Introduction to Computer Systems 15-213/18-243, spring 2009
CSE 2421
Array and Structure Storage and Access
1
Today
Arrays
One-dimensional
Multi-dimensional (nested)
Multi-level
Structures
Allocation
Access
Alignment
2
Pointer arithmetic
If p is a pointer to data type T
And, the value of p (i.e., an address) is x_p
Then, then p+i has value x_p + L*i
where, L is the size of data type T
Thus for an array A of elements, A[i] == *(A+i)
Example
int E[10]; /*Assume int is 4 bytes long */
Suppose rdx holds starting address of array E
Suppose rcx holds integer index i
C expression Type Assembly code… result in eax Comment
E int * movq %rdx, %rax
E[i] int movl (%rdx,%rcx,4),%eax Reference memory
&(E[i]) int * leaq (%rdx,%rcx,4),%rax Generate address
E+i-1 int * leaq -4(%rdx,%rcx,4),%rax Generate address
*(E+i-3) int movl -12(%rdx,%rcx,4),%eax Reference memory
3
Arrays
C declaration: type array[length]
Arrays are means for storing multiple data objects of the same type
Stored sequentially, often accessed as an offset from a pointer which points to the beginning of the array.
size = length*sizeof(type)
If x is the address of the first byte of the first element in the array, then array element i will be stored at address x+sizeof(type)*i
Array Allocation
Basic Principle
T A[L];
Array of data type T and length L
Contiguously allocated region of L * sizeof(T) bytes in memory
char string[12];
x
x + 12
int val[5];
x
x + 4
x + 8
x + 12
x + 16
x + 20
double a[3];
x + 24
x
x + 8
x + 16
char *p[3];
x + 24
x
x + 8
x + 16
Array Access
Basic Principle
T A[L];
Array of data type T and length L
Identifier A can be used as a pointer to array element 0: Type T*
Reference Type Value
val[4] int 3
val int * x
val+1 int * x + 4
&val[2] int * x + 8
val[5] int ??
*(val+1) int 5
val + i int * x + 4 i
int val[5];
1
5
2
1
3
x
x + 4
x + 8
x + 12
x + 16
x + 20
Array Example
Declaration zip_dig cmu equivalent to int cmu[5]
Example arrays were allocated in successive 20 byte blocks
Not guaranteed to happen in general
#define ZLEN 5
typedef int zip_dig[ZLEN];
zip_dig cmu = { 1, 5, 2, 1, 3 };
zip_dig mit = { 0, 2, 1, 3, 9 };
zip_dig ucb = { 9, 4, 7, 2, 0 };
zip_dig cmu;
1
5
2
1
3
16
20
24
28
32
36
zip_dig mit;
0
2
1
3
9
36
40
44
48
52
56
zip_dig ucb;
9
4
7
2
0
56
60
64
68
72
76
Array Accessing Example
Register %rdi contains starting address of array
Register %rsi contains
array index
Desired digit at
%rdi + 4*%rsi
Use memory reference (%rdi,%rsi,4)
use movl instruction to move 4 bytes
Use 4 byte register %eax
int get_digit
(zip_dig z, int digit)
{
return z[digit];
}
# %rdi = z
# %rsi = digit
movl (%rdi,%rsi,4), %eax # z[digit]
X86-64
zip_dig cmu;
1
5
2
1
3
16
20
24
28
32
36
8
# %rdi = z
movq $0, %rax # i = 0
jmp Test # goto Test
Loop: # loop:
incl (%rdi,%rax,4) # z[i]++
incq %rax # i++
Test: # middle
cmpq $4, %rax # i:4
jle Loop # if <=, goto Loop
ret # ret
Array Loop Example
void zincr(zip_dig z) {
size_t i;
for (i = 0; i < ZLEN; i++)
z[i]++;
}
Arrays – Example 1
Consider the following C code:
static int array[30];
int x = array[25];
Which is equivalent to assembly code:
REMINDER: $ in assembly language with a label gives an address. array and x must have been defined in the data segment (.data section) of the program.
