pointer (SP, with SS in 8086).

8086 operation.

• PUSH src: $SP \leftarrow SP-2$; the high byte of src goes to $[SS:SP+1]$ and the low byte to $[SS:SP]$.
• POP dest: low byte of dest is read from $[SS:SP]$, high byte from $[SS:SP+1]$; then $SP \leftarrow SP+2$.

Example (8086).

MOV AX, 1234H
MOV BX, 5678H
PUSH AX        ; stack: 1234H, SP = SP - 2
PUSH BX        ; stack: 5678H on top of 1234H, SP = SP - 2
POP  CX        ; CX = 5678H, SP = SP + 2
POP  DX        ; DX = 1234H, SP = SP + 2

Because the stack is LIFO, the registers are recovered in the reverse order of saving. The same pair is used to swap two registers (push AX, push BX, pop AX, pop BX) and to preserve the register contents around a CALL.

8085 equivalent. PUSH B stores B in $[SP-1]$ and C in $[SP-2]$ and decrements SP by 2; POP B loads C from $[SP]$, B from $[SP+1]$ and increments SP by 2.

The 8085 has a single multiplexed set of control signals: $IO/\overline{M}$, $\overline{RD}$ and $\overline{WR}$. To address memory and I/O separately, four separate control signals must be generated externally by combining them with logic gates:

• $\overline{MEMR}$ (memory read)
• $\overline{MEMW}$ (memory write)
• $\overline{IOR}$ (I/O read)
• $\overline{IOW}$ (I/O write)

Logic.

$\overline{MEMR} = \overline{RD} + IO/\overline{M}$ $\overline{MEMW} = \overline{WR} + IO/\overline{M}$ $\overline{IOR} = \overline{RD} + \overline{IO/\overline{M}}$ $\overline{IOW} = \overline{WR} + \overline{IO/\overline{M}}$

Each output is active low. For memory signals, $IO/\overline{M}$ must be 0 and RD (or WR) low, so an OR gate output goes low only then. For I/O signals, $IO/\overline{M}$ is inverted first, so the output goes low only when $IO/\overline{M}=1$ and RD (or WR) is low.

Logic diagram.

                       +-----+
 RD ----+------------->|     |
        |              | OR  |--------------------> MEMR (active low)
 IO/M --+----+-------->|     |
        |    |         +-----+
        |    |         +-----+
 WR ----|----|-------->| OR  |--------------------> MEMW
        |    +-------->|     |
        |    |         +-----+
        |    |  +---+
        |    +->|NOT|--+
        |       +---+  |   +-----+
        +--------------|-->| OR  |----------------> IOR
 (RD)                  +-->|     |
                           +-----+
                       (WR) similarly with the inverted IO/M --> IOW

Equivalent implementation: a 3-to-8 decoder (74LS138) or a combination of one 74LS32 (OR) and one 74LS04 (NOT) gate. A 74LS138 with $IO/\overline{M}$, $\overline{RD}$ and $\overline{WR}$ as inputs can also generate all four signals.

The Intel 80286 is a 16-bit microprocessor with a 16-bit data bus and a 24-bit address bus (16 MB physical, 1 GB virtual address space). It runs in two modes: real address mode (8086-compatible) and protected virtual address mode (memory management and protection). Internally it is divided into four functional units that work in parallel, which gives it pipelined operation.

Block diagram

                 +--------------------------------------------------+
  A23-A0  <----> |  BUS UNIT (BU)                                   |
  D15-D0  <----> |  address latches/drivers, data transceivers,     |
  Control <----> |  bus controller, prefetcher, 6-byte prefetch Q   |
                 +----------------------+---------------------------+
                                        |  prefetched bytes
                                        v
                 +--------------------------------------------------+
                 |  INSTRUCTION UNIT (IU)                           |
                 |  instruction decoder -> 3 decoded-instruction Q  |
                 +----------------------+---------------------------+
                                        |  decoded instructions
                                        v
                 +--------------------------------------------------+
                 |  EXECUTION UNIT (EU)                             |
                 |  ALU, register file (AX,BX,CX,DX,SP,BP,SI,DI,    |
                 |  flags, MSW), control                            |
                 +----------------------+---------------------------+
                                        |  logical address
                                        v
                 +--------------------------------------------------+
                 |  ADDRESS UNIT (AU)                               |
                 |  segment registers CS,DS,SS,ES, descriptor caches|
                 |  offset adder, segment-limit checker, MMU/       |
                 |  protection test, physical address generation    |
                 +----------------------+---------------------------+
                                        | 24-bit physical address
                                        +--------> to Bus Unit

Functional units

1. Address Unit (AU). Calculates the physical address of instructions and operands. In real mode it forms the address as in the 8086 (segment x 16 + offset). In protected mode it uses the segment selector to read a descriptor (base, limit, access rights) from the descriptor table, adds the offset to the 24-bit base, and checks the limit and the privilege level. It contains the segment registers and their hidden descriptor caches, and so does memory management and protection.

2. Bus Unit (BU). Performs all the external bus operations: it generates the address, data and control signals, fetches opcodes and transfers data. It has a prefetcher that fetches instruction bytes whenever the bus is free and stores them in a 6-byte prefetch queue. It also holds the bus controller, the address latches and data transceivers and the interface to the 80287 coprocessor.

3. Instruction Unit (IU). Takes bytes from the prefetch queue, decodes them into internal microcode form and keeps up to 3 decoded instructions in a queue ready for the EU, so decoding overlaps with execution.

4. Execution Unit (EU). Executes the decoded instructions. It contains the 16-bit ALU, the general registers (AX, BX, CX, DX), the pointer and index registers (SP, BP, SI, DI), the flag register and the machine status word (MSW), and the control logic. When an operand in memory is needed it passes the offset to the AU.

Because the four units operate concurrently (fetch, decode, address calculation, execution), the 80286 is considerably faster than the 8086 at the same clock rate.

Instruction set

The instruction set of a microprocessor is the complete collection of the instructions it can recognize and execute. Each instruction has an opcode (what operation to perform) and operands. The 8085 has 74 instructions (246 opcodes), grouped as follows.

1. Data transfer instructions copy data between registers, memory and registers, or load data directly, without altering the flags.

• MOV A, B, MVI C, 05H, LDA 2050H, STA 2060H, LXI H, 2050H, XCHG, PUSH B, POP D.

2. Arithmetic instructions perform addition, subtraction, increment and decrement.

• ADD B, ADI 05H, ADC C, SUB B, SBB C, INR A, DCR B, INX H, DAA, DAD B.

3. Logical instructions perform AND, OR, XOR, compare, rotate and complement.

• ANA B, ORI 0FH, XRA A, CMP B, CPI 30H, RLC, RAR, CMA.

4. Branching instructions change the sequence of program execution.

• Unconditional: JMP 2000H, CALL 3000H, RET.
• Conditional: JZ, JNZ, JC, JNC, JP, JM, CZ, RNZ.

5. Machine control and I/O instructions control the processor and the I/O devices, and manipulate the interrupts.

• IN 80H, OUT 81H, NOP, HLT, EI, DI, RIM, SIM.

Instructions are also classified by size: 1-byte (MOV A,B), 2-byte (MVI A,05H) and 3-byte (LDA 2050H).

The Intel 80386 is a 32-bit microprocessor with a 32-bit data bus and a 32-bit address bus (4 GB physical address space, 64 TB virtual). It supports real mode, protected mode and virtual 8086 mode, and has on-chip memory management with segmentation and paging. Internally it has six functional units which operate in parallel (pipelined).

Block diagram

                       +--------------------------------+
  A31-A2, BE3'-BE0' <--|          BUS INTERFACE UNIT    |--> D31-D0
  control signals   <->|  address drivers, data buffers |
                       |  bus control, request prioritiser
                       +---------------+----------------+
                  physical address     |       ^ opcode / data
                         ^             v       |
              +----------+----+  +--------------------------+
              | PAGING UNIT   |  |   CODE PREFETCH UNIT     |
              | TLB, page     |  |   16-byte prefetch queue |
              | protection    |  +------------+-------------+
              +----------+----+               v
                         ^             +---------------------+
                 linear  |             | INSTRUCTION DECODE  |
                 address |             | UNIT, 3-instruction |
              +----------+----+        | decoded queue       |
              | SEGMENTATION  |        +----------+----------+
              | UNIT          |                   v
              | descriptors,  |        +---------------------+
              | limit & rights|<-------|   EXECUTION UNIT    |
              +---------------+ offset | ALU, 8 GPRs (32-bit)|
                                       | barrel shifter,     |
                                       | multiply/divide     |
                                       +---------------------+

Functional units

1. Bus Interface Unit (BIU). Provides the interface to the outside world: address, data and control signals. It accepts requests for code fetch, data read/write and I/O from the other units internally, prioritises them, and carries out the bus cycles. It supports pipelined and non-pipelined addressing, and dynamic bus sizing (16 or 32 bits).

2. Code Prefetch Unit. Fetches instruction bytes in advance whenever the bus is idle and stores them in a 16-byte prefetch queue.

3. Instruction Decode Unit. Takes bytes from the prefetch queue, decodes them into microcode and places the decoded instructions in a 3-deep instruction queue, ready for the execution unit.

4. Execution Unit (EU). Executes the decoded instructions. It contains eight 32-bit general registers (EAX, EBX, ECX, EDX, ESP, EBP, ESI, EDI), a 64-bit barrel shifter (shift/rotate in one clock), a fast multiply/divide hardware and the ALU, and the flags.

5. Segmentation Unit. Converts the logical address (segment selector + offset) to a 32-bit linear address by using the segment descriptor (base, limit, rights) and also performs the segment-level protection checks. It has descriptor caches for the segment registers.

6. Paging Unit. If paging is enabled, it converts the linear address into the physical address using page directory and page table entries, with a 32-entry Translation Lookaside Buffer (TLB) to cache recently used translations. It also checks page-level protection. If paging is disabled, the linear address is the physical address.

The segmentation and paging units together form the Memory Management Unit (MMU). The decode, execution and addressing stages work concurrently, which gives the 80386 a six-stage pipeline.

Flag. A flag is a 1-bit flip-flop in the processor that records a condition (status) produced by the result of an arithmetic or logical operation. The flags are used by conditional jump, call and return instructions to make decisions.

The 8085 has five flags, held in the 8-bit flag register (with three unused bits):

 D7  D6  D5  D4  D3  D2  D1  D0
 S   Z   X   AC  X   P   X   CY

1. Sign flag (S). Set to 1 if bit D7 of the result is 1 (the result is negative in 2's complement); otherwise 0.
2. Zero flag (Z). Set to 1 if the result of the operation is zero; otherwise 0. For example, after SUB A or DCR B reaching 0.
3. Auxiliary Carry flag (AC). Set to 1 if there is a carry out of bit D3 into D4 during addition (or borrow in subtraction). It is used internally for BCD operations (DAA).
4. Parity flag (P). Set to 1 if the result has an even number of 1 bits (even parity); 0 if odd.
5. Carry flag (CY). Set to 1 if an addition produces a carry out of D7, or a subtraction needs a borrow; also affected by rotate and compare instructions.

Example. MVI A, 95H; ADI 6BH gives $95H + 6BH = 100H$, so A = 00H, with CY = 1, Z = 1, S = 0, P = 1 (zero 1s is even), AC = 1 ($5+B=10H$, carry out of D3).

The flags are tested by instructions such as JC, JNC, JZ, JNZ, JM, JP, JPE, JPO.

Instruction set. The instruction set of a microprocessor is the complete collection of machine instructions (operation codes with their operands) that the processor can decode and execute. Each instruction tells the CPU what operation to perform and on what data. It determines the programming capability of the processor.

Kinds of instructions in 8086.

1. Data transfer instructions. Move data between registers, memory and ports without changing flags (mostly): MOV, PUSH, POP, XCHG, XLAT, LEA, LDS, LES, IN, OUT, LAHF, SAHF, PUSHF, POPF.
2. Arithmetic instructions. Addition, subtraction, multiplication, division and adjustments: ADD, ADC, SUB, SBB, INC, DEC, NEG, CMP, MUL, IMUL, DIV, IDIV, DAA, DAS, AAA, AAS, AAM, AAD, CBW, CWD.
3. Logical instructions. Bitwise operations: AND, OR, XOR, NOT, TEST.
4. Shift and rotate instructions. SHL/SAL, SHR, SAR, ROL, ROR, RCL, RCR.
5. String instructions. Operate on blocks of bytes/words using DS:SI and ES:DI: MOVSB/MOVSW, CMPSB/CMPSW, SCASB, LODSB, STOSB, with prefixes REP, REPE/REPZ, REPNE/REPNZ.
6. Control transfer (branch) instructions. Unconditional: JMP, CALL, RET, INT, IRET. Conditional jumps: JZ, JNZ, JC, JNC, JS, JO, JA, JB, ...; loops: LOOP, LOOPE, LOOPNE, JCXZ.
7. Processor control instructions. Control flags and the processor state: CLC, STC, CMC, CLD, STD, CLI, STI, HLT, WAIT, NOP, LOCK, ESC.

Examples. MOV AX, BX (transfer), ADD AL, 05H (arithmetic), AND AL, 0FH (logic), SHL AX, 1 (shift), REP MOVSB (string), JNZ LOOP1 (control), STI (processor control).

80286 microprocessor. A 16-bit processor with a 16-bit data bus and 24-bit address bus (16 MB physical memory), supporting a virtual memory of 1 GB per task and two operating modes. Internally it has four independent units working in parallel (pipelining).

Block diagram.

                    +--------------------------------------------+
  A23-A0  <-------->|                BUS UNIT (BU)               |<--> D15-D0
  Control signals   |   address drivers, data transceivers,      |
                    |   bus control, prefetcher, prefetch queue  |
                    +----------------------+---------------------+
                                           |  (6-byte prefetch queue)
                    +----------------------v---------------------+
                    |           INSTRUCTION UNIT (IU)            |
                    |   instruction decoder, 3 decoded-          |
                    |   instruction queue                        |
                    +----------------------+---------------------+
                                           |
                    +----------------------v---------------------+
                    |           EXECUTION UNIT (EU)              |
                    |   ALU, registers (AX BX CX DX SP BP SI DI),|
                    |   flags, control                           |
                    +----------------------+---------------------+
                                           |
                    +----------------------v---------------------+
                    |            ADDRESS UNIT (AU)               |
                    |  segment registers, offset adder, limit    |
                    |  checker, descriptor caches, MMU/protection|
                    +--------------------------------------------+

Four functional sub-units.

1. Bus Unit (BU). Generates the address, data and control signals for memory and I/O access, and prefetches instructions ahead of time into a 6-byte prefetch queue when the bus is idle.
2. Instruction Unit (IU). Takes instructions from the prefetch queue, decodes them and keeps up to three decoded instructions in an instruction queue for the EU.
3. Execution Unit (EU). Executes the decoded instructions using the ALU and the general purpose, pointer/index and flag registers.
4. Address Unit (AU). Calculates the physical address of operands from the segment base and offset, performs memory management and protection checks (limit, access rights) and sends the address to the BU.

Real address mode vs protected virtual address mode.

Use of $AD_7$-$AD_0$. In the 8085 these 8 pins form a time-multiplexed address/data bus. During the first clock cycle (T1) of a machine cycle they carry the low-order address byte $A_7$-$A_0$; during the remaining cycles (T2, T3) they carry the 8-bit data $D_7$-$D_0$ (data in or out). This saves pins, but the address must be separated from the data (de-multiplexed) before it is used by memory and I/O.

Address de-multiplexing process.

