Introduction to Assembly Language IA32

Introduction to Assembly Language IA32
Winter 2013 COMP 2130 Intro Computer Systems Computing Science Thompson Rivers University

Reliable and efficient programming for power programmers
Course Objectives The better knowledge of computer systems, the better programing. Computer System C Programming Language Computer architecture CPU (Central Processing Unit) IA32 assembly language Introduction to C language Compiling, linking, loading, executing Physical main memory MMU (Memory Management Unit) Virtual memory space Memory hierarchy Cache Dynamic memory management Better coding – locality Reliable and efficient programming for power programmers (to avoid strange errors, to optimize codes, to avoid security holes, …) Not the replacement of IPv6; Inter-transition mechanism; But if IPv6 would fail TRU-COMP2130 IA32

Course Contents Introduction to computer systems: B&O 1
Introduction to C programming: K&R 1 – 4 Data representations: B&O 2.1 – 2.4 C: advanced topics: K&R 5.1 – 5.10, 6 – 7 Introduction to IA32 (Intel Architecture 32): B&O 3.1 – 3.8, 3.13 Compiling, linking, loading, and executing: B&O 7 (except 7.12) Dynamic memory management – Heap: B&O – 9.9.2, – 9.9.5, 9.11 Code optimization: B&O 5.1 – 5.6, 5.13 Memory hierarchy, locality, caching: B&O 5.12, 6.1 – 6.3, – 6.4.2, 6.5, – 6.6.3, 6.7 Virtual memory (if time permits): B&O 9.4 – 9.5 Not the replacement of IPv6; Inter-transition mechanism; But if IPv6 would fail TRU-COMP2130 IA32

Unit Learning Objectives
Translate a simple C code into an assembly code. Understand how a computer system runs an application. Prerequisite for compilers and operating systems Analyze assembly program code. List registers used in IA32. Compute memory address. In function call, understand the use of user stack for variables, with %esp and %ebp List two data types. List three operations types. List three operand types. Use different memory addressing modes. TRU-COMP2130 IA32

Use movel, leal, addl, subl, ...
Convert simple machine code to C code. Convert if-else to if and goto version. Convert if and goto version to if-else, do-while, while, or for version. Understand the use of stack for function call. TRU-COMP2130 IA32

Unit Contents IA32 (Intel Architecture 32) Program Encodings
Data Movement Data Layout and Access Arithmetic and Logical Operations Control Structures Function Calls, and Runtime Stack Array Allocation and Access TRU-COMP2130 IA32

Why should we spend our time learning machine code?
Even though compilers do most of the work in generating assembly code, being able to read and understand it is an important skill for serious programmers. By reading assembly code, We can understand the optimization capabilities of the compiler and analyze the underlying inefficiencies in the code. Code optimization in Chapter 5. We can understand the function invocation mechanism. We can help ourselves understand how computer systems (HW) and operating systems (SW) run programs. IA32 Traditional x86 32bit Linux uses what is referred to as flat addressing, where the entire memory space is viewed by the programmer as a large array of bytes. TRU-COMP2130 IA32

3.2 Program Encodings Machine Programming: We will just study basic topics. Many slides from CMU 15-213/18-243: Introduction to Computer Systems Sep. 2, 2010 Randy Bryant and Dave O’Hallaron TRU-COMP2130 IA32

Assembly Programmer’s View
Carnegie Mellon Assembly Programmer’s View Memory CPU Addresses Registers Object Code Program Data OS Data PC Data Condition Codes Instructions Stack Programmer-Visible State PC: Program counter Address of next instruction in memory Called “EIP” (IA32) or “RIP” (x86-64) Register file Heavily used program data Condition codes Store status information about most recent arithmetic operation Used for conditional branching, e.g., if Memory Byte addressable array Code, user data, (some) OS data Includes stack used to support procedures

Turning C into Object Code
Carnegie Mellon Turning C into Object Code Code in files p1.c p2.c Compile with command: $ gcc –O1 p1.c p2.c -o p Use basic optimizations (-O1) Put resulting binary in file p text C program (p1.c p2.c) Compiler (gcc -S) text Asm program (p1.s p2.s) Assembler (gcc or as) binary Object program (p1.o p2.o) Static libraries (.a) Linker (gcc or ld) binary Executable program (p)

Compiling Into Assembly
Carnegie Mellon Compiling Into Assembly C Code Generated IA32 Assembly int sum(int x, int y) { int t = x+y; return t; } sum: pushl %ebp movl %esp,%ebp movl 12(%ebp),%eax addl 8(%ebp),%eax popl %ebp ret Some compilers use instruction “leave” pushl, movl, addl, popl, ret are mnemonics for machine instructions. Obtain with command $ gcc –O1 -S code.c Produces file code.s

How to create assembly code on cs.tru.ca?
In order to support IA32 on 64bit Ubuntu, e.g., cs.tru.ca, we need to install libc6-dev:i386 and gcc-multilib. How to create assembly code on cs.tru.ca? $ gcc –O1 –S code.c –m32 In code.s on cs.tru.ca, you will see .cfi_startproc for // CFI (call frame information) directive // for exception handling on Linux pushl %ebp movel %esp, $ebp .cfi_endproc for // CFI directive popl %ebp TRU-COMP2130 IA32

code.s on cs.tru.ca, by using $ gcc –O1 –S code.c –m32
.file "code.c" .text .globl sum .type sum: .LFB0: .cfi_startproc movl 8(%esp), %eax addl 4(%esp), %eax ret .cfi_endproc .LFE0: .size sum, .-sum .ident "GCC: (Ubuntu/Linaro ubuntu5) 4.6.3" .section int sum(int x, int y) { int t = x+y; return t; } TRU-COMP2130 IA32

Assembly Characteristics: Data Types
Carnegie Mellon Assembly Characteristics: Data Types “Integer” data of 1, 2, or 4 bytes Data values Addresses Floating point data of 4, 8, or 10 bytes No aggregate types such as arrays or structures Just contiguously allocated bytes in memory

