Memory Basics and Assembly Programs by Nicole Tobias Adapted from text: LINUX Assembly Programming by Neveln Appendix C from Computer Organization and Design by Patterson and Hennessey
Basics of Memory Layout In all computers, main memory is organized as a rectangle of bits. Ex. A tiny six bit by four bit memory: Address Each row is called a word Words 5 1010 4 1111 3 1000 2 0000 1 1100 0 0111 Transfers of data are done a word at a time, or in multiples of words
Memory Basics The number of bits in a word is called word size Last example, would be said to have four-bit words Each word in this example memory holds a number representable in four binary digits. For example, a processor requesting the word located at the address 3 would be given the number 8. When designing a chess playing computer, for example (again), it would be a good idea to use 64-bit words One bit for each location on the chess board.
Words Words in memory are numbered consecutively, starting from zero. These numbers are called addresses A computer with n words will have addresses from 0 through n-1. The total capacity of a computer memory is the number of words in the memory times the word size (length times width) Note: Memory capacity is often measured in bytes instead of bits.
Basics and Storing Words in Memory Each address stores one element of the memory "array". typically one byte. There are some memory configurations where each address stores something besides a byte. For example, you might store a nybble or a bit. I will sometimes say that memory is byteaddressable. This is just a fancy way of saying that each address stores one byte. If I say memory is nybble-addressable, that means each memory address stores one nybble.
Storing Words in Memory We ll defined a word to mean 32 bits. This is the same as 4 bytes. Why would we care about 32 bits? Integers, single-precision floating point numbers, and MIPS instructions are all 32 bits long. How can we store these values into memory? After all, each memory address can store a single byte, not 4 bytes. The answer is simple.
Storing Words in Memory We split the 32 bit quantity into 4 bytes. For example, suppose we have a 32 bit quantity, written as 90AB12CD 16, which is hexadecimal. Since each hex digit is 4 bits, we need 8 hex digits to represent the 32 bit value. So, the 4 bytes are: 90, AB, 12, CD where each byte requires 2 hex digits. It turns out there are two ways to store this in memory.
Little Endian vs Big Endian For example, suppose we have a 32 bit quantity, written as 90AB12CD 16 In little endian, you store the least significant byte in the smallest address. In big endian, you store the most significant byte in the smallest address. Address Value 1003 90 1002 AB 1001 12 1000 CD Address Value 1003 CD 1002 12 1001 AB 1000 90
Which way makes sense? Different ISAs use different endianness. While one way may seem more natural to you (most people think big-endian is more natural), there is justification for either one. For example, IBMs(?) are little endian, while Motorolas and Suns are big endian. MIPS processors allowed you to select a configuration where it would be big or little endian.
Why is Endianness so important? Suppose you are storing int values to a file, then you send the file to a machine which uses the opposite endianness and read in the value. You'll run into problems because of endianness. You'll read in reversed values that won't make sense.
Why is Endianness so important? Endianness is also a big issue when sending numbers over the network. Again, if you send a value from a machine of one endianness to a machine of the opposite endianness, you'll have problems. This is even worse over the network, because you might not be able to determine the endianness of the machine that sent you the data.
Heaps and Stacks
Memory Layout (Big Picture)
The Stack A visual representation of the way memory is stored Works from top down Uses: 1. Temporary storage of data 2. Parameter passing 3. Holding subprogram temporary variables Operations: push and pop
Assembly BoilerPlate [main: push ebp mov ebp, esp push ebx push esi push edi ;;; Your code here ] pop edi pop esi pop ebx mov esp, ebp pop ebp ret
Linux Demo Accessing a LinuxVM Creating your first program VIM Compiling your first program Running your first program
Assembly Language Process: Compile-Assemble-Link to machine lang Machine Language is platform dependent Assembly language format: mnemonic-operand(s) Mnemonic is the instruction Operand(s) are the item(s) manipulated
Instructions A few basic instructions that we will be using: mov add jmp
Instructions (cont.) mov Format: mov destination, source Data is source is copied to destination mov is the mnemonic destination and source are the operands add Format: add destination, source1, source2 add source1 and source2 and place the results in destination
Instructions (cont.) jmp Format: jmp label continue execution of the program at the line named label
Memory in NASM Bit smallest data item Nybble 4 bits Byte 8 bits or 2 nybbles Word 2 bytes Double word 4 bytes Quad word 8 bytes Paragraph 16 bytes