1. In T1 the 8085 places $A_7$-$A_0$ on $AD_7$-$AD_0$, and raises ALE (Address Latch Enable) to 1 for that clock.
2. An external octal latch (74LS373) has its D inputs on $AD_7$-$AD_0$ and its G (enable) input driven by ALE.
3. When ALE = 1 the latch is transparent and its outputs follow the address; when ALE falls to 0 at the end of T1 the latch holds the address byte.
4. The latch outputs form the stable low-order address bus $A_7$-$A_0$ for the full machine cycle. $A_{15}$-$A_8$ come directly from the 8085 high-order pins.
5. In T2/T3 the $AD_7$-$AD_0$ lines are used as the data bus.

                      +--------------+
  AD7-AD0 ------+---->| D0-D7  Q0-Q7 |-----> A7-A0 (low address bus)
                |     |  74LS373     |
  ALE --------------->| G            |
  GND ---------------->| OE          |
                |     +--------------+
                +---------------------------> D7-D0 (data bus)

  A15-A8 (direct from 8085) ---------------> A15-A8 (high address bus)

Thus the system gets a 16-bit address bus $A_{15}$-$A_0$ and an 8-bit data bus $D_7$-$D_0$.

Instruction cycle, machine cycle and T-state

• T-state (clock period): one cycle of the processor's clock, the smallest unit of timing. For a 3 MHz 8085 clock, one T-state is 0.33 microsecond.
• Machine cycle: the time required to complete one basic operation of accessing memory or an I/O device, i.e. opcode fetch, memory read, memory write, I/O read, I/O write, interrupt acknowledge. A machine cycle consists of 3 to 6 T-states.
• Instruction cycle: the time required to fetch and execute one complete instruction. It consists of one to five machine cycles (the first is always the opcode fetch).

So an instruction cycle is made of machine cycles, and each machine cycle is made of T-states.

LDA addr (load accumulator direct), 3 bytes, 4 machine cycles, 13 T-states

LDA 4000H stores the opcode 3AH followed by the low-order byte (00H) and high-order byte (40H) of the address. The execution:

1. Opcode fetch (M1, 4 T): PC is put on the address bus; ALE = 1 in T1 to latch the low address; RD' goes low in T2 and the opcode 3AH is read into the instruction register in T3. T4 is used to decode the opcode. PC is incremented.
2. Memory read (M2, 3 T): PC points to the low-order address byte; the byte is read into register Z. PC is incremented.
3. Memory read (M3, 3 T): PC points to the high-order address byte; it is read into register W. Now WZ = 4000H.
4. Memory read (M4, 3 T): the address WZ is placed on the address bus and the data byte is read from 4000H into the accumulator.

Total = 4 + 3 + 3 + 3 = 13 T-states. Machine cycles M1 to M3 form the fetch and M4 the execute.

Timing diagram

        |<--------M1 (opcode fetch)------>|<----M2------->|<----M3------->|<----M4------->|
        T1   T2   T3   T4                  T1   T2   T3     T1   T2   T3     T1   T2   T3
CLK    _|-|_|-|_|-|_|-|_                  ...

A15-A8  [   PC high   ]                    [  PC+1 high  ]  [  PC+2 high  ]  [  40H (data adr high)]
AD7-AD0 [PC low][ 3AH opcode in ]          [PC+1 low][00H in] [PC+2 low][40H in] [00H][ data in ]
ALE     |--|                                |--|             |--|             |--|
RD'     ______|----|_____ (T2-T3)          ___|----|___     ___|----|___      ___|----|___
IO/M'   low (memory) throughout;  S1S0 = 11 in M1 (fetch), 10 in M2, M3, M4 (read)

In each machine cycle ALE goes high in T1 so the low-order address is latched, RD' is active low during T2-T3, and the data is sampled on the rising edge of RD'. In M1, the extra T4 is used for decoding and no bus activity takes place.

Flag

A flag is a 1-bit flip-flop that records a condition (status) produced by an arithmetic or logic instruction. Flags are used by conditional jump, call and return instructions to take decisions. The 8085 has five flags in the 8-bit flag register (a part of the PSW with the accumulator):

 D7  D6  D5  D4  D3  D2  D1  D0
 S   Z   X   AC  X   P   X   CY

(X = undefined)

1. Sign flag (S): set to 1 if the result of the operation is negative, i.e. bit D7 of the result is 1; otherwise 0. For signed numbers it indicates the sign.
2. Zero flag (Z): set to 1 if the result is zero; reset to 0 if the result is non-zero. It is also set by a compare instruction when the two operands are equal.
3. Auxiliary carry flag (AC): set to 1 if there is a carry out of bit D3 into D4 during an addition (or a borrow in subtraction). It is used internally for BCD arithmetic (DAA) and cannot be tested by a jump instruction.
4. Parity flag (P): set to 1 if the result has an even number of 1 bits (even parity); reset to 0 for odd parity.
5. Carry flag (CY): set to 1 if an addition produces a carry out of D7 or a subtraction needs a borrow (the minuend is smaller than the subtrahend). It is also changed by the rotate and compare instructions (CMP sets CY if A < operand), and by STC and CMC.

Example: 9AH + 67H = 101H: result 01H, CY = 1, Z = 0, S = 0, P = 0 (one 1-bit), AC = 1 (A + 7 = 11H has a carry out of bit 3).

Descriptor

In the protected mode of the 80286, a segment is defined by an 8-byte data structure called a descriptor, stored in a descriptor table (GDT, LDT or IDT) in memory. It tells the processor everything about the segment:

• Base address (24 bits): starting physical address of the segment.
• Limit (16 bits): size of the segment minus one (up to 64 KB); offsets above the limit cause a protection fault.
• Access rights byte: present bit (P), descriptor privilege level (DPL, 2 bits), segment/system type, executable (code/data) bit, expand-direction/conforming bit, read/write permission and accessed (A) bit.
• The remaining 16 bits are reserved (must be zero on the 80286).

Use in logical to physical address conversion

In protected mode, the segment register no longer holds a segment base but a 16-bit selector: bits 15-3 = index (13 bits), bit 2 = TI (0 = GDT, 1 = LDT), bits 1-0 = RPL (requested privilege level).

Steps for translating the logical address (selector : offset):

1. The processor selects the GDT (TI = 0, base from GDTR) or the LDT (TI = 1, from LDTR).
2. It multiplies the index by 8 and adds this to the table base to find the descriptor in memory. (When the selector is loaded into a segment register, the descriptor is copied to a hidden descriptor cache, so later accesses do not need to read memory again.)
3. It checks the descriptor: segment present, privilege levels (CPL, RPL <= DPL), type, and that the offset is within the limit.
4. If the checks pass, the physical address is obtained by adding the 16-bit offset to the 24-bit base in the descriptor:

$\text{Physical address} = \text{Base (24 bit)} + \text{Offset (16 bit)}$

This gives a 24-bit address (16 MB physical space). If a check fails, a protection exception is raised. In real mode, by comparison, the physical address is segment x 16 + offset.

Descriptor

A descriptor is an 8-byte data structure used in protected mode that describes a memory segment to the processor. It holds the segment's base address, limit (size) and access rights/attributes, such as type (code or data), privilege level (DPL), present bit and granularity. Descriptors are stored in descriptor tables: the Global Descriptor Table (GDT), the Local Descriptor Table (LDT) and the Interrupt Descriptor Table (IDT).

Use of the segment descriptor in address conversion

In protected mode the segment register no longer holds a segment base. It holds a selector, which has an index (13 bits), a table indicator TI (GDT or LDT) and a requested privilege level RPL (2 bits).

Steps of conversion of a logical address (selector : offset) to a physical address:

1. The processor uses TI to pick the GDT or LDT and finds the table base from the GDTR or LDTR register.
2. The index in the selector, multiplied by 8, selects the 8-byte descriptor in that table.
3. The processor checks the descriptor: the present bit, the privilege levels (access rights), and that the offset does not exceed the limit.
4. If all checks pass, the base address from the descriptor is added to the offset:

$\text{Physical address} = \text{Segment base (from descriptor)} + \text{Offset}$

The 80286 has a 24-bit base address, so the physical address is 24 bits and can reach 16 MB. If a check fails, an exception (protection fault) is raised.

For speed, the descriptor is copied into a hidden cache register of the segment register when the selector is loaded, so later accesses do not need to read the table again.

Definitions

• T-state: one clock period of the processor's clock. It is the smallest unit of time. If the clock frequency is $f$, then $T = 1/f$.
• Machine cycle: the time taken to complete one operation of accessing memory or an I/O device, such as opcode fetch, memory read, memory write, I/O read or I/O write. A machine cycle consists of 3 to 6 T-states.
• Instruction cycle: the time taken to fetch and execute one complete instruction. It consists of one to five machine cycles. The first machine cycle is always the opcode fetch.

STA 16-bit address (opcode 32H), 3 bytes

STA addr stores the accumulator contents at the given 16-bit address. It takes 4 machine cycles and 13 T-states.

Description of the timing diagram (clock, A15 to A8, AD7 to AD0, ALE, RD, WR, IO/M)

1. M1 (T1 to T4): In T1 the PC contents are put on A15 to A8 and AD7 to AD0, and ALE goes high to latch the low address. In T2 the RD signal goes low and the opcode comes from memory onto the data bus. In T3 the opcode is read into the instruction register and RD goes high. T4 decodes the instruction.
2. M2 (T1 to T3): PC is incremented. The low byte of the operand address is read with ALE and RD. It goes into register Z.
3. M3 (T1 to T3): The high byte is read in the same way and goes into register W.
4. M4 (T1 to T3): The WZ pair is put on the address bus (high part on A15 to A8, low part on AD7 to AD0 during T1 with ALE). In T2 the accumulator contents are placed on AD7 to AD0 and WR goes low. The memory stores the data at the end of T3 when WR rises.

IO/M stays low throughout, since all are memory operations.

Block diagram of the 8086

                +-------------------------------------------------+
                |        BUS INTERFACE UNIT (BIU)                 |
  Memory / IO   |  CS DS SS ES   Instruction pointer (IP)         |
  <---- Bus ----|  Address adder (20-bit)   6-byte instr. queue   |
                |  Bus control logic                              |
                +----------------------+--------------------------+
                                       | internal bus
                +----------------------+--------------------------+
                |        EXECUTION UNIT (EU)                      |
                |  AX BX CX DX (AH/AL ...)  SP BP SI DI           |
                |  ALU      Flag register    EU control system    |
                +-------------------------------------------------+

The 8086 is a 16-bit microprocessor with a 20-bit address bus (1 MB memory). It has two units that work in parallel (pipelining).

1. Bus Interface Unit (BIU)

• Fetches instructions from memory and reads or writes operand data for the EU.
• Has four 16-bit segment registers (CS, DS, SS, ES), the instruction pointer IP, and a 6-byte instruction queue (4 bytes in the 8088).
• The address adder forms the 20-bit physical address: segment $\times 16$ + offset.
• While the EU executes, the BIU pre-fetches the next instructions into the queue, so the CPU rarely waits for fetches.

2. Execution Unit (EU)

• Decodes and executes the instructions from the queue.
• Contains the general registers (AX, BX, CX, DX), pointer and index registers (SP, BP, SI, DI), the ALU, the flag register and the control unit.
• It has no direct bus access. When it needs data from memory or I/O, it asks the BIU.

Real address mode and protected virtual address mode of the 80286

Use of AD7 to AD0

The 8085 has only 40 pins, so the lower 8 address lines are multiplexed with the 8 data lines. AD7 to AD0 carry the low-order address (A7 to A0) at the start of a machine cycle (T1), and then carry data (D7 to D0) for the rest of the cycle. The higher address lines A15 to A8 are separate and stay valid throughout.

Address de-multiplexing

Since the low address is available only during T1, it must be held (latched) to keep a stable address for memory and I/O during the data phase. This is done with an external 8-bit latch, such as the 74LS373, and the ALE (Address Latch Enable) signal.

 8085                          74LS373
 AD7-AD0 ----------------->  D0-D7   Q0-Q7 ---> A7-A0  (low address bus)
 ALE     ----------------->  LE
 GND     ----------------->  OE (enable)
 A15-A8  --------------------------------------> A15-A8 (high address bus)
 AD7-AD0 ------------------------------------> D7-D0  (data bus)

Operation:

1. In T1, ALE goes high. The latch is transparent and the AD7 to AD0 lines carry the address, which passes to the output.
2. ALE then goes low. The latch holds the address on its outputs.
3. The AD7 to AD0 lines are now free to carry data, which goes directly to the data bus. The latched lines form the low address bus, giving a full 16-bit address bus plus a separate 8-bit data bus.

Definitions

• Instruction cycle: the total time needed to fetch an instruction from memory and execute it. It is made up of one or more machine cycles.
• Machine cycle: the time needed to complete one basic operation of the processor with memory or I/O, such as opcode fetch, memory read, memory write, I/O read or I/O write. A machine cycle is made up of 3 to 6 T-states.
• T-state: one clock period of the processor, the smallest unit of timing. If the clock frequency is $f$, then $T=1/f$.

So: instruction cycle $\supseteq$ machine cycles $\supseteq$ T-states.

STA 16-bit address (8085)

STA stores the accumulator contents at the memory address given in the instruction (3 bytes: opcode 32H, low address byte, high address byte). It takes 4 machine cycles and 13 T-states:

Assumptions: STA 2050H is stored at 2000H (bytes 32H, 50H, 20H) and A = 7FH.

Timing diagram

        |<---- M1 (OF) ---->|<-- M2 (MR) -->|<-- M3 (MR) -->|<-- M4 (MW) -->|
        |  T1  T2  T3  T4   |  T1  T2  T3   |  T1  T2  T3   |  T1  T2  T3   |
CLK     _|-|_|-|_|-|_|-|_|-|_|-|_|-|_|-|_|-|_|-|_|-|_|-|_|-|_|-|_|-|_
A15-A8  [ 20H (PC high) ][  20H (PC+1)  ][  20H (PC+2)  ][  20H (2050H high) ]
AD7-AD0 [00H][ 32H opcode, decode ][01H][ 50H ][02H][ 20H ][50H][ 7FH data  ]
ALE     _|--|______________________|--|__________|--|__________|--|_________
RD'     ‾‾‾‾‾‾‾\_______/‾‾‾‾‾‾‾‾‾‾‾‾\_______/‾‾‾‾‾‾\_______/‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾
WR'     ‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾\_______/‾‾‾‾
IO/M'   low throughout (memory operations); S1,S0 = 1,1 in M1; 1,0 in M2,M3; 0,1 in M4

Description

• M1 (opcode fetch, 4 T-states): In T1 the PC (2000H) is placed on A15-A8 and AD7-AD0; ALE goes high to latch the low byte. RD' goes low in T2-T3, so the opcode 32H is read into the instruction register. T4 is used to decode it, and PC increments to 2001H.
• M2 (memory read, 3 T-states): The address 2001H is output, RD' is activated and the low-order byte 50H is read into register Z (PC increments).
• M3 (memory read, 3 T-states): The address 2002H is output and the high-order byte 20H is read into register W.
• M4 (memory write, 3 T-states): WZ = 2050H is output on the address bus (ALE in T1), the accumulator data 7FH is placed on AD7-AD0, and WR' goes low during T2-T3. The data 7FH is written into location 2050H.

Vectored vs non-vectored interrupts

Where and how the 8259 PIC is used

The 8085 has only five interrupt pins (and 8086 has just INTR/NMI), so the Intel 8259A Programmable Interrupt Controller is used in the system whenever many I/O devices must be able to interrupt through the single INTR line. It manages up to 8 interrupt requests (IR0-IR7) per chip, and up to 64 by cascading one master with 8 slaves.

