6

I'm looking at the startup code in an HP SOM executable. The disassembly looks like this:

    00004010 b4 00 10 c2                      addi,tr 61,r0,r0
    00004014 e8 00 01 aa                      b,l,n 0x000040f0,r0

The addi instruction is adding the literal value 61 to the value of r0, and then stores the sum in r0. According to the manual, reading from the r0 register always yields 0, and writes to r0 are discarded. The computation thus has no visible effect, and can be considered a no-op.

However, the tr completer of the instruction controls whether or not the following instruction is "nullified", and tr (true) means "always nullify" according to my reading of the addi entry in the manual:

Purpose: To add an immediate value to a register and conditionally nullify the following instruction

and

Conditions: The condition is any of the 32-bit add conditions shown in Table D-6 on page D-5. When a condition completer is not specified, the “never” condition is used. The boolean variable “cond_satisfied” in the operation section is set when the values added satisfy the specified condition.

The end result is that the net effect of the addi instruction is to always nullify the following b,l,n call instruction. But if you always nullify the following instruction, why not just elide it?

The rest of the startup code "feels" like it's been written in assembly language, and not compiled from an HLL. Someone must have intentionally coded this instruction pair. So what would the purpose be for writing code like this?

Edit: a sample binary is available here (https://github.com/uxmal/reko-samples/blob/master/hpsom/test2a/test2a). The relevant instruction is located at address 0x2920. A wider context is:

00002910 0F791084 ldw -4(r27),r4
00002914 08A40245 or r4,r5,r5
00002918 0F651299 stw r5,-4(r27)
0000291C 27791000 fldw -4(r27),fr0L
00002920 B40010C2 addi,tr +00000061,r0,r0
00002924 E80001AA b,l,n L$0005,r0
00002928 8BD7A06A cmpb,>>,n r23,r30,L$0002
0000292C 83178062 cmpb,<<,n r23,r24,L$0002

The floating point instructions right before 0x2920 seem unrelated to the addi / b,l,n instruction pair.

Improve this question
4
  • Are you sure this is the actual entry point and not something else, e.g. some data being disassembled? Does the following code make sense?
    – Igor Skochinsky ♦
    Dec 12, 2021 at 0:53
  • Yes, the code is inline with other code, which is making correct-looking calls. I've verified the disassembly with objdump and Reko's disassembler.
    – John Källén
    Dec 12, 2021 at 14:53
  • Maybe show more context then or upload the file somewhere.
    – Igor Skochinsky ♦
    Dec 12, 2021 at 17:40
  • 1
    @IgorSkochinsky: I've added some contextual info and a link to the binary in question.
    – John Källén
    Jan 3, 2022 at 18:11

1 Answer 1

Reset to default
1

I found another HP-SOM binary and while it has a similar instruction sequence, it is missing the mysterious addi.

$CODE$:00002D14 27 79 12 00     fstw            %fpsr, -4(%dp) # dword_400018DC # Floating-Point Store Word
$CODE$:00002D18 20 A0 00 00     ldil            0, %r5              # Load Immediate Left
$CODE$:00002D1C 34 A5 00 00     copy            %r5, %r5            # Copy Register
$CODE$:00002D20 0F 79 10 84     ldw             -4(%dp), %r4 # dword_400018DC # Load Word
$CODE$:00002D24 08 A4 02 45     or              %r4, %r5, %r5       # Inclusive OR
$CODE$:00002D28 0F 65 12 99     stw             %r5, -4(%dp) # dword_400018DC # Store Word
$CODE$:00002D2C 27 79 10 00     fldw            -4(%dp), %fpsr # dword_400018DC # Floating-Point Load Word
$CODE$:00002D30 37 44 00 00     copy            %r26, %r4           # Copy Register
$CODE$:00002D34 37 25 00 00     copy            %r25, %r5           # Copy Register
$CODE$:00002D38 37 06 00 00     copy            %r24, %r6           # Copy Register
$CODE$:00002D3C 36 E7 00 00     copy            %r23, %r7           # Copy Register
$CODE$:00002D40 37 C8 00 00     copy            %sp, %r8            # Copy Register
$CODE$:00002D44 2B C1 00 00     addil           0x2000, %sp, %r1    # Add to Immediate Left
$CODE$:00002D48 34 3E 00 00     copy            %r1, %sp            # Copy Register
$CODE$:00002D4C 23 E1 20 00     ldil            0x3000, %r31        # Load Immediate Left
$CODE$:00002D50 E7 E0 29 10     be,l            0x488(%sr4,%r31), %sr0, %r31 # sub_3488 # Branch External
$CODE$:00002D54 37 E2 00 00     copy            %r31, %rp           # Copy Register
$CODE$:00002D54
$CODE$:00002D58 34 9A 00 00     copy            %r4, %r26           # Copy Register
$CODE$:00002D5C 34 B9 00 00     copy            %r5, %r25           # Copy Register
$CODE$:00002D60 34 D8 00 00     copy            %r6, %r24           # Copy Register
$CODE$:00002D64 34 F7 00 00     copy            %r7, %r23           # Copy Register
$CODE$:00002D68 35 1E 00 00     copy            %r8, %sp            # Copy Register
$CODE$:00002D6C 88 1C 20 72     cmpb,<>,n       %r28, %r0, loc_2DAC # Compare and Branch
$CODE$:00002D6C
$CODE$:00002D70 8B D7 A0 6A     cmpb,>>,n       %r23, %sp, loc_2DAC # Compare and Branch
$CODE$:00002D70
$CODE$:00002D74 83 17 80 62     cmpb,<<,n       %r23, %r24, loc_2DAC # Compare and Branch
$CODE$:00002D74
$CODE$:00002D78 0E E0 10 85     ldw             0(%r23), %r5        # Load Word
$CODE$:00002D7C 2B 7F EF FF     addil           -0x1000, %dp, %r1   # Add to Immediate Left
$CODE$:00002D80 68 25 0E 60     stw             %r5, 0x730(%r1) # _CPU_REVISION # Store Word
$CODE$:00002D84 0E F8 10 85     ldw             0xC(%r23), %r5      # Load Word
$CODE$:00002D88 2B 7F EF FF     addil           -0x1000, %dp, %r1   # Add to Immediate Left
$CODE$:00002D8C 68 25 0E 68     stw             %r5, 0x734(%r1) # dword_40001014 # Store Word
$CODE$:00002D90 20 80 28 00     ldil            dword_40001000, %r4 # Load Immediate Left
$CODE$:00002D94 34 84 00 18     ldo             0xC(%r4), %r4 # _FPU_MODEL # Load Offset
$CODE$:00002D98 0E E8 10 85     ldw             4(%r23), %r5        # Load Word
$CODE$:00002D9C D0 A6 19 FA     extrw,u         %r5, 15, 6, %r6     # Extract Word
$CODE$:00002DA0 0C 86 12 40     sth             %r6, 0(%r4)         # Store Halfword
$CODE$:00002DA4 D0 A6 1A 9B     extrw,u         %r5, 20, 5, %r6     # Extract Word
$CODE$:00002DA8 0C 86 12 44     sth             %r6, 2(%r4)         # Store Halfword
$CODE$:00002DA8
$CODE$:00002DAC
$CODE$:00002DAC             loc_2DAC:                               # CODE XREF: start+7C

