1. CS/COE 0447 Jarrett Billingsley
Controlling the PC
CS/COE 0447
Jarrett Billingsley

2. Class announcements
scromble
CS447

3. What is machine code?
CS447

4. Something denser
text is human-oriented and informationally… sparse.
instead, we encode each instruction as a bitfield.
this encoding is specified by the ISA.
MIPS has three instruction formats.
the opcode (and funct) field identifies which instruction it is. 31 26 25 21 20 16 15 11 10 6 5
opcode rs rt rd
shamt
funct
add rd,rs,rt R
sll rd,rs,shamt I 31 26 25 21 20 16 15
opcode rs rt
immediate
beq rs,rt,offset
- even if each letter is only 1 byte, each textual instruction would be huge.
- every ISA has its own format(s).
- so you don't need to memorize these formats…
- christ why do they teach this. it's useless. J 31 26 25
opcode
target
jal target
CS447

5. How does it… do the thing?
well this is mostly next lecture, but…
ALU
Register File WE rd rs rt
the fields are used as the control signals to the CPU's components.
add t0, t1, t2 1
"add"
gets encoded as… 31 26 25 21 20 16 15 11 10 6 5
000000
01001
01010
01000
00000
100000
CS447

6. How It's Made
CS447

7. okay, there's clearly a little more going on under the hood…
What's an assembler?
that's pretty obvious by now
Address
Instruction 0x 0x 0x 0x 0x
0x0C100008
0x C 0x 0x
0x2A010005 0x
0x1420FFFB 0x
0x A
0x C
0x C 0x 0x 0x 0x
0x03E00008
li s0, 0
top:
move a0, s0
jal print_int
add s0, s0, 1
blt s0, 5, top
li v0, 10
syscall
print_int:
li v0, 1
jr ra
assembler!
okay, there's clearly a little more going on under the hood…
CS447

8. lol but what about labels and the data segment
How it works
an assembler is a pretty simple program
see an instruction, output its encoding
add s0, s0, 1
this is an I-type instruction
splut
the opcode field is 8 0x
s0 is register 16
the encoding of 1 is 0x0001
lol but what about labels and the data segment
opcode rs rt
imm 8 16 1
CS447

9. How it actually works (animated)
.data
x: .word 0xDEADBEEF
y: .word 5
z: .word 0x
.text
li s0, 0
top:
move a0, s0
jal print_int
add s0, s0, 1
blt s0, 5, top
li v0, 10
syscall
print_int:
li v0, 1
jr ra
Labels
.text
.data
x: .data:0 0:
0: DEADBEEF
y: .data:4 4: 4:
z: .data:8
8: 0c000008
8: 0c000000 8:
top: .text:4 C:
print_int:
.text:20
10: 2A010005
14: 1420FFFB
18: A
1C: C
pseudo-op!
20:
Fixups
24: C
28: 03E00008
8: print_int
then, run through the fixups!
CS447

10. (object files are vegan)
Yum yum
if a label doesn't exist, it's an error.
now we have machine code!
it's packaged up into a casing: an object file
then the object files are linked
and then you get an executable program
this is CS0449 stuff!
(object files are vegan)
CS447

11. AST (Abstract Syntax Tree)
AAAAAAAAAAAAA AAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA
What about compilers?
ahahaha oh they're a lot more complicated
AST (Abstract Syntax Tree)
Function
ret_type: int
name: "main"
args: [
{type: int, name: "argc"},
{type: ptr(ptr(char)),
name: "argv"} ] if
<
argc 2
call
fatal
"gimme arguments" …
int main(int argc, char** argv) {
if(argc < 2)
fatal("gimme arguments");
else {
... }
parsing!
lexing!
KEYWORD("int"),
ID("main"),
LPAREN,
KEYWORD("int"),...
Tokens
semantic analysis!
intermediate representation translation!
mysterious bullshit
CS447

12. code goes in, sausage object files come out
It's just a grinder.
all that really matters:
plop
some compilers output assembly and rely on an assembler to produce machine code
/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\
hello.c
compiler!!!
bloop
these days, it's common for the compiler itself to produce machine code, or some kind of platform-independent assembly code
code goes in, sausage object files come out
CS447