Working:

1. A device raises one of the lines IR0-IR7. The request is stored in the IRR (Interrupt Request Register).
2. The priority resolver compares it with the in-service register (ISR) and the mask register (IMR), and selects the highest-priority unmasked request.
3. The 8259 raises INT, which is connected to the INTR pin of the processor.
4. The processor responds with the INTA' pulse(s). In the 8085, the 8259 places the CALL opcode (CDH) on the data bus on the first INTA' and the low and high bytes of the service routine address on the next two; in the 8086 mode the 8259 supplies an 8-bit interrupt type number on the second INTA' pulse, used to read the vector from the interrupt vector table.
5. The processor executes the ISR; at the end the ISR sends an EOI (End of Interrupt) command so that the ISR bit is cleared.

The 8259 is programmed with initialization command words (ICW1-ICW4) and operation command words (OCW1-OCW3) to set the vector base address, priority mode (fully nested, rotating), masking and cascade operation.

An addressing mode is the way in which the operand of an instruction is specified. The 8085 has five addressing modes.

1. Immediate addressing. The operand (data) is part of the instruction itself.

• MVI B, 32H loads 32H into B.
• LXI H, 2050H loads the 16-bit value 2050H into the HL pair.

2. Register addressing. The operand is in a register, and the register is named in the instruction.

• MOV A, B copies register B into A.
• ADD C adds register C to the accumulator.

3. Direct addressing. The 16-bit memory address of the operand is given in the instruction.

• LDA 2050H loads A from memory location 2050H.
• STA 3000H stores A at 3000H.
• IN 80H / OUT 01H use direct 8-bit port addresses.

4. Register indirect addressing. The address of the operand is held in a register pair (HL, BC or DE).

• MOV A, M loads A from the memory location whose address is in HL.
• LDAX B loads A from the location addressed by BC.

5. Implicit (implied) addressing. The operand is implied by the instruction itself; no operand is specified.

• CMA complements the accumulator.
• RAL rotates the accumulator left through carry.
• STC, HLT, RET.

Aim: read a string from the keyboard and display it in uppercase (8086, MASM/TASM with DOS interrupts).

Logic: DOS function 0Ah reads a buffered string. Each lowercase letter ('a' to 'z', ASCII 61H-7AH) is converted by subtracting 20H (clearing bit 5). Other characters are left unchanged. The string is terminated with $ and displayed using function 09h.

.MODEL SMALL
.STACK 100H
.DATA
    MSG1  DB 'Enter a string: $'
    MSG2  DB 0DH, 0AH, 'In uppercase: $'
    BUF   DB 50, ?, 52 DUP(?)   ; max length, actual length, characters

.CODE
MAIN PROC
    MOV  AX, @DATA
    MOV  DS, AX

    LEA  DX, MSG1               ; prompt
    MOV  AH, 09H
    INT  21H

    LEA  DX, BUF                ; read string
    MOV  AH, 0AH
    INT  21H

    LEA  SI, BUF + 2            ; SI -> first character
    MOV  CL, BUF + 1            ; CL = number of characters read
    MOV  CH, 0
    JCXZ SHOW                   ; empty string

NEXT:
    MOV  AL, [SI]
    CMP  AL, 'a'
    JB   SKIP                   ; below 'a'
    CMP  AL, 'z'
    JA   SKIP                   ; above 'z'
    SUB  AL, 20H                ; convert to uppercase
    MOV  [SI], AL
SKIP:
    INC  SI
    LOOP NEXT

SHOW:
    MOV  BL, BUF + 1            ; put '$' after last character
    MOV  BH, 0
    MOV  BYTE PTR BUF[BX + 2], '$'

    LEA  DX, MSG2
    MOV  AH, 09H
    INT  21H
    LEA  DX, BUF + 2            ; display converted string
    MOV  AH, 09H
    INT  21H

    MOV  AH, 4CH                ; exit to DOS
    INT  21H
MAIN ENDP
END MAIN

Example: input Hello Nepal 7 gives HELLO NEPAL 7.

System bus

A bus is a set of parallel lines (wires) used to carry information between the components of a computer. The system bus is the collection of buses that connects the microprocessor with the memory and I/O devices and carries the addresses, data and control signals among them. Using a shared bus reduces the number of connections needed, but only one device can use it at a time.

Types of system bus

1. Address bus.

• Carries the address of the memory location or I/O port that the processor wants to access.
• Unidirectional: from the processor to memory/I/O.
• Its width decides the addressable memory: $2^n$ locations for $n$ lines (8085: 16 lines gives 64 KB; 8086: 20 lines gives 1 MB).

2. Data bus.

• Carries the data (instructions and operands) between the processor, memory and I/O devices.
• Bidirectional, with tri-state drivers.
• Its width determines the word size transferred in one cycle (8085: 8 bits; 8086: 16 bits).

3. Control bus.

• Carries timing and control signals that coordinate the operations of the whole system.
• Signals include read (RD'), write (WR'), memory/IO select (IO/M'), ALE, interrupt request and acknowledge (INTR, INTA'), HOLD/HLDA, READY and RESET.
• The individual lines are mostly unidirectional but the bus as a whole includes signals in both directions.

In the 8085 the lower address lines AD0-AD7 are multiplexed with the data bus, and ALE is used to latch the address externally.

DTE and DCE wiring with RS-232

RS-232 (EIA-232) is a standard serial interface between a DTE (Data Terminal Equipment, e.g. a computer or terminal) and a DCE (Data Communication Equipment, e.g. a modem). The connector is DB-25 (or DB-9) and signals use voltage levels: logic 1 = -3 V to -15 V (mark), logic 0 = +3 V to +15 V (space).

The DTE and the DCE are connected with a straight-through cable, pin to pin, with the same signal on the same pin on both ends, because the DTE and DCE have complementary pin functions:

For two DTEs connected together (e.g. computer to computer) a null modem cable is used, which crosses TxD with RxD and RTS/CTS and DTR/DSR.

Double handshake I/O (full handshake)

In a double-handshake transfer, two control lines are exchanged for each data byte, so both the sender and the receiver confirm each step. For output from the processor to a peripheral:

1. The processor places data on the data lines and activates the request/strobe line (e.g. RTS or DAV) to tell the peripheral that valid data is available.
2. The peripheral reads the data and activates the acknowledge line (e.g. CTS or ACK) to say that the data was accepted.
3. The processor, on seeing the acknowledgment, removes (deactivates) the request line.
4. The peripheral then deactivates the acknowledge line, which shows that it is ready for the next byte.
5. The cycle repeats for the next data byte.

Since each request is answered by an acknowledgment and both lines return to the idle state, the transfer is reliable even if the two devices have very different speeds. It is used by the 8255 in mode 1/2 with the STB, IBF, OBF and ACK signals.

Memory interfacing

Memory interfacing means connecting memory chips (ROM/RAM) to the microprocessor's address, data and control buses so that the processor can read from or write to them. The processor must be able to select exactly one chip (and one location in it) at a time. The interfacing circuit does the following:

• connects the chip's data pins to the data bus and its low-order address pins to the lower address lines;
• uses the remaining high-order address lines to generate a chip select (CS') through an address-decoding circuit;
• connects RD'/WR' (or MEMR'/MEMW', generated from RD', WR' and IO/M') to the chip's output-enable and write-enable pins.

For the 8085 the multiplexed lines AD0-AD7 are first demultiplexed using an address latch (74LS373) controlled by ALE.

Address decoding in the 8085

The 8085 has 16 address lines (A15-A0), giving 64 KB. Suppose a memory chip has $n$ address pins; it uses A(n-1)-A0 internally, and the remaining lines A15-A$n$ are decoded to select the chip.

Example: a 2 KB RAM (2716/6116 type) needs 11 lines (A10-A0) for internal location selection. The remaining lines A15-A11 are decoded.

• Absolute (full) decoding: all the remaining lines take part in the decoding, so each location has a unique address. For a chip at 0000H-07FFH, CS' is low only when A15 to A11 = 00000, built using a NOR/NAND gate or a 74LS138 decoder.
• Partial (linear) decoding: only some of the high lines are used (others are left out or used directly as chip selects); this needs less hardware but gives foldback (multiple addresses for the same location) and wastes address space.

When several chips are used, a 3-to-8 decoder (74LS138) takes A15, A14, A13 as inputs and gives eight chip-select outputs, each selecting an 8 KB block:

Using IO/M' as an enable input of the decoder ensures that memory chips respond only to memory cycles. The unused lines between the chip's address pins and the decoder inputs (A12-A0 here) go directly to the chips.

Pipelining is the technique of overlapping the different stages of instruction processing, so that the processor starts fetching the next instruction while it is still executing the current one. It keeps the processor and the bus busy and increases throughput.

In the 8086 the CPU is divided into two independent units that work in parallel:

1. Bus Interface Unit (BIU): generates the 20-bit addresses, fetches instructions from memory, reads and writes operands and manages the bus. It holds the segment registers, the instruction pointer, the address adder and a 6-byte instruction queue.

2. Execution Unit (EU): decodes and executes the instructions. It contains the ALU, the general-purpose registers, the pointer/index registers and the flags register. It takes opcodes from the queue and never directly accesses the bus; when it needs memory or I/O data it asks the BIU.

How it works

• While the EU is executing an instruction, the BIU prefetches the next instruction bytes from memory into the queue (an 8086 fetches a word when at least two bytes of the queue are empty; the 8088 has a 4-byte queue).
• When the EU finishes an instruction, it reads the next one from the queue immediately, with no fetch delay. The effective time of fetch is therefore hidden.
• If the EU executes a jump, call or return, the queue contents are no longer valid and the queue is flushed; the BIU fetches from the new address and refills the queue (a small delay).

Thus fetch and execution overlap in time:

BIU:  fetch I1 | fetch I2 | fetch I3 | fetch I4 ...
EU:            | exec  I1 | exec  I2 | exec  I3 ...

This gives the 8086 higher speed than the non-pipelined 8085, in which fetch and execute are strictly sequential.

Von Neumann architecture

Proposed by John von Neumann, this is the stored-program model in which instructions and data are stored in the same memory and accessed over a single set of buses (address, data and control).

Main components:

• CPU (ALU + control unit + registers),
• Memory holding both program and data,
• Input/Output devices,
• the system bus connecting them.

Features:

• the CPU fetches an instruction, decodes and executes it, then fetches the next one in sequence (controlled by the program counter);
• since the program is just data in memory, it can be changed or loaded easily; the design is simple and cheap;
• a single bus means an instruction fetch and a data access cannot occur at the same time. This limitation is called the von Neumann bottleneck.

Most general-purpose microprocessors (8085, 8086, x86) follow this architecture. In contrast, the Harvard architecture uses separate memories and buses for program and data.

Macro assembler

A macro is a sequence of instructions given a name, defined once and inserted wherever its name is used. A macro assembler is an assembler that supports macros: when it meets a macro call, it replaces (expands) the call by the body of the macro, substituting the actual parameters for the formal ones.

Example (MASM):

ADDM  MACRO  X, Y, Z      ; macro definition
      MOV  AX, X
      ADD  AX, Y
      MOV  Z, AX
      ENDM

      ADDM  P, Q, R       ; macro call, expanded in-line

Differences from a subroutine: a macro is expanded in-line each time it is called (faster, no CALL/RET overhead, but increases program size), while a procedure exists once and is called. Advantages: shorter source code, readability, reusability and parameter passing. Common assemblers such as MASM and TASM are macro assemblers.

Direct Memory Access (DMA)

In programmed or interrupt-driven I/O, every byte passes through the CPU, which is slow for bulk transfers. In DMA, a DMA controller (DMAC) transfers data directly between an I/O device and memory without CPU involvement, by taking control of the system buses.

Working mechanism

1. The CPU programs the DMAC (starting address, byte count, direction, mode) and then continues its work.
2. The I/O device asserts a DREQ (DMA request) to the DMAC when it has data.
3. The DMAC sends HRQ (hold request) to the CPU's HOLD pin.
4. The CPU finishes the current bus cycle, floats its address, data and control buses (tri-state), and replies with HLDA (hold acknowledge).
5. The DMAC now becomes the bus master. It sends DACK to the device, puts the memory address on the address bus, and generates the read/write signals (MEMR', IOW' for a memory read, or IOR', MEMW' for a write). One byte moves directly between the device and memory.
6. The DMAC increments the address and decrements the byte count. When the count reaches zero it activates EOP' (terminal count) and the transfer ends.
7. The DMAC releases HRQ, the CPU takes back the buses and resumes (HLDA goes low); an interrupt can be generated to tell the CPU that the transfer is done.

Internal architecture of the 8237 DMAC

The 8237 has four independent channels (CH0 to CH3), each with a 16-bit address register and a 16-bit count register, and can be cascaded.

 IOR' IOW' CS' A3-A0 D7-D0
   |    |    |    |    |
 +-v----v----v----v----v------------------------------+
 |  I/O buffer  <->  READ/WRITE LOGIC                 |
 |                      |                             |
 |  TIMING & CONTROL  <-+-> COMMAND CONTROL           |
 |  (CLK, READY,        |   (Command, Mode, Request,  |
 |   RESET)             |    Mask, Status registers)  |
 |                      v                             |
 |  PRIORITY ENCODER (fixed / rotating)               |
 |                      |                             |
 |  +-----------+  +-----------+  +--------------+    |
 |  | CH0..CH3  |  | Current   |  | Temporary    |    |
 |  | base addr |  | address   |  | address/word |    |
 |  | base count|  | & count   |  | count regs   |    |
 |  +-----------+  +-----------+  +--------------+    |
 |  16-bit incrementer/decrementer, address buffers   |
 +--+--------+----------+---------+---------+---------+
    |        |          |         |         |
  DREQ0-3  DACK0-3  HRQ/HLDA   A7-A0/A3-A0  EOP'
                                 (DB0-DB7)

Main parts: data-bus buffer, read/write logic, control logic, priority resolver, mode, command, status, request and mask registers, and per channel a base/current address register and base/current word count register.

Timing of a DMA transfer (basic cycle)

State:     SI     S0     S1    S2    S3    S4    SI
CLK       _|‾|_|‾|_|‾|_|‾|_|‾|_|‾|_|‾|_|‾|_|‾|_
DREQ      __/‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾\_________
HRQ       ____/‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾\_______
HLDA      ________/‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾\____
DACK      __________/‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾\______
ADSTB     ____________/‾\______________________
AEN       __________/‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾\____
Address    ----------< A7-A0 / A15-A8 (S1) >----
MEMR'/IOW' ‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾\_______/‾‾‾‾‾‾‾‾

• SI: idle state; the 8237 samples DREQ.
• S0: DMAC has sent HRQ and waits for HLDA.
• S1 to S4: transfer states. In S1 the upper address byte is output on the data bus and latched by ADSTB, and AEN enables the address latch; S2 outputs the low byte on A7-A0 and DACK; S3 and S4 carry the read/write strobes (the extended write is activated earlier). Wait states (SW) are inserted if READY is low.
• After the transfer(s) the DMAC returns to SI and releases HRQ.

Transfer modes: single, block, demand and cascade.

The 8086 addressing modes specify how the operand (or its address) is found. The effective address (EA) of a memory operand is calculated as: EA = base (BX/BP) + index (SI/DI) + displacement. The physical address = segment register $\times$ 16 + EA. The modes are:

1. Register addressing. The operand is in a register. MOV AX, BX ; AX = BX

2. Immediate addressing. The operand is a constant in the instruction. MOV CX, 0050H ; CX = 50H

3. Direct addressing. The 16-bit effective address is given in the instruction. MOV AL, [2000H] ; AL = byte at DS:2000H

4. Register indirect addressing. The EA is held in BX, SI, DI (or BP). MOV AX, [BX] ; AX = word at DS:BX

5. Based addressing. EA = BX or BP + displacement. MOV AX, [BX + 04H] ; BP-based access uses the stack segment

6. Indexed addressing. EA = SI or DI + displacement. MOV AL, [SI + 10H] ; used for array access

7. Based-indexed addressing. EA = base register (BX/BP) + index register (SI/DI). MOV AX, [BX + SI]

8. Based-indexed with displacement. EA = base + index + displacement. MOV AX, [BX + SI + 08H] ; e.g. element in a table of records

9. String addressing. String instructions use SI (source, in DS) and DI (destination, in ES) implicitly, which are auto-incremented or decremented according to the DF flag. MOVSB ; ES:[DI] = DS:[SI]

Program-control (branch) addressing modes are also provided: intrasegment direct/indirect (JMP LABEL, JMP BX) and intersegment direct/indirect (JMP FAR PTR LABEL, JMP DWORD PTR [BX]), and I/O port addressing: direct (IN AL, 80H) and indirect through DX (IN AL, DX).

