Monday, October 17, 2016

Size: px

Start display at page:

Download "Monday, October 17, 2016"

Brian Ray
6 years ago
Views:

1 Monday, October 17, 2016 Topics for today C functions and Pep/8 subroutines Passing parameters by reference Globals Locals Reverse Engineering II Representation of Booleans C Functions and Pep/8 Subroutines (Section 6.3) Passing parameters by reference: see Warford pp So far we have passed parameters by value, that is we have copied the current value of a parameter (either a constant or a variable, a local or a global) onto the stack. Many languages support "pass by reference" where the address of the actual parameter is put on the stack. (It follows that actual parameters passed by reference can only be the addresses of variables; constants and expressions are not allowed.) When a parameter is passed by reference, the subprogram is able to update the value in the parameter. Consider the C function increment void increment (int V, int *N) /* adds V to location pointed to by N */ *N += V; and a call increment (Quantity, &Total) The parameter Quantity is passed by value - we can use but cannot change it. The parameter Total is passed by reference - we are able to change the value in this variable. We can perhaps picture increment as follows V N increment We can read V. We can both read and write N. Comp 162 Notes Page 1 of 12 October 17, 2016

2 In the Pep/8 calling environment, the difference in the way the two parameters are passed is small and subtle. Here is a translation of the call increment(quantity, &Total) subsp 4,i lda Quantity,d ; the value in Quantity sta 0,s ; is one parameter lda Total,i ; the address of Total - note the addressing mode! sta 2,s ; is the other call increment On entry to the subroutine, the stack looks like Return address Value of Quantity Address of Total Total Question: Answer: If the stack contains the address of a variable, how do we access the contents of that variable either to read from it or to write to it? We use a new addressing mode stack relative deferred (symbol,sf) When we use mode,s the operand is Mem[SP+operand] When we use mode,sf the operand is Mem[Mem[SP+operand]] Note that, in theory, when the program runs, an instruction that uses the sf mode will take more time than an instruction that uses the s mode because an additional memory read is required. Here is a possible implementation of the "increment" function increment: lda 4,sf ; load A from the variable N to be updated adda 2,s ; increment by the value of V sta 4,sf ; store back the new value of N ret0 We could also use our new mode to implement a function that exchanges the contents of two variables passed by reference. It might be used as part of a sorting routine. In high-level language Comp 162 Notes Page 2 of 12 October 17, 2016

3 void exchange (int* P, int* Q) int temp; temp = *P; *P = *Q; *Q = temp; A call exchange(&x, &Y) swaps the values in variables X and Y. Here is an implementation of the exchange function in Pep/8: exchange: subsp 2,i ; for the local variable lda 4,sf ; first value sta 0,s ; is stored in local lda 6,sf ; second value sta 4,sf ; is copied to first lda 0,s ; now the value in local sta 6,sf ; is copied to second ret2 ; deallocate local and return Pictorially local Return address Local variables passed by reference: see Warford pp Warford's example (Fig 6.27) shows how to handle the case where parameters are already on the stack as a result of another call as in order (&X, &Y).. exchange(&x, &Y) we just copy the addresses from appropriate stack locations. Comp 162 Notes Page 3 of 12 October 17, 2016

4 But what happens when the variables (actual parameters) to be passed by reference are not global variables but are local variables in the calling environment as in int main() int N,P,Q,R;.. exchange(&p,&q); When we call exchange, the two values we pass to it are addresses of locations on the stack itself. So in setting up the call we need to establish pointers as in the following diagram N P Q R But we don't know where the stack is in memory! Luckily, in Pep/8 there is an instruction that makes setting up such pointers possible. The instruction MOVSPA copies the value in the stack pointer (i.e., the address of the top of the stack) to register A. Now we can figure out the addresses of the actual parameters and put pointers to those locations onto the stack using Register A to do the arithmetic. Figure 6.29 shows one example of this. Here is another. Assume our routine exchange defined above, consider the following Comp 162 Notes Page 4 of 12 October 17, 2016

5 int main() int A, B, C, D; input(b); input (C); exchange(&b,&c); output(b); output(c); In Pep/8 main is: main: subsp 8,i ; space for the 4 locals: A, B, C and D movspa ; remember address of top of stack (address of local A) deci 2,s ; input(b) deci 4,s ; input(c) subsp 4,i ; make room for the two parameters of exchange adda 2,i ; Register A now contains the address of B. sta 0,s ; this is the first parameter of exchange adda 2,i ; Register A now contains address of C sta 2,s ; this is the second parameter call exchange addsp 4,i ; get rid of exchange parameter space deco 2,s ; output B deco 4,s ; output C ret0 Pictorially, on entry to exchange the stack is Retn Address A B C D And the subroutine will exchange the values in locals B and C. Comp 162 Notes Page 5 of 12 October 17, 2016

6 More reverse Engineering: Pep/8 to C Here is another example of a subroutine to convert into C, this time with a parameter passed by reference. Line 1 unknown: lda 2,s 2 breq zercase 3 brgt poscase 4 lda 4,s 5 nega 6 sta 6,sf 7 br ret1 8 poscase: lda 4,s 9 sta 6,sf 10 ret1: lda 1,i 11 sta 8,s 12 ret0 13 zercase: sta 8,s 14 ret0 Again, we start with a skeleton of the C function?? unknown ( ) There are no local variables in this subroutine. The return address is therefore at 0,s. There are references to several stack locations below the return address (e.g.,. Lines 4, 9, and 11). The lowest of these on the stack (8,s) has a word stored in it before the function exits. This suggests a return value and that unknown is therefore an integer function: int unknown ( ) We assume that the three remaining locations (2,s 4,s and 6,s) are parameters. Two are read from (2,s and 4,s) and one is written to (6,sf). The addressing modes used to access the locations indicate that two are values and one is an address int unknown (int A, int B, int *C) There are no loops, only forward branches, so we can fill out the action of the subroutine Comp 162 Notes Page 6 of 12 October 17, 2016