Reserving Memory Examples L1 db 0 ;byte labeled L1 with initial value 0 L2 dw 1000 ;word labeled L2 with initial value 1000 L3 db 110101b ;byte initialized to binary 110101 L4 db 12h ;byte initialized to hex 12 L5 db 17o ;byte initialized to octal 17 L6 dd 1A92h ;double word initialized to hex 1A92 L7 resb 1 ;1 un-initialized byte L8 db A ;byte initialized to ASCII for A (65) L9 db 0, 1, 2, 3 ;defines 4 bytes L10 db w, o, r, d, 0 ;defines a C string = word L11 db word, 0 ;same as L10 L12 times 100 db 0 ;equivalent to 100 (db 0) s L13 resw 100 ;reserve room for 100 words
Registers CPU data manipulation EAX, EBX, ECX, EDX general purpose Pointer Registers ESI, EDI and general purpose Stack EBP and ESP Segment Registers CS (code), DS (data), SS (stack), ES (extra) temporary register
Registers Program instruction pointer EIP Flag status EFLAGS Floating point manipulation floating point registers (see page 7 Carter)
Registers ESP Stack pointer EBP base pointer ESI index/general purpose EDI index/general purpose EAX counter for procedures (success =1, fail = 0)
Stack Frame Stack Frame contains the parameters, return information and local variables The area in stack memory between the base pointer EBP and the stack pointer ESP Created by pushing EBP to the stack and moving ESP into EBP. EBP is considered the anchor of the new stack frame. ESP is now free to move up and down the stack as needed
Back to BoilerPlate [main: push ebp mov ebp, esp push ebx push esi push edi ;push value in base pointer to stack ;move the stack pointer value into the base pointer register ;push the value in the base address reg to the stack ;push the value in the source index reg to the stack ;push the value in the destination index reg to the stack ;;; Your code here ] pop edi pop esi pop ebx mov esp, ebp pop ebp ret ;Now we restore the original values
MOV Reminder: Format: mov destination, source Data is source is copied to destination Examples: mov eax, 80 mov eax, ebx mov eax, [input]
JMP Reminder: Format: jmp label Begins execution at the next instruction after the label in the code Examples: label: ;some code jmp label ;the execution returns to the ;instruction immediately after ;the initial label
ADD Reminder: Format: add destination, source1, source2 Adds two values and places them in a destination Different format when implementing: add source1, source2 Same as source1 = source1 + source2 Examples: add ebx, ecx add ebx, 12
I/O in Linux Assembly List external files to be used Save the current registers by pushing onto the stack Use the stack for parameter passing to printf(), scanf(), and fgets() Adjust stack pointer ESP as necessary On completion of program restore registers by popping from the stack
External Files stdin standard file variable for input char *fgets(char *s, int size, FILE *stream); int printf(const char *format, ); int scanf(const char *format, );
int printf(const char *format, ) Write out the printf call in C style first Declare as extern printf Declare and initialize the base string: sshow db The string you entered was %s, 10, 0 Push the parameters in reverse order. Call printf Clean up the stack (add 4 for each push to ESP)
Formatting in printf() Format %c %d %e %f %g %i %o %s %u %x %% Description
Formatting in printf() Format Description %c Print a single character %d Print a decimal (base 10) number %e Print an exponential floating-point number %f Print a floating-point number %g Print a general-format floating-point number %i Print an integer in base 10 %o Print a number in octal (base 8) %s Print a string of characters %u Print an unsigned decimal (base 10) number %x Print a number in hexadecimal (base 16) %% Print a percent sign (\% also works)
Printing in Assembly: Example code: [section.text] extern printf global main main: ;boilerplate push dword phrase call printf add esp, 4 ;boilerplate [section.data] pharse db Space, the final frontier, 10, 0
int scanf(const char *format, ) Declare as extern scanf Declare a string that contains the format of the value to be input: iformat db %d, 10, 0 Reserve memory for each input to be used: intval resd 1 ;reserves 1 un-initialized double word Push the address of the reserved memory for the input on the stack Push the address of the address string on the stack. Call scanf Clean up the stack (add 4 for each push to ESP)
Scanning in Assembly: Example code: [section.text] extern scanf global main main: ;boilerplate push dword input push dword format call scanf add esp, 8 ;boilerplate [section.data] format db %d, 10, 0 [section.bss] input resd 1 ;push the address of the integer ;buffer ;push the address of the input ;format string ;clean up the stack
To compile: nasm f elf filename.asm gcc filename.o o exe_name./exe_name
Compiling: nasm f elf filename.asm Assembles filename.asm into an ELF object file named filename.o gcc filename.o o exe_name Links the object file to libraries that are needed (like C libraries)./exe_name This will execute your code
File Layout http://www.youtube.com/watch?v=h4pnbc 4SXMo
Memory Layout (again)
Basic Instructions MOV ADD mov eax, 3 mov bx, ax ;store 3 into EAX register ;(3 is immediate operand) ;store the value of AX into ;the BX register add eax, 4 ;eax = eax + 4 add al, ah ;al = al + ah
Basic Instructions SUB sub bx, 10 ;bx = bx 10 sub ebx, edi ;ebx = ebx edi INC and DEC inc ecx dec dl ;ecx++ ;dl--
Bit of Practice Statements: 1. a = 2 + 3; 2. b = 7 + 8; 3. c = a + b; What assembly code produces this? What is the state of the registers through execution?