Assembly Characteristics: Operation Types
Carnegie Mellon Assembly Characteristics: Operation Types Perform arithmetic function on register or memory data Transfer data between memory and register Load data from memory into register Store register data into memory Transfer control Unconditional jumps to/from procedures Conditional branches

Object Code Code for sum Assembler Linker Translates .s into .o
Carnegie Mellon Object Code Code for sum Assembler Translates .s into .o Binary encoding of each instruction Nearly-complete image of executable code Missing linkages between code in different files Linker Resolves references between files Combines with static run-time libraries E.g., code for malloc, printf Some libraries are dynamically linked Linking occurs when program begins execution 0x <sum>: 0x55 0x89 0xe5 0x8b 0x45 0x0c 0x03 0x08 0x5d 0xc3 Total of 11 bytes Each instruction 1, 2, or 3 bytes Starts at address 0x401040

Machine Instruction Example
Carnegie Mellon Machine Instruction Example C Code Add two signed integers Assembly Add 2 4-byte integers “Long” words in GCC parlance Same instruction whether signed or unsigned Operands: x: Register %eax y: Memory M[%ebp+8] t: Register %eax Return function value in %eax Object Code 3-byte instruction Stored at address 0x80483ca int t = x+y; addl 8(%ebp),%eax Similar to expression: x += y; More precisely: int eax; int *ebp; eax += ebp[2]; // *(ebp+2) 0x80483ca:

Disassembling Object Code
Carnegie Mellon Disassembling Object Code Disassembled 0x80483c4 <sum>: 80483c4: push %ebp 80483c5: 89 e5 mov %esp,%ebp 80483c7: 8b 45 0c mov 0xc(%ebp),%eax 80483ca: add 0x8(%ebp),%eax 80483cd: 5d pop %ebp 80483ce: c ret Disassembler $ objdump -d prog Useful tool for examining object code Analyzes bit pattern of series of instructions Produces approximate rendition of assembly code Can be run on either a.out (complete executable) or .o file

Alternate Disassembly
Carnegie Mellon Alternate Disassembly Object Disassembled 0x401040: 0x55 0x89 0xe5 0x8b 0x45 0x0c 0x03 0x08 0x5d 0xc3 Dump of assembler code for function sum: 0x080483c4 <sum+0>: push %ebp 0x080483c5 <sum+1>: mov %esp,%ebp 0x080483c7 <sum+3>: mov 0xc(%ebp),%eax 0x080483ca <sum+6>: add 0x8(%ebp),%eax 0x080483cd <sum+9>: pop %ebp 0x080483ce <sum+10>: ret Within gdb Debugger $ gdb prog disassemble sum Disassemble procedure x/11xb sum Examine the 11 bytes starting at sum

What Can be Disassembled?
Carnegie Mellon What Can be Disassembled? % objdump -d WINWORD.EXE WINWORD.EXE: file format pei-i386 No symbols in "WINWORD.EXE". Disassembly of section .text: <.text>: : push %ebp : 8b ec mov %esp,%ebp : 6a ff push $0xffffffff : push $0x a: dc 4c 30 push $0x304cdc91 Anything that can be interpreted as executable code Disassembler examines bytes and reconstructs assembly source

3.3 Data Format Integer data of 1, 2, or 4 bytes
Data values Addresses Floating point data of 4, 8, or 10 bytes No aggregate types such as arrays or structures Just contiguously allocated bytes in memory C Intel Assembly code suffix Size (bytes) char Byte b 1 short Word w 2 int Double word l 4 long int char * float Single precision s double Double precesion 8 long double Extended precision t 10/12 movl 12(%ebp), %eax addl 8(%ebp), %eax TRU-COMP2130 IA32

3.4 Accessing Information
Assembly operation types Perform arithmetic function on register or memory data Transfer data between memory and register Load data from memory into register Store register data into memory Store register data into register But no memory to memory Transfer control Unconditional jumps to/from procedures Conditional branches Examples movl 12(%ebp), %eax addl 8(%ebp), %eax What kind of registers are in IA32? TRU-COMP2130 IA32

Integer Registers (IA32)
Carnegie Mellon Integer Registers (IA32) Origin (mostly obsolete) %eax %ecx %edx %ebx %esi %edi %esp %ebp %ax %ah %al accumulate %cx %ch %cl counter %dx %dh %dl data general purpose %bx %bh %bl base source index %si destination index %di stack pointer %sp base pointer %bp 16-bit virtual registers (backwards compatibility)

3.4.1, 3.4.2, and 3.4.3 TRU-COMP2130 IA32

Moving Data: IA32 Moving Data (data transfer operations) Operand Types
Carnegie Mellon Moving Data: IA32 %eax %ecx %edx %ebx %esi %edi %esp %ebp Moving Data (data transfer operations) movl Source, Dest: Operand Types Immediate: Constant integer data Example: $0x400, $-533 Like C constant, but prefixed with ‘$’ Encoded with 1, 2, or 4 bytes Register: One of 8 integer registers Example: %eax, %edx But %esp and %ebp reserved for special use Others have special uses for particular instructions Memory: 4 consecutive bytes of memory at address given by register Simplest example: (%eax) Various other “address modes”

movl Operand Combinations
Carnegie Mellon movl Operand Combinations Assumption: %eax <- temp1; %edx <- temp2; %ecx <- p; Source Dest Src, Dest C Analog Reg movl $0x4,%eax temp1 = 0x4; Imm Mem movl $-147,(%ecx) *p = -147; Reg movl %eax,%edx temp2 = temp1; movl Reg Mem movl %eax,(%ecx) *p = temp1; Mem Reg movl (%ecx),%eax temp1 = *p; Cannot do memory-memory transfer with a single instruction How to do memory-memory transfer?

