Microsoft PowerPoint – 21_X86_Assembly_Language_Part2
O
SU
C
SE
2
42
1
J.E.Jones
X86-64Assembly Language – Part 2: data movement
instructions, memory addressing modes, address calculations
O
SU
C
SE
2
42
1
J. E. Jones
Turn on your microphones and just answer…
O
SU
C
SE
2
42
1
J. E. Jones
What is the size of a memory address on stdlinux???
O
SU
C
SE
2
42
1
J. E. Jones
What is the size of a memory address on stdlinux???
8 bytes = 64 bits
What is the only suffix should we be using when we are
calculating/moving addresses?
O
SU
C
SE
2
42
1
J. E. Jones
What is the size of a memory address on stdlinux???
8 bytes = 64 bits
What is the only suffix should we be using when we are
calculating/moving addresses?
q
What size registers should we be using when we are
calculating addresses?
O
SU
C
SE
2
42
1
J. E. Jones
What is the size of a memory address on stdlinux???
8 bytes = 64 bits
What is the only suffix should we be using when we are
calculating/moving addresses?
q
What size registers should we be using when we are
calculating addresses?
%rax,%rbx, %rcx, %rdx, %r12, etc.
Is there ever an exception to this?
O
SU
C
SE
2
42
1
J. E. Jones
What is the size of a memory address on stdlinux???
8 bytes = 64 bits
What is the only suffix should we be using when we are
calculating/moving addresses?
q
What size registers should we be using when we are
calculating/moving addresses?
%rax,%rbx, %rcx, %rdx, %r12, etc.
Is there ever an exception to this?
Not ever!
(as long as we are working on a 64-bit processor.)
O
SU
C
SE
2
42
1
J. E. Jones
Normal (R) Mem[Reg[R]]
◦ Register R specifies memory address
◦ Aha! Pointer dereferencing in C
movq (%rcx),%rax [rax = *rcx]
Displacement D(R) Mem[Reg[R]+D]
◦ Register R specifies start of memory region
◦ Constant displacement D specifies offset
movq 8(%rbp),%rdx [rdx = *(rbp+8)]
O
SU
C
SE
2
42
1
J. E. Jones
Normal (R) Mem[Reg[R]]
◦ Register R specifies memory address
movq (%rcx),%rax [rax = *rcx]
◦ Are any of these a valid instruction on stdlinux?
movq (%ecx),%rax
movl (%ecx),%eax
movb (%rax),%al
O
SU
C
SE
2
42
1
J. E. Jones
Normal (R) Mem[Reg[R]]
◦ Register R specifies memory address
movq (%rcx),%rax
◦ Are any of these a valid instruction on stdlinux?
movq (%ecx),%rax #No. must use %rcx
movl (%ecx),%eax
movb (%rax),%al
O
SU
C
SE
2
42
1
J. E. Jones
Normal (R) Mem[Reg[R]]
◦ Register R specifies memory address
movq (%rcx),%rax
◦ Are any of these a valid instruction on stdlinux?
movq (%ecx),%rax #No. must use %rcx
movl (%ecx),%eax #No. must use %rcx
# l suffix and dest
# of %eax is OK
movb (%rax),%al
O
SU
C
SE
2
42
1
J. E. Jones
Normal (R) Mem[Reg[R]]
◦ Register R specifies memory address
movq (%rcx),%rax
◦ Are any of these a valid instruction on stdlinux?
movq (%cx),%rax #No. must use %rcx
movl (%ecx),%eax #No. must use %rcx
# l suffix and dest
# of %eax is OK
movb (%rax),%al #Yes! Address is 8
#byte reg, suffix
#and dest are 1 byte
O
SU
C
SE
2
42
1
J. E. Jones
void swap(long *xp, long *yp){
register long t0;
register long t1;
t0 = *xp;
t1 = *yp;
*xp = t1;
*yp = t0;
}
swap:
movq (%rdi), %r8
movq (%rsi), %rdx
movq %rdx, (%rdi)
movq %r8, (%rsi)
ret
C language Program Equivalent x86-64 Program
O
SU
C
SE
2
42
1
J. E. Jones
Most General Form of the address expression
Imm(Rb,Ri,S) Mem[Imm+ Reg[Rb]+S*Reg[Ri]]
or Address = Imm+Rb+Ri*S
where:
◦ Imm: Constant “displacement”
It’s often a “displacement” of 1, 2, 4 or 8 bytes, but can be any constant value
◦ Rb: Base register: Any of the16 integer registers
Since we are dealing with addresses, it’s got to be one of the 8-byte registers
◦ Ri: Index register: Any register except %rsp
Since it’s being added to an 8-byte register, it has to be one as well.
◦ S: Scale: Only 1, 2, 4, or 8 (why these numbers?)
