1. 1 IKI10230 Pengantar Organisasi Komputer Kuliah no. 07: CALL, RET, Stacks Sumber: 1. Paul Carter, PC Assembly Language 2. Hamacher. Computer Organization, ed-5 3. Materi kuliah CS61C/2000 & CS152/1997, UCB 4. Intel Architecture Software Developer’s Manual 31 Maret 2004 L. Yohanes Stefanus (yohanes@cs.ui.ac.id) Bobby Nazief (nazief@cs.ui.ac.id) bahan kuliah: http://www.cs.ui.ac.id/kuliah/POK/

2. 2 REVIEW

3. 3 Unconditional vs Conditional (1/2) °Unconditional Branch (JMP) umumnya digunakan untuk melengkapi Conditional Branch (Jcc) untuk “keluar” dari IF-THEN-ELSE-BLOCK: 1. ; code to set flags 2. Jcc Then-Block 3. ; Else-Block instructions 4. Jmp Next-Block 5.Then-Block: 6. ; Then-Block instructions 7.Next-Block: 8. ; Next-block instructions

4. 4 Unconditional vs Conditional (2/2) °the following pseudo-code: if ( EAX == 0 ) EBX = 1; else EBX = 2; °could be written in assembly as: 1. cmp eax, 0 ; set flags (ZF set if eax - 0 = 0) 2. jz thenblock ; if ZF is set branch to thenblock 3. mov ebx, 2 ; ELSE part of IF 4. jmp next ; jump over THEN part of IF 5.thenblock: 6. mov ebx, 1 ; THEN part of IF 7.next:

5. 5 Complexity of Conditional Branches °Simple Conditional Branches: only look at 1 flag JZ Jump if ZF is set (result is 0) JNZ Jump if ZF is unset JC Jump if CF is set (carry-out is generated) JNC Jump if CF is unset JO Jump if OF is set (result is overflow) JNO Jump if OF is unset JS Jump if SF is set (result is negative) JNS Jump if SF is unset JP Jump if PF is set (parity is even) JNP Jump if PF is unset °Complex (higher level) Conditional Branches: Unsigned Numbers: -JA/JNBE Jump if above/Jump if not below or equal(CF or ZF) == 0 -JAE/JNB Jump if above or equal/Jump if not belowCF == 0 -JB/JNAE Jump if below/Jump if not above or equalCF == 1 -JBE/JNA Jump if below or equal/Jump if not above(CF or ZF) == 1 -JE Jump if equalZF == 1 Signed Numbers: -JG/JNLE Jump if greater/Jump if not less or equal ((SF xor OF) or ZF) == 0 -JGE/JNL Jump if greater or equal/Jump if not less (SF xor OF) == 0 -JL/JNGE Jump if less/Jump if not greater or equal (SF xor OF) == 1 -JLE/JNG Jump if less or equal/Jump if not greater ((SF xor OF) or ZF) == 1

6. 6 Complex Condition (v1: using simple ones) °consider the following pseudo-code: if ( EAX >= 5 ) EBX = 1; else EBX = 2; °here is assembly code that tests for these conditions (assuming that EAX is signed): 1. cmp eax, 5 2. js signon ; goto signon if SF = 1 3. jo elseblock ; goto elseblock if OF = 1 and SF = 0 4. jmp thenblock ; goto thenblock if SF = 0 and OF = 0 5.signon: 6. jo thenblock ; goto thenblock if SF = 1 and OF = 1 7.elseblock:; SF=0 and OF=1 or SF=1 and OF=0 8. mov ebx, 2 9. jmp next 10.thenblock: 11. mov ebx, 1 12.next :

