1. Arrays, Control flow, and Loops
CS/COE 0447
Jarrett Billingsley

2. Class announcements
mmmmmmmm no
CS447

3. Address Calculation
CS447

4. Strings, arrays, objects…
when we wanted to store 4-byte values…
we split them up across consecutive bytes
what about a string?
how is a string represented?
how many bytes is a string?
any array might be that big too
the solution to storing it in memory is the same
but how do you access these big things?
Addr
0000
0001
0002
0003
0004
0005
0006
0007
0008
0009
000A
000B
000C
000D
Val 00 30 04 DE C0 EF BE 6C 34 01 02 03
- a string is a sequence of individual character values…
- …but a string can be any size, even millions or billions of characters
CS447

5. What's an array, really byte[] arr = {1, 2, 3, 4, 5, ...};
if we did this in C or Java:
byte[] arr = {1, 2, 3, 4, 5, ...};
in memory it might look like this
what memory address is arr[0] at?
what about arr[1]?
what about arr[2]?
what about arr[3]?
let's generalize. if an array starts at memory address A…
…then item i is at address…
A + i
that's true, but it's only part of the answer
Addr
Val
...
F405 06
F404 05
F403 04
F402 03
F401 02
F400 01
- I will try to be consistent in having memory addresses increasing upwards
- this makes the stack grow "down" as we expect and makes little-endian values "look right"
- arr[0] is at 0xF400, arr[1] is at 0xF401, arr[2] is at 0xF402…
- generally, arr[i] is at 0xF400 + i
CS447

6. well sort of int[] arr = {1, 2, 3}; if we did this:
in memory it'd look like this
why are there all these 0s?
what endianness is being used here?
what memory address is arr[1] at? arr[2]?
what would the next address be?
if an array starts at memory address A…
…and each item is B bytes long…
…then item i is at address A + Bi
on the last slide, B happened to be 1
Addr
Val
F40B 00
F40A
F409
F408 03
F407
F406
F405
F404 02
F403
F402
F401
F400 01
- the 0s are because ints are (often) 4 bytes, so the whole numbers are 0x , 0x , etc
- this is little-endian, as the little end (the smallest byte) comes first
- arr[1] is at 0xF404, arr[2] is at 0xF408
- the next address would be at 0xF40C (C = 12)
CS447

7. How do you eat an elyphant?
if you wanna print all the values in an array, how do??
for(int i = 0; i < length; i++)
print(data[i]);
let's focus on ^this bit^ for now
data is an array of words, so how big is each item?
in this calculation, what is A? B? i?
so what's the address calculation?
address of item i = data + (i * 4)
do you think you could convert that bit into assembly?
- each word is 32 bits, or 4 bytes
- A is the address of the beginning of the array (data) - B is 4
- i is…………. i
CS447

8. Arrays in MIPS
CS447

9. Making arrays in MIPS
first you need to make space for it just like a variable
for a small array you can list all the values:
little_array: .word 1, 2, 3, 4
but for a big array, that would be annoying
so you can write:
big_array: .word 0xBEEFC0DE:100
this fills the array with 100 copies of 0xBEEFC0DE
notice how similar these look to variables
(that's cause there's not really any difference)
- an array is, conceptually, a bunch of individual variables that "live next to each other" in memory
CS447

10. MIPS ISA: putting an address in a register
if the address calculation needs the address of the array…
we've gotta get that address into a register, right?
this is what the la instruction does
la t0, little_array
la means load address
it doesn't load anything from memory.
what it does: t0 now contains little_array's address
- we can't do "A + Bi" unless we have "A" in a register, and "A" is the starting address
- remember, the assembler is the one coming up with the addresses whenever we use a label to make something
- la is kind of a special form of li – it's putting a constant in the register, but the constant happens to be the address of something
- all "load" instructions have in common is "they put something in a register"
- this was a poor choice of name on the MIPS designers' part, IMO
CS447

11. Intermission: Data transfer
let's get a handle on the data transfer instructions so far
registers
memory
li v0, 10
la t0, arr
lw, lh, lhu, lb, lbu
sw, sh, sb
- data transfer = copying data around
- computers alllllways copyyyyyyyy, there is no such thing as "moving" something – there's no such thing as a "data vacuum"
- so DRM technologies that try to make things artificially scarce are just… an abomination? the worst?
CS447

12. Accessing arrays in MIPS (let's do it together)
we want to print out the value in little_array[3].
what's the address calculation?
now turn that into MIPS
let's come up with the instructions first
and then decide which registers to use
how do we put the address of little_array in a register?
now to translate the math
now we have the address; how do we get the value?
how do we print it out?
if we want to store a value into the array…
we just use a store instruction instead of a load
- see the "arrays.asm" example for the result of this little exercise
CS447