◦ This form is seen often when referencing elements of arrays
◦ DON’T CONFUSE Imm and S!!
Imm can be *any* constant
S can only be 1, 2, 4, or 8
One of the bigger mistakes
students make!
O
SU
C
SE
2
42
1
J. E. Jones
Imm(Rb,Ri,S) Mem[Imm+ Reg[Rb]+S*Reg[Ri]]
or Address = Imm+Rb+Ri*S
int ar1[60];
If %rdx contains start address of array (ar1), (e.g., 0x600400)
%rcx contains index into ar1 (e.g., 15)
movl (%rdx, %rcx, 4), %eax
Read from address (0x600400 + 60 (0x3c) )= 0x60043c and
put the 4-byte value in register eax
15* 4
O
SU
C
SE
2
42
1
J. E. Jones
Most General Form of the address expression
Imm(Rb,Ri,S) Mem[Imm+ Reg[Rb]+S*Reg[Ri]]
or Address = Imm+Rb+Ri*S
Each field has a default value to use if it is missing from the expression above:
◦ Imm: 0, Rb: 0, Ri: 0, S: 1
Special Cases
(Rb,Ri) Mem[Reg[Rb]+Reg[Ri]] 0+Rb+Ri*1
Imm(Rb,Ri) Mem[Reg[Rb]+Reg[Ri]+Imm] Imm+Rb+Ri*1
(Rb,Ri,S) Mem[Reg[Rb]+S*Reg[Ri]] 0+Rb+Ri*S
Imm(,Ri,S) Mem[S*Reg[Ri]+Imm] Imm+0+Ri*S
O
SU
C
SE
2
42
1
J. E. Jones
Examples: These read a value in memory into a register
movq 24(%rax,%rcx,4), %rdx
means read 8 bytes from this address: (%rax + 4*%rcx + 24)
and store it in %rdx
movl 24(%rax,%rcx,4), %edx
means read 4 bytes from this address: (%rax + 4*%rcx + 24)
and store it in %edx
movw 24(%rax,%rcx,4), %dx
means read 2 bytes from this address: (%rax + 4*%rcx + 24)
and store it in %dx
movb 24(%rax,%rcx,4), %dl
means read 1 byte from this address: (%rax + 4*%rcx + 24)
and store it in %dl
Note that only suffix and destination register size change. Suffix and
destination register size (on a read from memory) must match. Address
calculations are always 8 bytes.
O
SU
C
SE
2
42
1
J. E. Jones
Examples: These write a register value to a place in memory
movq %rdx, 24(%rax,%rcx,4)
means write 8 bytes to this address: (%rax + 4*%rcx + 24)
from %rdx
movl %edx, 24(%rax,%rcx,4)
means write 4 bytes to this address: (%rax + 4*%rcx + 24)
from %edx
movw %dx, 24(%rax,%rcx,4)
means write 2 bytes to this address: (%rax + 4*%rcx + 24)
from %dx
movb %dl, 24(%rax,%rcx,4)
means write 1 byte to this address: (%rax + 4*%rcx + 24)
from %dl
Note that only suffix and source register size change. Suffix and source
register size (on a write to memory) must match . Address calculations
are always 8 bytes.
O
SU
C
SE
2
42
1
J. E. Jones
Expression Address Computation Address
0x8(%rdx)
(%rdx,%rcx)
(%rdx,%rcx,4)
0x80(,%rdx,2)
%rdx 0xf000
%rcx 0x0100 Address = Imm+Rb+Ri*S
O
SU
C
SE
2
42
1
J. E. Jones
Expression Address Computation Address
0x8(%rdx) 0xf000 + 0x0008 0xf008
(%rdx,%rcx)
(%rdx,%rcx,4)
0x80(,%rdx,2)
%rdx 0xf000
%rcx 0x0100 Address = Imm+Rb+Ri*S
O
SU
C
SE
2
42
1
J. E. Jones
Expression Address Computation Address
0x8(%rdx) 0xf000 + 0x0008 0xf008
(%rdx,%rcx) 0xf000 + 0x100 0xf100
(%rdx,%rcx,4)
0x80(,%rdx,2)
%rdx 0xf000
%rcx 0x0100 Address = Imm+Rb+Ri*S
O
SU
C
SE
2
42
1
J. E. Jones
Expression Address Computation Address
0x8(%rdx) 0xf000 + 0x0008 0xf008
(%rdx,%rcx) 0xf000 + 0x100 0xf100
(%rdx,%rcx,4) 0xf000 + 4*0x100 0xf400
0x80(,%rdx,2)
%rdx 0xf000
%rcx 0x0100 Address = Imm+Rb+Ri*S
O
SU
C
SE
2
42
1
J. E. Jones
Expression Address Computation Address
0x8(%rdx) 0xf000 + 0x0008 0xf008
(%rdx,%rcx) 0xf000 + 0x100 0xf100
(%rdx,%rcx,4) 0xf000 + 4*0x100 0xf400
0x80(,%rdx,2) 0x0+ 2*0xf000 + 0x80 0x1e080
%rdx 0xf000
%rcx 0x0100 Address = Imm+Rb+Ri*S
O
SU
C
SE
2
42
1
J. E. Jones
What if we want to compute an address, but not
necessarily access value at that address just yet?
