Introduction to Computer Systems 15-213/18-243, spring 2009
CSE 2421
Array Storage and Access
C Auto Storage Class, Block Scope Variables in X86-64
C Static Storage Class, Block/File Scope Variables in X86-64
Required Reading: Computer Systems: A Programmer’s Perspective, 3rd Edition Chapter 3, Section 3.8 through 3.8.4 (inclusive)
1
Today
Arrays
One-dimensional
Multi-dimensional (nested)
Multi-level
Structures
Allocation
Access
Alignment
2
Complete Memory Addressing Modes(Review)
See Figure 3.3 page 181
Most General Form of the address expression
Imm(Rb,Ri,S) Mem[Imm+ Reg[Rb]+S*Reg[Ri]]
or Address = Imm+Rb+Ri*S
Imm: Constant “displacement”
It’s often a “displacement” of 1, 2, 4 or 8 bytes, but can be any constant value
Rb: Base register: Any of the16 integer registers
Ri: Index register: Any register except %rsp or %rbp
S: Scale: Only 1, 2, 4, or 8 (why these numbers?)
This form is seen often when referencing elements of arrays
DON’T CONFUSE Imm and S!!
Imm can be *any* constant
S can only be 1, 2, 4, or 8
Pointer arithmetic in C
Review
If p is a pointer to data type T
And, the value of p (i.e., an address) is x_p
Then, then p+i has value x_p + L*i
where, L is the size of data type T
Thus for an array A of elements, A[i] == *(A+i)
In C the compiler takes care of multiplying i by L for us
Example
int E[10]; /*Assume int is 4 bytes long */
C expression Type Comment
E int * Address to start of array
E[i] int Value of array element i
&(E[i]) int * Address of array element i
E+i-1 int * Address of array element i-1
*(E+i-3) int Value of array element i-3
4
Pointer arithmetic in x86-64
X86-64 is consistent with what we saw in C to a point
If p is a pointer to data type T
And, the value of p (i.e., an address) is x_p
Then, then p+i has value x_p + L*i
where, L is the size of data type T
Thus for an array A of elements, A[i] == *(A+L*i)
In x86-64 we must take care of multiplying i by L ourselves
Usually, the easiest way to do this is with Imm(Base, Index, Scale) constructs
Example
int E[10]; /*Assume int is 4 bytes long */
Suppose rdx holds starting address of array E
Suppose rcx holds integer index i
C expression Type Assembly code result in rax/eax Comment
E int * movq %rdx, %rax Address copy
E[i] int movl (%rdx,%rcx,4),%eax, or
movl E(,%rcx,4), %eax if E is a label Reference memory
&(E[i]) int * leaq (%rdx,%rcx,4),%rax Generate address
E+i-1 int * leaq -4(%rdx,%rcx,4),%rax Generate address
*(E+i-3) int movl -12(%rdx,%rcx,4),%eax Reference memory
Note memory reference is 4-bytes
Note memory address is 8-bytes
5
Arrays
C declaration: type array[length]
Arrays store multiple data objects of the same type
Stored sequentially, often accessed as an offset from a pointer which points to the beginning of the array.
size = length*sizeof(type)
If x is the address of the first byte of the first element in the array, then array element i will be stored at address x+sizeof(type)*i
THIS DOESN’T CHANGE BETWEEN C AND X86!
Nor should it since all C code gets compiled to assembler within gcc
If it wasn’t consistent nothing would work!
Array Allocation
Basic Principle
T A[L];
Array of data type T and length L
Contiguously allocated region of L * sizeof(T) bytes in memory
char string[12];
if x==string
x
x + 12
int val[5];
if x==val
val[0]
val[1]
val[2]
val[3]
val[4]
x
x + 4
x + 8
x + 12
x + 16
x + 20
double a[3];
if x==a
p[0]
p[1]
p[2]
x + 24
x
x + 8
x + 16
char *p[3];
if x==p
a[0]
a[1]
a[2]
x + 24
x
x + 8
x + 16
Array Access
Basic Principle
T A[L];
Array of data type T and length L
Identifier A can be used as a pointer to array element 0: Type T*
Reference Type Value
val[4] int 3
val int * x
val+1 int * x + 4
&val[2] int * x + 8
val[5] int ??
