Machine-Level Programming I: Introduction

Transcription

1 Machine-Level Programming I: Introduction Topics n Assembly Programmer s Execution Model n Accessing Information l Registers l Memory n Arithmetic operations

2 IA32 Processors Totally Dominate Computer Market Evolutionary Design n Starting in 1978 with 8086 n Added more features as time goes on n Still support old features, although obsolete Complex Instruction Set Computer (CISC) n Many different instructions with many different formats l But, only small subset encountered with Linux programs n Hard to match performance of Reduced Instruction Set Computers (RISC) n But, Intel has done just that! 2

3 X86 Evolution: Programmer s View Name Date Transistors K n 16-bit processor. Basis for IBM PC & DOS n Limited to 1MB address space. DOS only gives you 640K K n Added elaborate, but not very useful, addressing scheme n Basis for IBM PC-AT and Windows K n Extended to 32 bits. Added flat addressing n Capable of running Unix n Linux/gcc uses no instructions introduced in later models 3

4 X86 Evolution: Programmer s View Name Date Transistors M Pentium M Pentium/MMX M n Added special collection of instructions for operating on 64- bit vectors of 1, 2, or 4 byte integer data PentiumPro M n Added conditional move instructions n Big change in underlying microarchitecture 4

5 X86 Evolution: Programmer s View Name Date Transistors Pentium III M n Added streaming SIMD instructions for operating on 128-bit vectors of 1, 2, or 4 byte integer or floating point data n Our fish machines Pentium M n Added 8-byte formats and 144 new instructions for streaming SIMD mode 5

6 X86 Evolution: Clones Advanced Micro Devices (AMD) n Historically l AMD has followed just behind Intel l A little bit slower, a lot cheaper n Recently l Recruited top circuit designers from Digital Equipment Corp. l Exploited fact that Intel distracted by IA64 l Now are close competitors to Intel n Developing own extension to 64 bits 6

7 X86 Evolution: Clones Transmeta n Recent start-up l Employer of Linus Torvalds n Radically different approach to implementation l Translates x86 code into Very Long Instruction Word (VLIW) code l High degree of parallelism n Shooting for low-power market 7

8 New Species: IA64 Name Date Transistors Itanium M n Extends to IA64, a 64-bit architecture n Radically new instruction set designed for high performance n Will be able to run existing IA32 programs l On-board x86 engine n Joint project with Hewlett-Packard Itanium M n Big performance boost 8

9 Assembly Programmer s View E I P CPU Registers Condition Codes Addresses Data Instructions Memory Object Code Program Data OS Data Programmer-Visible State 9 n EIP Program Counter l Address of next instruction n Register File l Heavily used program data n Condition Codes l Store status information about most recent arithmetic operation l Used for conditional branching n Memory Stack l Byte addressable array l Code, user data, (some) OS data l Includes stack used to support procedures

10 Turning C into Object Code n Code in files p1.c p2.c n Compile with command: gcc -O p1.c p2.c -o p l Use optimizations (-O) l Put resulting binary in file p text C program (p1.c p2.c) Compiler (gcc -S) text Asm program (p1.s p2.s) Assembler (gcc or as) binary binary Object program (p1.o p2.o) Linker (gcc or ld) Executable program (p) Static libraries (.a) 10

11 Compiling Into Assembly C Code int sum(int x, int y) { int t = x+y; return t; } Generated Assembly _sum: pushl %ebp movl %esp,%ebp movl 12(%ebp),%eax addl 8(%ebp),%eax movl %ebp,%esp popl %ebp ret Obtain with command gcc -O -S code.c Produces file code.s 11

12 Assembly Characteristics Minimal Data Types 12 n Integer data of 1, 2, or 4 bytes l Data values l Addresses (untyped pointers) n Floating point data of 4, 8, or 10 bytes n No aggregate types such as arrays or structures l Just contiguously allocated bytes in memory Primitive Operations n Perform arithmetic function on register or memory data n Transfer data between memory and register l Load data from memory into register l Store register data into memory n Transfer control l Unconditional jumps to/from procedures l Conditional branches

13 Object Code Code for sum 0x <sum>: 0x55 0x89 0xe5 0x8b 0x45 0x0c 0x03 0x45 0x08 0x89 0xec 0x5d 0xc3 13 Total of 13 bytes Each instruction 1, 2, or 3 bytes Starts at address 0x Assembler Linker n Translates.s into.o n Binary encoding of each instruction n Nearly-complete image of executable code n Missing linkages between code in different files n Resolves references between files n Combines with static run-time libraries l E.g., code for malloc, printf n Some libraries are dynamically linked l Linking occurs when program begins execution