Simple Memory Addressing Modes
Carnegie Mellon Simple Memory Addressing Modes Normal (R) Mem[Reg[R]] Register R specifies memory address. movl (%ecx),%eax Displacement D(R) Mem[Reg[R]+D] Register R specifies start of memory region. Constant displacement D specifies offset. movl 8(%ebp),%edx ??? %edx = M[%ebp + d];

Practice Problem 3.1 Address Value Register Value
0x100 0xFF %eax 0x100 0x104 0xAB %ecx 0x1 0x108 0x13 %edx 0x3 Operand Value %eax ??? $0x108 (%eax) 4(%eax) TRU-COMP2130 IA32

Using Simple Addressing Modes
Carnegie Mellon Using Simple Addressing Modes swap: pushl %ebp movl %esp,%ebp pushl %ebx movl 8(%ebp), %edx movl 12(%ebp), %ecx movl (%edx), %ebx movl (%ecx), %eax movl %eax, (%edx) movl %ebx, (%ecx) popl %ebx popl %ebp ret void swap(int *xp, int *yp) { int t0 = *xp; int t1 = *yp; *xp = t1; *yp = t0; } Set Up Body Finish

• • • Figure 3.5 Illustration of stack operation 0x123 0x108 %eax %edx
Initially pushl %eax popl %edx 0x123 0x108 %eax %edx %esp 0x123 0x104 %eax %edx %esp 0x123 0x108 %eax %edx %esp Stack “bottom” Stack “bottom” Stack “bottom” Increasing address • • • 0x108 0x108 0x108 Stack “top” 0x123 0x123 0x104 Stack “top” Stack “top”

pushl %eax is equivalent to
subl $4, %esp movl %eax, (%esp) popl %edx is equivalent to movl (%esp), %edx addl $4, %esp

Intermediate Review Registers Data transfer instruction Operand types
%eax, %ebx, %ecx, %edx, %esp, %ebp Data transfer instruction movl ... Operand types Constant values Memory Register Addressing mode movl (%ecx),%eax movl 8(%ebp),%edx Stack operations pushl ... popl ... TRU-COMP2130 IA32

Using Simple Addressing Modes
Carnegie Mellon Using Simple Addressing Modes swap: pushl %ebp movl %esp,%ebp pushl %ebx movl 8(%ebp), %edx movl 12(%ebp), %ecx movl (%edx), %ebx movl (%ecx), %eax movl %eax, (%edx) movl %ebx, (%ecx) popl %ebx popl %ebp ret void swap(int *xp, int *yp) { int t0 = *xp; int t1 = *yp; *xp = t1; *yp = t0; } Set Up Body yp: &y xp: &x Rtn adr Old %ebp %ebp 4 8 12 Offset from %ebp • Old %ebx -4 %esp Stack (in memory) Prepared by the caller function Finish %esp initially

How to use the variables?
Carnegie Mellon Understanding Swap yp: &y xp: &x Rtn adr Old %ebp %ebp 4 8 12 • Old %ebx -4 %esp void swap(int *xp, int *yp) { int t0 = *xp; int t1 = *yp; *xp = t1; *yp = t0; } Stack (in memory) Offset from %ebp Prepared by the caller function How to use the variables? Register Value %edx xp %ecx yp %ebx t0 %eax t1 movl 8(%ebp), %edx # edx = xp movl 12(%ebp), %ecx # ecx = yp movl (%edx), %ebx # ebx = *xp (t0) movl (%ecx), %eax # eax = *yp (t1) movl %eax, (%edx) # *xp = t1 movl %ebx, (%ecx) # *yp = t0

Understanding Swap Address 123 0x124 456 0x120 0x11c %eax %edx %ecx
Carnegie Mellon Address Understanding Swap 123 0x124 456 0x120 0x11c %eax %edx %ecx %ebx %esi %edi %esp %ebp 0x100 0x104 Offset from %ebp 0x118 0x114 yp 12 0x120 0x110 xp 8 0x124 0x10c 4 Rtn adr 0x108 %ebp 0x104 -4 0x100 movl 8(%ebp), %edx # edx = xp movl 12(%ebp), %ecx # ecx = yp movl (%edx), %ebx # ebx = *xp (t0) movl (%ecx), %eax # eax = *yp (t1) movl %eax, (%edx) # *xp = t1 movl %ebx, (%ecx) # *yp = t0

Carnegie Mellon Address Understanding Swap 123 0x124 456 0x120 0x11c %eax %edx %ecx %ebx %esi %edi %esp %ebp 0x118 Offset 0x124 0x114 yp 12 0x120 0x120 0x110 xp 8 0x124 0x10c 4 Rtn adr 0x108 %ebp 0x104 -4 0x100 0x100 movl 8(%ebp), %edx # edx = xp movl 12(%ebp), %ecx # ecx = yp movl (%edx), %ebx # ebx = *xp (t0) movl (%ecx), %eax # eax = *yp (t1) movl %eax, (%edx) # *xp = t1 movl %ebx, (%ecx) # *yp = t0 0x104

Carnegie Mellon Address Understanding Swap 123 0x124 456 0x120 0x11c %eax %edx %ecx %ebx %esi %edi %esp %ebp 0x118 Offset 0x124 0x114 yp 12 0x120 0x120 0x110 xp 8 0x124 0x124 0x10c 4 Rtn adr 0x108 %ebp 0x104 -4 0x100 0x100 movl 8(%ebp), %edx # edx = xp movl 12(%ebp), %ecx # ecx = yp movl (%edx), %ebx # ebx = *xp (t0) movl (%ecx), %eax # eax = *yp (t1) movl %eax, (%edx) # *xp = t1 movl %ebx, (%ecx) # *yp = t0 0x104

Understanding Swap Address 123 0x124 456 456 0x120 0x11c %eax %edx
Carnegie Mellon Address Understanding Swap 123 0x124 456 456 0x120 0x11c %eax %edx %ecx %ebx %esi %edi %esp %ebp 0x118 Offset 0x124 0x114 yp 12 0x120 0x120 0x110 xp 8 0x124 0x10c 123 4 Rtn adr 0x108 %ebp 0x104 -4 0x100 0x100 movl 8(%ebp), %edx # edx = xp movl 12(%ebp), %ecx # ecx = yp movl (%edx), %ebx # ebx = *xp (t0) movl (%ecx), %eax # eax = *yp (t1) movl %eax, (%edx) # *xp = t1 movl %ebx, (%ecx) # *yp = t0 0x104