IMUL Instruction In unsigned integers, 255 = FF = 1111 1111 255 * 255 = 65025 In signed integers, -1-1 is 1111 1111 in two s complement -1 * -1 = 1 We need IMUL for signed integers.
IMUL IMUL source IMUL source, immed IMUL destination, source, immed IMUL destination, source
IMUL Example mov eax, [input] imul eax mov eax, 10 mov edx, 15 imul eax, edx imul ecx, eax, edx ;eax = user input ;eax = eax * eax ;eax = eax * edx ;ecx = eax * edx
Bit Significance Numerical concept of a significant digit is useful when singling out individual bits of a specific storage location. Ex. The binary number 1100 2 MSB = 1 and LSB = 0 The three MSBs is 110
Negative Number Representation As humans, the customary way to represent a negative number is to append a minus sign Put a in front of 3 makes a -3 This is called signed magnitude representation. How can we implement this on a computer? Implemented on the computer by allocating one bit of storage for a sign bit.
Negative Number Representation To change the sign, simply flip the bit that is representing the sign. This representation is not generally used for integers on the computer. Why? The reason is that in order to do addition with signed magnitude representation, we need to do it the way it is taught to kids:
Signed Magnitude Addition In order to add x and y, we have to consider cases: Case 1: If x and y are positive, Just add and make your answer positive. Case 2: If x and y are both negative, Remove the negative signs, add the numbers, and tack a minus sign onto the result. Case 3: If x and y have different signs, Subtract the smaller magnitude from the larger one, then tack the sign from the larger one to the result
Signed Magnitude Addition vs Easy Addition Implementing this method of addition with logic circuits on a chip would be a terrible waste of transistors! So how would we want to implement this? Implement with logic circuits to add x and y such that the sign doesn t matter! Just add them
Signed vs. Unsigned Numbers Sometimes arithmetic is done and it assumes that numbers are represented using the plain binary system; other times the system may assume two s complement Both systems are used It is up to the software to make the distinction This is why you see things like signed vs unsigned integers in programming langs.
Main Methods There are three main methods that computers represent signed numbers: 1. Signed Magnitude 2. One s Complement 3. Two s Complement All use the MSB to show if number is negative (1) or not (0) Two s Complement is used in most modern day computers
Signed Magnitude (Revisited) A technique to represent negative numbers in binary: 1. Take the binary representation of the number, 2. Flip the MSB, MSB = 1 represents a negative number. *Note: Very important to make sure to have enough digits to represent the negative-ness of the number. Ex: Using Signed Magnitude, represent the signed integer -19 How about the signed integer 5??
One s complement A technique to represent negative numbers in binary: 1. Take the binary representation of the number, 2. Flip all of the bits MSB = 1 represents a negative number. *Note: Very important to make sure to have enough digits to represent the negative-ness of the number. Ex: Using One s complement, represent the signed integer -19 How about the signed integer 5??
Two s complement A technique to represent negative numbers in binary: 1. Take the binary representation of the number, 2. Flip all of the bits, 3. Add 1 MSB = 1 represents a negative number. *Note: Very important to make sure to have enough digits to represent the negative-ness of the number. Ex: Using Two s complement, represent the signed integer -19 How about the signed integer 5??
Two s complement Arithmetic Class Demo! Double Negate? Check! Arithmetic? Check!
Sign Extension In assembly, all data has a specified size. Sometimes we may need to change the size to use it with other data Decreasing is the easiest! Simply remove the more significant bits of the data Does not work if number cannot be represented correctly in remaining bits All bits being removed must be 0 (for unsigned numbers) to be correct (For signed) all 1s or all 0s and a keep signed bit
Sign Extension Increasing the size of data is more complicated: In general, make new bits of expanded number 0 for an unsigned number For signed, we must expand the signed bit Remember this is important because it is up to the programmer to use the appropriate instructions. The computer is unaware if a number is signed or unsigned.