14 Machine Instruction Example int t = x+y; C Code n Add two signed integers 14 addl 8(%ebp),%eax Similar to expression x += y 0x401046: Assembly n Add 2 4-byte integers l Long words in GCC parlance l Same instruction whether signed or unsigned n Operands: x: Register %eax y: Memory M[%ebp+8] t: Register %eax Object Code» Return function value in %eax n 3-byte instruction n Stored at address 0x401046

15 Disassembling Object Code Disassembled <_sum>: 0: 55 push %ebp 1: 89 e5 mov %esp,%ebp 3: 8b 45 0c mov 0xc(%ebp),%eax 6: add 0x8(%ebp),%eax 9: 89 ec mov %ebp,%esp b: 5d pop %ebp c: c3 ret d: 8d lea 0x0(%esi),%esi Disassembler objdump -d p n Useful tool for examining object code n Analyzes bit pattern of series of instructions 15 n Produces approximate rendition of assembly code n Can be run on either a.out (complete executable) or.o file

16 16 Alternate Disassembly Object 0x401040: 0x55 0x89 0xe5 0x8b 0x45 0x0c 0x03 0x45 0x08 0x89 0xec 0x5d 0xc3 Disassembled 0x <sum>: push %ebp 0x <sum+1>: mov %esp,%ebp 0x <sum+3>: mov 0xc(%ebp),%eax 0x <sum+6>: add 0x8(%ebp),%eax 0x <sum+9>: mov %ebp,%esp 0x40104b <sum+11>: pop %ebp 0x40104c <sum+12>: ret 0x40104d <sum+13>: lea 0x0(%esi),%esi Within gdb Debugger gdb p disassemble sum n Disassemble procedure x/13b sum n Examine the 13 bytes starting at sum

17 What Can be Disassembled? % objdump -d WINWORD.EXE WINWORD.EXE: file format pei-i386 No symbols in "WINWORD.EXE". Disassembly of section.text: <.text>: : 55 push %ebp : 8b ec mov %esp,%ebp : 6a ff push $0xffffffff : push $0x a: dc 4c 30 push $0x304cdc91 17 n Anything that can be interpreted as executable code n Disassembler examines bytes and reconstructs assembly source

18 Moving Data Moving Data movl Source,Dest: n Move 4-byte ( long ) word n Lots of these in typical code Operand Types n Immediate: Constant integer data l Like C constant, but prefixed with $ l E.g., $0x400, $-533 l Encoded with 1, 2, or 4 bytes n Register: One of 8 integer registers l But %esp and %ebp reserved for special use l Others have special uses for particular instructions n Memory: 4 consecutive bytes of memory l Various address modes %eax %edx %ecx %ebx %esi %edi %esp %ebp 18

19 movl Operand Combinations Source Destination C Analog Imm Reg Mem movl $0x4,%eax movl $-147,(%eax) temp = 0x4; *p = -147; movl Reg Reg Mem movl %eax,%edx movl %eax,(%edx) temp2 = temp1; *p = temp; Mem Reg movl (%eax),%edx temp = *p; n Cannot do memory-memory transfers with single instruction 19

20 Simple Addressing Modes Normal (R) Mem[Reg[R]] n Register R specifies memory address movl (%ecx),%eax Displacement D(R) Mem[Reg[R]+D] n Register R specifies start of memory region n Constant displacement D specifies offset movl 8(%ebp),%edx 20

21 Using Simple Addressing Modes void swap(int *xp, int *yp) { int t0 = *xp; int t1 = *yp; *xp = t1; *yp = t0; } swap: pushl %ebp movl %esp,%ebp pushl %ebx movl 12(%ebp),%ecx movl 8(%ebp),%edx movl (%ecx),%eax movl (%edx),%ebx movl %eax,(%edx) movl %ebx,(%ecx) movl -4(%ebp),%ebx movl %ebp,%esp popl %ebp ret Set Up Body Finish 21