Understanding Swap Address 123 123 0x124 456 0x120 0x11c %eax %edx
Carnegie Mellon Address Understanding Swap 123 123 0x124 456 0x120 0x11c %eax %edx %ecx %ebx %esi %edi %esp %ebp 456 0x118 Offset 0x124 0x114 yp 12 0x120 0x120 0x110 xp 8 0x124 0x10c 123 4 Rtn adr 0x108 %ebp 0x104 -4 0x100 0x100 movl 8(%ebp), %edx # edx = xp movl 12(%ebp), %ecx # ecx = yp movl (%edx), %ebx # ebx = *xp (t0) movl (%ecx), %eax # eax = *yp (t1) movl %eax, (%edx) # *xp = t1 movl %ebx, (%ecx) # *yp = t0 0x104

Carnegie Mellon Address Understanding Swap 456 0x124 456 0x120 0x11c %eax %edx %ecx %ebx %esi %edi %esp %ebp 456 456 0x118 Offset 0x124 0x114 yp 12 0x120 0x120 0x110 xp 8 0x124 0x10c 123 123 4 Rtn adr 0x108 %ebp 0x104 -4 0x100 0x100 movl 8(%ebp), %edx # edx = xp movl 12(%ebp), %ecx # ecx = yp movl (%edx), %ebx # ebx = *xp (t0) movl (%ecx), %eax # eax = *yp (t1) movl %eax, (%edx) # *xp = t1 movl %ebx, (%ecx) # *yp = t0 0x104

Carnegie Mellon Address Understanding Swap 456 0x124 123 0x120 0x11c %eax %edx %ecx %ebx %esi %edi %esp %ebp 456 0x118 Offset 0x124 0x114 yp 12 0x120 0x120 0x110 xp 8 0x124 0x10c 123 123 4 Rtn adr 0x108 %ebp 0x104 -4 0x100 0x100 movl 8(%ebp), %edx # edx = xp movl 12(%ebp), %ecx # ecx = yp movl (%edx), %ebx # ebx = *xp (t0) movl (%ecx), %eax # eax = *yp (t1) movl %eax, (%edx) # *xp = t1 movl %ebx, (%ecx) # *yp = t0 0x104

Complete Memory Addressing Modes
Carnegie Mellon Complete Memory Addressing Modes Most General Form D(Rb,Ri,S) Mem[Reg[Rb]+S*Reg[Ri]+D] D: Constant “displacement” 1, 2, or 4 bytes Rb: Base register: Any of 8 integer registers Ri: Index register: Any, except for %esp Unlikely you’d use %ebp, either S: Scale: 1, 2, 4, or 8 E.g., 8(%eax, %edx, 4) -> M[%eax + 4 * %edx + 8] Special Cases (Rb,Ri) Mem[Reg[Rb]+Reg[Ri]] D(Rb,Ri) Mem[Reg[Rb]+Reg[Ri]+D] (Rb,Ri,S) Mem[Reg[Rb]+S*Reg[Ri]]

Practice Problem 3.1 Address Value Register Value
0x100 0xFF %eax 0x100 0x104 0xAB %ecx 0x1 0x108 0x13 %edx 0x3 Operand Value %eax ??? $0x108 (%eax) 4(%eax) 9(%eax, %edx) 0xFC(, %ecx, 4) (%eax, %edx, 4) TRU-COMP2130 IA32

Address Computation Examples
Carnegie Mellon Address Computation Examples %edx 0xf000 %ecx 0x0100 Expression Address Computation Address 0x8(%edx) (%edx,%ecx) (%edx,%ecx,4) 0x80(,%edx,2) Expression Address Computation Address 0x8(%edx) 0xf x8 0xf008 (%edx,%ecx) 0xf x100 0xf100 (%edx,%ecx,4) 0xf *0x100 0xf400 0x80(,%edx,2) 2*0xf x80 0x1e080 0xf x8 = 0xf008 0xf x0100 = 0xf100 0xf *0x0100 = 0xf400 2*0xf x80 = 0x1d080

3.5 Arithmetic & Logical Operations
TRU-COMP2130 IA32

3.5.1 Load Effective Address
The load effective address instruction leal is a variant of the movl instruction. It has the form of an instruction that reads from memory to a register, but it does not reference memory at all. Just address computation. Example, If %edx contains value x and %ecx contains y, then leal 7(%edx, %edx, 4) %eax x + 4x + 7 leal 6(%eax), %edx ??? leal (%eax, %ecx, 4), %edx ??? leal 0xA(, %ecx, 4), %edx ??? TRU-COMP2130 IA32

Address Computation Instruction
Carnegie Mellon Address Computation Instruction leal Src,Dest Src is address mode expression Set Dest to address denoted by expression Uses Computing addresses without a memory reference E.g., translation of p = &x[i]; Computing arithmetic expressions of the form x + k*y k = 1, 2, 4, or 8 Example int mul12(int x) { return x*12; } Converted to ASM by compiler, assuming %eax has x: leal (%eax,%eax,2), %eax ;t <- x+2*x sall $2, %eax ;return t<<2

3.5.2,3 Unary, Binary, Shift Operations
TRU-COMP2130 IA32

Some Arithmetic Operations
Carnegie Mellon Some Arithmetic Operations Two Operand Instructions: Format Computation addl Src,Dest Dest = Dest + Src subl Src,Dest Dest = Dest  Src imull Src,Dest Dest = Dest * Src sall Src,Dest Dest = Dest << Src Also called shll sarl Src,Dest Dest = Dest >> Src Arithmetic shrl Src,Dest Dest = Dest >> Src Logical (filled with 0) xorl Src,Dest Dest = Dest ^ Src andl Src,Dest Dest = Dest & Src orl Src,Dest Dest = Dest | Src Watch out for argument order!