7 int unknown (int A, int B, int *C) if (A==0) return 0; if (A >0) *C = B; return 1; *C = -B; return 1; which we can simplify to int unknown (int A, int B, int *C) if (A == 0) return 0; if (A > 0) *C = B; else *C = -B; return 1; Representation of Booleans: Warford p. 281 The last topic in section 6.3 is the representation and manipulation of Booleans. Q: how much space do we allocate for each bool? A: in theory only one bit is needed but manipulating individual bits is time-consuming and even a byte for each bool is slow because of the limited set of byte instructions that Pep/8 has so we will use a word for each bool. Q: what values to use for true and false? A: there are many possibilities including the five in the following table (i) (ii) (iii) (iv) (v) True Non-zero Negative Odd 1 FFFF16 False Zero Non-negative Even Option (i) is what C uses. Suppose variable A is type bool. Consider the translation into Pep/8 of the assignment A =!(A); /* invert A */ Comp 162 Notes Page 7 of 12 October 17, 2016

8 That is, we wish to change the value in A. For implementation methods (ii), (iii) and (v) the code is lda A,d nota sta A,d If we implement Booleans using method (iv) the code might be lda 1,i suba A,d sta A,d It turns out that the most complicated code is required if we choose implementation method (i) (the one that C uses). Here is a possible translation lda A,d breq iszero lda -1,i ; so that next lines makes it zero iszero: adda 1,i store: sta A,d To finish our look at Booleans we will see short circuit evaluation might be useful. Short-circuit evaluation Consider the following two fragments of if statements (i) if (A && B && C) action; (ii) if (P Q R) action; In the case of (i) a compiler could generate code that first checks A and if it is false, doesn't even evaluate B or C. Similarly in (ii) rather than figure out the whole Boolean expression then check it, the compiler could generate code that looks first at P and if it is true, does not even evaluate Q or R. This is short-circuit evaluation 1. (i) is if (A) if (B) if (C) action; (ii) is if (P) action else if (Q) action else if (R) action; 1 The default in C Comp 162 Notes Page 8 of 12 October 17, 2016

9 Short-circuit evaluation can be useful Example 1: a loop that scans N-element array AR looking for the first non-zero element i = 0; while (i<n && AR[i]==0) i++; If there are no non-zero elements than the value of i will reach N. However, if i is N then the first clause will be false and we will not try to access the non-existent element AR[N] and thus avoid a run-time error. Example 2: a check to see if the character pointed to by ptr is the newline character. if ( (ptr!=0 ) && ( *ptr == \n )) To avoid error that occurs when following a null (zero) pointer, check for that in the first clause. Example 3: similar to Example 2, this time to avoid a division by zero if ( count!=0 && sum/count > oldaverage). While short circuit code may be faster in some cases, in general it may take up more space and, on average, may be slower than full evaluation. Compare the following two implementations of if (A B C D)... assuming we use zero for false and non-zero for true. Regular lda A,d ora B,d ora C,d ora D,d brne true false:... Short-Circuit lda A,d brne true ora B,d brne true ora C,d brne true ora D,d brne true false:... Space: Regular uses 5 instructions and short-circuit uses 8. Run-time: Consider the number of instructions we execute in each case for various values of A, B, C, D. Comp 162 Notes Page 9 of 12 October 17, 2016

10 A B C D Regular Short-Circuit True 5 2 False True 5 4 False False True 5 6 False False False 5 8 So, because short circuit code may take up more space and run slower than regular code using the short-circuit approach should be a compiler option rather than imposed on a user. Reading We have reached the end of section 6.3. The next section looks at arrays and includes global arrays local arrays arrays used as parameters of subroutines. Each of these three uses of an array requires its own addressing mode. Review questions 1. If the MOVSPA instruction were not available, is there another way to find out the value in the SP register? 2. If in subroutine X the following are the only references to the stack below the Return Address, what is a plausible C-style prototype for X? ldbytea 4,sf ora 6,s sta 2,sf sta 8,s 3. If function ABC has prototype Void ABC (int X, int* Y, char* Z) Which of the following are valid calls of ABC (N and T are type int, C is type char) ABC ( 3+N, &N, & ) ABC ( N, N, * ) ABC (3, 26, C) ABC (40-N, &T, &C) Comp 162 Notes Page 10 of 12 October 17, 2016

11 4. If we used a single bit for each element of the array bool T[100] How could we determine the value of T[i]? 5. We are searching 1000-element array M for the last value equal to 99. Write a loop that does this assuming short-circuit evaluation to avoid an index-out-of-bounds error. Comp 162 Notes Page 11 of 12 October 17, 2016

12 Review answers 1. No. 2. int X ( int*, char*, int) 3. ABC (40-N, &T, &C) 4. T would occupy 13 bytes (half the last one is unused). The byte number we need is i/8. We could get that byte and isolate the bit of interest using an AND 5. i=999; while (i>0 and M[i]!=99) i--; Comp 162 Notes Page 12 of 12 October 17, 2016

Monday, March 9, 2015

Monday, March 9, 2015 Topics for today C functions and Pep/8 subroutines Passing parameters by reference Globals Locals More reverse engineering: Pep/8 to C Representation of Booleans C Functions and Pep/8