22 Understanding Swap void swap(int *xp, int *yp) { int t0 = *xp; int t1 = *yp; *xp = t1; *yp = t0; } 22 Register %ecx %edx %eax %ebx Variable yp xp t1 t0 movl 12(%ebp),%ecx movl 8(%ebp),%edx movl (%ecx),%eax movl (%edx),%ebx movl %eax,(%edx) movl %ebx,(%ecx) Offset yp xp Rtn adr # ecx = yp # edx = xp # eax = *yp (t1) # ebx = *xp (t0) # *xp = eax # *yp = ebx Stack 0 Old %ebp %ebp -4 Old %ebx

23 Understanding Swap 23 %eax %edx %ecx %ebx %esi %edi %esp %ebp 0x104 movl 12(%ebp),%ecx movl 8(%ebp),%edx movl (%ecx),%eax movl (%edx),%ebx movl %eax,(%edx) movl %ebx,(%ecx) yp xp Offset %ebp x120 0x124 Rtn adr # ecx = yp # edx = xp # eax = *yp (t1) # ebx = *xp (t0) # *xp = eax # *yp = ebx Address 0x124 0x120 0x11c 0x118 0x114 0x110 0x10c 0x108 0x104 0x100

24 Understanding Swap 24 %eax %edx %ecx %ebx %esi %edi %esp %ebp 0x120 0x104 movl 12(%ebp),%ecx movl 8(%ebp),%edx movl (%ecx),%eax movl (%edx),%ebx movl %eax,(%edx) movl %ebx,(%ecx) yp xp Offset %ebp x120 0x124 Rtn adr # ecx = yp # edx = xp # eax = *yp (t1) # ebx = *xp (t0) # *xp = eax # *yp = ebx Address 0x124 0x120 0x11c 0x118 0x114 0x110 0x10c 0x108 0x104 0x100

25 Understanding Swap 25 %eax %edx %ecx %ebx %esi %edi %esp %ebp 0x124 0x120 0x104 movl 12(%ebp),%ecx movl 8(%ebp),%edx movl (%ecx),%eax movl (%edx),%ebx movl %eax,(%edx) movl %ebx,(%ecx) yp xp Offset %ebp x120 0x124 Rtn adr # ecx = yp # edx = xp # eax = *yp (t1) # ebx = *xp (t0) # *xp = eax # *yp = ebx Address 0x124 0x120 0x11c 0x118 0x114 0x110 0x10c 0x108 0x104 0x100

26 Understanding Swap 26 %eax %edx %ecx %ebx %esi %edi %esp %ebp 456 0x124 0x120 0x104 movl 12(%ebp),%ecx movl 8(%ebp),%edx movl (%ecx),%eax movl (%edx),%ebx movl %eax,(%edx) movl %ebx,(%ecx) yp xp Offset %ebp x120 0x124 Rtn adr # ecx = yp # edx = xp # eax = *yp (t1) # ebx = *xp (t0) # *xp = eax # *yp = ebx Address 0x124 0x120 0x11c 0x118 0x114 0x110 0x10c 0x108 0x104 0x100

27 Understanding Swap 27 %eax %edx %ecx %ebx %esi %edi %esp %ebp 456 0x124 0x x104 movl 12(%ebp),%ecx movl 8(%ebp),%edx movl (%ecx),%eax movl (%edx),%ebx movl %eax,(%edx) movl %ebx,(%ecx) yp xp Offset %ebp x120 0x124 Rtn adr # ecx = yp # edx = xp # eax = *yp (t1) # ebx = *xp (t0) # *xp = eax # *yp = ebx Address 0x124 0x120 0x11c 0x118 0x114 0x110 0x10c 0x108 0x104 0x100

28 Understanding Swap 28 %eax %edx %ecx %ebx %esi %edi %esp %ebp 456 0x124 0x x104 movl 12(%ebp),%ecx movl 8(%ebp),%edx movl (%ecx),%eax movl (%edx),%ebx movl %eax,(%edx) movl %ebx,(%ecx) yp xp Offset %ebp x120 0x124 Rtn adr # ecx = yp # edx = xp # eax = *yp (t1) # ebx = *xp (t0) # *xp = eax # *yp = ebx Address 0x124 0x120 0x11c 0x118 0x114 0x110 0x10c 0x108 0x104 0x100

29 Understanding Swap 29 %eax %edx %ecx %ebx %esi %edi %esp %ebp 456 0x124 0x x104 movl 12(%ebp),%ecx movl 8(%ebp),%edx movl (%ecx),%eax movl (%edx),%ebx movl %eax,(%edx) movl %ebx,(%ecx) yp xp Offset %ebp x120 0x124 Rtn adr # ecx = yp # edx = xp # eax = *yp (t1) # ebx = *xp (t0) # *xp = eax # *yp = ebx Address 0x124 0x120 0x11c 0x118 0x114 0x110 0x10c 0x108 0x104 0x100