7. 7 CMP V1,V2; v1,v2: signed numbers °JGE Jump if greater or equal(SF xor OF) == 0 °Remember: overflow may occur during comparison! 1.v1>0 & v2>0 or v1<0 & v2<0 1.v1>v2  v1-v2>0  SF = 0 & OF = 0 2.v1=v2  v1-v2=0  SF = 0 & OF = 0 3.v1<v2  v1-v2<0  SF = 1 & OF = 0 2.v1>0 & v2<0, assume 4-bit integers 1.v1=6>v2=-1  v1-v2=7>0  SF = 0 & OF = 0 2.v1=7>v2=-3  v1-v2=-6>0  SF = 1 & OF = 1 3.v1 0, assume 4-bit integers 1.v1=-1<v2=6  v1-v2=-7<0  SF = 1 & OF = 0 2.v1=-3<v2=7  v1-v2=6<0  SF = 0 & OF = 1

8. 8 CMP V1,V2; v1,v2: unsigned numbers °JA Jump if above (CF or ZF) == 0 °JAE Jump if above or equalCF == 0 °JB Jump if belowCF == 1 °JBE Jump if below or equal(CF or ZF) == 1 1.v1>v2  v1-v2>0  CF = 0 & ZF = 0 2.v1=v2  v1-v2=0  CF = 0 & ZF = 1 3.v1<v2  v1-v2<0  CF = 1 & ZF = 0

9. 9 Complex Condition (v2: using complex ones) °consider the following pseudo-code: if ( EAX >= 5 ) EBX = 1; else EBX = 2; °here is assembly code that tests for these conditions (assuming that EAX is signed): 1. cmp eax, 5 2. jge thenblock 3. mov ebx, 2 4. jmp next 5.thenblock: 6. mov ebx, 1 7.next:

10. 10 Loop (1) °the following pseudo-code: sum = 0; for ( i=10; i>0; i-- ) sum += i; °could be translated into assembly as: 1. mov eax, 0; eax is sum 2. mov ecx, 10; ecx is i 3.loop_start: 4. add eax, ecx 5. loop loop_start °or: 1. mov eax, 0; eax is sum 2. mov ecx, 10; ecx is i 3.loop_start: 4. add eax, ecx 5. dec ecx 6. jnz loop_start

11. 11 Loop (2) °the following pseudo-code: sum = 0; for ( i=0; i<10; i++ ) sum += i; °could be translated into assembly as: 1. mov eax, 0; eax is sum 2. mov ecx, 0; ecx is i 3.loop_start: 4. add eax, ecx 5. inc ecx 6. cmp ecx,10 7. jne loop_start

12. 12 WHILE Loop °The while loop is a top tested loop: while( EAX == 1 ) { body of loop; } °This could be translated into: 1.while: 2. cmp eax,1 3. jne endwhile ; select xx so that branches if false 4. ; body of loop 5. jmp while 6.endwhile:

13. 13 DO WHILE Loop °The do while loop is a bottom tested loop: do { body of loop; } while( EAX == 1 ); °This could be translated into: 1.do: 2. ; body of loop 3. cmp eax,1 4. je do ; select xx so that branches if true

14. 14 Stacks, Subroutine Calls

15. 15 Stacks °Lokasi memori yang pengaksesan datanya dibatasi dengan cara LIFO (Last In, First Out) data terakhir yang disimpan kedalam stack akan menjadi data pertama yang diperoleh pada saat stack diakses °Push: memasukkan data ke Stack °Pop: mengeluarkan data yang berada di top-of-stack (TOS) alamat TOS disimpan dalam register Stack Pointer (ESP) 0 2 k -1 Top-of-Stack: ESP Bottom-of-Stack Stack Push Pop

16. 16 Operasi pada Stacks Push NewItem:SubESP,4 Mov[ESP],NewItem 19 17 -28 SP 19 17 19 -28 SP NewItem Item NewItem Item Pop Item: MovItem,[ESP] AddESP,4 Bahaya Overflow Bahaya Underflow SP

17. 17 Call & Ret Instructions °The CALL instruction transfers program control from the current (or calling procedure) to another procedure (the called procedure). To allow a subsequent return to the calling procedure, the CALL instruction saves the current contents of the EIP register on the stack before jumping to the called procedure. The EIP register (prior to transferring program control) contains the address of the instruction following the CALL instruction. When this address is pushed on the stack, it is referred to as the return instruction pointer or return address. °The RET instruction transfers program control from the procedure currently being executed (the called procedure) back to the procedure that called it (the calling procedure). Transfer of control is accomplished by copying the return instruction pointer from the stack into the EIP register. The RET instruction has an optional operand, the value of which is added to the contents of the ESP register as part of the return operation. This operand allows the stack pointer to be incremented to remove parameters from the stack that were pushed on the stack by the calling procedure.