movq $array, %rbx # %rbx is base register
movq $25, %rcx # %rcx is index register
movl (%rbx,%rcx,4),%eax # %eax = array[25]
movl %eax, $x # x = array[25]
Why can’t we combine the last 2 instructions? movl (%rbx, %rcx,4), $x
Arrays – Example 1
Consider the following C code:
static int array[30];
int x = array[25];
Which is equivalent to assembly code:
REMINDER: $ in assembly language with a label gives an address. array and x must have been defined in the data segment (.data section) of the program.
movq $array, %rbx # %rbx is base register
movq $25, %rcx # %rcx is index register
movl (%rbx,%rcx,4),%eax # %eax = array[25]
movl %eax, $x # x = array[25]
Why can’t we combine the last 2 instructions? movl (%rbx, %rcx,4), $x
Because memory to memory moves are not legal in x86-64
Arrays – Example 2
C code:
int MyFunction1()
{
int data[20];
...
}
What are the class/scope/linkage of the array?
Arrays – Example 2
C code:
int MyFunction1()
{
int data[20];
...
}
What are the class/scope/linkage of the array? Automatic/Block/None
Where is the array located? Stack or Heap?
Arrays – Example 2
C code:
int MyFunction1()
{
int data[20];
...
}
What are the class/scope/linkage of the array? Automatic/Block/None
Where is the array located? Stack or Heap?
Stack. So how do we do that in x86-64??
Arrays – Example 2
C code:
int MyFunction1()
{
int data[20];
...
}
x86-64 code:
MyFunction1:
pushq %rbp # must do stack housekeeping first
movq %rsp, %rbp
subq $80,%rsp #Allocate space for array #on the stack: 20 elements, 4 bytes each=80 bytes
leaq (%rsp), %rax #using %rax as base register for int data[20] array
#OR movq %rsp, %rax
...
Arrays – Example 3
C code:
void MyFunction2()
{
char buffer[6];
...
}
x86-64 code:
MyFunction2:
pushq %rbp
movq %rsp, %rbp
subq $6,%rsp # allocate 6 bytes for array
leaq (%rsp), %rax # %rax is base register for char buffer[6]
# OR movq %rsp, %rax
...
http://en.wikibooks.org/wiki/X86_Disassembly/Data_Structures
16
Array – Example 3
MyFunction2:
pushq %rbp
movq %rsp, %rbp
subq $6, %rsp
leaq (%rsp), %rax #OR movq %rsp, %rax
...
Caller Ret Address
8 byte value
When we enter MyFunction2:
%rsp
Lower
Addresses
Higher
Addresses
Array – Example 3
MyFunction2:
pushq %rbp
movq %rsp, %rbp
subq $6, %rsp
leaq (%rsp), %rax #OR movq %rsp, %rax
...
Caller’s %rbp
8 byte value
Caller Ret Address
8 byte value
After pushq %rbp :
%rsp
Lower
Addresses
1 byte
chunks
8
byte chunks
Higher
Addresses
Array – Example 3
MyFunction2:
pushq %rbp
movq %rsp, %rbp
subq $6, %rsp
leaq (%rsp), %rax #OR movq %rsp, %rax
...
Caller’s %rbp
8 byte value
Caller Ret Address
8 byte value
After movq %rsp, %rbp:
%rsp
%rbp
Lower
Addresses
1 byte
chunks
8
byte chunks
Higher
Addresses
Array – Example 3
MyFunction2:
pushq %rbp
movq %rsp, %rbp
subq $6, %rsp
leaq (%rsp), %rax #OR movq %rsp, %rax
...
buffer[0]
1 byte value
buffer[1]
1 byte value
buffer[2]
1 byte value
buffer[3]
1 byte value
buffer[4]
1 byte value
buffer[5]
1 byte value
Caller’s %rbp
8 byte value
Caller Ret Address
8 byte value
%rsp
After subq $6, %rsp:
%rbp
Lower
Addresses
1 byte
chunks
8
byte chunks
Higher
Addresses
Array – Example 3
MyFunction2:
pushq %rbp
movq %rsp, %rbp
subq $6, %rsp
leaq (%rsp), %rax #OR movq %rsp, %rax
...