What if we want to compute an address and put it in an
8-byte register to use later?
What if we just want to compute a formula of the form:
◦ x + k*y + C, where x & y are variables; k =1, 2, 4, or 8 and C
is some constant
There’s a way to do this with an x86-64 instruction, but
unless you are paying attention, you will confuse it
with the mov instruction.
O
SU
C
SE
2
42
1
J. E. Jones
leaq Src, Dst
◦ Load Effective Address
◦ Src is address mode expression (i.e. Imm(Rb,Ri,S) )
◦ Set Dst to address denoted by expression (since suffix is q, Dst MUST be an 8-byte register)
◦ Doesn’t affect condition codes
◦ http://stackoverflow.com/questions/1658294/whats-the-purpose-of-the-lea-instruction
Uses
◦ Computing addresses without a memory reference
E.g., translation of p = &x[i];
◦ Computing arithmetic expressions of the form x + k*y + C,
where x & y are variables;
k = 1, 2, 4, or 8
and C is some constant
e. g. if %rdx contains a value x, then leaq 7(%rdx, %rdx,4), %rax sets %rax to 5x+7
Example
3x * 4 = 12x
long m12(long x)
{
return x*12;
}
leaq (%rdi,%rdi,2), %rax # t = x+x*2 =3x
salq $2, %rax # return t<<2
Converted to ASM by compiler:
IMPORTANT!
O
SU
C
SE
2
42
1
J. E. Jones
leaq Src, Dst
◦ Load Effective Address
◦ Src is address mode expression (i.e. Imm(Rb,Ri,S) )
◦ Set Dst to address denoted by expression (since suffix is q, Dst MUST be an 8-byte register)
◦ Doesn’t affect condition codes
◦ http://stackoverflow.com/questions/1658294/whats-the-purpose-of-the-lea-instruction
Uses
◦ Computing addresses without a memory reference
E.g., translation of p = &x[i];
◦ Computing arithmetic expressions of the form x + k*y + C,
where x & y are variables;
k = 1, 2, 4, or 8
and C is some constant
e. g. if %rdx contains a value x, then leaq 7(%rdx, %rdx,4), %rax sets %rax to 5x+7
Example
3x * 4 = 12x
salq instruction == shlq instruction
long m12(long x)
{
return x*12;
}
leaq (%rdi,%rdi,2), %rax # t = x+x*2=3x
salq $2, %rax # return t<<2
Converted to ASM by compiler:
IMPORTANT!
Using a screwdriver
as a hammer!!
O
SU
C
SE
2
42
1
J. E. Jones
Examples: These compute functions of the form Rb+ S*Ri + C
leaq 24(%rax,%rcx,4), %rdx
means compute 8-byte value : (%rax + 4*%rcx + 24)
and store it in %rdx
leal 24(%eax,%ecx,4), %edx
means compute 4-bytes value: (%eax + 4*%ecx + 24)
and store it in %edx
leaw 24(%ax,%cx,4), %dx
means compute 2 bytes value: (%ax + 4*%cx + 24)
and store it in %dx
O
SU
C
SE
2
42
1
J. E. Jones
Since we know that leaq Imm(Rb,Ri,S), %Rd
calculates Imm + Rb + Ri*S and puts the result in
%Rd
If %rdx contains some value x and %rcx contains
some value y, then what value does %rax contain in
these examples? (in terms of x & y)
◦ leaq (%rdx, %rcx), %rax
◦ leaq (%rdx, %rcx,4), %rax
◦ leaq 5(%rdx, %rdx,4), %rax
◦ leaq 7(%rcx, %rcx,2), %rax
◦ leaq 10(%rdx, %rcx,8), %rax
◦ leaq 0x4000(,%rdx, 8), %rax
O
SU
C
SE
2
42
1
J. E. Jones
Since we know that leaq Imm(Rb,Ri,S), %Rd
calculates Imm + Rb + Ri*S and puts the result in
%Rd
If %rdx contains some value x and %rcx contains
some value y, then what value does %rax contain in