13. Jumps and Branches
CS447

14. Maybe you never noticed…
the control flow instructions are divided into two groups.
jumps make execution go to one specific place
branches make execution go to one of two places
j end
bne s1, t0, top
but.. why?
well, notice the operands of each.
CS447

15. A matter of practicality
each jump or branch has a target: where it goes to
we'd like to be able to encode any target address…
but we have a fixed number of bits to encode our instructions.
think about the cases where jumps are used.
now think about the cases where branches are used.
some_function()
if(...) {}
while(...) {}
return;
while(true) {}
for(...) {}
how far away is a jump target likely to be?
- jump targets might be far, far away – functions can be anywhere in the assembled program.
- branch targets are often very nearby – only a few dozen instructions away.
how far away is a branch target likely to be?
CS447

16. Absolute versus Relative
we say that jumps are absolute and branches are relative.
top:
move a0, s0
jal print_int
add s0, s0, 1
blt s0, 5, top
...
jumps just set the PC to a new value.
PC = 0x800400B0
PC += (-4)
branches either add an offset to the PC or do nothing.
jumps need a long address, but branches only need a small offset. so we can fit them into J and I instructions!
CS447

17. More bang for your buck 0x78000000
every MIPS instruction is 4 bytes
what's memory alignment again?
Address in hex
and in binary 0x 0x 0x
0x C
what do you notice about these low 2 bits?
in binary, multiples of 4 always end in 00
- the address of an n-byte value must be a multiple of n.
- no. no, we don't.
since every instruction's address ends in 00, do we need to store it?
CS447

18. The PC
CS447

19. Remember this? li s0, 0 print_int: top: li v0, 1 move a0, s0 syscall
jal print_int
add s0, s0, 1
blt s0, 5, top
li v0, 10
syscall
print_int:
li v0, 1
syscall
jr ra
we gotta know what instruction is next in order to fetch it from memory
this is the PC's job
CS447

20. These boots are made for walking
moving ahead by 1 instruction after each cycle is easy enough. PC +
size of one instruction
how big are instructions in MIPS again?
- they're 4 bytes!!!!!!!!! GOSH!!!!!!!!!!!!
CS447

21. And that's just what they'll do
jumps (j, jal) put a constant value into the PC
well now we have two choices of where to go after each instruction.
how do we choose?
size of one instruction + PC
jump target
PC Source
PC Source (PCSrc for short) is a control signal. many control signals are just MUX selectors
CS447

22. opcode target MIPS jump targets 00100004 WHAT DO?? 31 26 25
in MIPS, j and jal use the J-type instruction format: 31 26 25
opcode
target
this is 26 bits…
…but the PC is 32 bits.
WHAT DO??
CS447

23. Do we really need a full 32-bit address (no)
we don't need to store the lower 2 bits because of alignment.
most programs are nowhere near big enough to need 32-bit addrs.
so in MIPS, jumps only change the lower 28 bits of the PC.
here's a jal. 31 26 25
000011
0x243C007 PC
790F001C
<< 2
0x90F001C
put that into the low 28 bits of the PC
- it means you can't do it with a j-type instruction!
- the assembler will just not allow you to (it'll say something about "exceeds 26 bit range")
- in these very rare cases, you'd have to load the address as an immediate into a register, and use jr.
what does this mean if the thing you're jumping to is too far away?
CS447

24. if you want to get here, what do you have to add to 10?
Relative branches
think about a number line.
you are here 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
if you want to get here, what do you have to add to 10?
how about here?
what's the pattern?
destination - source
where you want to be, minus where you are.
CS447

25. target – (branch address + 4) = 12 – (0 + 4) = 8
MIPS branch offsets
in MIPS, the PC always points to the next instruction to run.
let's say we're running the beq here. it's at address 00…
00: beq a0, 10, else
04: li v0, 0
08: b end
else: 0C: li v0, 1
end: 10: ...
…but the PC is here. PC
we want to get to address 0C.
how do we get there?
PC += 8
the branch offset for this beq is:
target – (branch address + 4) = 12 – (0 + 4) = 8
CS447