30 Indexed Addressing Modes Most General Form n D: D(Rb,Ri,S) Mem[Reg[Rb]+S*Reg[Ri Reg[Ri]+ D] Constant displacement 1, 2, or 4 bytes n Rb: Base register: Any of 8 integer registers n Ri: Index register: Any, except for %esp l Unlikely you d use %ebp, either n S: Scale: 1, 2, 4, or 8 Special Cases (Rb,Ri) D(Rb,Ri) (Rb,Ri,S) Mem[Reg[Rb]+Reg[Ri]] ]] Mem[Reg[Rb]+Reg[Ri]+D] Mem[Reg[Rb]+S*Reg[Ri Reg[Ri]] 30

31 Address Computation Examples %edx %ecx 0xf000 0x100 Expression 0x8(%edx) (%edx,%ecx edx,%ecx) (%edx,%ecx,4) 0x80(,%edx,2) Computation 0xf x8 0xf x100 0xf *0x100 2*0xf x80 Address 0xf008 0xf100 0xf400 0x1e080 31

32 Address Computation Instruction leal Src,Dest Uses n Src is address mode expression n Set Dest to address denoted by expression n Computing address without doing memory reference l E.g., translation of p = &x[i]; n Computing arithmetic expressions of the form x + k*y l k = 1, 2, 4, or 8. 32

33 Some Arithmetic Operations Format Computation Two Operand Instructions addl Src,Dest Dest = Dest + Src subl Src,Dest Dest = Dest - Src imull Src,Dest Dest = Dest * Src sall Src,Dest Dest = Dest << Src Also called shll sarl Src,Dest Dest = Dest >> Src Arithmetic shrl Src,Dest Dest = Dest >> Src Logical xorl Src,Dest Dest = Dest ^ Src andl Src,Dest Dest = Dest & Src orl Src,Dest Dest = Dest Src 33

34 Some Arithmetic Operations Format Computation One Operand Instructions incl Dest Dest = Dest + 1 decl Dest Dest = Dest - 1 negl Dest notl Dest Dest = - Dest Dest = ~ Dest 34

35 Using leal for Arithmetic Expressions int arith (int x, int y, int z) { int t1 = x+y; int t2 = z+t1; int t3 = x+4; int t4 = y * 48; int t5 = t3 + t4; int rval = t2 * t5; return rval; } arith: pushl %ebp movl %esp,%ebp movl 8(%ebp),%eax movl 12(%ebp),%edx leal (%edx,%eax),%ecx leal (%edx,%edx,2),%edx sall $4,%edx addl 16(%ebp),%ecx leal 4(%edx,%eax),%eax imull %ecx,%eax movl %ebp,%esp popl %ebp ret Set Up Body Finish 35

36 Understanding arith int arith (int x, int y, int z) { int t1 = x+y; int t2 = z+t1; int t3 = x+4; int t4 = y * 48; int t5 = t3 + t4; int rval = t2 * t5; return rval; } Offset z y x Rtn adr Stack 0 Old %ebp %ebp 36 movl 8(%ebp),%eax # eax = x movl 12(%ebp),%edx # edx = y leal (%edx,%eax),%ecx # ecx = x+y (t1) leal (%edx,%edx,2),%edx # edx = 3*y sall $4,%edx # edx = 48*y (t4) addl 16(%ebp),%ecx # ecx = z+t1 (t2) leal 4(%edx,%eax),%eax # eax = 4+t4+x (t5) imull %ecx,%eax # eax = t5*t2 (rval)

37 Understanding arith int arith (int x, int y, int z) { int t1 = x+y; int t2 = z+t1; int t3 = x+4; int t4 = y * 48; int t5 = t3 + t4; int rval = t2 * t5; return rval; } # eax = x movl 8(%ebp),%eax # edx = y movl 12(%ebp),%edx # ecx = x+y (t1) leal (%edx,%eax),%ecx # edx = 3*y leal (%edx,%edx,2),%edx # edx = 48*y (t4) sall $4,%edx # ecx = z+t1 (t2) addl 16(%ebp),%ecx # eax = 4+t4+x (t5) leal 4(%edx,%eax),%eax # eax = t5*t2 (rval) imull %ecx,%eax 37

