University

 of  Washington  

long switch_eg (unsigned

long x, long y, long z) Switch  Statement  
{
long w = 1; Example  
switch(x) {
case 1:
w = y*z; ¢ Mul;ple  case  labels  
break;
case 2: § Here:  5,  6  
w = y/z; ¢ Fall  through  cases  
/* Fall Through */
case 3:
§ Here:  2  
w += z; ¢ Missing  cases  
break;
§ Here:  4  
case 5:
case 6:
w -= z;
break;
default: ¢ Lots  to  manage,  we  
w = 2; need  a  jump  table  
}
return w;
}
x86  
 University  of  Washington  

Jump  Table  Structure  

Switch  Form   Jump  Table   Jump  Targets  
switch(x) { JTab: Targ0 Targ0: Code  Block  
case val_0:
Targ1 0  
Block  0  
case val_1: Targ2
Targ1: Code  Block  
Block  1   •
• • •   1  
•
case val_n-1: •
Block  n–1 Targ2: Code  Block  
Targn-1
} 2  

•
Approximate  Transla;on   •
target = JTab[x]; •
goto *target;
Targn-1: Code  Block  
n–1  
x86  
 University  of  Washington  

Jump  Table  Structure  

C  code:   Memory  
switch(x) {
case 1: <some code>
break;
case 2: <some code>
case 3: <some code>
break; Code  
case 5: Blocks  
case 6: <some code>
break;
default: <some code>
}
We  can  use  the  jump  table  when  x  <=  6:   0  
1  
if (x <= 6) Jump   2  
target = JTab[x];
goto *target; Table   3  
4  
else 5  
goto default; 6  

x86  
 University  of  Washington  

Jump  Table  
Jump  table  
.section .rodata switch(x) {
.align 4 case 1: // .L56
.L62: w = y*z;
.long .L61 # x = 0 break;
.long .L56 # x = 1 case 2: // .L57
.long .L57 # x = 2 w = y/z;
.long .L58 # x = 3 /* Fall Through */
.long .L61 # x = 4 case 3: // .L58
.long .L60 # x = 5 w += z;
.long .L60 # x = 6 break;
case 5:
case 6: // .L60
w -= z;
break;
default: // .L61
w = 2;
}
x86  
 University  of  Washington  

Switch  Statement  Example  (IA32)  

long switch_eg(unsigned long x, long y,
long z)
{
long w = 1;
switch(x) {
. . .
} Jump  table  
return w; .section .rodata
.align 4
} .L62:
Setup:   switch_eg: .long .L61 # x = 0
.long .L56 # x = 1
pushl %ebp # Setup .long .L57 # x = 2
movl %esp, %ebp # Setup .long .L58 # x = 3
pushl %ebx # Setup .long .L61 # x = 4
movl $1, %ebx # w = 1 .long .L60 # x = 5
.long .L60 # x = 6
movl 8(%ebp), %edx # edx = x
movl 16(%ebp), %ecx # ecx = z
cmpl $6, %edx # x:6
ja .L61 # if Transla3on?  
> goto default
jmp *.L62(,%edx,4) # goto JTab[x]
x86  
 University  of  Washington  

Switch  Statement  Example  (IA32)  

long switch_eg(unsigned long x, long y,
long z)
{
long w = 1;
switch(x) {
. . .
} Jump  table  
return w; .section .rodata
.align 4
} .L62:
Setup:   switch_eg: .long .L61 # x = 0
.long .L56 # x = 1
pushl %ebp # Setup
.long .L57 # x = 2
movl %esp, %ebp # Setup .long .L58 # x = 3
pushl %ebx # Setup .long .L61 # x = 4
movl $1, %ebx # w = 1 .long .L60 # x = 5
.long .L60 # x = 6
movl 8(%ebp), %edx # edx = x
movl 16(%ebp), %ecx # ecx = z
cmpl $6, %edx # x:6
Indirect     ja .L61 # if > goto default
jump   jmp *.L62(,%edx,4) # goto JTab[x]
x86  
 University  of  Washington  

Assembly  Setup  Explana;on  

¢ Table  Structure  
§ Each  target  requires  4  bytes   Jump  table  
§ Base  address  at  .L62   .section .rodata
.align 4
.L62:
¢ Jumping:  different  address  modes   .long .L61 # x = 0
.long .L56 # x = 1
for  target   .long .L57 # x = 2
Direct: jmp .L61 .long .L58 # x = 3
§ Jump  target  is  denoted  by  label  .L61 .long .L61 # x = 4
.long .L60 # x = 5
.long .L60 # x = 6
Indirect: jmp *.L62(,%edx,4)
§ Start  of  jump  table:  .L62
§ Must  scale  by  factor  of  4  (labels  are  32-­‐bits  =  4  bytes  on  IA32)  
§ Fetch  target  from  effecLve  address  .L62 + edx*4
§ target = JTab[x]; goto *target;  (only  for    0  ≤  x  ≤  6)  
x86  
 University  of  Washington  