Approach. Read the string with DOS function 0Ah (buffered input), then print the characters from the last one back to the first with function 02h.

.model small
.stack 100h
.data
    msg1 db 'Enter a string: $'
    msg2 db 0Dh, 0Ah, 'Reversed string: $'
    buf  db 50, ?, 50 dup(0)      ; max length, actual length, characters
.code
main proc
    mov ax, @data
    mov ds, ax

    lea dx, msg1                  ; prompt
    mov ah, 09h
    int 21h

    lea dx, buf                   ; read string (ends with Enter)
    mov ah, 0Ah
    int 21h

    lea dx, msg2
    mov ah, 09h
    int 21h

    mov cl, buf+1                 ; number of characters actually typed
    mov ch, 0
    jcxz done                     ; empty string -> nothing to print

    lea si, buf+2                 ; SI -> first character
    add si, cx
    dec si                        ; SI -> last character

print:
    mov dl, [si]                  ; take character
    mov ah, 02h                   ; display it
    int 21h
    dec si                        ; move backwards
    loop print                    ; CX = CX - 1, repeat until 0

done:
    mov ah, 4Ch                   ; return to DOS
    int 21h
main endp
end main

For the input NEPAL the buffer holds N E P A L, CX = 5, SI starts at L and moves back, so the output is LAPEN.

In the 8085 the lower address lines and the data lines share the same eight pins $AD_7$-$AD_0$ (a multiplexed bus). To give the memory and I/O devices a separate, stable 16-bit address and an 8-bit data bus, the lower address byte must be separated from the data. This is called address/data de-multiplexing.

Process.

1. In the first clock period (T1) of every machine cycle the 8085 places the low-order address $A_7$-$A_0$ on $AD_7$-$AD_0$. The high-order address $A_{15}$-$A_8$ is on its own pins for the whole cycle.
2. At the same time the processor raises the ALE (Address Latch Enable) signal to 1 for one clock period, then makes it 0.
3. An external 8-bit latch (74LS373, a transparent D-type latch) has its inputs connected to $AD_7$-$AD_0$ and its enable (G) input connected to ALE. While ALE = 1 the latch is transparent, and when ALE falls it holds the address byte. The output enable of the 74LS373 is grounded.
4. The latch outputs are the stable low-order address bus $A_7$-$A_0$. Together with $A_{15}$-$A_8$ they form the 16-bit address bus for the rest of the cycle.
5. In T2 and T3 the $AD_7$-$AD_0$ lines are free, so they now act as the bidirectional data bus (D7-D0), read or written under control of $\overline{RD}$ and $\overline{WR}$.

            8085                     74LS373
   A15-A8 ------------------------------------------> A15-A8
   AD7-AD0 --------+---------> D0..D7  Q0..Q7 -------> A7-A0
                   |
                   +--------> (data bus D7-D0 to memory/I/O)
   ALE ---------------------> G (latch enable)
                              OE grounded

The result is a de-multiplexed bus: separate address bus $A_{15}$-$A_0$ and data bus $D_7$-$D_0$, which saves 8 pins on the chip.

CALL operation. A CALL instruction transfers control to a subroutine. Before jumping, the processor saves the address of the next instruction (the return address) on the stack, so the subroutine can return with RET.

In the 8085, CALL addr (3 bytes):

1. The PC (already pointing to the next instruction) is pushed on the stack: the high byte at $[SP-1]$ and the low byte at $[SP-2]$, and $SP \leftarrow SP-2$.
2. The 16-bit address addr is loaded into the PC, so execution continues at the subroutine.
3. RET pops the two bytes into the PC, and the main program resumes after the CALL.

JUMP operation. JMP addr loads the address directly into the PC. Nothing is stored on the stack, so there is no automatic way to return.

Example.

        CALL DELAY      ; return address (next instruction) pushed
        MVI  A, 00H     ; executes after RET
        HLT
DELAY:  MVI  B, 0FFH
LOOP:   DCR  B
        JNZ  LOOP       ; JNZ is only a jump within the routine
        RET

Synchronous and asynchronous serial communication.

RS-232 connections. RS-232 is the EIA standard for connecting DTE (Data Terminal Equipment, e.g. a computer or terminal) to DCE (Data Communication Equipment, e.g. a modem). It uses a 25-pin (DB-25) or 9-pin (DB-9) connector, with logic 1 as -3 V to -15 V and logic 0 as +3 V to +15 V.

DTE to DCE (straight-through). Pins are connected pin-to-pin:

 DTE (computer)                       DCE (modem)
 TxD   (pin 2) ------------------->  TxD   (pin 2)
 RxD   (pin 3) <-------------------  RxD   (pin 3)
 RTS   (pin 4) ------------------->  RTS   (pin 4)
 CTS   (pin 5) <-------------------  CTS   (pin 5)
 DSR   (pin 6) <-------------------  DSR   (pin 6)
 GND   (pin 7) -------------------   GND   (pin 7)
 DCD   (pin 8) <-------------------  DCD   (pin 8)
 DTR   (pin 20) ------------------>  DTR   (pin 20)

DTE to DTE (null modem). Both ends transmit on TxD, so the lines are crossed:

 DTE 1                                DTE 2
 TxD (2) ---------\     /---------- TxD (2)
                   \   /
                    \ /
                    / \
                   /   \
 RxD (3) ----------/     \--------- RxD (3)
 RTS (4) ------------+--- CTS (5)   (RTS of one to CTS of the other, and vice versa)
 DTR (20) ----------- DSR (6)       (DTR of one to DSR (and DCD) of the other)
 GND (7) ------------------------- GND (7)

That is, TxD of one goes to RxD of the other, RTS to CTS, DTR to DSR, and the grounds are joined. A minimal null modem needs only TxD-RxD crossed and a common ground.

Harvard architecture. In a Harvard architecture the program (instruction) memory and the data memory are physically separate, each with its own address bus and data bus. The CPU can therefore fetch an instruction and read or write data at the same time.

          +------------------+  program address/data bus  +----------------+
          |                  |<-------------------------->| Program memory |
          |       CPU        |                            +----------------+
          |                  |  data address/data bus     +----------------+
          |                  |<-------------------------->|  Data memory   |
          +------------------+                            +----------------+

• Advantages: higher speed because of parallel access (no bottleneck), instruction and data words can have different widths, and the program memory is protected from being overwritten.
• Disadvantages: more buses and pins, so a more complex and costly design.
• Used in many microcontrollers (8051, PIC, AVR) and DSPs, in contrast with the Von-Neumann design of the 8085/8086, which has one shared memory.

GDT and LDT. These are descriptor tables used by the Intel 80286 and later processors in protected mode. A segment is described by an 8-byte descriptor (base address, limit, access rights). The segment register holds a selector that indexes into a table.

• GDT (Global Descriptor Table): one table shared by all tasks, holding descriptors of segments used by the operating system and of common code/data, plus descriptors of the LDTs and task state segments. Its base address and limit are held in the GDTR register. The first entry (index 0) is the null descriptor and is unused.
• LDT (Local Descriptor Table): a table specific to a task (a process), holding descriptors of that task's own private segments. The LDTR register holds the selector of the current LDT, which must be defined by a descriptor in the GDT. Each task can have its own LDT, which isolates tasks from one another.

The table indicator bit (TI) in the selector chooses between them: TI = 0 selects the GDT and TI = 1 the LDT.

LXI instruction (Load register pair immediate). LXI rp, 16-bit data is a 3-byte instruction (10 T-states) that loads a 16-bit immediate value into a register pair (BC, DE, HL) or SP. The low-order byte goes into the second register of the pair and the high-order byte into the first.

Example: LXI H, 8050H loads H = 80H and L = 50H, so HL points to memory location 8050H. No flags are affected.

CMP instruction (Compare). CMP r or CMP M compares the contents of the accumulator with a register or memory byte by an internal subtraction $A - r$. Neither A nor the operand is changed; only the flags are set:

• if $A < r$: CY = 1, Z = 0
• if $A = r$: Z = 1, CY = 0
• if $A > r$: CY = 0, Z = 0

Example: CMP B. It is 1 byte, 4 T-states (7 for CMP M).

Program: divide by repeated subtraction.

Data: dividend in 8050H, divisor in 8051H, quotient in 8052H, remainder in 8053H.

        LXI  H, 8050H     ; HL -> dividend
        MOV  A, M         ; A = dividend
        INX  H            ; HL -> 8051H
        MOV  B, M         ; B = divisor
        MOV  C, A         ; (hold dividend in C temporarily)
        MOV  A, B
        ORA  A            ; check divisor = 0
        JZ   END          ; division by zero: stop
        MOV  A, C         ; A = dividend
        MVI  C, 00H       ; C = quotient = 0
LOOP:   CMP  B            ; A - B ; CY = 1 if A < B
        JC   DONE         ; remainder < divisor -> finished
        SUB  B            ; A = A - B
        INR  C            ; quotient + 1
        JMP  LOOP
DONE:   INX  H            ; HL -> 8052H
        MOV  M, C         ; store quotient
        INX  H            ; HL -> 8053H
        MOV  M, A         ; store remainder
END:    HLT

Check. Dividend = 17H = 23, divisor = 05H. Subtract 5 repeatedly: 23, 18, 13, 8, 3. Four subtractions (C = 4) leave A = 3 (CY set when 3 < 5). So 8052H = 04H and 8053H = 03H, matching $23 = 5\times4+3$.

Modes of parallel communication. Parallel data transfer between the microprocessor and a peripheral is done in the following ways:

1. Simple (unconditional) I/O. The processor transfers data without checking the device status, assuming the device is always ready (e.g. LEDs, switches).
2. Polled (status check) I/O. The processor repeatedly reads the status of the peripheral and transfers data only when it is ready.
3. Interrupt driven I/O. The peripheral interrupts the processor when it is ready; the ISR does the transfer.
4. Handshake I/O. Strobe/acknowledge signals synchronize the transmitter and receiver, e.g. the STB, IBF, OBF and ACK lines of the 8255.
5. DMA. A DMA controller moves data directly between memory and the peripheral.

In the 8255 PPI these appear as Mode 0 (basic input/output, no handshake), Mode 1 (strobed I/O with handshake and interrupt) and Mode 2 (bidirectional bus, Port A only).

Control word for the 8255 (I/O mode).

Control word: $1\,00\,1\,1\,0\,0\,0 = 1001\,1000_2 = \mathbf{98H}$.

It is loaded into the control register with MVI A, 98H followed by OUT CWR.

Interrupt based I/O vs DMA based I/O.

DMA operation (brief).

1. The CPU programs the DMA controller (DMAC) with the starting memory address, the byte count and the direction (read/write) of the transfer.
2. When the device is ready it sends a DMA request (DREQ) to the DMAC.
3. The DMAC sends a HOLD request to the CPU.
4. At the end of the current machine cycle the CPU floats its buses (tri-states address, data and control lines) and replies with HLDA (hold acknowledge).
5. The DMAC takes over the system bus, sends DACK to the device and generates the memory address and the read/write control signals; data goes directly between memory and the device. After each transfer the address is incremented and the count decremented.
6. When the count reaches zero (terminal count), the DMAC removes HOLD, the CPU regains the bus and may be told by an interrupt that the transfer is complete.

Modes: single (byte), block (burst) and demand transfer, with cycle stealing as a common technique.

Approach (8086). The string This is Microprocessor has 22 characters. It is reversed in place by swapping the first character with the last, the second with the second-last, and so on, for $22/2 = 11$ swaps, using SI at the start and DI at the end. The result is then displayed.

.model small
.stack 100h
.data
    str1 db 'This is Microprocessor'
    len  equ $ - str1                 ; = 22
    str2 db '$'                       ; terminator placed right after the string
    msg  db 0Dh, 0Ah, 'Reversed: $'
.code
main proc
    mov ax, @data
    mov ds, ax

    lea si, str1                      ; SI -> first character
    lea di, str1 + len - 1            ; DI -> last character
    mov cx, len / 2                   ; 11 swaps
swap:
    mov al, [si]
    mov bl, [di]
    mov [si], bl
    mov [di], al
    inc si
    dec di
    loop swap

    lea dx, msg
    mov ah, 09h
    int 21h

    lea dx, str1                      ; the '$' after str1 ends the output
    mov ah, 09h
    int 21h

    mov ah, 4Ch
    int 21h
main endp
end main

Because str2 (the $ byte) follows str1 immediately in memory, function 09h prints exactly the 22 characters.

Result: This is Microprocessor becomes rossecorporciM si sihT.

Addressing mode. The addressing mode is the method by which an instruction specifies the location of its operand (data) - a register, memory location, port or the instruction itself.

The 8085 has five addressing modes.

1. Immediate addressing. The operand (8-bit or 16-bit data) is part of the instruction.
   • MVI B, 32H (B $\leftarrow$ 32H), LXI H, 2050H (HL $\leftarrow$ 2050H), ADI 05H.
2. Register addressing. The operand is in a register named by the instruction.
   • MOV A, B (A $\leftarrow$ B), ADD C.
3. Direct addressing. The instruction contains the 16-bit memory (or 8-bit port) address of the operand.
   • LDA 2050H (A $\leftarrow$ [2050H]), STA 3000H, IN 80H, OUT 81H, LHLD, SHLD.
4. Register indirect addressing. A register pair (HL, BC, DE) holds the address of the operand in memory.
   • MOV A, M (A $\leftarrow$ [HL]), LDAX B, STAX D, ADD M.
5. Implicit (implied) addressing. The operand is implied by the opcode; no operand is written. The accumulator or flags are used implicitly.
   • CMA (complement A), RAL, RAR, STC, CMC, DAA, XCHG.

Branch instructions (JMP, CALL) use direct addressing, while PCHL uses register indirect.

Program Counter (PC). The PC is a 16-bit special-purpose register of the 8085 (IP in the 8086) that holds the memory address of the next instruction to be fetched. During an opcode fetch the processor places the PC on the address bus, reads the byte and automatically increments the PC (by 1 for each byte of the instruction) so that it points to the next byte. For a branch instruction (JMP, CALL, RET) a new address is loaded into the PC, which changes the program flow. On reset the PC is 0000H, so execution starts at that address. Since a 16-bit PC can address $2^{16}=64$ KB, this is the maximum memory of the 8085. It is not directly accessible to the programmer, except through PCHL or by CALL/RET.

Von-Neumann Architecture. In a Von-Neumann (stored-program) architecture the program instructions and data are stored in the same single memory and share the same bus (address, data, control). The CPU contains an ALU, control unit and registers, and the memory is connected to the CPU via the system bus along with I/O.

        +-------+      +----------------------+
 Input->|  I/O  |<---->|  CPU: ALU + Control  |
        +-------+      +----------+-----------+
                                  |  single bus
                       +----------v-----------+
                       |  Memory (code+data)  |
                       +----------------------+

• Advantages: simple design, flexible use of memory, and programs can be modified like data.
• Disadvantage: instructions and data cannot be fetched at the same time, which creates the "Von-Neumann bottleneck".
• Used in the 8085, 8086 and most general-purpose computers.