38 Another Example int logical(int x, int y) { int t1 = x^y; int t2 = t1 >> 17; int mask = (1<<13) - 7; int rval = t2 & mask; return rval; } 2 13 = 8192, = 8185 logical: pushl %ebp movl %esp,%ebp movl 8(%ebp),%eax xorl 12(%ebp),%eax sarl $17,%eax andl $8185,%eax movl %ebp,%esp popl %ebp ret Set Up Body Finish movl 8(%ebp),%eax eax = x xorl 12(%ebp),%eax eax = x^y (t1) sarl $17,%eax eax = t1>>17 (t2) andl $8185,%eax eax = t2 &

39 CISC Properties Instruction can reference different operand types n Immediate, register, memory Arithmetic operations can read/write memory Memory reference can involve complex computation n Rb + S*Ri + D n Useful for arithmetic expressions, too Instructions can have varying lengths n IA32 instructions can range from 1 to 15 bytes 39

40 Summary: Abstract Machines Machine Models Data Control mem C proc 1) char 2) int, float 3) double 4) struct, array 5) pointer 1) loops 2) conditionals 3) switch 4) Proc. call 5) Proc. return Assembly mem regs alu Stack Cond. Codes processor 1) byte 2) 2-byte word 3) 4-byte long word 5) ret 4) contiguous byte allocation 5) address of initial byte 3) branch/jump 4) call 40

41 History Pentium Pro (P6) n Announced in Feb. 95 n Basis for Pentium II, Pentium III, and Celeron processors n Pentium 4 similar idea, but different details Features n Dynamically translates instructions to more regular format l Very wide, but simple instructions n Executes operations in parallel l Up to 5 at once n Very deep pipeline l cycle latency 41

42 PentiumPro Block Diagram Microprocessor Report 2/16/95

43 43 PentiumPro Operation Translates instructions dynamically into Uops n 118 bits wide n Holds operation, two sources, and destination Executes Uops with Out of Order engine n Uop executed when l Operands available l Functional unit available n Execution controlled by Reservation Stations l Keeps track of data dependencies between uops l Allocates resources Consequences n Indirect relationship between IA32 code & what actually gets executed n Tricky to predict / optimize performance at assembly level

44 Whose Assembler? Intel/Microsoft Format lea eax,[ecx+ecx*2] sub esp,8 cmp dword ptr [ebp-8],0 mov eax,dword ptr [eax*4+100h] GAS/Gnu Format leal (%ecx,%ecx,2),%eax subl $8,%esp cmpl $0,-8(%ebp) movl $0x100(,%eax,4),%eax Intel/Microsoft Differs from GAS 44 n Operands listed in opposite order mov Dest, Src movl Src, Dest n Constants not preceded by $, Denote hex with h at end 100h $0x100 n Operand size indicated by operands rather than operator suffix sub subl n Addressing format shows effective address computation [eax*4+100h] $0x100(,%eax,4)

45 Machine-Level Programming II: Control Flow Topics n Condition Codes l Setting l Testing n Control Flow l If-then-else l Varieties of Loops l Switch Statements 45

46 Condition Codes Single Bit Registers CF Carry Flag SF Sign Flag ZF Zero Flag OF Overflow Flag Implicitly Set By Arithmetic Operations addl Src,Dest C analog: t = a + b n CF set if carry out from most significant bit l Used to detect unsigned overflow n ZF set if t == 0 n SF set if t < 0 n OF set if two s complement overflow (a>0 && b>0 && t<0) (a<0 && b<0 && t>=0) Not Set by leal instruction 46

47 Setting Condition Codes (cont.) Explicit Setting by Compare Instruction cmpl Src2,Src1 n cmpl b,a like computing a-b without setting destination n CF set if carry out from most significant bit l Used for unsigned comparisons n ZF set if a == b n SF set if (a-b) < 0 n OF set if two s complement overflow (a>0 && b<0 && (a-b)<0) (a<0 && b>0 && (a-b)>0) 47

48 Setting Condition Codes (cont.) Explicit Setting by Test instruction testl Src2,Src1 n Sets condition codes based on value of Src1 & Src2 n l Useful to have one of the operands be a mask testl b,a like computing a&b without setting destination n ZF set when a&b == 0 n SF set when a&b < 0 48