*(val+1) int 5
val + i int * x + 4 i
int val[5];
1
5
2
1
3
x
x + 4
x + 8
x + 12
x + 16
x + 20
Array Example
Declaration zip_dig cmu equivalent to int cmu[5]
Example arrays were allocated in successive 20-byte blocks
Not guaranteed to happen in general
#define ZLEN 5
typedef int zip_dig[ZLEN];
zip_dig cmu = { 1, 5, 2, 1, 3 };
zip_dig mit = { 0, 2, 1, 3, 9 };
zip_dig ucb = { 9, 4, 7, 2, 0 };
zip_dig cmu;
1
5
2
1
3
16
20
24
28
32
36
zip_dig mit;
0
2
1
3
9
36
40
44
48
52
56
zip_dig ucb;
9
4
7
2
0
56
60
64
68
72
76
Array Accessing Example
Register %rdi contains starting address of array
Register %rsi contains
array index
Desired digit at
%rdi + 4*%rsi
Use memory reference (%rdi,%rsi,4)
use movl instruction to move 4 bytes
Use 4-byte register %eax
int get_digit(zip_dig z, int digit)
{
return z[digit];
}
# %rdi = z
# %rsi = digit
movl (%rdi,%rsi,4), %eax # z[digit]
X86-64
zip_dig cmu;
1
5
2
1
3
16
20
24
28
32
36
10
# %rdi = z
movq $0, %rax # i = 0
jmp Test # goto Test
Loop: # loop:
incl (%rdi,%rax,4) # z[i]++
incq %rax # i++
Test: # middle
cmpq $4, %rax # i:4
jle Loop # if <=, goto Loop
ret # ret
Array Loop Example
void zincr(zip_dig z) {
int i;
for (i = 0; i < ZLEN; i++)
z[i]++;
}
Arrays – Example 1
Consider the following C code:
static int array[30];
int x = array[25];
Which is equivalent to assembly code:
REMINDER: $ in assembly language with a label gives an address. array and x must have been defined in the data segment (.data section) of the program.
movq $array, %rbx # %rbx is base register
movq $25, %rcx # %rcx is index register
movl (%rbx,%rcx,4),%eax # %eax = array[25]
movl %eax, $x # x = array[25]
Why can’t we combine the last 2 instructions? movl (%rbx, %rcx,4), $x
Arrays – Example 1
Consider the following C code:
static int array[30];
int x = array[25];
Which is equivalent to assembly code:
REMINDER: $ in assembly language with a label gives an address. array and x must have been defined in the data segment (.data section) of the program.
movq $array, %rbx # %rbx is base register
movq $25, %rcx # %rcx is index register
movl (%rbx,%rcx,4),%eax # %eax = array[25]
movl %eax, $x # x = array[25]
Why can’t we combine the last 2 instructions? movl (%rbx, %rcx,4), $x
Because memory to memory moves are not legal in x86-64
Arrays – Example 2
C code:
int MyFunction1()
{
int data[20];
...
}
What are the class/scope/linkage of the array?
Arrays – Example 2
C code:
int MyFunction1()
{
int data[20];
...
}
What are the class/scope/linkage of the array? Automatic/Block/None
Where is the array located? Stack or Heap?
Arrays – Example 2
C code:
int MyFunction1()
{
int data[20];
...
}
What are the class/scope/linkage of the array? Automatic/Block/None
Where is the array located? Stack or Heap?
Stack. So how do we do that in x86-64??
Arrays – Example 2
C code:
int MyFunction1()
{
int data[20];
...
}
x86-64 code:
MyFunction1:
pushq %rbp # must do stack housekeeping first
movq %rsp, %rbp
subq $80,%rsp #Allocate space for array #on the stack: 20 elements, 4 bytes each=80 bytes
leaq (%rsp), %rax #using %rax as base register for int data[20] array
#OR movq %rsp, %rax
...
Arrays – Example 3
C code:
void MyFunction2()
{
char buffer[6];
...
}
x86-64 code:
MyFunction2:
pushq %rbp
movq %rsp, %rbp
subq $6,%rsp # allocate 6 bytes for array
leaq (%rsp), %rax # %rax is base register for char buffer[6]
# OR movq %rsp, %rax
...
http://en.wikibooks.org/wiki/X86_Disassembly/Data_Structures
18
Array – Example 3
MyFunction2:
pushq %rbp
movq %rsp, %rbp
subq $6, %rsp
leaq (%rsp), %rax #OR movq %rsp, %rax
...