Interrupt Masking. Masking means disabling (blocking) the processor from recognizing particular interrupts. In the 8085, EI and DI enable or disable the maskable interrupts (RST 7.5, 6.5, 5.5 and INTR) as a group, while TRAP is non-maskable. The individual masks of RST 7.5, 6.5 and 5.5 are set with SIM using the accumulator: D0 = M5.5, D1 = M6.5, D2 = M7.5 (1 means masked) and D3 = MSE (mask set enable, must be 1 for the mask bits to take effect). RIM reads the current mask and pending-interrupt status.

Example: MVI A, 0DH then SIM. $0DH = 0000\,1101_2$, so MSE = 1, M7.5 = 1 and M5.5 = 1 (both masked), M6.5 = 0 (enabled). Masking is used to protect critical code sections and to give priority to important interrupts.

Instruction cycle. The instruction cycle is the total time needed to fetch an instruction from memory, decode it and execute it. It is made up of one or more machine cycles (opcode fetch, memory read/write, I/O read/write), and each machine cycle consists of 3 to 6 T-states (clock periods).

$\text{Instruction cycle} = \text{fetch cycle} + \text{execute cycle}$

Timing diagram of MOV A, B (8085). MOV A, B is a 1-byte instruction (opcode 78H) that needs only one machine cycle, the opcode fetch (M1), of 4 T-states. Assume the instruction is stored at address 2000H and a 3 MHz clock (T = 0.33 $\mu s$, so the instruction takes about 1.33 $\mu s$).

• T1: The PC (2000H) is placed on the address bus: 20H on $A_{15}$-$A_8$ and 00H on $AD_7$-$AD_0$. ALE goes high to latch the low byte. Status: $IO/\overline{M}=0$, $S_1=1$, $S_0=1$ (opcode fetch). PC is incremented to 2001H.
• T2: $\overline{RD}$ goes low; the memory places the opcode 78H on the data bus. ALE is low and $AD_7$-$AD_0$ now act as the data bus.
• T3: The opcode is read into the instruction register and $\overline{RD}$ returns high.
• T4: The opcode is decoded and executed internally: the content of B is copied into A. No bus activity.

        |   T1   |   T2   |   T3   |   T4   |
CLK     _|-|__|-|__|-|__|-|__|-|__|-|__|-|__
A15-A8  [   20H (PC high)  ....................]
AD7-AD0 [ 00H ]     [ 78H opcode read ]  (float)
ALE     __|-----|_______________________________
IO/M    _______________ 0 ______________________
S1 S0   _______________ 1 1 _____________________
RD      ------\_____________/-------------------
                  (RD low in T2-T3)       T4: decode + A <- B

Only registers are involved, so there is no further memory or I/O cycle. Compare this with MVI A, 32H, which needs M1 (4T) plus a memory-read cycle (3T) = 7 T-states.

Architecture of the 80386. The 80386 (386DX) is a 32-bit microprocessor with a 32-bit data bus and 32-bit address bus (4 GB physical memory, 64 TB virtual). It is pipelined and has six functional units working in parallel:

1. Bus interface unit: handles the data/address bus transfers and bus control.
2. Code prefetch unit: fetches instructions in advance into a 16-byte prefetch queue.
3. Instruction decode unit: decodes the prefetched instructions into microcode and stores them in a 3-instruction decoded queue.
4. Execution unit: contains the eight 32-bit general registers, a 64-bit barrel shifter, a multiply/divide unit and the ALU; executes the instructions.
5. Segmentation unit: translates a logical address into a linear address using segment descriptors and performs protection checks.
6. Paging unit: translates the linear address into the physical address using the page tables, aided by a translation look-aside buffer (TLB). Paging can be enabled or disabled by CR0.PG.

 Prefetch queue                    Instruction queue
 +--------------+   +----------+   +----------+   +-------------+
 | Bus          |-->| Code     |-->| Decode   |-->| Execution   |
 | interface    |   | prefetch |   | unit     |   | unit (ALU,  |
 | unit         |   +----------+   +----------+   |  registers) |
 |              |                                 +------+------+
 |              |<-- physical addr <-- Paging unit <-- Segmentation unit
 +--------------+        (page tables / TLB)     (logical -> linear)

Address translation: logical (segment:offset) $\rightarrow$ segmentation unit $\rightarrow$ 32-bit linear address $\rightarrow$ paging unit $\rightarrow$ 32-bit physical address.

Modes. Real mode (8086 compatible, 1 MB), protected mode (full 32-bit features, multitasking, protection) and virtual 8086 mode.

Register organization.

1. General purpose registers (32-bit): EAX, EBX, ECX, EDX, ESI, EDI, EBP, ESP. Their lower halves are AX, BX, CX, DX, SI, DI, BP, SP, and AX, BX, CX, DX split into 8-bit AH/AL etc.
2. Segment registers (16-bit): CS, SS, DS, ES, FS, GS, holding selectors, with hidden descriptor caches.
3. EIP: 32-bit instruction pointer; EFLAGS: 32-bit flag register containing the status flags (CF, PF, AF, ZF, SF, OF), control flags (TF, IF, DF), and the system flags IOPL, NT, RF and VM.
4. Control registers: CR0 (PE, PG, MP, EM, TS, ET), CR2 (page-fault linear address), CR3 (page directory base). CR1 is reserved.
5. System address registers: GDTR, IDTR (48 bits, base + limit), LDTR and TR (16-bit selectors).
6. Debug registers (DR0-DR7) for breakpoints and test registers (TR6, TR7) for testing the TLB.

Approach (8086). Read the two strings with DOS function 0Ah into two buffers. If their lengths differ, the strings are different. Otherwise compare them byte by byte with REPE CMPSB; if all characters match (ZF = 1 at the end), the strings are the same.

.model small
.stack 100h
.data
    m1   db 'Enter first string : $'
    m2   db 0Dh, 0Ah, 'Enter second string: $'
    same db 0Dh, 0Ah, 'Strings are same$'
    diff db 0Dh, 0Ah, 'Strings are not same$'
    buf1 db 50, ?, 50 dup(0)
    buf2 db 50, ?, 50 dup(0)
.code
main proc
    mov ax, @data
    mov ds, ax
    mov es, ax                    ; ES = DS for CMPSB

    lea dx, m1
    mov ah, 09h
    int 21h
    lea dx, buf1
    mov ah, 0Ah
    int 21h

    lea dx, m2
    mov ah, 09h
    int 21h
    lea dx, buf2
    mov ah, 0Ah
    int 21h

    mov al, buf1+1                ; length of string 1
    cmp al, buf2+1                ; length of string 2
    jne notsame                   ; different lengths -> not same

    mov cl, al
    mov ch, 0
    jcxz issame                   ; both empty -> same
    lea si, buf1+2
    lea di, buf2+2
    cld
    repe cmpsb                    ; compare while equal and CX <> 0
    jne notsame                   ; mismatch found

issame:
    lea dx, same
    jmp show
notsame:
    lea dx, diff
show:
    mov ah, 09h
    int 21h
    mov ah, 4Ch
    int 21h
main endp
end main

For NEPAL and NEPAL the lengths are equal (5) and REPE CMPSB finishes with ZF = 1, so "Strings are same" is displayed. For NEPAL and NEPAN the fifth comparison clears ZF and "Strings are not same" is displayed.

The 8085 instructions are classified into five functional groups.

1. Data transfer (copy) group. Copy data between registers, memory and I/O without changing the source or the flags: MOV, MVI, LXI, LDA, STA, LHLD, SHLD, LDAX, STAX, XCHG, SPHL, XTHL, PUSH, POP, IN, OUT.
2. Arithmetic group. Addition, subtraction, increment, decrement and comparison: ADD, ADC, ADI, ACI, SUB, SBB, SUI, SBI, INR, DCR, INX, DCX, DAD, DAA. Results are stored in the accumulator and flags are affected.
3. Logical group. Bitwise operations, compare, rotate and complement: ANA, ANI, ORA, ORI, XRA, XRI, CMP, CPI, RLC, RRC, RAL, RAR, CMA, CMC, STC.
4. Branching group. Change the sequence of program execution: unconditional JMP, CALL, RET, PCHL, RST n; conditional JC, JNC, JZ, JNZ, JP, JM, JPE, JPO and the conditional call and return forms (CZ, RNZ etc.).
5. Machine control group. Control the operation of the processor, interrupts and I/O: HLT, NOP, EI, DI, RIM, SIM.

Instructions are 1, 2 or 3 bytes long. Examples: MOV A, B (1 byte), MVI A, 32H (2 bytes), JMP 2050H (3 bytes).

An addressing mode defines how the operand of an instruction is specified. The 8086 has the following modes.

1. Register addressing. The operand is in a register. MOV AX, BX (AX $\leftarrow$ BX).

2. Immediate addressing. The operand is a constant in the instruction. MOV CL, 05H, MOV AX, 1234H.

3. Direct addressing. The 16-bit offset (effective address) of the operand is given in the instruction. MOV AL, [2000H] reads the byte at $DS \times 10H + 2000H$.

4. Register indirect addressing. The offset is held in BX, SI, DI (or BP). MOV AX, [BX] gives the physical address $DS\times10H + BX$.

5. Based addressing. The effective address is the base register (BX or BP) plus an 8/16-bit displacement. MOV AX, [BX+04H].

6. Indexed addressing. The effective address is an index register (SI or DI) plus a displacement. MOV AL, [SI+10H].

7. Based indexed addressing. The effective address is a base register plus an index register. MOV AX, [BX+SI].

8. Based indexed with displacement. The sum of a base register, an index register and a displacement. MOV AX, [BX+SI+08H].

9. String addressing. The string instructions use implied registers: source DS:SI and destination ES:DI, with SI/DI automatically incremented or decremented according to DF. MOVSB.

10. I/O port addressing. Direct (IN AL, 80H, 8-bit port address) or indirect through DX (OUT DX, AL).

11. Relative addressing (branch). The target is IP plus a signed displacement: JNZ LOOP1, JMP SHORT.

12. Implied addressing. The operand is implied by the instruction: CLC, STD, CBW, XLAT.

In memory modes the physical address is $\text{segment}\times 10H + \text{effective address}$. The default segment is DS (SS when BP is used).

Multitasking means that the processor appears to run several programs (tasks) at the same time by switching rapidly between them, each task getting a time slice. The 80286 provides hardware support for multitasking in its protected virtual address mode, so the operating system does not have to save and restore all registers by software.

Key elements

1. Task. A task is a program together with its own execution environment: its code, data and stack segments, registers, flags and local descriptor table (LDT). Each task is isolated from the others through the protection mechanism.

2. Task State Segment (TSS). Every task has a TSS, a memory segment (at least 44 bytes) that stores the complete state of the task when it is not running: general registers (AX, BX, CX, DX, SP, BP, SI, DI), segment registers (CS, DS, SS, ES), IP, FLAGS, the LDT selector, the stack pointers for privilege levels 0, 1, 2, and a back-link selector to the previous task.

3. TSS descriptor and Task Register (TR). The TSS is described by a TSS descriptor stored in the GDT. The task register (TR) holds the selector of the currently running task's TSS (with a hidden descriptor cache for fast access).

4. Task gate. A task can be entered through a task gate descriptor (placed in the GDT, LDT or IDT), which points to a TSS descriptor. This allows interrupts and calls to cause a task switch with controlled access.

Task switching

A task switch occurs when a JMP or CALL instruction refers to a TSS descriptor or task gate, when an interrupt or exception uses a task gate in the IDT, or when IRET is executed with the NT (nested task) flag set. The processor then automatically:

• saves the complete state of the current task into its own TSS;
• loads TR with the selector of the new TSS;
• loads the registers and LDT of the new task from its TSS and starts execution;
• for a CALL or interrupt, stores the old TSS selector in the back-link field and sets the NT flag so that IRET can return to the previous task.

The whole switch is performed by one instruction, in about 17 microseconds at 8 MHz, and it is indivisible with respect to the program. The protection mechanism (descriptor privilege levels, separate LDTs) ensures one task cannot corrupt another, so a scheduler in the operating system can share the CPU among tasks safely.

Practical implications of asynchronous serial communication

In asynchronous serial communication data is sent one character at a time, with no common clock between sender and receiver. Each character is framed by a start bit (logic 0), 5 to 8 data bits (LSB first), an optional parity bit and 1, 1.5 or 2 stop bits (logic 1). The line idles at logic 1.

Implications:

• Simple and cheap hardware. No clock line is needed; both ends are only agreed on the same baud rate and frame format. The receiver synchronises on the falling edge of each start bit.
• Overhead. Every character carries 2 or 3 extra bits (start, stop, parity), so efficiency is only about 70 to 80 % (for 8N1, 8 data bits in 10 transmitted bits is 80 %). This is unsuitable for high-speed bulk transfer.
• Tolerance of idle gaps. Characters can be sent at irregular intervals (e.g. keyboard), which makes it ideal for terminals, modems and low-speed devices.
• Timing accuracy. The receiver samples in the middle of each bit (usually with a 16x clock), so baud-rate mismatch of more than a few percent causes framing errors. The same settings must be configured at both ends.
• Error detection. Parity checks single-bit errors; framing errors (missing stop bit), overrun errors and break conditions are detected by the UART/USART (e.g. 8251A).
• Limited speed and distance. Used up to about 115.2 kbps and tens of metres with RS-232.

DTE-DCE connection in RS-232

RS-232 defines the interface between DTE (Data Terminal Equipment, e.g. computer or terminal) and DCE (Data Communication Equipment, e.g. modem). A DB-25 (or DB-9) connector is used, with signals at EIA levels: logic 1 (mark) = -3 V to -15 V, logic 0 (space) = +3 V to +15 V.

   DTE (computer)                          DCE (modem)
   TxD  (pin 2)  ----------------------->  TxD  (pin 2)
   RxD  (pin 3)  <-----------------------  RxD  (pin 3)
   RTS  (pin 4)  ----------------------->  RTS  (pin 4)
   CTS  (pin 5)  <-----------------------  CTS  (pin 5)
   DSR  (pin 6)  <-----------------------  DSR  (pin 6)
   GND  (pin 7)  -----------------------   GND  (pin 7)
   DCD  (pin 8)  <-----------------------  DCD  (pin 8)
   DTR  (pin 20) ----------------------->  DTR  (pin 20)

The connection is a straight-through cable (pin n to pin n). Roles: TxD carries data from DTE to DCE and RxD from DCE to DTE; RTS (request to send) and CTS (clear to send) provide hardware handshaking for the DTE-to-DCE direction; DTR (terminal ready) and DSR (modem ready) show readiness of each end; DCD indicates a carrier is detected from the remote modem; GND is the common signal ground. When two DTEs are connected directly (without modems) a null modem cable is used, which crosses TxD and RxD and loops the handshake lines.

Purpose of 8255A

The 8255A Programmable Peripheral Interface (PPI) is a general-purpose parallel I/O chip that connects peripherals such as keyboards, displays, switches, LEDs, ADC/DAC and printers to a microprocessor. It has 24 I/O lines in three 8-bit ports, and the function of these lines is selected by software through a control word, so one chip can be used in many ways without changing hardware. It is TTL compatible, uses a single +5 V supply, and has an 8-bit bidirectional data bus, with lines RD, WR, CS, RESET, A0 and A1 to select a port (A1A0 = 00 port A, 01 port B, 10 port C, 11 control register).