Some Arithmetic Operations
Carnegie Mellon Some Arithmetic Operations One Operand Instructions incl Dest Dest = Dest + 1 decl Dest Dest = Dest  1 negl Dest Dest = Dest notl Dest Dest = ~Dest See book for more instructions

Address Value Register Value
Practice Problem 3.7 Address Value Register Value 0x100 0xFF %eax 0x100 0x104 0xAB %ecx 0x1 0x108 0x13 %edx 0x3 0x10C 0x11 Instruction Destination Value addl %ecx, (%eax) imull $16, (%eax,%edx,4) decl %ecx shrl %edx, 4(%eax) TRU-COMP2130 IA32

3.5.4 TRU-COMP2130 IA32

Arithmetic Expression Example
Carnegie Mellon Arithmetic Expression Example arith: pushl %ebp movl %esp, %ebp movl 8(%ebp), %ecx movl 12(%ebp), %edx leal (%edx,%edx,2), %eax sall $4, %eax leal 4(%ecx,%eax), %eax addl %ecx, %edx addl 16(%ebp), %edx imull %edx, %eax popl %ebp ret Set Up int arith(int x, int y, int z) { int t1 = x+y; int t2 = z+t1; int t3 = x+4; int t4 = y * 48; int t5 = t3 + t4; int rval = t2 * t5; return rval; } <- x <- y Body <- z Finish

Understanding arith • 16 z 12 y 8 x 4 Rtn Addr Old %ebp
Carnegie Mellon Understanding arith • 16 z 12 y 8 x 4 Rtn Addr Old %ebp int arith(int x, int y, int z) { int t1 = x+y; int t2 = z+t1; int t3 = x+4; int t4 = y * 48; int t5 = t3 + t4; int rval = t2 * t5; return rval; } Offset %ebp movl 8(%ebp), %ecx # ??? movl 12(%ebp), %edx # ??? leal (%edx,%edx,2), %eax # ??? sall $4, %eax # ??? leal 4(%ecx,%eax), %eax # ??? addl %ecx, %edx # ??? addl 16(%ebp), %edx # ??? imull %edx, %eax # ???

Understanding arith • 16 z 12 y 8 x 4 Rtn Addr Old %ebp Stack
Carnegie Mellon Understanding arith • 16 z 12 y 8 x 4 Rtn Addr Old %ebp Stack int arith(int x, int y, int z) { int t1 = x+y; int t2 = z+t1; int t3 = x+4; int t4 = y * 48; int t5 = t3 + t4; int rval = t2 * t5; return rval; } Offset %ebp movl 8(%ebp), %ecx # ecx = x movl 12(%ebp), %edx # edx = y leal (%edx,%edx,2), %eax # eax = y*3 sall $4, %eax # eax *= 16 (t4) leal 4(%ecx,%eax), %eax # eax = t4 +x+4 (t5) addl %ecx, %edx # edx = x+y (t1) addl 16(%ebp), %edx # edx += z (t2) imull %edx, %eax # eax = t2 * t5 (rval)

Observations about arith
Carnegie Mellon Observations about arith Instructions in different order from C code Some expressions require multiple instructions Some instructions cover multiple expressions Get exact same code when compile: (x+y+z)*(x+4+48*y) int arith(int x, int y, int z) { int t1 = x+y; int t2 = z+t1; int t3 = x+4; int t4 = y * 48; int t5 = t3 + t4; int rval = t2 * t5; return rval; } movl 8(%ebp), %ecx # ecx = x movl 12(%ebp), %edx # edx = y leal (%edx,%edx,2), %eax # eax = y*3 sall $4, %eax # eax *= 16 (t4) leal 4(%ecx,%eax), %eax # eax = t4 +x+4 (t5) addl %ecx, %edx # edx = x+y (t1) addl 16(%ebp), %edx # edx += z (t2) imull %edx, %eax # eax = t2 * t5 (rval)

Another Example logical: pushl %ebp movl %esp,%ebp Set Up
Carnegie Mellon Another Example logical: pushl %ebp movl %esp,%ebp movl 12(%ebp),%eax xorl 8(%ebp),%eax sarl $17,%eax andl $8185,%eax popl %ebp ret Set Up int logical(int x, int y) { int t1 = x^y; int t2 = t1 >> 17; int mask = (1<<13) - 7; int rval = t2 & mask; return rval; } Body Finish movl 12(%ebp),%eax # eax = y xorl 8(%ebp),%eax # eax = x^y (t1) sarl $17,%eax # eax = t1>>17 (t2) andl $8185,%eax # eax = t2 & mask (rval)

Another Example logical: pushl %ebp movl %esp,%ebp Set Up
Carnegie Mellon Another Example logical: pushl %ebp movl %esp,%ebp movl 12(%ebp),%eax xorl 8(%ebp),%eax sarl $17,%eax andl $8185,%eax popl %ebp ret Set Up int logical(int x, int y) { int t1 = x^y; int t2 = t1 >> 17; int mask = (1<<13) - 7; int rval = t2 & mask; return rval; } Body Finish 213 = 8192, 213 – 7 = 8185 movl 12(%ebp),%eax # eax = y xorl 8(%ebp),%eax # eax = x^y (t1) sarl $17,%eax # eax = t1>>17 (t2) andl $8185,%eax # eax = t2 & mask (rval)

Can you make a C code from the above assembly code?
Carnegie Mellon Another Example logical: pushl %ebp movl %esp,%ebp movl 12(%ebp),%eax xorl 8(%ebp),%eax sarl $17,%eax andl $8185,%eax popl %ebp ret Set Up int logical(int x, int y) { } Body Finish Can you make a C code from the above assembly code?

3.6 Control TRU-COMP2130 IA32

3.6.1 Condition Codes TRU-COMP2130 IA32

Processor State (IA32, Partial)
Carnegie Mellon Processor State (IA32, Partial) Information about currently executing program Temporary data ( %eax, … ) Location of runtime stack ( %ebp,%esp ) Location of current code control point ( %eip, … ) Status of recent tests ( CF, ZF, SF, OF ) %eax %ecx %edx %ebx %esi %edi %esp %ebp General purpose registers Current stack top Current stack frame %eip Instruction pointer CF ZF SF OF Condition codes

Condition Codes (Implicit Setting)
Carnegie Mellon Condition Codes (Implicit Setting) Single bit registers CF Carry Flag (for unsigned) SF Sign Flag (for signed) ZF Zero Flag OF Overflow Flag (for signed) Implicitly set (think of it as side effect) by arithmetic operations Example: addl Src,Dest ↔ t = a+b CF set if carry out from most significant bit (unsigned overflow) ZF set if t == 0 SF set if t < 0 (as signed) OF set if two’s-complement (signed) overflow - (a>0 && b>0 && t<0) || (a<0 && b<0 && t>=0) Not set by lea instruction