18. 18 SubRoutines (the Called Procedure) °SubRoutine adalah sekumpulan instruksi yang mengerjakan suatu fungsi tertentu dan diakhiri dengan instruksi RET (return) °SubRoutine biasanya dipanggil (CALL) oleh program lain dan setelah SubRoutine selesai mengerjakan fungsinya, kendali program dikembalikan (RET) ke program pemanggil LokasiProgram Utama 200CallSUB 201instruksi_berikutnya LokasiSubroutine SUB 1000instruksi_i... Ret 201 EIP [ESP] 1000 201

19. 19 SubRoutine’s Call & Stacks LokasiProgram Utama 200 Push EAX 201 Call SUB 202 Pop EAX 203 instruksi_berikutnya LokasiSubroutine SUB 1000instruksi_i... Add EAX,EBX... Return 1000 EIP ESP 99 202 Setelah ‘Call SUB’ 99 EAX 202 ESP 99 202 Setelah ‘Return’ EIP EAX

20. 20 LokasiProgram Utama 200 MovECX,[N] 201 MovEBX,NUM 202 CallLISTADD 203 MovEAX,[SUM] … LokasiSubroutine LISTADD LISTADD: MovEAX,0 L1: AddEAX,[EBX] AddEBX,4 LoopL1 Ret Passing Parameters via Registers Contoh:... int sum; int n = 112; int[ ] num = new int[n]; … sum = ListAdd(n, num);... °Caller & Subroutine share the same registers °Passing by Value: [N] via ECX °Passing by Reference: NUM via EBX

21. 21 LokasiProgram Utama PushNUM Push[N] CallLISTADD MovEAX,[ESP] Mov[SUM],EAX AddESP,8 … LokasiSubroutine LISTADD LISTADD:PushEAX PushEBX PushECX MovECX,[ESP+16] MovEBX,[ESP+20] MovEAX,0 L1: AddEAX,[EBX] AddEBX,4 LoopL1 Mov[ESP+16],EAX PopECX PopEBX PopEAX Ret Passing Parameters via Stack Frame EIP (prg. Utama) EAX ECX EBX [N] NUM ESP ESP+4 ESP+8 ESP+12 ESP+16 ESP+20 ESP ESP+4

22. 22 sub1.asm (SubRoutine Call w/o CALL-RET) mov ebx, input1 ; store address of input1 into ebx mov ecx, ret1 ; store return address into ecx jmp short get_int; read integer ret1:... ; subprogram get_int ; Parameters: ; ebx - address of dword to store integer into ; ecx - address of instruction to return to ; Notes: ; value of eax is destroyed get_int: call read_int mov [ebx], eax ; store input into memory jmp ecx; jump back to caller

23. 23 sub2.asm (Passing Parameters via Registers) mov ebx, input1; store address of input1 into ebx call get_int ; read integer... ; subprogram get_int ; Parameters: ; ebx - address of word to store integer into ; Notes: ; value of eax is destroyed get_int: call read_int mov [ebx], eax ; store input into memory ret ; jump back to caller

24. 24 sub3.asm (Passing Parameters via Stack Frame) push edx ; save i on stack push dword input; push address on input on stack call get_int add esp, 8 ; remove i and &input from stack; subprogram get_int... ; Parameters (in order pushed on stack) ; number of input (at [ebp + 12]) ; address of word to store input into (at [ebp + 8]) ; Notes: ; values of eax and ebx are destroyed get_int: push ebp mov ebp, esp mov eax, [ebp + 12] call print_int... call read_int mov ebx, [ebp + 8] mov [ebx], eax ; store input into memory pop ebp ret ; jump back to caller [ESP][EBP] [ESP+4][EIP] [ESP+8][input] [ESP+12][edx]