Ports

• Port A (PA7-PA0): an 8-bit latched output and buffered input port. It can work in mode 0, mode 1 or mode 2 (bidirectional).
• Port B (PB7-PB0): an 8-bit input/output port, with latched output and buffered input. It can work in mode 0 or mode 1.
• Port C (PC7-PC0): an 8-bit port that can be divided into two 4-bit ports, upper C (PC7-PC4) and lower C (PC3-PC0), each set independently as input or output. In mode 0 it is a normal I/O port; in mode 1 and mode 2 its lines carry handshake and interrupt signals (STB, IBF, OBF, ACK, INTR) for ports A and B. Individual bits of port C can be set or reset by the BSR (bit set/reset) mode.
• Control register: write-only register that holds the control word. For the I/O mode, D7 = 1; D6D5 select group A mode (00 mode 0, 01 mode 1, 1x mode 2); D4 port A direction (1 input); D3 port C upper direction; D2 group B mode (0 mode 0, 1 mode 1); D1 port B direction; D0 port C lower direction. With D7 = 0 the word is a BSR word, with D3D2D1 selecting the bit and D0 giving set (1) or reset (0).

The ports are grouped as Group A (port A and upper C) and Group B (port B and lower C). Example: control word 80H makes ports A, B and C all outputs in mode 0; 9BH makes all three inputs.

Memory read operation (8085)

A memory read is the machine cycle in which the microprocessor fetches a byte (an opcode, operand or data) from a memory location. It takes 3 T-states (T1, T2, T3), and it is the same cycle used for fetching operands, with the opcode fetch cycle lengthened to 4 T-states.

Steps

1. T1: The processor puts the high-order address on A15-A8 and the low-order address on the multiplexed bus AD7-AD0. It sets ALE high; the falling edge of ALE latches the low-order address in an external 74LS373 latch. Status signals are IO/M' = 0 (memory) with S1 = 1, S0 = 0 for a read.
2. T2: AD7-AD0 is switched to input (floating). The processor makes the RD' signal low, which enables the addressed memory chip to place the data from the addressed location on the data bus.
3. T3: The processor reads (latches) the data from the bus into the internal register (instruction register or an operand register) and then makes RD' high, which disables the memory output buffer. The cycle ends.

Timing figure

        T1        T2        T3
CLK   _|-|_|-|_|-|_|-|_|-|_|-|_

A15-A8 ==<=== high-order address ============>==
AD7-AD0 --<-- A7-A0 -->|--(float)--<= data in =>--

ALE    ___|-----|_____________________________

IO/M'  ------- low (memory) -------------------

RD'    -----------|__________________|---------

The low-order address is valid on AD7-AD0 during T1 only, which is why ALE is used to latch it. Data is sampled by the processor on the rising edge of RD' at the end of T3. For slower memory, the READY input inserts wait states (Tw) between T2 and T3.

Kinds of buses

A bus is a group of lines that carries information between the processor, memory and I/O devices. A microprocessor system has three kinds:

1. Address bus: unidirectional, carries the address from the processor to memory and I/O. The 8085 has a 16-bit address bus (A15-A0), addressing 64 KB.
2. Data bus: bidirectional, carries data and instructions between the processor, memory and I/O. The 8085 has an 8-bit data bus (D7-D0).
3. Control bus: carries timing and control signals such as RD', WR', IO/M', ALE, READY, INTA', which coordinate the operations.

Multiplexing and de-multiplexing in the 8085

To save pins on its 40-pin package, the 8085 sends the low-order address A7-A0 and the data D7-D0 on the same pins AD7-AD0 (time multiplexed). The high-order address A15-A8 has its own dedicated pins.

Why de-multiplex? Memory and I/O chips need the address to stay valid for the entire read/write cycle, while the data appears later on the same lines. Since the AD lines carry the address only in T1 and data afterwards, the address must be stored (latched) externally so that separate address and data buses are available.

How it is done:

• In T1 of every machine cycle, the 8085 places A7-A0 on AD7-AD0 and raises ALE (Address Latch Enable) to 1.
• ALE is connected to the enable (G) input of an octal latch such as the 74LS373, whose inputs D0-D7 are connected to AD7-AD0. While ALE is high the latch is transparent; when ALE falls (end of T1) the latch holds the address.
• The latch outputs Q7-Q0 give the stable low-order address A7-A0, which together with A15-A8 forms the 16-bit address bus. The AD7-AD0 lines are then used directly as the data bus D7-D0 during T2 and T3.

 8085 AD7-AD0 ----+----> 74LS373 D -> Q ----> A7-A0 (address bus)
                  |         ^ G
                  |         |
 8085 ALE --------------------+ (OE' to ground)
                  |
                  +----------------------> D7-D0 (data bus)
 8085 A15-A8 ---------------------------> A15-A8 (address bus)

LDT (Local Descriptor Table)

In the protected mode of the 80286 and later processors, memory segments are described by 8-byte descriptors (base address, limit, access rights) kept in descriptor tables. There are three types: the Global Descriptor Table (GDT), the Interrupt Descriptor Table (IDT) and the Local Descriptor Table (LDT).

• The GDT holds descriptors that are shared by all tasks (e.g. operating system code and data). There is only one GDT.
• An LDT holds the descriptors of the segments private to a single task, so every task can have its own LDT. This gives each task its own protected address space and prevents tasks from accessing one another's segments.
• The LDT is itself a segment, described by an LDT descriptor in the GDT. The LDTR register holds the selector of the current LDT and is loaded with LLDT. It is switched automatically at a task switch.
• A segment selector contains an index, a TI bit (TI = 0 selects the GDT, TI = 1 selects the LDT) and a 2-bit requested privilege level. A table can have up to 8192 descriptors, so the 80286 can address up to 16 K segments per task (8 K local + 8 K global).

DMA (Direct Memory Access)

DMA is a method of transferring data directly between an I/O device and memory (or memory to memory) without involving the CPU in each transfer. It is used for fast, bulk transfers such as disk, display and network data, where programmed I/O or interrupt-driven I/O would be too slow.

Operation:

1. The device requests service from the DMA controller (e.g. 8237) on DREQ.
2. The DMA controller issues HOLD to the CPU.
3. The CPU finishes the current bus cycle, floats its buses and responds with HLDA.
4. The DMA controller takes the bus, places the memory address, and issues the read/write signals (MEMR', IOW' etc.) and DACK to the device, so data moves directly between the device and memory. The address is incremented and the count decremented after each transfer.
5. When the count finishes (terminal count, TC), the controller releases HOLD and the CPU resumes.

Modes: single transfer, block (burst) transfer and demand transfer; cycle stealing is also used. Advantages are high speed and a free CPU; the disadvantage is the extra hardware.

Block diagram of 8086

The 8086 is a 16-bit microprocessor with a 20-bit address bus (1 MB memory). It is internally divided into two independent units that work in parallel (pipelining): the Bus Interface Unit (BIU) and the Execution Unit (EU).

                 +----------------------- BIU -------------------------+
 AD15-AD0  <---> |  Address/data buffers   Segment registers           |
 A19-A16   <---> |  & bus control logic    CS | DS | SS | ES           |
 Control   <---> |                         Instruction pointer (IP)    |
                 |      Adder (20-bit address generation)              |
                 |      Instruction queue: 6 bytes (4 in 8088)         |
                 +-----------------------+-----------------------------+
                                         | internal bus
                 +-----------------------+----------- EU --------------+
                 |  Control unit / instruction decoder                 |
                 |  General registers: AX(AH,AL) BX CX DX              |
                 |  Pointer & index:   SP BP SI DI                     |
                 |  ALU (16-bit)       Flag register                   |
                 +-----------------------------------------------------+

• BIU: fetches instructions, reads/writes data, and generates the 20-bit physical address (segment x 16 + offset) using the adder. It prefetches instructions into a 6-byte FIFO queue while the EU is executing.
• EU: decodes and executes instructions from the queue. It has the ALU, the general registers, flags and control unit; it does not connect to the buses directly but gives the BIU the addresses it needs.

Register organisation (14 registers of 16 bits)

1. General-purpose (data) registers:
   • AX (accumulator; AH, AL) - arithmetic, I/O, string and multiply/divide operations.
   • BX (base) - holds a base address for memory addressing; BH, BL.
   • CX (count) - loop counter and shift/rotate and string repeat count; CH, CL.
   • DX (data) - holds part of multiplication result/dividend, and port address for I/O; DH, DL.
2. Pointer and index registers:
   • SP (stack pointer) - offset of the top of stack in the stack segment.
   • BP (base pointer) - base offset for accessing data in the stack segment.
   • SI (source index) and DI (destination index) - offsets for data and string operations (DS:SI source, ES:DI destination).
3. Segment registers: CS (code segment), DS (data segment), SS (stack segment) and ES (extra segment) hold the 16-bit base of the current segments.
4. Instruction pointer (IP): offset of the next instruction in the code segment (CS:IP).
5. Flag register (16 bits, 9 used):
   • Status flags: CF (carry), PF (parity), AF (auxiliary carry), ZF (zero), SF (sign), OF (overflow).
   • Control flags: TF (trap/single step), IF (interrupt enable), DF (direction for string instructions).

LHLD address (Load H-L direct)

A 3-byte instruction (opcode 2AH; 5 machine cycles, 16 T-states). It loads the L register with the content of the memory location whose address is given in the instruction, and the H register with the content of the next higher location.

L <- [address], H <- [address + 1]

Example: if [2050H] = 34H and [2051H] = 12H, then LHLD 2050H gives L = 34H, H = 12H, so HL = 1234H. No flags are affected.

DAA (Decimal Adjust Accumulator)

A 1-byte instruction (opcode 27H, 4 T-states) used after adding two BCD numbers so that the accumulator holds a valid BCD result. It works on the accumulator in two steps:

1. If the lower nibble of A is greater than 9 or the AC flag is set, 06H is added to A.
2. If the upper nibble of A is then greater than 9 or the CY flag is set, 60H is added to the upper nibble.

All flags are affected. Example: A = 29H + 18H = 41H (AC = 1). DAA: the low nibble 1 with AC set, so add 06H giving 47H, which is BCD 47, the correct answer.

Program: largest of 5 elements (stored at 4000H to 4004H), result at 4005H

The array has 5 elements, stored from 4000H to 4004H. The first element is taken as the largest and compared with the next four.

        LXI  H, 4000H     ; HL points to the first element
        MVI  C, 04H       ; 4 comparisons remain
        MOV  A, M         ; A = first element (assumed largest)
NEXT:   INX  H            ; point to the next element
        CMP  M            ; compare A with [HL] (A - M)
        JNC  SKIP         ; if A >= M (no borrow) keep A
        MOV  A, M         ; else M is larger, A = M
SKIP:   DCR  C            ; decrement count
        JNZ  NEXT         ; repeat until all compared
        STA  4005H        ; store the largest at 4005H
        HLT

Check with data 12H, 4AH, 05H, 7FH, 33H: A = 12H; compare 4AH -> A = 4AH; 05H -> keep; 7FH -> A = 7FH; 33H -> keep. 7FH is stored at 4005H. CMP sets CY when A < M, so JNC leaves A unchanged exactly when A is not smaller (unsigned comparison).

ALE (Address Latch Enable)

ALE is an output signal of the 8085 that goes high during T1 of every machine cycle. It indicates that the bits on AD7-AD0 are the low-order address (A7-A0) and not data. It is used to latch that address externally.

Role of ALE in address/data de-multiplexing

The 8085 has only 40 pins, so the lower 8 bits of the address and the 8 data bits share the same pins AD7-AD0 (time multiplexed). The upper address A15-A8 is on its own pins. A memory or I/O chip, however, needs the full address to be stable during the whole cycle, while the data comes later on the same lines. So the address must be separated from the data:

1. In T1, the 8085 puts A7-A0 on AD7-AD0 and ALE = 1.
2. ALE is connected to the enable input G of an octal transparent latch (74LS373); AD7-AD0 go to its inputs. With ALE = 1 the latch passes the address through.
3. At the end of T1 ALE falls to 0, the latch holds (stores) the low-order address, and the latched outputs give A7-A0 for the rest of the cycle.
4. During T2 and T3 the AD7-AD0 lines carry the data in or out and act as the data bus D7-D0.

                        +-----------+
  AD7-AD0 --------+---->| D       Q |----> A7-A0
                  |     |  74LS373  |
  ALE ------------|---->| G         |
  GND ------------|---->| OE'       |
                  |     +-----------+
                  +-------------------> D7-D0 (to memory / I/O)
  A15-A8 ------------------------------> A15-A8

  ALE:     __|-----|________________
  AD7-AD0: [ A7-A0 ][   data D7-D0   ]
            T1       T2     T3

Thus the 16-bit address bus A15-A0 and the 8-bit data bus D7-D0 are produced, and ALE does the job of the strobe for the latch.

Isolated I/O (I/O-mapped I/O)

In isolated I/O the I/O devices have an address space separate from the memory address space. The processor distinguishes the two with a control signal (IO/M' in the 8085) and special instructions (IN port, OUT port). With 8-bit port addresses the 8085 can address 256 input and 256 output ports, and the full 64 KB of memory stays available for memory. Only the accumulator can be used for data transfer, and arithmetic or logic operations cannot be done directly on port data. The memory instructions (MOV, LDA, etc.) cannot access the ports.

Basic DMA operation

Direct Memory Access allows an I/O device to exchange data with memory without the CPU transferring each byte, using a DMA controller (e.g. 8237) as the bus master during the transfer.

1. The peripheral asserts a DMA request (DREQ) to the DMA controller.
2. The controller sends a HOLD request to the CPU.
3. The CPU completes the current machine cycle, tri-states the address, data and control buses and sends back HLDA (hold acknowledge).
4. The DMA controller now controls the buses. It sends DACK to the device, places the memory address on the address bus and generates the memory and I/O read/write signals, so data is moved directly between the memory and the I/O device. After each transfer the address register is incremented and the byte count is decremented.
5. When the count reaches zero (terminal count), the transfer stops, HOLD is removed, and the CPU takes back the bus and continues.

DMA is much faster than programmed or interrupt-driven I/O since no instruction fetch or execution is required per byte, and it is used for disks, displays and similar high-speed devices.

The program is written for the 8086 using DOS interrupts. In "Microprocessor organization" the lowercase letter o appears 3 times in "Microprocessor" (Microprocessor) and 2 times in "organization", so the expected output is 5.

.MODEL SMALL
.STACK 100H
.DATA
TEXT  DB 'Microprocessor organization'
LEN   EQU $ - TEXT              ; length of the string
MSG   DB 'Number of o = $'
.CODE
MAIN PROC
      MOV  AX, @DATA
      MOV  DS, AX               ; initialise data segment
      LEA  SI, TEXT             ; SI points to the string
      MOV  CX, LEN              ; CX = number of characters
      XOR  BL, BL               ; BL = counter of 'o' = 0
NEXT: CMP  BYTE PTR [SI], 'o'   ; is the character 'o'?
      JNE  SKIP
      INC  BL                   ; yes, count it
SKIP: INC  SI                   ; next character
      LOOP NEXT                 ; repeat for CX characters

      LEA  DX, MSG              ; display the message
      MOV  AH, 09H
      INT  21H
      ADD  BL, '0'              ; convert count (single digit) to ASCII
      MOV  DL, BL
      MOV  AH, 02H              ; display the count
      INT  21H

      MOV  AH, 4CH              ; exit to DOS
      INT  21H
MAIN ENDP
END MAIN

Output: Number of o = 5. The loop runs LEN = 27 times, comparing each byte with 6FH ('o'); the count is a single digit here, so adding '0' (30H) gives its ASCII code for display by function 02H.