What happens if %rcx equals 12, and the code tries to access (%rax,%rcx,1)? For example, suppose %dl equals 5, and this instruction is executed:
movb %dl, (%rax,%rcx,1)
buffer[0]
1 byte value
buffer[1]
1 byte value
buffer[2]
1 byte value
buffer[3]
1 byte value
buffer[4]
1 byte value
buffer[5]
1 byte value
Caller’s %rbp
8 byte value
Caller Ret Address
8 byte value
%rax
%rsp
%rax+6
%rbp
%rax+12
2nd byte of 8 byte %rbp
Lower
Addresses
1 byte
chunks
8
byte chunks
Higher
Addresses
Array – Example 3
MyFunction2:
pushq %rbp
movq %rsp, %rbp
subq $6, %rsp
leaq (%rsp), %rax #OR movq %rsp, %rax
...
What happens if %rcx equals 12, and the code tries to access (%rax,%rcx,1)? For example, suppose %dl equals 5, and this instruction is executed:
movb %dl, (%rax,%rcx,1)
Buffer Overflow! What was on the stack where we wrote 5??
We may have written over
something important!
buffer[0]
1 byte value
buffer[1]
1 byte value
buffer[2]
1 byte value
buffer[3]
1 byte value
buffer[4]
1 byte value
buffer[5]
1 byte value
Caller’s %rbp
8 byte value
Caller Ret Address
8 byte value
%rax
%rsp
%rax+6
%rbp
%rax+12
2nd byte of 8 byte %rbp
Lower
Addresses
1 byte
chunks
8
byte chunks
Higher
Addresses
5
Arrays On the Stack - cont
Look for large allocation on the stack
Look for data references using a register other than %rsp or %rbp as the base
StackArrayEx:
pushq %rbp
movq %rsp, %rbp
subq $520, %rsp
leaq (%rsp), %rbx #OR movq %rsp, %rbx
movl $0x0,(%rbx) #set first element to 0
What options can you think of for how the array was declared?
Arrays On the Stack - cont
Look for large allocation on the stack
Look for data references using a register other than %rsp or %rbp as the base
StackArrayEx:
pushq %rbp
movq %rsp, %rbp
subq $520, %rsp
leaq (%rsp), %rbx #OR movq %rsp, %rbx
movl $0x0,(%rbx) #set first element to 0
What options can you think of for how the array was declared?
char buffer[520];
Arrays On the Stack - cont
Look for large allocation on the stack
Look for data references using a register other than %rsp or %rbp as the base
StackArrayEx:
pushq %rbp
movq %rsp, %rbp
subq $520, %rsp
leaq (%rsp), %rbx #OR movq %rsp, %rbx
movl $0x0,(%rbx) #set first element to 0
What options can you think of for how the array was declared?
char buffer[520];
short buffer[260]; Any of these would be options, right?
int buffer[130];
long buffer[65];
Arrays On the Stack - initialization
For the array on the preceding slide, how could the compiler generate code for a loop to initialize all of the array elements to 0?
StackArrayEx:
pushq %rbp
movq %rsp, %rbp
subq $520, %rsp
pushq %rbx
leaq (%rsp), %rbx #base register
#OR movq %rsp, %rbx
movq $130, %rcx # number of array elements
initialize:
decq %rcx # decrement index
jl next # if less than 0 done
movl $0x0, (%rbx,%rcx,4) # set 4 bytes of memory to zero
jmp initialize # go again
next:
…
Arrays On the Stack – cleanup
For the array on the preceding slides, what needs to happen with respect to cleanup before return?