Directives Directives are Assembler specific NASM may be different from MASM Instruct or inform the Assembler to do something Not translated into machine code Common uses: Define constants Define memory to store data into Group memory into segments Conditionally include source code Include other files
Directives The equ directive Can be used to define a symbol. Symbols are named constants and their values can not be redefined later Syntax: symbol equ value The %define directive Similar to C s #define directive Commonly used to define constant macros Example: %define SIZE 100 mov eax, SIZE
Directives Data directives Used in data segments to define room for memory We see these in our.data and.bss sections: Two ways memory can be reserved: 1. Using RESX directives, where X is replaced with a letter that determines the size 2. DX, where again X is replaced with a letter that determines the size.
Labels Labels are used to refer to data in code. Two ways that a label can be used: If plain label is used, it is interpreted as the address (or offset) of the data. If the [label] is used, it is interpreted as the data at that address. (For my C-like language folks): You can think of a label as a pointer to the data and the [ ] dereferences the pointer just as the asterisk does in C
IDIV Instruction No special idiv instructions like there are with imul. General format: idiv source What do we get from a division operation? Quotient and remainder so where are these stored? In special registers!
IDIV Instruction EDX and EAX are the special registers used to store this information. Quotient is stored in EAX Remainder is stored in EDX Common mistake is to forget to initialize EDX before division. Also, cannot divide by immediate value! Call CDQ command prior to IDIV, this initializes EDX by sign extension cdq idiv ecx ;initalize edx by sign extend ;edx:eax / ecx
Now let s take a minute Scanf Printf getchar Let s look at examples of using all of these <Another In-Class Demo Here>!
Control Structures High level languages provide high level control structures that control the sequence of execution. Examples if, if-else, while, do while, for, etc Assemble does not provide such complex structures. Uses the infamous goto method instead
Control Structures So is it still possible to implement these control structure in assembly? Yes! Basic Procedure: Design the program logic using high-level control structures Translate the design into the appropriate assembly language (Just like a compiler would do!!)
Comparisons Comparing data drives effects that control structures have on instruction execution In assembly, results from a comparison is stored in a special register FLAGS The CMP instruction performs comparisons.
CMP instruction FLAGS is set based on the difference of the two operands of the CMP instruction The operands are subtracted and the FLAGS register is set based on the result. Note:: the result is NOT stored anywhere If needed, you will have to use the sub instruction yourself.
CMP and FLAGS For unsigned ints, there are two flags that are important: the zero (ZF) and the carry (CF) flags. These are merely bits in the FLAGS register The zero flag is set (1) if the resulting difference would be zero. The carry flag is used as a borrow flag for subtraction.
CMP Example Consider the following instruction: cmp vleft, vright What are the values of ZF and CF?
CMP and FLAGS For signed ints, there are three flags that are important: the zero (ZF), the overflow (OF) and the sign (SF) flags. These are merely bits in the FLAGS register The zero flag works the same as before. The overflow flag is set if result from an op overflows. The sign flag is set if the result of an op is neg.
CMP Example (Again) Consider the following instruction using signed ints: cmp vleft, vright What are the values of ZF, OF, and SF?
Be careful!! ***Do Not Forget: CMP is not the only instruction that can change the FLAGS register
Branch Instructions These can transfer execution to arbitrary points of a program. They essentially act like a goto Two types of branches: Unconditional Conditional
Branch Instructions Unconditional branches act just like gotos Branch is always taken Conditional branches not like goto May or may not take the branch Depends on the state of the FLAGS register On branch not taken, control passes to next instruction
JMP instruction Short for jump Makes unconditional branches Takes a single argument, the code label, to the instruction you wish to branch to So what about the conditional jumps? This instruction comes with several variations
Variations of JMP There are several variations of the jump instruction: SHORT NEAR FAR
Variations of JMP SHORT Limited range Can only move up or down 128 bytes in memory Advantage: uses less memory than the others Uses a single byte to store the displacement, number of bytes to move ahead or behind in memory, of the jump Syntax: short jmp label