49 49 Reading Condition Codes SetX Instructions n Set single byte based on combinations of condition codes SetX Condition Description sete ZF Equal / Zero setne ~ZF Not Equal / Not Zero sets SF Negative setns ~SF Nonnegative setg ~(SF^OF)&~ZF Greater (Signed) setge ~(SF^OF) Greater or Equal (Signed) setl (SF^OF) Less (Signed) setle (SF^OF) ZF Less or Equal (Signed) seta ~CF&~ZF Above (unsigned) setb CF Below (unsigned)

50 50 Reading Condition Codes (Cont.) SetX Instructions Body n Set single byte based on combinations of condition codes n One of 8 addressable byte registers l Embedded within first 4 integer registers l Does not alter remaining 3 bytes l Typically use movzbl to finish job int gt (int x, int y) { return x > y; } movl 12(%ebp),%eax cmpl %eax,8(%ebp) setg %al movzbl %al,%eax # eax = y # Compare x : y # al = x > y # Zero rest of %eax %eax %edx %ecx %ebx %esi %edi %esp %ebp Note inverted ordering! %ah %dh %ch %bh %al %dl %cl %bl

51 jx Instructions 51 Jumping n Jump to different part of code depending on condition codes jx Condition Description jmp 1 Unconditional je ZF Equal / Zero jne ~ZF Not Equal / Not Zero js SF Negative jns ~SF Nonnegative jg ~(SF^OF)&~ZF Greater (Signed) jge ~(SF^OF) Greater or Equal (Signed) jl (SF^OF) Less (Signed) jle (SF^OF) ZF Less or Equal (Signed) ja ~CF&~ZF Above (unsigned) jb CF Below (unsigned)

52 Conditional Branch Example int max(int x, int y) { if (x > y) return x; else return y; } _max: L9: pushl %ebp movl %esp,%ebp movl 8(%ebp),%edx movl 12(%ebp),%eax cmpl %eax,%edx jle L9 movl %edx,%eax Set Up Body movl %ebp,%esp popl %ebp ret Finish 52

53 Conditional Branch Example (Cont.) int goto_max(int x, int y) { int rval = y; int ok = (x <= y); if (ok) goto done; rval = x; done: return rval; } n C allows goto as means of transferring control l Closer to machine-level programming style n Generally considered bad coding style movl 8(%ebp),%edx # edx = x movl 12(%ebp),%eax # eax = y cmpl %eax,%edx # x : y jle L9 # if <= goto L9 movl %edx,%eax # eax = x L9: # Done: Skipped when x y 53

54 Do-While Loop Example C Code int fact_do (int x) { int result = 1; do { result *= x; x = x-1; } while (x > 1); return result; } Goto Version int fact_goto(int x) { int result = 1; loop: result *= x; x = x-1; if (x > 1) goto loop; return result; } n Use backward branch to continue looping n Only take branch when while condition holds 54

55 Do-While Loop Compilation Goto Version int fact_goto (int x) { int result = 1; loop: result *= x; x = x-1; if (x > 1) goto loop; return result; } Assembly _fact_goto: pushl %ebp # Setup movl %esp,%ebp # Setup movl $1,%eax # eax = 1 movl 8(%ebp),%edx # edx = x L11: imull %edx,%eax # result *= x decl %edx # x-- cmpl $1,%edx # Compare x : 1 jg L11 # if > goto loop Registers 55 %edx x %eax result movl %ebp,%esp popl %ebp ret # Finish # Finish # Finish

56 General Do-While Translation C Code do Body while (Test); Goto Version loop: Body if (Test) goto loop n Body can be any C statement l Typically compound statement: { } Statement 1 ; Statement 2 ; Statement n ; n Test is expression returning integer = 0 interpreted as false 0 interpreted as true 56

57 While Loop Example #1 C Code int fact_while (int x) { int result = 1; while (x > 1) { result *= x; x = x-1; }; return result; } First Goto Version int fact_while_goto (int x) { int result = 1; loop: if (!(x > 1)) goto done; result *= x; x = x-1; goto loop; done: return result; } n Is this code equivalent to the do-while version? n Must jump out of loop if test fails 57

58 Actual While Loop Translation C Code int fact_while(int x) { int result = 1; while (x > 1) { result *= x; x = x-1; }; return result; } n Uses same inner loop as do-while version n Guards loop entry with extra test Second Goto Version int fact_while_goto2 (int x) { int result = 1; if (!(x > 1)) goto done; loop: result *= x; x = x-1; if (x > 1) goto loop; done: return result; } 58

59 General While Translation C Code while (Test) Body Do-While Version if (!Test) goto done; do Body while(test); done: Goto Version if (!Test) goto done; loop: Body if (Test) goto loop; done: 59