Addressing mode

An addressing mode is the way in which the operand (data or its address) of an instruction is specified. The 8085 supports five addressing modes:

1. Immediate addressing: the data is part of the instruction itself. The instruction is 2 or 3 bytes long.
   • MVI B, 32H (load 8-bit data into B)
   • LXI H, 2050H (load 16-bit data into HL)
2. Register addressing: the operand is in a register and the instruction names the register(s). It is 1 byte long and fast.
   • MOV A, B (A <- B)
   • ADD C (A <- A + C)
3. Direct addressing: the 16-bit address of the operand is given in the instruction.
   • LDA 2000H (A <- [2000H])
   • STA 3000H, IN 80H, OUT 81H (8-bit port addresses)
4. Register indirect addressing: a register pair (HL, BC or DE) holds the memory address of the operand.
   • MOV A, M (A <- [HL])
   • LDAX B (A <- [BC])
5. Implicit (implied) addressing: the operand is implied by the opcode, usually the accumulator. The instruction is 1 byte.
   • CMA (complement accumulator)
   • RAL, STC, DAA

Example: if HL = 2050H and [2050H] = 7FH, then MOV A, M loads 7FH into A, while LDA 2050H loads the same content using direct addressing.

Functional units of the 80386

The 80386 is a 32-bit microprocessor (32-bit address bus, 4 GB physical memory, 64 TB virtual space) that is internally divided into six pipelined units operating in parallel:

1. Bus Interface Unit (BIU): Handles all communication with memory and I/O over the external 32-bit address and data buses. It accepts bus requests from the code prefetch unit and the execution unit, prioritises them, and generates the bus control signals (read, write, byte enables, etc.). It also supports pipelined addressing and dynamic bus sizing (16/32-bit).
2. Code Prefetch Unit: When the bus is free, it fetches instructions from memory in advance and keeps them in a 16-byte prefetch queue, so the processor seldom waits for the next instruction.
3. Instruction Decode Unit: Reads bytes from the prefetch queue, decodes them into microcode and stores up to three decoded instructions in an instruction queue, ready for the execution unit.
4. Execution Unit (EU): Executes the decoded instructions. It contains the eight 32-bit general registers (EAX, EBX, ECX, EDX, ESP, EBP, ESI, EDI), a 32-bit ALU, a 64-bit barrel shifter (shifts or rotates any number of bits in one clock) and a multiply/divide hardware, and the control unit.
5. Segmentation Unit: Translates the logical address (segment selector + 32-bit offset) into a linear address. It contains the segment registers (CS, DS, SS, ES, FS, GS) and the descriptor caches, adds the base and offset, and checks the limit and the access rights (protection) of the segment.
6. Paging Unit: Converts the linear address from the segmentation unit to a physical address when paging is enabled (using 4 KB pages through the page directory and page tables). It has a translation lookaside buffer (TLB) of 32 entries that caches recent translations, and checks page-level protection. If paging is disabled, the linear address is the physical address.

The segmentation and paging units together form the memory management unit (MMU). The pipeline of these six units lets fetching, decoding, execution and address translation overlap.

Modes of parallel I/O

Parallel I/O transfers all bits of a byte at once over several lines. The common modes are:

1. Simple (unconditional) I/O: the device is always ready, e.g. LEDs, switches; the processor reads or writes the port at any time without checking status.
2. Programmed I/O with polling (status check): the processor reads the status of the device repeatedly in a loop and transfers data when the device is ready. This wastes processor time.
3. Interrupt-driven I/O: the device interrupts the processor when it is ready; the processor suspends its program, runs the service routine for the transfer, and returns.
4. Handshake I/O: data transfer is controlled by control signals between the processor and the peripheral (e.g. STB/IBF, OBF/ACK of the 8255A mode 1 and mode 2).
5. DMA: the DMA controller moves data directly between memory and device without CPU involvement, for fast bulk transfers.

(For the 8255A: mode 0 = simple I/O, mode 1 = strobed/handshake I/O, mode 2 = bidirectional bus with handshake.)

Synchronous vs asynchronous serial communication

a. RS-232

RS-232 (EIA RS-232C) is a standard for serial binary data exchange between a DTE (data terminal equipment, e.g. a computer) and a DCE (data communication equipment, e.g. a modem). It uses a 25-pin (DB-25) or 9-pin (DB-9) connector.

• Voltage levels: logic 1 (mark) = -3 V to -15 V; logic 0 (space) = +3 V to +15 V; the range -3 V to +3 V is undefined. Because TTL levels (0 and 5 V) are different, a level converter such as MAX232 (or 1488/1489) is needed.
• Speed and distance: up to about 20 kbps standard (115.2 kbps common) and a cable length of about 15 m.
• Main signals: TxD (transmit data), RxD (receive data), RTS (request to send), CTS (clear to send), DSR (data set ready), DTR (data terminal ready), DCD (carrier detect), RI (ring indicator) and signal ground. In a three-wire connection only TxD, RxD and ground are used.
• Data is sent asynchronously with start and stop bits, typically generated by a UART or USART (8251A).
• Single-ended signalling makes it sensitive to noise, hence the limited range.

b. Interrupts

An interrupt is a signal from an external device (or internal event) that asks the processor to suspend its present program and run a special interrupt service routine (ISR), then return and resume the original program. It avoids the wasted time of polling.

Sequence: the processor completes the current instruction, saves the return address (PC) on the stack, branches to the ISR (via a fixed vector address), executes it, and returns to the main program with RET/IRET/RETI.

The 8085 has five hardware interrupts: TRAP (non-maskable, highest priority, edge and level triggered, vector 0024H), RST 7.5 (003CH, rising edge), RST 6.5 (0034H), RST 5.5 (002CH), and INTR (non-vectored, the device supplies the instruction, e.g. RST n or CALL, through INTA'). The maskable ones are controlled by the EI/DI instructions and masks set by SIM; RIM reads their status. There are also eight software interrupts RST 0 to RST 7. In the 8086, interrupts use a 256-entry interrupt vector table (INT n, NMI, INTR).

The Intel 8085 is an 8-bit microprocessor with a 16-bit address bus (64 KB memory), a single +5 V supply, a 3 MHz clock, on-chip clock generator and serial I/O lines. Its internal architecture contains the following blocks.

   +---------------------------------------------------------------------+
   |  Accumulator (A)   Temp. reg.   Flag flip-flops (S Z AC P CY)       |
   |        \              |            /                               |
   |         +----------- ALU ---------+                                 |
   |                                                                     |
   |  B   C      D   E      H   L      W (temp)  Z (temp)               |
   |  Stack pointer (SP, 16)     Program counter (PC, 16)               |
   |  Increment/decrement address latch                                  |
   |                                                                     |
   |  Instruction register -> Instruction decoder & machine cycle encoder|
   |  Timing and control: CLK GEN, ALE, RD', WR', IO/M', S0, S1, READY   |
   |  Interrupt control: TRAP RST7.5 RST6.5 RST5.5 INTR  INTA'           |
   |  Serial I/O control: SID, SOD                                       |
   +---------------------------------------------------------------------+
        | A15-A8 (address buffer)       | AD7-AD0 (address/data buffer)
        v                               v
     address bus                    multiplexed address/data bus

1. Arithmetic and Logic Unit (ALU): performs arithmetic (add, subtract, increment, decrement) and logic (AND, OR, XOR, complement, rotate, compare) operations on 8-bit data. One operand comes from the accumulator and the other from a temporary register; the result goes to the accumulator.

2. Registers:

• Accumulator (A): 8-bit register that holds one operand and the result of ALU operations; I/O transfers also use it.
• General-purpose registers B, C, D, E, H, L: 8-bit registers that can be used singly or as 16-bit pairs BC, DE, HL; HL also acts as the memory pointer M.
• Temporary registers W and Z: used internally by instructions like CALL, XCHG; not accessible to the programmer.
• Program Counter (PC): 16-bit register that holds the address of the next instruction to be fetched; it is incremented automatically.
• Stack Pointer (SP): 16-bit register that holds the address of the top of the stack in memory.
• Instruction register and decoder: the opcode fetched is stored in the instruction register and decoded to generate the machine cycles and control signals.

3. Flag register: five flip-flops, Sign (S), Zero (Z), Auxiliary carry (AC), Parity (P) and Carry (CY), set or reset according to the result of ALU operations; used by conditional instructions.

4. Timing and control unit: generates timing and control signals for all operations: ALE, RD', WR', IO/M', S1, S0, READY, HOLD/HLDA, RESET IN/OUT, CLK OUT, X1 and X2 (crystal inputs, the internal clock is half the crystal frequency).

5. Interrupt control: five hardware interrupts, TRAP, RST 7.5, RST 6.5, RST 5.5 and INTR (with INTA' acknowledge), handled with the EI, DI, SIM and RIM instructions.

6. Serial I/O control: SID (serial input data) and SOD (serial output data) lines for serial communication using RIM and SIM.

7. Address/data buffers and buses: the address buffer drives A15-A8; the address/data buffer drives the multiplexed lines AD7-AD0 (low-order address in T1, data later, separated by ALE and an external latch). The internal 8-bit data bus connects all the above blocks.

ALE signal

ALE (Address Latch Enable) is an output of the 8085 that goes high during T1 of every machine cycle, when the multiplexed bus AD7-AD0 carries the low-order address A7-A0. The falling edge of ALE is used to latch this address in an external latch (74LS373), thereby de-multiplexing the address and data lines. During the remaining T-states the lines carry data.

LDA 5000H

LDA 5000H loads the accumulator with the contents of memory location 5000H. It is a 3-byte instruction (opcode 3AH, low address 00H, high address 50H) and takes 4 machine cycles and 13 T-states.

Machine cycles

1. M1 - opcode fetch (4 T): PC = address of the opcode is placed on the address bus. In T1, ALE = 1 and IO/M' = 0, S1S0 = 11. RD' goes low in T2; the opcode 3AH is read and stored in the instruction register in T3. In T4 the instruction is decoded. PC is incremented.
2. M2 - memory read (3 T): the address bus holds PC; the byte 00H (low-order address) is read into register Z. PC is incremented.
3. M3 - memory read (3 T): the byte 50H (high-order address) is read from the next location into W. Now WZ = 5000H.
4. M4 - memory read (3 T): WZ = 5000H is put on the address bus; the data at this location is read and stored in the accumulator.

Total: 4 + 3 + 3 + 3 = 13 T-states (at 3 MHz, 4.33 microseconds).

Timing diagram

          |      M1 (opcode fetch)    |   M2 (mem read)  |   M3 (mem read)  |  M4 (mem read)   |
          T1   T2   T3   T4            T1   T2   T3       T1   T2   T3       T1   T2   T3
 CLK     _|-|_|-|_|-|_|-|_            _|-|_|-|_|-|_      _|-|_|-|_|-|_      _|-|_|-|_|-|_
 A15-A8  [ PC high        ]            [ PC+1 high  ]     [ PC+2 high  ]     [ 50H        ]
 AD7-AD0 [PC low]  [3AH in ]  [dec]    [PC+1 low][00H]    [PC+2 low][50H]    [00H][data in]
 ALE     _|--|_____________            _|--|_______       _|--|_______       _|--|_______
 RD'     ------|______|-----           -----|____|---     -----|____|---     -----|____|---
 IO/M'   low throughout (memory operations)
 S1,S0   1 1 (fetch)                   1 0 (read)         1 0 (read)         1 0 (read)

LHLD address (Load H-L direct)

A 3-byte instruction (opcode 2AH) with 5 machine cycles and 16 T-states. It loads register L from the memory location given in the instruction and register H from the next location:

L <- [address], H <- [address + 1]

Example: LHLD 2050H with [2050H] = 34H and [2051H] = 12H gives HL = 1234H. No flags are affected.

SHLD address (Store H-L direct)

A 3-byte instruction (opcode 22H) with 5 machine cycles and 16 T-states. It stores register L at the given address and register H at the next location:

[address] <- L, [address + 1] <- H

Example: if HL = 1234H, SHLD 3000H gives [3000H] = 34H and [3001H] = 12H. No flags are affected.

Program: sum of ten 8-bit numbers starting at 6000H; sum at 9500H and carry at 9501H

Each number is added to the accumulator; whenever an addition produces a carry, a counter in register B is incremented, which accumulates the high byte of the sum.

        LXI  H, 6000H     ; HL points to the start of the data
        MVI  C, 0AH       ; counter = 10
        MVI  B, 00H       ; B holds the carry count (high byte of sum)
        XRA  A            ; A = 0 (also clears CY)
LOOP:   ADD  M            ; A = A + [HL]
        JNC  NEXT         ; no carry, skip
        INR  B            ; carry occurred, B = B + 1
NEXT:   INX  H            ; next data location (flags unaffected)
        DCR  C            ; decrement counter
        JNZ  LOOP         ; repeat until all ten are added
        STA  9500H        ; store the low byte of the sum
        MOV  A, B
        STA  9501H        ; store the carry (high byte)
        HLT

Check with data FFH ten times: the total is 10 x 255 = 2550 = 09F6H. The program leaves A = F6H and B = 09H (the carry count: the accumulator wraps 9 times), so 9500H = F6H and 9501H = 09H, which matches. INX H and DCR C do not alter the carry flag, and INR B does not affect CY, so the logic is correct.

Memory segment

The 8086 has a 20-bit address bus and so can address 1 MB of memory, but its registers are only 16 bits wide. To overcome this, the memory is organised in segments: a segment is a logical block of memory up to 64 KB (2^16 bytes) whose starting address is a multiple of 16 (a "paragraph" boundary). Within a segment, a location is identified by a 16-bit offset. The segments may be contiguous, overlapping, or separate.

The 1 MB memory is used through four types of segment:

• Code segment: holds the program instructions.
• Data segment: holds the program data.
• Stack segment: holds the stack (return addresses, saved registers).
• Extra segment: an additional data segment, mainly for string operations.

Segment registers

Four 16-bit registers hold the base (starting) addresses of the currently active segments:

• CS (code segment) - used with IP to fetch instructions, CS:IP.
• DS (data segment) - used for ordinary data accesses, DS:offset (SI, BX, direct address).
• SS (stack segment) - used with SP and BP, SS:SP.
• ES (extra segment) - destination of string instructions, ES:DI.

The 16-bit segment register value is taken as the upper 16 bits of a 20-bit base (four zero bits appended, i.e. multiplied by 16). The physical address is

$\text{Physical address} = \text{Segment} \times 16 + \text{Offset}$

Example: CS = 2000H, IP = 0150H gives 20000H + 0150H = 20150H.

Advantages: programs can be relocated by changing only the segment registers, code, data and stack can be kept apart for protection, and 16-bit registers can address 1 MB.

Lowercase letters are converted by clearing bit 5 (subtracting 20H); the space is left unchanged. The program for the 8086 uses DOS function calls.

.MODEL SMALL
.STACK 100H
.DATA
STR1  DB 'computer science'
LEN   EQU $ - STR1              ; length = 16
NL    DB 0DH, 0AH, '$'
.CODE
MAIN PROC
      MOV  AX, @DATA
      MOV  DS, AX               ; initialise DS
      LEA  SI, STR1             ; SI -> string
      MOV  CX, LEN              ; CX = number of characters
AGAIN: MOV AL, [SI]
      CMP  AL, 'a'              ; below 'a'? (e.g. space)
      JB   NEXT
      CMP  AL, 'z'              ; above 'z'?
      JA   NEXT
      SUB  AL, 20H              ; convert to upper case
      MOV  [SI], AL             ; store back
NEXT: INC  SI
      LOOP AGAIN

      ; display the converted string character by character
      LEA  SI, STR1
      MOV  CX, LEN
SHOW: MOV  DL, [SI]
      MOV  AH, 02H
      INT  21H
      INC  SI
      LOOP SHOW

      MOV  AH, 4CH              ; return to DOS
      INT  21H
MAIN ENDP
END MAIN

The string becomes COMPUTER SCIENCE. For example 'c' = 63H; 63H - 20H = 43H = 'C'. The space (20H) is below 'a' (61H) so it is skipped.