StackArrayEx:CREATION
pushq %rbp
movq %rsp, %rbp
subq $520, %rsp
pushq %rbx
leaq (%rsp), %rbx #base register
#OR movq %rsp, %rbx
Return:CLEANUP
movq %rbp, %rsp #leave instruction
popq %rbp
ret
buffer[0]
1 byte value
buffer[1]
1 byte value
buffer[2]
1 byte value
buffer[3]
1 byte value
buffer[4]
1 byte value
buffer[519]
1 byte value
Caller’s %rbp
8 byte value
Caller Ret Address
8 byte value
%rsp
%rbx
%rbp
%rsp
%rbp
Arrays on the heap – part 1
“Global” Arrays (i.e. Static Class/Can be either File or Block Scope)
Arrays of elements with initial values of 0 by default
If stored in the data section of application (i.e., static arrays)
Accessed through a memory address
.section
.data
staticArray1:
.skip 48,0 # staticArray1 is 48 bytes long
# initialized to zero
# equivalent to static char staticArray1[48];
staticArray2:
.long 1 # staticArray2 is 20 bytes long
.long 2 # equivalent to
.long 3 # static int staticArray2[5]={1,2,3,4,5}
.long 4
.long 5
Arrays on the heap – part 2
“Global” Arrays (i.e. Static Class/Can be either File or Block Scope)
Arrays of elements with initial values of 0 by default
If stored in the data section of application (i.e., static arrays)
Accessed through a memory address
MemArrayEx:
pushq %rbp
movq %rsp, %rbp
pushq %rbx
pushq %rsi
movq $staticArray1, %rsi #base register
movq $0x0, %rbx #index register
movq $0x0,(%rsi,%rbx,4) #set 1st element to 0
Arrays
If an array holds elements larger than 1 byte, the index will need to be multiplied by the size of the element
#access to array of elements of size 4,
#with scaling, where rax holds the index
#i, and rbx is base register:
#e.g., arr[i] = 11223344
movl $11223344,(%rbx,%rax,4)
...
Arrays of size larger than 8 bytes
What if the array holds elements larger than 8 bytes? For example, what if it is an array of structures?
Recall that, in x86-64, scaling factors can only be: 1, 2, 4, or 8 so
(%rbx, %rcx, 20) won’t compile!!
Therefore, for arrays with elements larger than 8 bytes, manual scaling must be used
What if we had an array of structures where each structure is 20 bytes???
#Here, two index registers are used, one
#for the conventional index (here, %rcx),
#and one for a scaled index register,
#here, %rax. This is “manual scaling.”
movq $0, %rcx
# signed multiply
# imulq aux, src, Dest
imulq $20,%rcx,%rax # manually scale index, NOTE! 3 operand mult
#Suppose we want: ptr = &arr[i]
leaq (%rbx,%rax), %rdx # what is in %rdx???
Arrays of size larger than 8 bytes
What if the array holds elements larger than 8 bytes? For example, what if it is an array of structures?
Recall that, in x86-64, scaling factors can only be: 1, 2, 4, or 8 so
(%rbx, %rcx, 20) won’t compile!!
Therefore, for arrays with elements larger than 8 bytes, manual scaling must be used
What if we had an array of structures where each structure is 20 bytes???
#Here, two index registers are used, one
#for the conventional index (here, %rcx),
#and one for a scaled index register,
#here, %rax. This is “manual scaling.”
movq $0, %rcx
# signed multiply
# imulq aux, src, Dest
imulq $20,%rcx,%rax # manually scale index, NOTE! 3 operand mult
#Suppose we want: ptr = &arr[i]
leaq (%rbx,%rax), %rdx # what is in %rdx???
Address to beginning of structure in an array!
/docProps/thumbnail.jpeg