60 For Loop Example /* Compute x raised to nonnegative power p */ int ipwr_for(int x, unsigned p) { int result; for (result = 1; p!= 0; p = p>>1) { if (p & 0x1) result *= x; x = x*x; } return result; } Algorithm n Exploit property that p = p 0 + 2p 1 + 4p n 1 p n 1 n Gives: x p = z 0 z 1 2 (z 2 2 ) 2 ( ((z n 12 ) 2 ) ) 2 z i = 1 when p i = 0 z i = x when p i = 1 n Complexity O(log p) n 1 times Example 3 10 = 3 2 * 3 8 = 3 2 * ((3 2 ) 2 ) 2 60

61 ipwr Computation /* Compute x raised to nonnegative power p */ int ipwr_for(int x, unsigned p) { int result; for (result = 1; p!= 0; p = p>>1) { if (p & 0x1) result *= x; x = x*x; } return result; } result x p

62 For Loop Example int result; for (result = 1; p!= 0; p = p>>1) { if (p & 0x1) result *= x; x = x*x; } General Form for (Init; Test; Update ) Body Init result = 1 Test p!= 0 Update p = p >> 1 Body { } if (p & 0x1) result *= x; x = x*x; 62

63 For While 63 For Version for (Init; Test; Update ) Body Do-While Version Init; if (!Test) goto done; do { Body Update ; } while (Test) done: While Version Init; while (Test ) { Body Update ; } Goto Version Init; if (!Test) goto done; loop: Body Update ; if (Test) goto loop; done:

64 For Loop Compilation 64 Goto Version Init; if (!Test) goto done; loop: Body Update ; if (Test) goto loop; done: Init result = 1 Update p = p >> 1 Test p!= 0 { } result = 1; if (p == 0) goto done; loop: if (p & 0x1) result *= x; x = x*x; p = p >> 1; if (p!= 0) goto loop; done: Body if (p & 0x1) result *= x; x = x*x;

65 typedef enum {ADD, MULT, MINUS, DIV, MOD, BAD} op_type; char unparse_symbol(op_type op) { switch (op) { case ADD : return '+'; case MULT: return '*'; case MINUS: return '-'; case DIV: return '/'; case MOD: return '%'; case BAD: return '?'; } } Switch Statements Implementation Options n Series of conditionals l Good if few cases l Slow if many n Jump Table l Lookup branch target l Avoids conditionals l Possible when cases are small integer constants n GCC l Picks one based on case structure n Bug in example code l No default given 65

66 Jump Table Structure Switch Form Jump Table Jump Targets switch(op) { case val_0: Block 0 case val_1: Block 1 case val_n-1: Block n 1 } jtab: Targ0 Targ1 Targ2 Targn-1 Targ0: Targ1: Targ2: Code Block 0 Code Block 1 Code Block 2 Approx. Translation target = JTab[op]; goto *target; Targn-1: Code Block n 1 66

67 Switch Statement Example Branching Possibilities typedef enum {ADD, MULT, MINUS, DIV, MOD, BAD} op_type; char unparse_symbol(op_type op) { switch (op) { } } Enumerated Values ADD 0 MULT 1 MINUS 2 DIV 3 MOD 4 BAD 5 Setup: unparse_symbol: pushl %ebp # Setup movl %esp,%ebp # Setup movl 8(%ebp),%eax # eax = op cmpl $5,%eax # Compare op : 5 ja.l49 # If > goto done jmp *.L57(,%eax,4) # goto Table[op] 67

68 68 Assembly Setup Explanation Symbolic Labels n Labels of form.lxx translated into addresses by assembler Table Structure n Each target requires 4 bytes n Base address at.l57 Jumping jmp.l49 n Jump target is denoted by label.l49 jmp *.L57(,%eax,4) n Start of jump table denoted by label.l57 n Register %eax holds op n Must scale by factor of 4 to get offset into table n Fetch target from effective Address.L57 + op*4

69 Jump Table Table Contents.section.rodata.align 4.L57:.long.L51 #Op = 0.long.L52 #Op = 1.long.L53 #Op = 2.long.L54 #Op = 3.long.L55 #Op = 4.long.L56 #Op = 5 Enumerated Values ADD 0 MULT 1 MINUS 2 DIV 3 MOD 4 BAD 5 Targets & Completion.L51: movl $43,%eax # + jmp.l49.l52: movl $42,%eax # * jmp.l49.l53: movl $45,%eax # - jmp.l49.l54: movl $47,%eax # / jmp.l49.l55: movl $37,%eax # % jmp.l49.l56: movl $63,%eax #? # Fall Through to.l49 69