Caller Ret Address
8-byte value
When we enter MyFunction2:
%rsp
Lower
Addresses
Higher
Addresses
Array – Example 3
MyFunction2:
pushq %rbp
movq %rsp, %rbp
subq $6, %rsp
leaq (%rsp), %rax #OR movq %rsp, %rax
...
Caller’s %rbp
8-byte value
Caller Ret Address
8-byte value
After pushq %rbp :
%rsp
Lower
Addresses
1 byte
chunks
8
byte chunks
Higher
Addresses
Array – Example 3
MyFunction2:
pushq %rbp
movq %rsp, %rbp
subq $6, %rsp
leaq (%rsp), %rax #OR movq %rsp, %rax
...
Caller’s %rbp
8-byte value
Caller Ret Address
8-byte value
After movq %rsp, %rbp:
%rsp
%rbp
Lower
Addresses
1 byte
chunks
8
byte chunks
Higher
Addresses
Array – Example 3
MyFunction2:
pushq %rbp
movq %rsp, %rbp
subq $6, %rsp
leaq (%rsp), %rax #OR movq %rsp, %rax
...
buffer[0]
1-byte value
buffer[1]
1-byte value
buffer[2]
1-byte value
buffer[3]
1-byte value
buffer[4]
1-byte value
buffer[5]
1-byte value
Caller’s %rbp
8-byte value
Caller Ret Address
8-byte value
Lower
Addresses
1 byte
chunks
8
byte chunks
Higher
Addresses
%rax
%rsp
After
subq $6, %rsp
%rax+6
%rbp
%rax+12
2nd byte of 8 byte %rbp
Array – Example 3
MyFunction2:
pushq %rbp
movq %rsp, %rbp
subq $6, %rsp
leaq (%rsp), %rax #OR movq %rsp, %rax
...
buffer[0]
1-byte value
buffer[1]
1-byte value
buffer[2]
1-byte value
buffer[3]
1-byte value
buffer[4]
1-byte value
buffer[5]
1-byte value
Caller’s %rbp
8-byte value
Caller Ret Address
8-byte value
Lower
Addresses
1 byte
chunks
8
byte chunks
Higher
Addresses
%rax
%rsp
After
leaq (%rsp), %rax
%rax+6
%rbp
%rax+12
2nd byte of 8 byte %rbp
Array – Example 3
MyFunction2:
pushq %rbp
movq %rsp, %rbp
subq $6, %rsp
leaq (%rsp), %rax #OR movq %rsp, %rax
pushq %rbx
...
%rbx
8-byte value
buffer[0]
1-byte value
buffer[1]
1-byte value
buffer[2]
1-byte value
buffer[3]
1-byte value
buffer[4]
1-byte value
buffer[5]
1-byte value
Caller’s %rbp
8-byte value
Caller Ret Address
8-byte value
%rax
%rsp
%rax+6
%rbp
%rax+12
2nd byte of 8 byte %rbp
Lower
Addresses
1 byte
chunks
8
byte chunks
Higher
Addresses
Array – Example 3
MyFunction2:
pushq %rbp
movq %rsp, %rbp
subq $6, %rsp
leaq (%rsp), %rax #OR movq %rsp, %rax
pushq %rbx
...
Note %rsp continues to change, but we still have
%rax that contains the starting address of the array
%rbx
8-byte value
buffer[0]
1-byte value
buffer[1]
1-byte value
buffer[2]
1-byte value
buffer[3]
1-byte value
buffer[4]
1-byte value
buffer[5]
1-byte value
Caller’s %rbp
8-byte value
Caller Ret Address
8-byte value
%rax
%rsp
%rax+6
%rbp
%rax+12
2nd byte of 8 byte %rbp
Lower
Addresses
1 byte
chunks
8
byte chunks
Higher
Addresses
Array – Example 3
MyFunction2:
pushq %rbp
movq %rsp, %rbp
subq $6, %rsp
leaq (%rsp), %rax #OR movq %rsp, %rax
pushq %rbx
...