Code  Blocks  (Par;al)  

switch(x) { .L61: // Default case
. . . movl $2, %ebx # w = 2
case 2: // .L57 movl %ebx, %eax # Return w
w = y/z; popl %ebx
/* Fall Through */ leave
case 3: // .L58 ret
w += z; .L57: // Case 2:
break; movl 12(%ebp), %eax # y
. . . cltd # Div prep
default: // .L61 idivl %ecx # y/z
w = 2; movl %eax, %ebx # w = y/z
} # Fall through
.L58: // Case 3:
addl %ecx, %ebx # w+= z
movl %ebx, %eax # Return w
popl %ebx
leave
ret

x86  
 University  of  Washington  

Code  Blocks  (Rest)  

switch(x) { .L60: // Cases 5&6:
case 1: // .L56 subl %ecx, %ebx # w –= z
w = y*z; movl %ebx, %eax # Return w
break; popl %ebx
. . . leave
case 5: ret
case 6: // .L60 .L56: // Case 1:
w -= z; movl 12(%ebp), %ebx # w = y
break; imull %ecx, %ebx # w*= z
. . . movl %ebx, %eax # Return w
} popl %ebx
leave
ret

x86  
 University  of  Washington  

IA32  Object  Code  

¢ Setup  
§ Label  .L61  becomes  address  0x08048630  
§ Label  .L62  becomes  address  0x080488dc

Assembly  Code  
switch_eg:
. . .
ja .L61 # if > goto default
jmp *.L62(,%edx,4) # goto JTab[x]

Disassembled  Object  Code  

08048610 <switch_eg>:
. . .
08048622: 77 0c ja 8048630
08048624: ff 24 95 dc 88 04 08 jmp *0x80488dc(,%edx,4)

x86  
 University  of  Washington  

IA32  Object  Code  (cont.)  

¢ Jump  Table  
§ Doesn’t  show  up  in  disassembled  code  
§ Can  inspect  using  GDB  
gdb asm-cntl
(gdb) x/7xw 0x080488dc
§ Examine  7  hexadecimal  format  “words”  (4-­‐bytes  each)  
§ Use  command  “help x”  to  get  format  documentaLon  
0x080488dc:
0x08048630
0x08048650
0x0804863a
0x08048642
0x08048630
0x08048649
0x08048649
x86  
 University  of  Washington  

Disassembled  Targets  
8048630: bb 02 00 00 00 mov $0x2,%ebx
8048635: 89 d8 mov %ebx,%eax
8048637: 5b pop %ebx
8048638: c9 leave
8048639: c3 ret
804863a: 8b 45 0c mov 0xc(%ebp),%eax
804863d: 99 cltd
804863e: f7 f9 idiv %ecx
8048640: 89 c3 mov %eax,%ebx
8048642: 01 cb add %ecx,%ebx
8048644: 89 d8 mov %ebx,%eax
8048646: 5b pop %ebx
8048647: c9 leave
8048648: c3 ret
8048649: 29 cb sub %ecx,%ebx
804864b: 89 d8 mov %ebx,%eax
804864d: 5b pop %ebx
804864e: c9 leave
804864f: c3 ret
8048650: 8b 5d 0c mov 0xc(%ebp),%ebx
8048653: 0f af d9 imul %ecx,%ebx
8048656: 89 d8 mov %ebx,%eax
8048658: 5b pop %ebx
8048659: c9 leave
804865a: c3 ret
x86  
 University  of  Washington  

Matching  Disassembled  Targets  

8048630: bb 02 00 00 00 mov
8048635: 89 d8 mov
8048637: 5b pop
8048638: c9 leave
8048639: c3 ret
804863a: 8b 45 0c mov
804863d: 99 cltd
0x08048630 804863e: f7 f9 idiv
8048640: 89 c3 mov
0x08048650 8048642: 01 cb add
0x0804863a 8048644: 89 d8 mov
8048646: 5b pop
0x08048642 8048647: c9 leave
8048648: c3 ret
0x08048630 8048649: 29 cb sub
804864b: 89 d8 mov
0x08048649 804864d: 5b pop
0x08048649 804864e: c9 leave
804864f: c3 ret
8048650: 8b 5d 0c mov
8048653: 0f af d9 imul
8048656: 89 d8 mov
8048658: 5b pop
8048659: c9 leave
804865a: c3 ret
x86  
 University  of  Washington  

Ques;on  

¢ Would  you  implement  this  with  a  jump  table?  

switch(x) {
case 0: <some code>
break;
case 10: <some code>
break;
case 52000: <some code>
break;
default: <some code>
break;
}

¢ Probably  not:  
§ Don’t  want  a  jump  table  with  52001  entries  (too  big)  

x86