similar code in your binary:

$CODE$:00002904 27 79 12 00     fstw            %fpsr, -4(%dp) # dword_400010DC # Floating-Point Store Word
$CODE$:00002908 20 A0 00 00     ldil            0, %r5              # Load Immediate Left
$CODE$:0000290C 34 A5 00 00     copy            %r5, %r5            # Copy Register
$CODE$:00002910 0F 79 10 84     ldw             -4(%dp), %r4 # dword_400010DC # Load Word
$CODE$:00002914 08 A4 02 45     or              %r4, %r5, %r5       # Inclusive OR
$CODE$:00002918 0F 65 12 99     stw             %r5, -4(%dp) # dword_400010DC # Store Word
$CODE$:0000291C 27 79 10 00     fldw            -4(%dp), %fpsr # dword_400010DC # Floating-Point Load Word
$CODE$:00002920 B4 00 10 C2     addi,tr         0x61, %r0, %r0 # 'a' # Add to Immediate
$CODE$:00002924 E8 00 01 AA     b,n             L_0005              # Branch
$CODE$:00002924
$CODE$:00002928             # ---------------------------------------------------------------------------
$CODE$:00002928 8B D7 A0 6A     cmpb,>>,n       %r23, %sp, L_0002   # Compare and Branch
$CODE$:00002928
$CODE$:0000292C 83 17 80 62     cmpb,<<,n       %r23, %r24, L_0002  # Compare and Branch
$CODE$:0000292C
$CODE$:00002930 0E E0 10 85     ldw             0(%r23), %r5        # Load Word
$CODE$:00002934 2B 7F FF FF     addil           -0x800, %dp, %r1    # Add to Immediate Left
$CODE$:00002938 68 25 0E 60     stw             %r5, 0x730(%r1) # _CPU_REVISION # Store Word
$CODE$:0000293C 0E F8 10 85     ldw             0xC(%r23), %r5      # Load Word
$CODE$:00002940 2B 7F FF FF     addil           -0x800, %dp, %r1    # Add to Immediate Left
$CODE$:00002944 68 25 0E 68     stw             %r5, 0x734(%r1) # _CPU_KEYBITS_1 # Store Word
$CODE$:00002948 20 80 28 00     ldil            _ARGV, %r4          # Load Immediate Left
$CODE$:0000294C 34 84 00 18     ldo             0xC(%r4), %r4 # _FPU_MODEL # Load Offset
$CODE$:00002950 0E E8 10 85     ldw             4(%r23), %r5        # Load Word
$CODE$:00002954 D0 A6 19 FA     extrw,u         %r5, 15, 6, %r6     # Extract Word
$CODE$:00002958 0C 86 12 40     sth             %r6, 0(%r4)         # Store Halfword
$CODE$:0000295C D0 A6 1A 9B     extrw,u         %r5, 20, 5, %r6     # Extract Word
$CODE$:00002960 0C 86 12 44     sth             %r6, 2(%r4)         # Store Halfword
$CODE$:00002960
$CODE$:00002964
$CODE$:00002964             L_0002:                                 # CODE XREF: _START_+48

As you can see, they're quite similar and have the same sequence of cmpb checks, although my binary has an extra one using <>. I guess the only certain way to figure out what's going on with yours would be to run it under the debugger. Possibly people over at Retrocomputing may be able to help.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.