Condition Codes (Explicit Setting: Compare)
Carnegie Mellon Condition Codes (Explicit Setting: Compare) Explicit Setting by Compare Instruction cmpl Src2, Src1 cmpl b,a like computing a-b without setting destination, i.e., compare a to b ZF set if (a == b) SF set if (a - b) < 0 (as signed, i.e., a < b) Jump instructions use these flags for controlling program execution, i.e., conditional branching. CF set if carry out from most significant bit (used for unsigned comparisons) OF set if two’s-complement (signed) overflow (a>0 && b<0 && (a-b)<0) || (a<0 && b>0 && (a-b)>0)

Condition Codes (Explicit Setting: Test)
Carnegie Mellon Condition Codes (Explicit Setting: Test) Explicit Setting by Test instruction testl Src2, Src1 testl b,a like computing a&b without setting destination Sets condition codes based on value of Src1 & Src2 Useful to have one of the operands be a mask ZF set when a&b == 0 SF set when a&b < 0

3.6.3,4 Jump & Conditional Branches
TRU-COMP2130 IA32

Jumping jX Instructions jX Condition Description
Carnegie Mellon Jumping jX Instructions Jump to different part of code depending on condition codes jX Condition Description jmp 1 Unconditional je ZF Equal / Zero jne ~ZF Not Equal / Not Zero js SF Negative jns ~SF Nonnegative jg ~(SFÔF)&~ZF Greater (Signed) jge ~(SFÔF) Greater or Equal (Signed) jl (SFÔF) Less (Signed) jle (SFÔF)|ZF Less or Equal (Signed) ja ~CF&~ZF Above (unsigned) jb CF Below (unsigned) after an instruction e.g., cmpX

Conditional Branch Example
Carnegie Mellon Conditional Branch Example int absdiff(int x, int y) { int result; if (x > y) { result = x-y; } else { result = y-x; } return result; absdiff: pushl %ebp movl %esp, %ebp movl 8(%ebp), %edx movl 12(%ebp), %eax cmpl %eax, %edx jle .L6 subl %eax, %edx movl %edx, %eax jmp .L7 .L6: subl %edx, %eax .L7: popl %ebp ret Setup x y Body1 Body2a Body2b Any good idea to use machine instructions for the above code? Can you rewrite the above code using goto statements? Finish Can you write C code?

C allows “goto” as means of transferring control
Carnegie Mellon int goto_ad(int x, int y) { int result; if (x <= y) goto Else; result = x-y; goto Exit; Else: result = y-x; Exit: return result; } absdiff: pushl %ebp movl %esp, %ebp movl 8(%ebp), %edx movl 12(%ebp), %eax cmpl %eax, %edx jle .L6 subl %eax, %edx movl %edx, %eax jmp .L7 .L6: subl %edx, %eax .L7: popl %ebp ret Body1 Setup Finish Body2b Body2a x y C allows “goto” as means of transferring control Closer to machine-level programming style Generally considered bad coding style in high-level programming.

int goto_ad(int x, int y) { int result; if (x <= y) goto Else;
Carnegie Mellon int goto_ad(int x, int y) { int result; if (x <= y) goto Else; result = x-y; goto Exit; Else: result = y-x; Exit: return result; } absdiff: pushl %ebp movl %esp, %ebp movl 8(%ebp), %edx movl 12(%ebp), %eax cmpl %eax, %edx jle .L6 subl %eax, %edx movl %edx, %eax jmp .L7 .L6: subl %edx, %eax .L7: popl %ebp ret Body1 Setup Finish Body2b Body2a x y

3.6.6 Conditional Move Instructions
TRU-COMP2130 IA32

3.6.5 Loops TRU-COMP2130 IA32

“Do-While” Loop Example
Carnegie Mellon “Do-While” Loop Example C Code Goto Version (if (…) goto …) int pcount_do(unsigned x) { int result = 0; do { result += x & 0x1; x >>= 1; } while (x); return result; } int pcount_do(unsigned x) { int result = 0; loop: result += x & 0x1; x >>= 1; if (x) goto loop; return result; } Count number of 1’s in argument x (“popcount”) Use conditional branch to either continue looping or to exit loop

“Do-While” Loop Compilation
Carnegie Mellon “Do-While” Loop Compilation Goto Version (if (…) goto …) Non-goto Version (if (…) goto …) int pcount_do(unsigned x) { int result = 0; loop: result += x & 0x1; x >>= 1; if (x) goto loop; return result; } int pcount_do(unsigned x) { int result = 0; do { result += x & 0x1; x >>= 1; } while (x); return result; } movl $0, %ecx # result = 0 .L2: # loop: movl %edx, %eax andl $1, %eax # t = x & 1 addl %eax, %ecx # result += t shrl %edx # x >>= 1 jne .L2 # If !0, goto loop Registers: %edx x %ecx result

General “Do-While” Translation
Carnegie Mellon General “Do-While” Translation C Code Goto Version (if (…) goto …) do Body while (Test); loop: Body if (Test) goto loop Body: Test returns integer = 0 interpreted as false ≠ 0 interpreted as true { Statement1; Statement2; … Statementn; }

“While” Loop Example C Code Goto Version (if (…) goto …)
Carnegie Mellon “While” Loop Example C Code Goto Version (if (…) goto …) int pcount_while(unsigned x) { int result = 0; while (x) { result += x & 0x1; x >>= 1; } return result; int pcount_do(unsigned x) { int result = 0; if (!x) goto done; loop: result += x & 0x1; x >>= 1; if (x) goto loop; done: return result; } Is this code equivalent to the do-while version? Must jump out of loop if test fails

General “While” Translation
Carnegie Mellon General “While” Translation While version while (Test) Body Goto Version Do-While Version if (!Test) goto done; loop: Body if (Test) goto loop; done: if (!Test) goto done; do Body while(Test); done:

