Flags & Control Flow in Assembly

	mov eax,3
	jmp lemme_outta_here
	mov eax,999  ; <- not executed!
lemme_outta_here:
	ret

	int x=3;
	goto quiddit;
	x=999;
quiddit:
	return x;

Conditional Jumps: Branching in Assembly

• A compare instruction, like "cmp", compares two values.
• A conditional jump instruction, like "je" (jump-if-equal), does a goto somewhere if the two values satisfy the right condition.

	mov eax,3
	cmp eax,3 ; how does eax compare with 3?
	je lemme_outta_here  ; if it's equal, then jump
	mov eax,999  ; <- not executed *if* we jump over it
lemme_outta_here:
	ret

(Try this in NetRun now!)

	mov eax,1
	cmp eax,3 ; how does eax compare with 3?
	jl lemme_outta_here  ; if it's less, then jump
	mov eax,999  ; <- not executed *if* we jump over it
lemme_outta_here:
	ret

(Try this in NetRun now!)

   0:	b8 01 00 00 00       	mov    eax,0x1
   5:	83 f8 03             	cmp    eax,0x3
   8:	7c 05                	jl     f <foo+0xf>
   a:	b8 e7 03 00 00       	mov    eax,0x3e7
   f:	c3                   	ret

More Complex Control Flow: C--

int main() {
	int i=0;
	if (i>=10) goto byebye;
	std::cout<<"Not too big!\n";
byebye:	return 0;
}

	int i, n=10;
	for (i=0;i<n;i++) {
		std::cout<<"In loop: i=="<<i<<"\n";
	}

	int i=0, n=10;
start:	std::cout<<"In loop: i=="<<i<<"\n";
	i++;
	if (i<n) goto start;

Comparison Instruction

Compare vs. Subtract: Examples

mov ecx,5

sub ecx,7
jl yes_it_jumped
; ... else no, it didn't jump: return 0
mov eax,0
ret

yes_it_jumped: ; ... so return 1
mov eax,1
ret

mov edx,5
mov eax,0

loop_start:
  add eax,7
  sub edx,1
  jnz loop_start ; Jumps if edx is still nonzero

ret

Flags and The Gory Details

• ZF-- The "zero flag".  Set whenever the previous arithmetic result was zero.  Can be used by the "jz" (jump if last result was zero) or "jnz" instructions.  "je" (jump if equal) and "jne" (jump if not equal) are just aliases of jz & jnz, because if the difference is zero, then the two values are equal.  For example, this code checks if the input is equal to 4:
      extern read_input
      call read_input
      cmp eax,4
      je equal
      add eax, 20 ; If not equal, add
  equal: ret;  If equal, just return
  
• CF--The "carry flag".  Set to indicate the bit that carries out of an addition or subtraction.  For signed numbers, this doesn't really indicate a problem, but for unsigned numbers, this indicates an overflow.  Can be used by the "jc" (jump if carry flag is set) instruction.  Set by all the arithmetic instructions.  Can be added into another arithmetic operation with "adc" (add with carry).  For example, you can preserve the bit overflowing out of a big add like this:
  mov ecx, 0x8000ff00
  add ecx, ecx
  mov eax,0
  adc eax,eax ; Adds eax, eax, and the carry flag together
  "adc" is used in the compiler's implementation of the 64-bit "long long" datatype, and in general in "multiple precision arithmetic" software, like the GNU Multiple Precision Arithmetic Library.  It'd also be used to implement overflow checking by a careful compiler.  The carry and zero flags are also used by the unsigned comparison instructions: "jb" (jump if unsigned below), "jbe" (jump if unsigned below or equal), "ja" (jump if unsigned above), and "jae" (jump if unsigned above or equal) in the usual way.
  
• SF-- The "sign flag", which indicates a negative signed result.  This is just the highest bit of the result, and it ignores any overflow.  Because overflow can screw up your answer, "jl" looks at both SF and OF to implement signed comparison.
  
• OF-- The signed "overflow flag". Set by subtract, add, and compare in a surprisingly clever way: for example, if you add two positive numbers, and get a negative number, then overflow happened.  If you add a positive and a negative number, overflow can't happen.  If you add two negative numbers and get a positive number, then overflow happened.  OF is used in the signed comparison instructions "jl" (jump if less than), "jle" (jump if less than or equal to), "jg" (jump if greater than), and "jge" (jump if greater than or equal to) instructions.  See below for exactly how OF and SF are used. For example:
• jae: unsigned >=.  Jumps if CF==0.  OK, we've just computed a-b, and want to jump if a>=b.  If a-b is positive (or zero), then CF==0 and a>=b, so we should jump, and do.  If a-b is negative, we'd get a carry, CF==1, and we don't jump.
  
• jge: signed >=.  Jumps if SF==OF.  Normally, we didn't overflow, so OF is zero, and this is exactly the same as the jae case above.  Recall that this is a signed compare, so we may get a carry if we're comparing negative numbers, so it's not worth looking at CF.  Curiously, if we overflowed, the sign bit is now wrong, so if OF is one, we compare SF against one, which flips the comparison back the right way again.
• PF and AF are really bizarre ancient flags, holdovers from the 8 bit days.  They both operate only on the low 8 bits of the result.  PF returns odd parity, like for serial communication.  AF indicates a carry from the low 4 bits up into the high 4 bits, which is used for the ancient technique of "binary coded decimal" (BCD), where "0x23" means decimal twenty-three, not thirty-five like normal hex.  It's nasty, now gone, and good riddance!

mov ecx,4 ; values to compare
mov edx,7

mov eax,0

cmp ecx,edx
jne skipe ; Equal to zero flag
add eax,0xE
skipe:

cmp ecx,edx
jno skipo ; Overflow flag (assuming signed)
add eax,0x80
skipo:

cmp ecx,edx
jns skips ; Sign flag (negative result)
add eax,0x500
skips:

cmp ecx,edx
jnc skipc ; Carry flag (33rd bit of result)
add eax,0xC000
skipc:

ret

(Try this in NetRun now!)

The Even Nastier Details