13. How does the CPU know that t0 holds an address?
WHAT DO YOU THINK
IT DOESN'T
addresses are just numbers too!!
which means we can do math on addresses
which we just did!
like that's how arrays and strings and objects and stuff work
you can also have a variable whose value is an address
these are……. pointers in C
(& is like la, * is like lw/sw)
CS447

14. Don't step on the crack (alignment)
let's remove the mul instruction
"fetch address not aligned on word boundary"?
in MIPS, all memory accesses must be aligned
alignment is just:
the address of an n-byte value must be a multiple of n
whyyyy do we align values?
very long, complicated story short: it's faster
that's it, that's all, there's nothing more to it
Addr
Val
F40B 00
F40A
F409
F408 03
F407
F406
F405
F404 02
F403
F402
F401
F400 01
- REMEMBER THE DEFINITION!!!!!!!!!! OKAY?????????????????????
- Good to remember that multiples of 4 in hex go 0, 4, 8, C, 0, 4, 8, C…
CS447

15. Control flow
CS447

16. With great power…
control flow is the order that your instructions run in
what kinds of control flow statements do you know of?
what about functions?
WELLLLLLLLLLLLLLLLLLLLLLLLLLLLLLL
in asm, the only thing you get for free is that instructions run in order
you're responsible for coming up with everything else.
if you screw up your control flow, the CPU doesn't care
you'll just have a broken, malfunctioning program
and it'll be half an hour before the lab is due
and you'll be sad
this is like 90% of the bugs I've seen
- things like if/else/switches, while/do-while/for loops, break/continue, function calls/return
- control flow is probably the hardest part to get right in assembly. no joke
CS447

17. if(x == w - 1) { do_thing() } else { other_thing() } third_thing()
Building blocks
a basic block is a chunk of code that has no control flow in it
control flow statements separate basic blocks
x == w - 1?
if(x == w - 1) {
do_thing()
} else {
other_thing() }
third_thing()
other_thing
do_thing
third_thing
- basic blocks come up a lot in compilers, virtual machines, reverse engineering, that kinda stuff
thinking about this is REAL HELPFUL
CS447

18. TRANSLATE THE CONTROL FLOW
How to approach it
WRITE PSEUDOCODE
if(x == w - 1) {
do_thing()
} else {
other_thing() }
IGNORE THE CRAP INSIDE
TRANSLATE THE CONTROL FLOW
TO ASM FIRSTTTTTTTTT
- SERIOUSLY.
- control flow is like the foundation or skeleton of your code.
- once you lay it down, it's much easier to add the basic block code inside.
CS447

19. essentially…
the way control flow works in asm is you make basic blocks
you gotta name (label) them
then, you use control flow instructions to choose where to go
"which basic block runs next?"
that's the question you need to ask yourself for this stuff
the CPU will always execute the next instruction, unless you explicitly tell it otherwise
THE CPU DOES NOT SEE YOUR LABELS.
a label does not end a basic block. a control flow instruction does.
or, the absence of one will cause the next basic block to run.
- if some code is acting weird, and you don't know why it's executing something…
- step through one instruction at a time.
- usually, it's because you forgot to account for one possible branch in the control flow graph.
CS447

20. Loops
CS447

21. Getting a little further from familiarity
all control flow is done with branches and jumps
these are instructions which say "go somewhere else"
for example…
main_loop:
# clear screen
# draw one thing
# sleep
# draw another thing
# etc
j main_loop
this is an infinite loop, which is sometimes useful but not too interesting
j stands for "jump" – go somewhere else
- "branch" means "go to an instruction a certain distance away" while "jump" means "go to a specific instruction"
- but when you're programming in assembly, they kinda look the same
- but we'll learn that they work differently inside the CPU.
- 'b' is a synonym for 'j' – they both unconditionally go to the given label
CS447

22. MIPS ISA: conditional branch instructions
conditional branch instructions do one of two things:
if the condition is met, we go to the label
otherwise, nothing happens, and we go to the next instruction
Instruction
Meaning
beq a, b, label
if(a == b) { goto label }
bne a, b, label
if(a != b) { goto label }
blt a, b, label
if(a < b) { goto label }
ble a, b, label
if(a <= b) { goto label }
bgt a, b, label
if(a > b) { goto label }
bge a, b, label
if(a >= b) { goto label }
- if the condition is false, they do absolutely nothing; the CPU ignores it entirely
- so look after your conditional branches and ask yourself, "is this where I want to go if the condition was false?"
- and remember that labels mean nothing!
- EQual, Not Equal, Less Than, Less or Equal, Greater Than, Greater or Equal
above, a must be a register, but b can be a register or number
CS447

23. A simple conditional loop (animated)
something like this…
if s2<10, where do we go?
what are the basic blocks?
cond:
body
which conditional branch?
blt s2, 10, ____
while(s2 < 10) {
// stuff!! }
// more stuff
j end
if s2≥10, where do we go?
body:
# stuff!!
j cond
how to go back up to the top?
end:
# more stuff
we NEED THIS – the CPU doesn't see/care about your labels!!
CS447