“For” Loop Example C Code Is this code equivalent to other versions?
Carnegie Mellon “For” Loop Example C Code #define WSIZE sizeof(int) int pcount_for(unsigned x) { int i; int result = 0; for (i = 0; i < WSIZE; i++) { unsigned mask = 1 << i; result += (x & mask) != 0; } return result; Is this code equivalent to other versions?

for (Init; Test; Update )
Carnegie Mellon “For” Loop Form Init i = 0 General Form Test for (Init; Test; Update ) Body i < WSIZE Update i++ for (i = 0; i < WSIZE; i++) { unsigned mask = 1 << i; result += (x & mask) != 0; } Body { unsigned mask = 1 << i; result += (x & mask) != 0; }

for (Init; Test; Update )
Carnegie Mellon “For” Loop  While Loop For Version for (Init; Test; Update ) Body While Version Init; while (Test ) { Body Update; }

“For” Loop  …  Goto For Version While Version Init; if (!Test)
Carnegie Mellon “For” Loop  …  Goto Init; if (!Test) goto done; loop: Body Update if (Test) goto loop; done: For Version for (Init; Test; Update ) Body While Version Init; while (Test ) { Body Update; } Init; if (!Test) goto done; do Body Update while(Test); done:

“For” Loop Conversion Example
Carnegie Mellon “For” Loop Conversion Example Goto Version C Code int pcount_for_gt(unsigned x) { int i; int result = 0; i = 0; if (!(i < WSIZE)) goto done; loop: { unsigned mask = 1 << i; result += (x & mask) != 0; } i++; if (i < WSIZE) goto loop; done: return result; #define WSIZE sizeof(int) int pcount_for(unsigned x) { int i; int result = 0; for (i = 0; i < WSIZE; i++) { unsigned mask = 1 << i; result += (x & mask) != 0; } return result; Init !Test Body Update Test

int fun_b(unsigned x) { // x at %ebp+8
Practice Problem 3.23 int fun_b(unsigned x) { int val = 0; int i; for ( _ ; _ ; ) { _____________ } return val; // x at %ebp+8 movl 8(%dbp), %ebx movl $0, %eax movl $0, %ecx .L13: leal (%eax, %eax), %edx movl %ebx, %eax andl $1, %eax orl %edx, %eax shrl %ebx addl $1, %ecx cmpl $32, %ecx jne .L13 TRU-COMP2130 IA32

Practice Problem 3.24 int sum = 0; int i;
for (i = 0; i < 10; i++) { if (i & 1) continue; sum += 1; } TRU-COMP2130 IA32

3.7 Procedures TRU-COMP2130 IA32

IA32 Stack Stack “Bottom” Stack Pointer: %esp Stack “Top”
Carnegie Mellon IA32 Stack Stack Pointer: %esp Stack Grows Down Increasing Addresses Stack “Top” Stack “Bottom” Region of memory managed with stack discipline Grows toward lower addresses Register %esp contains lowest stack address address of “top” element

IA32 Stack: Push Stack “Bottom” Stack Pointer: %esp Stack “Top”
Carnegie Mellon IA32 Stack: Push Stack “Bottom” pushl Src Fetch operand at Src Decrement %esp by 4 Write operand at address given by %esp Increasing Addresses Stack Grows Down Stack Pointer: %esp Stack “Top” -4

IA32 Stack: Pop Stack “Bottom” Stack Pointer: %esp Stack “Top”
Carnegie Mellon IA32 Stack: Pop Stack “Bottom” Increasing Addresses Stack Grows Down +4 Stack Pointer: %esp Stack “Top”

Procedure Control Flow
Carnegie Mellon Procedure Control Flow Use stack to support procedure call and return Procedure call: call label, consisting of Push return address on stack Jump to label How to jump? What does “jump” really mean? Return address: Address of the next instruction right after call Example from disassembly 804854e: e8 3d call b90 <main> : pushl %eax Return address = 0x Procedure return: ret, consisting of Pop address from stack Jump to address

Procedure Call Example
Carnegie Mellon Procedure Call Example 804854e: e8 3d call b90 <main> : pushl %eax Push … Jump … call 8048b90 0x110 0x110 0x10c 0x10c 0x108 123 0x108 123 0x104 0x %esp 0x108 %esp 0x104 %eip 0x804854e %eip 0x8048b90 %eip: the name of program counter (PC)

Procedure Return Example
Carnegie Mellon Procedure Return Example : c ret Pop … Jump … ret 0x110 0x110 0x10c 0x10c 0x108 123 0x108 123 0x104 0x 0x %esp 0x104 %esp 0x108 %eip 0x %eip 0x %eip: program counter

Stack-Based Languages
Carnegie Mellon Stack-Based Languages Languages that support recursion e.g., C, Pascal, Java Code must be “Reentrant” Multiple simultaneous instantiations of single procedure Need some place to store state of each instantiation Arguments (i.e., paramenters) Local variables Return pointer Stack discipline State for given procedure needed for limited time From when called to when return Callee returns before caller does Stack allocated in Frames Frame: the portion of the stack allocated for a single procedure instantiation

Call Chain Example Example Call Chain yoo(…) { • who(); } yoo who(…) {
Carnegie Mellon Call Chain Example Example Call Chain yoo(…) { • who(); } yoo who(…) { • • • amI(); } who amI(…) { • amI(); } amI amI amI amI Procedure amI() is recursive

Stack Frames Stack “Top” Previous Frame Contents Frame for proc
Carnegie Mellon Stack Frames Previous Frame Frame for proc Contents Local variables Return information Temporary space Management Space allocated when enter procedure “Set-up” code Deallocated when return “Finish” code Frame Pointer: %ebp Stack Pointer: %esp Stack “Top”

Example Stack yoo yoo yoo(…) %ebp { • yoo who(); who %esp } amI amI
Carnegie Mellon Example Stack yoo yoo yoo(…) { • who(); } %ebp %esp yoo who amI amI amI amI

Example Stack yoo who yoo(…) { • who(); } yoo who(…) { • • • amI(); }
Carnegie Mellon Example Stack yoo who yoo(…) { • who(); } yoo who(…) { • • • amI(); } yoo who %ebp %esp amI amI amI amI