What happens if %rcx equals 12, and the code tries to access (%rax,%rcx,1)? For example, suppose %dl equals 5, and this instruction is executed:
movb %dl, (%rax,%rcx,1)
%rbx
8-byte value
buffer[0]
1-byte value
buffer[1]
1-byte value
buffer[2]
1-byte value
buffer[3]
1-byte value
buffer[4]
1-byte value
buffer[5]
1-byte value
Caller’s %rbp
8-byte value
Caller Ret Address
8-byte value
Lower
Addresses
1 byte
chunks
8
byte chunks
Higher
Addresses
%rax
%rsp
%rax+6
%rbp
%rax+12
2nd byte of 8 byte %rbp
Array – Example 3
MyFunction2:
pushq %rbp
movq %rsp, %rbp
subq $6, %rsp
leaq (%rsp), %rax #OR movq %rsp, %rax
pushq %rbx
...
What happens if %rcx equals 12, and the code tries to access (%rax,%rcx,1)? For example, suppose %dl equals 5, and this instruction is executed:
movb %dl, (%rax,%rcx,1)
Buffer Overflow! What was on the stack where we wrote 5??
We may have written over
something important!
%rbx
8-byte value
buffer[0]
1-byte value
buffer[1]
1-byte value
buffer[2]
1-byte value
buffer[3]
1-byte value
buffer[4]
1-byte value
buffer[5]
1-byte value
Caller’s %rbp
8-byte value
Caller Ret Address
8-byte value
Lower
Addresses
1 byte
chunks
8
byte chunks
Higher
Addresses
%rax
%rsp
%rax+6
%rbp
%rax+12
2nd byte of 8 byte %rbp
5
Arrays On the Stack - cont
Look for large allocation on the stack
Look for data references using a register other than %rsp or %rbp as the base
StackArrayEx:
pushq %rbp
movq %rsp, %rbp
pushq %rbx
subq $520, %rsp
leaq (%rsp), %rbx #OR movq %rsp, %rbx
movl $0x0,(%rbx) #set first element to 0
What options can you think of for how the array was declared?
Arrays On the Stack - cont
Look for large allocation on the stack
Look for data references using a register other than %rsp or %rbp as the base
StackArrayEx:
pushq %rbp
movq %rsp, %rbp
subq $520, %rsp
leaq (%rsp), %rbx #OR movq %rsp, %rbx
movl $0x0,(%rbx) #set first element to 0
What options can you think of for how the array was declared?
char buffer[520];
Arrays On the Stack - cont
Look for large allocation on the stack
Look for data references using a register other than %rsp or %rbp as the base
StackArrayEx:
pushq %rbp
movq %rsp, %rbp
subq $520, %rsp
leaq (%rsp), %rbx #OR movq %rsp, %rbx
movl $0x0,(%rbx) #set first element to 0
What options can you think of for how the array was declared?
char buffer[520];
short buffer[260]; Any of these would be options, right?
int buffer[130];
long buffer[65];
Arrays On the Stack - cont
Look for large allocation on the stack
Look for data references using a register other than %rsp or %rbp as the base
StackArrayEx:
pushq %rbp
movq %rsp, %rbp
subq $520, %rsp
leaq (%rsp), %rbx #OR movq %rsp, %rbx
movl $0x0,(%rbx) #set first element to 0
What options can you think of for how the array was declared?
char buffer[520];
short buffer[260]; Any of these would be options, right?
int buffer[130]; This one is likely the correct one, since using
‘l’ suffix to set first element to 0.
long buffer[65];
Arrays On the Stack - initialization
For the array on the preceding slide, how could the compiler generate code for a loop to initialize all of the array elements to 0?
StackArrayEx:
pushq %rbp
movq %rsp, %rbp
subq $520, %rsp
pushq %rbx
leaq (%rsp), %rbx #base register
#OR movq %rsp, %rbx
movq $130, %rcx # number of array elements
initialize:
decq %rcx # decrement index
jl next # if less than 0 done Why not jle??
movl $0x0, (%rbx,%rcx,4) # set 4 bytes of memory to zero
jmp initialize # go again
next:
…
Arrays On the Stack – cleanup
buffer[0]
1-byte value
buffer[1]
1-byte value
buffer[2]
1-byte value
buffer[3]
1-byte value
buffer[4]
1-byte value
buffer[519]
1-byte value
Caller’s %rbp
8-byte value
Caller Ret Address
8-byte value
%rsp
%rcx
%rbp
For the array on the preceding slides, what needs to happen with respect to cleanup before return?