Types of I/O instructions

1. Isolated (I/O-mapped) instructions: special instructions that address a separate I/O space with the I/O control signals.
   • 8085: IN port8 reads a byte from the port into the accumulator; OUT port8 writes the accumulator to the port. 256 input and 256 output ports.
   • 8086: IN AL/AX, port8 or DX and OUT port8 or DX, AL/AX, with a 16-bit port address in DX (64 K ports).
2. Memory-mapped instructions: the device is treated as a memory location and the ordinary memory-reference instructions are used, e.g. LDA, STA, MOV A, M, MOV M, A, LDAX.
3. String I/O (8086): INS/INSB/INSW and OUTS transfer blocks of data between a port and memory (80186 and above).

Memory-mapped I/O versus I/O-mapped I/O

Vectored interrupt

An interrupt is called vectored when the processor knows automatically the address of its service routine (the interrupt vector): on acceptance, control goes to a fixed memory location specific to that interrupt, with no need for the device to supply the address. In the 8085 the vectored interrupts are TRAP, RST 7.5, RST 6.5 and RST 5.5, with the fixed addresses:

(The vector address of RST n is 8 x n, and for the hardware ones it is 8 x n + 4, e.g. 5.5 -> 8 x 5 + 4 = 002CH.) INTR is non-vectored, since the interrupting device must put an instruction (RST n or CALL address) on the data bus during INTA'.

Maskable interrupts

An interrupt that the programmer can enable or disable (mask) is maskable. The 8085 has INTR, RST 7.5, RST 6.5 and RST 5.5.

• The interrupt enable flip-flop is set by EI and cleared by DI (and by RESET and on accepting an interrupt), which controls all four together.
• RST 7.5, 6.5 and 5.5 can also be individually masked using the SIM instruction (mask bits M7.5, M6.5, M5.5, and R7.5 resets the RST 7.5 flip-flop); RIM reads the mask and pending status.
• Priority (high to low): RST 7.5, RST 6.5, RST 5.5, INTR.

Non-maskable interrupt

An interrupt that cannot be disabled by software is non-maskable. The 8085 has TRAP. It has the highest priority, is unaffected by DI or SIM, and is recognised even when interrupts are disabled. It is both edge and level sensitive (must go high and stay high until acknowledged), and its vector is 0024H. It is used for critical events such as power failure or memory error, where the processor has to save its state immediately.

An addressing mode is the way an instruction specifies the location of its operand. The 8085 has five addressing modes.

1. Immediate addressing: the operand (data) is part of the instruction itself.

• MVI B, 32H loads 32H into register B.
• LXI H, 2050H loads a 16-bit immediate value into the HL pair.

2. Register addressing: the operand is in a CPU register, and the instruction names the register(s).

• MOV A, B copies B into A.
• ADD C adds C to the accumulator.

3. Direct addressing: the instruction contains the 16-bit memory address of the operand.

• LDA 2050H loads A from memory location 2050H.
• STA 3000H stores A at 3000H.
• IN 80H / OUT 81H use an 8-bit port address in the same way.

4. Register indirect addressing: a register pair (HL, BC or DE) holds the memory address of the operand.

• MOV A, M copies the byte at the address in HL into A.
• LDAX B loads A from the address held in BC.

5. Implicit (implied) addressing: the operand is implied by the opcode, so no operand is written.

• CMA complements the accumulator.
• RAL, STC, HLT are further examples.

Instructions such as JMP 2000H and CALL also use the direct form to give the target address.

Limitations of parallel communication

• It needs many wires (at least 8 data lines plus control lines), so cables and connectors are bulky and costly.
• Over longer distances, crosstalk and skew between the lines cause errors, so the usable distance is short.
• Every bit needs its own driver and receiver, which raises hardware cost.
• Noise pickup and signal attenuation grow with cable length, so speed cannot be raised much over distance.
• Sender and receiver need handshake signals to stay synchronised.

Operating modes of the 8255A PPI

The 8255A has three 8-bit ports (A, B, C) and is controlled by a control word written to the control register. It works in two main modes.

1. I/O mode: selected by D7 = 1 in the control word. It has three sub-modes.

• Mode 0 (simple I/O): ports A, B and the two halves of C (upper and lower) work independently as plain input or output. There is no handshaking, and outputs are latched but inputs are not. It suits simple devices such as switches and LEDs.
• Mode 1 (strobed I/O): ports A and B transfer data using handshake signals taken from port C lines (STB, IBF, OBF, ACK, INTR). Port C lines not used for handshaking stay as I/O lines. Both input and output data are latched, and interrupt-driven transfer is possible.
• Mode 2 (bidirectional bus): available only for port A. Port A is a bidirectional 8-bit bus, and five lines of port C (PC3 to PC7) provide the handshaking and interrupt signals. Port B can work in mode 0 or mode 1.

2. Bit Set/Reset (BSR) mode: selected by D7 = 0 in the control word. Any single bit of port C can be set or reset individually. This is used to generate control signals.

(a) Flags in the 8085 MPU

The 8085 has a flag register with five 1-bit flags, which show the result of the last arithmetic or logic operation.

• Sign (S): copy of bit D7 of the result. It is 1 if the result is negative.
• Zero (Z): 1 if the result is zero.
• Auxiliary Carry (AC): 1 if there is a carry from bit 3 to bit 4. It is used for BCD arithmetic (DAA).
• Parity (P): 1 if the result has an even number of 1s.
• Carry (CY): 1 if there is a carry out of D7 in addition, or a borrow in subtraction.

Flag register layout: D7 S, D6 Z, D5 X, D4 AC, D3 X, D2 P, D1 X, D0 CY (X means unused).

(b) DMA (Direct Memory Access)

DMA is a technique in which an I/O device transfers data directly to or from memory without passing every byte through the CPU. It is used for fast, bulk transfers, because the CPU-controlled transfer is slow.

Working:

1. The device sends a DMA request to the DMA controller (such as the 8257 or 8237), which sends HOLD to the CPU.
2. The CPU finishes its current machine cycle, floats its buses, and replies with HLDA.
3. The DMA controller takes over the address, data and control buses and moves the data, updating the address and a byte count each time.
4. When the count ends, it releases HOLD and the CPU resumes.

Modes include burst (block), cycle stealing and transparent transfer. The main advantage is high transfer speed with a free CPU.

PUSH and POP

The stack is a LIFO memory area in RAM. The stack pointer (SP) holds the address of its top, and the stack grows towards lower addresses.

PUSH rp (rp is BC, DE, HL or PSW) saves a 16-bit register pair on the stack:

1. SP is decremented and the high-order register is stored at the address in SP.
2. SP is decremented again and the low-order register is stored there.

POP rp restores a register pair:

1. The byte at SP goes into the low-order register, and SP is incremented.
2. The byte at SP goes into the high-order register, and SP is incremented again.

Example: let SP = 2099H, B = 12H, C = 34H.

PUSH B    ; (2098H) = 12H, (2097H) = 34H, SP = 2097H
POP  D    ; E = (2097H) = 34H, D = (2098H) = 12H, SP = 2099H

After these two instructions DE = 1234H, so the pair BC is copied to DE. Since the stack is LIFO, POP must be done in the reverse order of PUSH.

Program: divide 34H by 08H

The 8085 has no divide instruction, so we subtract repeatedly. The quotient counts the number of subtractions, and the remainder is what remains.

        MVI  A, 34H      ; dividend
        MVI  B, 08H      ; divisor
        MVI  C, 00H      ; quotient = 0
LOOP:   CMP  B           ; compare A with B
        JC   DONE        ; if A < B, stop
        SUB  B           ; A = A - B
        INR  C           ; quotient + 1
        JMP  LOOP
DONE:   STA  8050H       ; remainder
        MOV  A, C
        STA  8051H       ; quotient
        HLT

Check: $34H = 52$ and $08H = 8$. $52 = 6\times 8 + 4$. So the quotient is 06H and the remainder is 04H. Thus (8050H) = 04H and (8051H) = 06H.

Isolated (I/O mapped) I/O versus memory mapped I/O

Basic DMA operation

DMA lets an I/O device exchange data with memory directly under a DMA controller (for example the 8237), without the CPU handling every byte.

1. The I/O device raises DREQ to the DMA controller.
2. The controller sends HOLD to the CPU to ask for the buses.
3. The CPU finishes the current machine cycle, tri-states its address, data and control buses, and replies with HLDA.
4. The controller sends DACK to the device, places the memory address on the address bus, and generates the read and write control signals. Data moves directly between memory and the device. The address is incremented and the byte count decremented after each transfer.
5. When the count reaches zero (terminal count), the controller removes HOLD and the CPU takes back the buses.

This gives fast transfer for large blocks, such as from disk.

Flag

A flag is a single bit (flip-flop) in the processor that records a condition produced by the last arithmetic or logic operation. The flags are held in the flag register and are tested by conditional instructions such as JZ, JC, JNC, JP, JM.

Flags in the 8085

The 8085 has five flags, in the following bit positions:

1. Sign flag (S): set to 1 when bit D7 of the result is 1, meaning a negative number in 2's complement.
2. Zero flag (Z): set to 1 when the result is zero, and reset otherwise. It is also set by a compare when the two values are equal.
3. Auxiliary Carry flag (AC): set to 1 when there is a carry from bit D3 to D4. It is used internally for BCD correction by the DAA instruction.
4. Parity flag (P): set to 1 when the result has an even number of 1 bits (even parity), and reset when odd.
5. Carry flag (CY): set to 1 when an addition generates a carry out of D7, or a subtraction needs a borrow. It is also affected by rotate instructions and by STC and CMC.

Bits D5, D3 and D1 are unused.

In ASCII, lowercase letters 'a' to 'z' (61H to 7AH) differ from uppercase letters (41H to 5AH) by 20H (bit 5). So a lowercase letter is converted by subtracting 20H. Characters outside 'a' to 'z' (such as the space) are left unchanged.

.MODEL SMALL
.STACK 100H
.DATA
    STR  DB 'microprocessor is programmable', '$'
.CODE
MAIN PROC
    MOV  AX, @DATA
    MOV  DS, AX
    LEA  SI, STR          ; SI points to the string
NEXT:
    MOV  AL, [SI]
    CMP  AL, '$'          ; end of string?
    JE   DONE
    CMP  AL, 'a'
    JB   SKIP             ; below 'a', leave as is
    CMP  AL, 'z'
    JA   SKIP             ; above 'z', leave as is
    SUB  AL, 20H          ; convert to uppercase
    MOV  [SI], AL
SKIP:
    INC  SI
    JMP  NEXT
DONE:
    LEA  DX, STR          ; display the result
    MOV  AH, 09H
    INT  21H
    MOV  AH, 4CH          ; exit
    INT  21H
MAIN ENDP
END MAIN

The output is MICROPROCESSOR IS PROGRAMMABLE. The $ ends the string for the DOS display function, and the loop stops when it reaches it.

Interrupt

An interrupt is a signal from an external device (or from software) that makes the processor suspend its current program, run a special service routine (ISR) for the event, and then resume the original program. It avoids wasting time in polling.

8259 Programmable Interrupt Controller (PIC)

The 8259 manages up to 8 interrupt requests (IR0 to IR7) and can be cascaded with other 8259s (up to 9 chips for 64 levels). It resolves priorities and gives the CPU the vector of the highest-priority interrupt.

Block diagram

 IR0-IR7 --> [IRR] --> [Priority resolver] --> [ISR] --+
              ^              ^                         |
              |         [IMR] mask                     v
 D7-D0 <--> [Data bus buffer] <--> [Control logic] --> INT --> CPU
 RD, WR, A0, CS --> [Read/Write logic]    <-- INTA <-- CPU
 CAS0-CAS2, SP/EN --> [Cascade buffer/comparator]

Main blocks

• IRR (Interrupt Request Register): stores the requests on IR0 to IR7.
• IMR (Interrupt Mask Register): masks (disables) selected requests.
• ISR (In-Service Register): records the interrupt currently being served.
• Priority resolver: finds the highest-priority pending unmasked request.
• Control logic: sends INT to the CPU and handles INTA.
• Cascade buffer/comparator: for master/slave connection.
• Data bus buffer and read/write logic: connect to the CPU and take the control words (ICW and OCW).

Operation

1. A device raises an IR line, which sets the corresponding IRR bit.
2. If unmasked and of highest priority, the 8259 sends INT to the CPU.
3. The CPU acknowledges with INTA pulses.
4. The 8259 places the CALL opcode and then the ISR address (8085) or interrupt type number (8086) on the data bus.
5. The ISR runs. The 8259 clears the ISR bit with an EOI command at the end.

It is programmed using Initialization Command Words (ICW1 to ICW4) and Operational Command Words (OCW1 to OCW3), and supports fully nested, rotating and special-mask priority modes.

Descriptor

A descriptor is an 8-byte entry in a descriptor table that describes one memory segment (or a gate or system object) to the processor in protected mode. It contains the segment base address, the limit (size of the segment), and access rights (type, privilege level DPL, present bit, accessed bit, readable or writable). Descriptors are kept in the Global Descriptor Table (GDT), the Local Descriptor Table (LDT) and the Interrupt Descriptor Table (IDT).

Logical to physical address conversion

A logical address has the form selector : offset. The selector, held in a segment register, has:

• Index (13 bits): which descriptor in the table
• TI (1 bit): 0 means GDT, 1 means LDT
• RPL (2 bits): requested privilege level

 Segment register (selector)        Descriptor table (GDT/LDT)
 +-------+----+-----+               +--------------------+
 | Index | TI | RPL |-----index---->| Descriptor 0       |
 +-------+----+-----+     x 8       | ...                |
                                    | Descriptor n:      |
   GDTR/LDTR (table base) --------> |  Base | Limit | AR |
                                    +---------|----------+
                                              |
                                        Base address
                                              v
        Offset ---------------------------> [  +  ] ---> Physical address

Steps:

1. TI selects the GDT or LDT. The table base address comes from the GDTR or LDTR register.
2. The descriptor is found at table base + index $\times$ 8.
3. The processor checks the present bit, privilege (CPL, RPL against DPL), type, and that offset $\le$ limit.
4. If the checks pass, the physical address is computed:

$\text{Physical address} = \text{Base (from descriptor)} + \text{Offset}$

If a check fails, a protection exception occurs. A copy of the descriptor is kept in a hidden cache register in the CPU so that later accesses to the same segment are quick.

(a) Operating modes of the 8255 PPI

The 8255 has three 8-bit ports (A, B, C), and the control word in the control register sets the mode. Bit D7 chooses between the two main modes.

I/O modes (D7 = 1)

• Mode 0, basic (simple) I/O: ports A, B and the upper and lower halves of port C are independent inputs or outputs. There is no handshaking, and outputs are latched.
• Mode 1, strobed I/O: ports A and B transfer data using handshake lines from port C (STB, IBF, OBF, ACK, INTR). Data are latched and interrupts can be used.
• Mode 2, bidirectional bus: only for port A, which acts as an 8-bit bidirectional bus. Five lines of port C give the handshaking signals. Port B can work in mode 0 or 1.

Bit Set/Reset (BSR) mode (D7 = 0): individual bits of port C are set or cleared by a control word, which is useful for generating control signals.

(b) Harvard architecture

In Harvard architecture, the program (instruction) memory and data memory are separate, each with its own address and data buses.

• The CPU can fetch an instruction and read or write data at the same time, which gives higher throughput.
• Instruction and data widths can differ, and program memory is protected from being overwritten by data.
• It needs more pins/buses and is more complex.
• It is used in DSPs and microcontrollers such as the 8051, PIC and AVR.

This contrasts with the Von Neumann architecture, where one memory and one bus are shared by instructions and data, so fetching and data access cannot overlap.