Example Stack yoo who amI yoo(…) { • who(); } yoo who(…) { • • •
Carnegie Mellon Example Stack yoo who amI yoo(…) { • who(); } yoo who(…) { • • • amI(); } yoo amI(…) { • amI(); } who amI amI %ebp %esp amI amI

Carnegie Mellon Example Stack yoo who amI yoo(…) { • who(); } yoo who(…) { • • • amI(); } yoo amI(…) { • amI(); } who amI(…) { • amI(); } amI amI amI %ebp %esp amI

Carnegie Mellon Example Stack yoo who amI yoo(…) { • who(); } yoo who(…) { • • • amI(); } yoo amI(…) { • amI(); } who amI(…) { • amI(); } amI amI amI(…) { • amI(); } amI amI %ebp %esp

Carnegie Mellon Example Stack yoo who amI yoo(…) { • who(); } yoo who(…) { • • • amI(); } yoo amI(…) { • amI(); } who amI(…) { • amI(); } amI amI amI %ebp %esp amI

Example Stack yoo yoo %ebp yoo(…) yoo { • who %esp who(); } amI amI
Carnegie Mellon Example Stack yoo yoo %ebp %esp yoo(…) { • who(); } yoo who amI amI amI amI

Parameters for the callee
Carnegie Mellon IA32/Linux Stack Frame Current Stack Frame (“Top” to Bottom) contains “Argument build:” Parameters for another function about to call Local variables If can’t keep in registers Saved register context Old frame pointer Caller Stack Frame contains Return address Pushed by call instruction Arguments for this call Caller Frame Arguments Parameters for the callee Frame pointer %ebp Return Addr Old %ebp Saved Registers + Local Variables Current Frame Argument Build Stack pointer %esp

Calling swap from call_swap
Carnegie Mellon Revisiting swap Calling swap from call_swap int course1 = 15213; int course2 = 18243; void call_swap() { swap(&course1, &course2); } call_swap: • • • subl $8, %esp movl $course2, 4(%esp) movl $course1, (%esp) call swap • Resulting Stack void swap(int *xp, int *yp) { int t0 = *xp; int t1 = *yp; *xp = t1; *yp = t0; } %esp &course2 subl &course1 %esp call Rtn adr %esp

Revisiting swap swap: pushl %ebp movl %esp, %ebp pushl %ebx
Carnegie Mellon Revisiting swap swap: pushl %ebp movl %esp, %ebp pushl %ebx movl 8(%ebp), %edx movl 12(%ebp), %ecx movl (%edx), %ebx movl (%ecx), %eax movl %eax, (%edx) movl %ebx, (%ecx) popl %ebx popl %ebp ret Set Up void swap(int *xp, int *yp) { int t0 = *xp; int t1 = *yp; *xp = t1; *yp = t0; } Body Finish

swap Setup #1 Entering Stack Resulting Stack • %ebp • %ebp &course2 yp
Carnegie Mellon swap Setup #1 Entering Stack Resulting Stack • %ebp • %ebp &course2 yp &course1 xp Rtn adr %esp Rtn adr Old %ebp %esp swap: pushl %ebp movl %esp,%ebp pushl %ebx

swap Setup #2 Entering Stack Resulting Stack • %ebp • &course2 yp
Carnegie Mellon swap Setup #2 Entering Stack Resulting Stack • %ebp • &course2 yp &course1 xp Rtn adr %esp Rtn adr %ebp Old %ebp %esp swap: pushl %ebp movl %esp,%ebp pushl %ebx

swap Setup #3 Entering Stack Resulting Stack • %ebp • &course2 yp
Carnegie Mellon swap Setup #3 Entering Stack Resulting Stack • %ebp • &course2 yp &course1 xp Rtn adr %esp Rtn adr Old %ebp %ebp Old %ebx %esp swap: pushl %ebp movl %esp,%ebp pushl %ebx

Offset relative to %ebp
Carnegie Mellon swap Body Entering Stack Resulting Stack • %ebp • Offset relative to %ebp &course2 12 yp &course1 8 xp Rtn adr %esp 4 Rtn adr Old %ebp %ebp Old %ebx %esp movl 8(%ebp),%edx # get xp movl 12(%ebp),%ecx # get yp . . .

swap Finish Observation Stack Before Finish Resulting Stack
Carnegie Mellon swap Finish Stack Before Finish Resulting Stack yp xp Rtn adr Old %ebp %ebp • %esp Old %ebx • %ebp popl %ebx popl %ebp ret yp xp Rtn adr %esp Observation Saved and restored register %ebx Not so for %eax, %ecx, %edx

Register Saving Conventions
Carnegie Mellon Register Saving Conventions When procedure yoo calls who: yoo is the caller who is the callee Can register be used for temporary storage? Contents of register %edx overwritten by who This could be trouble ➙ something should be done! Need some coordination yoo: • • • movl $15213, %edx call who addl %edx, %eax ret who: • • • movl 8(%ebp), %edx addl $18243, %edx ret

Register Saving Conventions
Carnegie Mellon Register Saving Conventions When procedure yoo calls who: yoo is the caller who is the callee Can register be used for temporary storage? Conventions “Caller Save” Caller saves temporary values in its frame before the call “Callee Save” Callee saves temporary values in its frame before using

IA32/Linux+Windows Register Usage
Carnegie Mellon IA32/Linux+Windows Register Usage %eax, %edx, %ecx Caller saves prior to call if values are used later %eax also used to return integer value %ebx, %esi, %edi Callee saves if wants to use them %esp, %ebp special form of callee save Restored to original values upon exit from procedure %eax Caller-Save Temporaries %edx %ecx %ebx Callee-Save Temporaries %esi %edi %esp Special %ebp

Introduction to Assembly Language IA32

Similar presentations

Presentation on theme: "Introduction to Assembly Language IA32"— Presentation transcript:

Similar presentations

About project

Feedback

Log in

Auth with social network:

Introduction to Assembly Language IA32

Similar presentations

Presentation on theme: "Introduction to Assembly Language IA32"— Presentation transcript:

Similar presentations

About project

Feedback