StackArrayEx:CREATION
pushq %rbp
movq %rsp, %rbp
subq $520, %rsp
leaq (%rsp), %rcx #base register
#OR movq %rsp, %rcx
Arrays On the Stack – cleanup
For the array on the preceding slides, what needs to happen with respect to cleanup before return?
StackArrayEx:CREATION
pushq %rbp
movq %rsp, %rbp
subq $520, %rsp
leaq (%rsp), %rcx #base register
#OR movq %rsp, %rcx
Return:CLEANUP
movq %rbp, %rsp #leave instruction
popq %rbp
ret
buffer[0]
1-byte value
buffer[1]
1-byte value
buffer[2]
1-byte value
buffer[3]
1-byte value
buffer[4]
1-byte value
buffer[519]
1-byte value
Caller’s %rbp
8-byte value
Caller Ret Address
8-byte value
%rsp
%rcx
%rbp
%rsp
%rbp
Arrays on the heap – part 1
“Global” Arrays (i.e. Static Class/Can be either File or Block Scope)
Arrays of elements with initial values of 0 by default
If stored in the .data section of application (i.e., static arrays)
Accessed through a memory address
.section
.data
staticArray1:
.skip 48,0 # staticArray1 is 48 bytes long
# initialized to zero
# equivalent to static char staticArray1[48];
staticArray2:
.long 1 # staticArray2 is 20 bytes long
.long 2 # equivalent to
.long 3 # static int staticArray2[5]={1,2,3,4,5}
.long 4
.long 5
Arrays on the heap – part 2
“Global” Arrays (i.e. Static Class/Can be either File or Block Scope)
Arrays of elements with initial values of 0 by default
If stored in the data section of application (i.e., static arrays)
Accessed through a memory address
MemArrayEx:
pushq %rbp
movq %rsp, %rbp
pushq %rbx
movq $staticArray1, %rsi #base register
movq $0x0, %rbx #index register
movb $0x0,(%rsi,%rbx,1) #set 1st element to 0
Arrays
If an array holds elements larger than 1 byte, the index will need to be multiplied by the size of the element
The Scale element of the address computation takes care of that for us
#access to array of elements of size 4,
#with scaling, where rax holds the index i,
#and rbx is base register:
#e.g., arr[i] = 0x11223344
movl $0x11223344, (%rbx,%rax,4)
...
Arrays of size larger than 8 bytes
What if the array holds elements larger than 8 bytes? For example, what if it is an array of structures?
Recall that, in x86-64, scaling factors can only be: 1, 2, 4, or 8 so
(%rbx, %rcx, 20) won’t compile!!
Therefore, for arrays with elements larger than 8 bytes, manual scaling must be used
What if we had an array of structures where each structure is 20 bytes???
#Here, two index registers are used, one
#for the conventional index (here, %rcx), 0 <= %rcx < n
#and one for a scaled index register,
#here, %rax. This is “manual scaling.” 0<= %rax <= 20*(n-1)
movq $5, %rcx
# signed multiply
# imulq aux, src, Dest
imulq $20,%rcx,%rax # manually scale index, NOTE! 3 operand mult
#Suppose we want: ptr = &arr[i]
leaq (%rbx,%rax), %rdx # what is in %rdx???
Arrays of size larger than 8 bytes
What if the array holds elements larger than 8 bytes? For example, what if it is an array of structures?
Recall that, in x86-64, scaling factors can only be: 1, 2, 4, or 8 so
(%rbx, %rcx, 20) won’t compile!!
Therefore, for arrays with elements larger than 8 bytes, manual scaling must be used
What if we had an array of structures where each structure is 20 bytes???
#Here, two index registers are used, one
#for the conventional index (here, %rcx),
#and one for a scaled index register,
#here, %rax. This is “manual scaling.”
movq $0, %rcx
# signed multiply
# imulq aux, src, Dest
imulq $20,%rcx,%rax # manually scale index, NOTE! 3 operand mult
#Suppose we want: ptr = &arr[i]
leaq (%rbx,%rax), %rdx # what is in %rdx???
Address to beginning of structure in an array!
/docProps/thumbnail.jpeg