Variations of JMP NEAR Default type for both branch types Used to jump to any location in a code segment FAR Allows control to move to another code segment Very rare variation of jump to use
JMP labels Valid labels follow same rules as data labels Labels are defined by placing them in the code segment in front of the statement they label. A colon is placed as the end as its point of definition Note: the colon is not part of the label name
Conditional Branch Instructions Instruction JZ JNZ JO JNO JS JNS JC JNC JP JNP Branch Condition
Conditional Branch Instructions Instruction JZ JNZ JO JNO JS JNS JC JNC JP JNP Branch Condition Branches only if ZF is set Branches only if ZF is unset Branches only if OF is set Branches only if OF is unset Branches only if SF is set Branches only if SF is unset Branches only if CF is set Branches only if CF is unset Branches only if PF is set Branches only if PF is unset
Comparison Example 1 The following pseudocode: Could be written in assembly as: if(eax == 0) EBX = 1; else EBX = 2; cmp eax, 0 jz thenblock mov ebx, 2 jmp next thenblock: mov ebx, 1 next:
A Closer look cmp eax, 0 jz thenblock mov ebx, 2 jmp next thenblock: next: mov ebx, 1 ; set flags ;(ZF set if eax 0 = 0) ;if ZF is set branch to thenblock ;ELSE part of IF ;jump over THEN part of IF ;THEN part of IF
Comparison Example 2 The following pseudocode: if(eax >= 5) EBX = 1; else EBX = 2; Could be written in assembly as: cmp eax, 5 js signon jo elseblock jmp thenblock signon: jo thenblock elseblock: mov ebx, 2 jmp next thenblock: mov ebx, 1 next:
A Closer look cmp eax, 5 js signon jo elseblock jmp thenblock signon: jo thenblock elseblock: mov ebx, 2 jmp next thenblock: mov ebx, 1 next: ;goto signon if SF=1 ;goto elseblock if OF=1 & SF=0 ;goto thenblock if SF=0 & OF=0 ;goto thenblock if SF=1 & OF=1
Other Branch Instructions The above instructions can make code a bit awkward, even for assembly Fortunately, there are additional branch instructions that make testing things easier!! --YAY! These instructions come in both signed and unsigned forms
Signed and Unsigned Comparison Instructions Signed Unsigned JE Branches if vleft = vright JE Branches if vleft = vright JNE Branches if vleft vright JNE Branches if vleft vright JL, JNGE Branches if vleft < vright JB, JNAE Branches if vleft < vright JLE, JNG Branches if vleft vright JBE, JNA Branches if vleft vright JG, JNLE Branches if vleft > vright JA, JNBE Branches if vleft > vright JGE, JNL Branches if vleft vright JAE, JNA Branches if vleft vright Note: unsigned branches use A for above and B for below instead of L and G
Comparison Example 2 (revisited) The following pseudocode: if(eax >= 5) EBX = 1; else EBX = 2; Could be written in assembly as: cmp eax, 5 jge thenblock mov ebx, 2 jmp next thenblock: next: mov ebx, 1
Comparison Example 2 (revisited) Version1: cmp eax, 5 js signon jo elseblock jmp thenblock signon: jo thenblock elseblock: mov ebx, 2 jmp next thenblock: mov ebx, 1 next: Version2: cmp eax, 5 jge thenblock mov ebx, 2 jmp next thenblock: mov ebx, 1 next:
The loop instructions There are several instructions to implement for-like loops: LOOP LOOPE, LOOPZ LOOPNE, LOOPNZ Each takes a code label as its single operand The last two are useful for sequential search loops
The loop instructions LOOP Decrements ECX If ECX 0, it branches to label LOOPE, LOOPZ Decrements ECX (FLAGS register is not modified) If ECX 0 and ZF = 1, then branches LOOPNE, LOOPNZ Decrements ECX (FLAGS unchanged) If ECX 0 and ZF = 0, then branches
Loop Example 1 The following pseudocode: Could be written in assembly as: sum = 0; for(i=10; i>0; i--) sum += i; mov eax, 0 mov ecx, 10 loop_start: add eax, ecx loop loop_start
Translating Standard Control Structures (IF-ELSE statements) The following pseudo-code: if( condition ) then_block; else else_block Could be implemented as: ;code to set FLAGS jxx else_block ;code for then block jmp endif else_block: ;code for else block endif: Select xx in jxx so that the branch is taken if condition is false
Translating Standard Control Structures (IF statements) The following pseudo-code: Could be implemented as: if( condition ) then_block; ;code to set FLAGS jxx endif ;code for then block endif: Select xx in jxx so that the branch is taken if condition is false
Translating Standard Control Structures (While-loop statements) The following pseudo-code: while(condition) { } body of loop; Could be implemented as: while: ;code to set FLAGS ;based on condition jxx endwhile ;body of loop jmp while endwhile: Select xx in jxx so that the branch is taken if condition is false
Translating Standard Control Structures (do while-loop statements) The following pseudo-code: Could be implemented as: do { body of loop; }while(condition); do: ;body of loop ;code to set FLAGS ;based on condition jxx do Select xx in jxx so that the branch is taken if condition is false
Problem to think about: Exercise: Write the assembly code needed to find the prime numbers up to a given number.