these examples? (in terms of x & y)
◦ leaq (%rdx, %rcx), %rax x + y
◦ leaq (%rdx, %rcx,4), %rax
◦ leaq 5(%rdx, %rdx,4), %rax
◦ leaq 7(%rcx, %rcx,2), %rax
◦ leaq 10(%rdx, %rcx,8), %rax
◦ leaq 0x4000(,%rdx, 8), %rax
O
SU
C
SE
2
42
1
J. E. Jones
Since we know that leaq Imm(Rb,Ri,S), %Rd
calculates Imm + Rb + Ri*S and puts the result in
%Rd
If %rdx contains some value x and %rcx contains
some value y, then what value does %rax contain in
these examples? (in terms of x & y)
◦ leaq (%rdx, %rcx), %rax x + y
◦ leaq (%rdx, %rcx,4), %rax x + 4y
◦ leaq 5(%rdx, %rdx,4), %rax
◦ leaq 7(%rcx, %rcx,2), %rax
◦ leaq 10(%rdx, %rcx,8), %rax
◦ leaq 0x4000(,%rdx, 8), %rax
O
SU
C
SE
2
42
1
J. E. Jones
Since we know that leaq Imm(Rb,Ri,S), %Rd
calculates Imm + Rb + Ri*S and puts the result in
%Rd
If %rdx contains some value x and %rcx contains
some value y, then what value does %rax contain in
these examples? (in terms of x & y)
◦ leaq (%rdx, %rcx), %rax x + y
◦ leaq (%rdx, %rcx,4), %rax x + 4y
◦ leaq 5(%rdx, %rdx,4), %rax 5 + x + 4x = 5x + 5
◦ leaq 7(%rcx, %rcx,2), %rax
◦ leaq 10(%rdx, %rcx,8), %rax
◦ leaq 0x4000(,%rdx, 8), %rax
O
SU
C
SE
2
42
1
J. E. Jones
Since we know that leaq Imm(Rb,Ri,S), %Rd
calculates Imm + Rb + Ri*S and puts the result in
%Rd
If %rdx contains some value x and %rcx contains
some value y, then what value does %rax contain in
these examples? (in terms of x & y)
◦ leaq (%rdx, %rcx), %rax x + y
◦ leaq (%rdx, %rcx,4), %rax x + 4y
◦ leaq 5(%rdx, %rdx,4), %rax 5 + x + 4x = 5x + 5
◦ leaq 7(%rcx, %rcx,2), %rax 7 + y + 2y = 3y + 7
◦ leaq 10(%rdx, %rcx,8), %rax
◦ leaq 0x4000(,%rdx, 8), %rax
O
SU
C
SE
2
42
1
J. E. Jones
Since we know that leaq Imm(Rb,Ri,S), %Rd
calculates Imm + Rb + Ri*S and puts the result in %Rd
If %rdx contains some value x and %rcx contains
some value y, then what value does %rax contain in
these examples? (in terms of x & y)
◦ leaq (%rdx, %rcx), %rax x + y
◦ leaq (%rdx, %rcx,4), %rax x + 4y
◦ leaq 5(%rdx, %rdx,4), %rax 5 + x + 4x = 5x + 5
◦ leaq 7(%rcx, %rcx,2), %rax 7 + y + 2y = 3y + 7
◦ leaq 10(%rdx, %rcx,8), %rax 10 + x + 8y = x + 8y + 10
◦ leaq 0x4000(,%rdx, 8), %rax
O
SU
C
SE
2
42
1
J. E. Jones
Since we know that leaq Imm(Rb,Ri,S), %Rd
calculates Imm + Rb + Ri*S and puts the result in %Rd
If %rdx contains some value x and %rcx contains
some value y, then what value does %rax contain in
these examples? (in terms of x & y)
◦ leaq (%rdx, %rcx), %rax x + y
◦ leaq (%rdx, %rcx,4), %rax x + 4y
◦ leaq 5(%rdx, %rdx,4), %rax 5 + x + 4x = 5x + 5
◦ leaq 7(%rcx, %rcx,2), %rax 7 + y + 2y = 3y + 7
◦ leaq 10(%rdx, %rcx,8), %rax 10 + x + 8y = x + 8y + 10
◦ leaq 0x4000(,%rdx, 8), %rax 0x4000 + 8x
O
SU
C
SE
2
42
1
J. E. Jones
Consider:
leaq (%rdi, %rdi,1), %rax => %rdi + 1*%rdi = 2%rdi
leaq (%rdi, %rdi,2), %rax => %rdi + 2*%rdi = 3%rdi
leaq (%rdi, %rdi,4), %rax => %rdi + 4*%rdi = 5%rdi
leaq (%rdi, %rdi,8), %rax => %rdi + 8*%rdi = 9%rdi
What kind of multiplication problems can you create that
might make these valuable?
leaq(%rdi, %rdi,2), %rax # 3%rdi
leaq(%rdi, %rdi,8), %rbx # 9%rdi
addq %rbx, %rax # 12%rdi
subq %rax, %rbx # 6%rdi