70 Switch Statement Completion.L49: movl %ebp,%esp popl %ebp ret # Done: # Finish # Finish # Finish Puzzle n What value returned when op is invalid? Answer n Register %eax set to op at beginning of procedure n This becomes the returned value Advantage of Jump Table 70 n Can do k-way branch in O(1) operations

71 Object Code Setup n Label.L49 becomes address 0x804875c n Label.L57 becomes address 0x8048bc <unparse_symbol>: : 55 pushl %ebp : 89 e5 movl %esp,%ebp b: 8b movl 0x8(%ebp),%eax e: 83 f8 05 cmpl $0x5,%eax : ja c <unparse_symbol+0x44> : ff c0 8b jmp *0x8048bc0(,%eax,4) 71

72 Object Code (cont.) Jump Table n Doesn t show up in disassembled code n Can inspect using GDB gdb code-examples (gdb) x/6xw 0x8048bc0 l Examine 6 hexadecimal format words (4-bytes each) l Use command help x to get format documentation 72 0x8048bc0 <_fini+32>: 0x x x x x x

73 Extracting Jump Table from Binary Jump Table Stored in Read Only Data Segment (.rodata rodata) n Various fixed values needed by your code Can examine with objdump objdump code-examples s -section=.rodata n Show everything in indicated segment. Hard to read n Jump table entries shown with reversed byte ordering Contents of section.rodata: 8048bc @...G bd P...W...Fact(%d) 8048be0 203d2025 6c640a d2025 = %ld..char = % n E.g., really means 0x

74 Disassembled Targets : b8 2b movl $0x2b,%eax : eb 25 jmp c <unparse_symbol+0x44> : b8 2a movl $0x2a,%eax c: eb 1e jmp c <unparse_symbol+0x44> e: 89 f6 movl %esi,%esi : b8 2d movl $0x2d,%eax : eb 15 jmp c <unparse_symbol+0x44> : b8 2f movl $0x2f,%eax c: eb 0e jmp c <unparse_symbol+0x44> e: 89 f6 movl %esi,%esi : b movl $0x25,%eax : eb 05 jmp c <unparse_symbol+0x44> : b8 3f movl $0x3f,%eax n movl %esi,%esi does nothing n Inserted to align instructions for better cache performance 74

75 Matching Disassembled Targets Entry 0x x x x x x : b8 2b movl : eb 25 jmp : b8 2a movl c: eb 1e jmp e: 89 f6 movl : b8 2d movl : eb 15 jmp : b8 2f movl c: eb 0e jmp e: 89 f6 movl : b movl : eb 05 jmp : b8 3f movl 75

76 Sparse Switch Example /* Return x/111 if x is multiple && <= otherwise */ int div111(int x) { switch(x) { case 0: return 0; case 111: return 1; case 222: return 2; case 333: return 3; case 444: return 4; case 555: return 5; case 666: return 6; case 777: return 7; case 888: return 8; case 999: return 9; default: return -1; } } n Not practical to use jump table l Would require 1000 entries n Obvious translation into if-then-else would have max. of 9 tests 76

77 Sparse Switch Code 77 movl 8(%ebp),%eax # get x cmpl $444,%eax # x:444 je L8 jg L16 cmpl $111,%eax # x:111 je L5 jg L17 testl %eax,%eax # x:0 je L4 jmp L14... n Compares x to possible case values n Jumps different places depending on outcomes L5: L6: L7: L8:... movl $1,%eax jmp L19 movl $2,%eax jmp L19 movl $3,%eax jmp L19 movl $4,%eax jmp L19...

78 Sparse Switch Code Structure = -1-1 n Organizes cases as binary tree n Logarithmic performance < > = 2 < = > < > = = = < > = = = =

79 Summarizing C Control n n n n if-then-else do-while while switch Assembler Control n n jump Compiler n Conditional jump Must generate assembly code to implement more complex control Standard Techniques n n All loops converted to do-while form Large switch statements use jump tables Conditions in CISC n CISC machines generally have condition code registers Conditions in RISC n n n Use general registers to store condition information Special comparison instructions E.g., on Alpha: cmple $16,1,$1 l Sets register $1 to 1 when Register $16 <= 1 79