C assembly language ATT walkthrough?

Question

I have a simple c program that multiplies and adds three variables and returns the results. I have compiled the code into assembly language (ATT format) on a 32 bit machine. I am trying to learn assembly code, and while I can understand some of the lines, I need help understanding why for example leal (%edx, %edx, 2), %edx, would be done in the following code, like what would be the result to that, what would it accomplish?

Assembly code

.file   "calc.c"
        .text
.globl calc
        .type   calc, @function
calc:
        pushl   %ebp                   #prolog
        movl    %esp, %ebp             #prolog
        movl    8(%ebp), %edx          #move %ebp +8 into %edx 
        movl    16(%ebp), %ecx         #move %ebp +16 into %ecx
        leal    (%edx,%edx,2), %edx
        movl    12(%ebp), %eax
        leal    (%edx,%eax,2), %eax
        movl    %ecx, %edx
        sall    $4, %edx
        subl    %ecx, %edx
        addl    %edx, %eax
        popl    %ebp
        ret
        .size   calc, .-calc
        .ident  "GCC: (Ubuntu 4.3.3-5ubuntu4) 4.3.3"
        .section        .note.GNU-stack,"",@progbits

C program

#include <stdio.h>
int calc(int x, int y, int z){
    return 3*x + 2*y + 15*z;
}
int main(void) {
    int x = 2;
    int y = 6;
    int z = 11;

    int result = calc(x,y,z);

    printf("x=%d, y=%d, z=%d, result=%d\n", x,y,z,result);
    return 0;
}

Could someone help me trace the problem starting from the prolog.

Have you tried reading the manuals? What does the manual say about the `lea` instruction? What does it say about the `(a,b,c)` operand notation? — fuz, Oct 31 '17 at 16:02
Tell the compiler to optimize. Reading unoptimized compiler generated assembly is painful. — EOF, Oct 31 '17 at 16:08
See also [What's the purpose of the LEA instruction?](https://stackoverflow.com/questions/1658294/whats-the-purpose-of-the-lea-instruction) — Jester, Oct 31 '17 at 16:08
@Jester Better would be a reference to the AT&T operand syntax, but I doubt this would help OP if he can't even find and read his assembler's manual. — fuz, Oct 31 '17 at 16:09
Using a debugger, displaying registers, and stepping individual assembly instructions should reveal most of what you are looking for. — KeithSmith, Oct 31 '17 at 16:10
See also [at&t syntax](https://stackoverflow.com/questions/6819957/gnu-as-movl-eax-eax/6820015#6820015) :) Link from [x86 tag wiki](https://stackoverflow.com/tags/x86/info). Also `gcc -masm=intel` will produce intel syntax output if you find that more readable. — Jester, Oct 31 '17 at 16:11
@EOF that looks like some optimized code though, though it is optimized for some 386... — Antti Haapala -- Слава Україні, Oct 31 '17 at 16:20
@AnttiHaapala As long as uses a frame pointer, it's not optimized enough. — EOF, Oct 31 '17 at 16:21
Ah yeah I agree with that, but I tried with `-m32 -O3` and the tricky part stays the same mostly... — Antti Haapala -- Слава Україні, Oct 31 '17 at 16:22
below: could you replace the code with that from one compiled with `-S -O3` — Antti Haapala -- Слава Україні, Oct 31 '17 at 16:24

score 1 · Accepted Answer · answered Oct 31 '17 at 17:04

Maybe it can be best explained with the C function code in mind:

int calc(int x, int y, int z){
    return 3*x + 2*y + 15*z;
}

Look at parameter x. It is multiplied by 3 so it is easily recognizable in the assembly code:

movl    8(%ebp), %edx

....

leal    (%edx,%edx,2), %edx
movl    12(%ebp), %eax
leal    (%edx,%eax,2), %eax

It moves the value of argument x into edx. The address of argument x in the stack frame is ebp+8. Then later on with leal it adds edx to 2*edx and stores the value in edx. That equals 3*x.
Then loads argument y into eax, wich you can recognize easily because y is a 32bit int so it is 4 bytes past the start address of x.
Next leal adds edx (i.e. 3*x) with 2*eax (i.e. 2*y) and stores the result in eax, thus in eax you have 3*x + 2*y.
And so on...

well that makes a lot more sense than what I was trying to do: `0x8 + 0x8*2 = %edx address`. — below_avg_st, Oct 31 '17 at 22:49

score -1 · Answer 2 · answered Oct 31 '17 at 16:45

-1

I suggest you start by not optimizing your code. Your optimizer is playing games on you. If your system is pushing arguments in reverse order

8(%ebp) = x = edx
12(%ebp) = y = eax
16(%ebp) = z = ecx

With assembler games:

(%edx,%edx,2) = edx + 2 x edx = 3 x edx  (3 x X)
(%edx,%eax,2)  = edx + 2 x eax = (3 x X + 2 * y)

  movl    %ecx, %edx
  sall    $4, %edx = (16 x Z)
  subl    %ecx, %edx = 15 x Z

answered Oct 31 '17 at 16:45

user3344003

20,574
3
26
62

2

That is `gcc -O0` output. You can tell by the spill/reload between every C statement to support changing C variables with a debugger, and using gdb's `jump` command. `lea` *is* how you multiply by 3 in x86. If optimizing for code-size, you could `imul $3, (mem), %eax`, but gcc chooses not to do that at `-O0`and uses its normal method for multiplying by small constants. – Peter Cordes Oct 31 '17 at 17:14

C assembly language ATT walkthrough?

2 Answers2