IA32 Stack Discipline Aug 30, 2017

Transcription

1 A Experiece Like No Other IA32 Disciplie Aug 30, 2017 Dave Eckhardt Dave O Hallaro Slides origially stole from , F 17

2 Sychroizatio Registratio The wait list will probably be doe today or tomorrow I do't thik everybody will fit If you're here but ot o ay wait list, see me right away ECE udergrad: most likely 5/15 will fit (could be more) ECE M.S.: 4/7 likely? INI: most likely 10/20? If you are a M.S. or or Ph.D. studet ad have ot discussed this class with your advisor, do so today We will ot be registerig graduate studets without hearig from their advisors Some people are beig added this morig If you receive mail from a admiistrator, please reply the same day If you have't take (A/B, malloc lab ok) Cotact me o later tha today , F 17

3 Why Oly 32? You leared x86-64 i 213 Most machies (eve phoes!) are 64-bit these days x86-64 is simpler tha IA32 for user code Why will 410 be IA32? x86-64 is ot simpler for kerel code Machie begis i 16-bit mode, the 32, fially 64 Iterrupts are more complicated x86-64 is ot simpler durig debuggig More registers meas more registers to have wrog values x86-64 virtual memory is a bit of a drag More steps tha x86-32, but ot more itellectually stimulatig There are still a lot of 32-bit machies i the world...which ca boot ad ru your persoal OS , F 17

4 IA32 vs x86-64 Geeratig IA32 code: gcc m32 o hello hello.c Key differeces: IA32 has oly 8 32-bit geeral purpose registers IA32 might use %ebp as a stack frame poiter. gcc m32 -fo-stack-protector -fo-omit-frame-poiter IA32 passes argumets o the stack rather tha i registers IA32 has differet caller/callee-save register covetios Detailed IA32 Summary: , F 17

5 IA32/Liux Registers Iteger Registers Two have special uses %ebp, Three maaged as callee-save %ebx, %esi, %edi Old values saved o stack prior to usig Three maaged as caller-save %eax, %edx, %ecx Do what you please, but expect ay callee to do so, as well Register %eax also holds retur value Caller-Save Temporaries Callee-Save Temporaries Special 32 bits %eax %edx %ecx %ebx %esi %edi %ebp , F 17

6 Private Address Spaces Each process has its ow private address space. 0xffffffff 0xc kerel virtual memory (code, data, heap, stack) user stack (created at rutime) memory ivisible to user code (stack poiter) Warig: umbers specific to Liux 2.x o IA32!! 0x memory mapped regio for shared libraries ru-time heap (maaged by malloc) read/write segmets (.data,.bss) read-oly segmets (.iit,.text,.rodata) 0x uused , F 17 brk loaded from the executable file Warig: details vary by OS ad kerel versio!

7 IA32 Regio of memory maaged with stack disciplie Grows toward lower addresses Register idicates lowest stack address address of top elemet stack poiter Bottom Icreasig Addresses Poiter Grows Dow Top , F 17

8 IA32 Pushig Pushig pushl Src Fetch operad from Src Maybe a register: %ebp Maybe memory: 8(%ebp) Decremet by 4 Store operad i memory at address give by Bottom Icreasig Addresses Poiter -4 Grows Dow Top , F 17

9 IA32 Poppig Poppig popl Dest Read memory at address give by Icremet by 4 Store ito Dest operad Bottom Icreasig Addresses Poiter +4 Grows Dow Top , F 17

10 Operatio Examples pushl %eax popl %edx 0x110 0x110 0x110 0x10c 0x10c 0x10c 0x x x x x %eax 213 %eax 213 %eax 213 %edx 555 %edx 555 %edx x108 0x108 0x104 0x104 0x , F 17

11 Procedure Cotrol Flow Use stack to support procedure call ad retur Procedure call: call label Push retur address; Jump to label Retur address? Address of istructio after call Example from disassembly e:e8 3d call 8048b90 <mai> :50 pushl %eax» Retur address = 0x Procedure retur: ret Pop address from stack; Jump to address , F 17

12 Procedure Call Example e: e8 3d call 8048b90 <mai> : 50 pushl %eax call 8048b90 0x110 0x110 0x10c 0x10c 0x x x104 0x x108 0x108 0x104 %eip 0x804854e %eip 0x804854e 0x8048b90 %eip is program couter , F 17

13 Procedure Retur Example : c3 ret ret 0x110 0x110 0x10c 0x10c 0x x x104 0x x x104 0x104 0x108 %eip 0x %eip 0x x %eip is program couter , F 17

14 -Based Laguages Laguages that support recursio e.g., C, Pascal, Java Code must be reetrat Multiple istatiatios of a sigle procedure live at same time Need some place to store state of each istatiatio Argumets Local variables Retur poiter (maybe) Weird thigs (static liks, exceptio hadlig, ) disciplie key observatio State for give procedure eeded for limited time From time of call to time of retur Note: callee returs before caller does Therefore stack allocated i ested frames State for sigle procedure istatiatio , F 17

15 Call Chai Example Code Structure yoo( ) { who(); } who( ) { ami(); ami(); } Procedure ami() recursive ami( ) { ami(); } Call Chai yoo who ami ami ami ami , F 17

16 Frames Cotets Local variables Retur iformatio Temporary space Maagemet Poiters Space allocated whe eter procedure Set-up code Deallocated whe retur Fiish code poiter idicates stack top Frame poiter %ebp idicates start of curret frame yoo Frame Poiter %ebp Poiter who proc ami Top , F 17

17 IA32/Liux Frame Curret Frame ( Top to Bottom ) Parameters for fuctio we're about to call Argumet build Local variables If do't all fit i registers Caller's saved registers Caller's saved frame poiter Caller's Frame Retur address Pushed by call istructio Argumets for this call Caller Frame Frame Poiter (%ebp) Poiter () Argumets Retur Addr Old %ebp Saved Registers + Local Variables Argumet Build , F 17

18 swap() it zip1 = 15213; it zip2 = 91125; void call_swap() { swap(&zip1, &zip2); } Callig swap from call_swap call_swap: pushl $zip2 # Global var pushl $zip1 # Global var call swap void swap(it *xp, it *yp) { it t0 = *xp; it t1 = *yp; *xp = t1; *yp = t0; } &zip2 &zip1 Rt adr Resultig , F 17

19 swap() void swap(it *xp, it *yp) { it t0 = *xp; it t1 = *yp; *xp = t1; *yp = t0; } Core swap: pushl %ebp movl,%ebp pushl %ebx movl 12(%ebp),%ecx movl 8(%ebp),%edx movl (%ecx),%eax movl (%edx),%ebx movl %eax,(%edx) movl %ebx,(%ecx) Set Up Body movl -4(%ebp),%ebx movl %ebp, popl %ebp ret Fiish , F 17

20 swap() Setup Eterig %ebp &zip2 &zip1 Rt adr swap: pushl %ebp movl,%ebp pushl %ebx , F 17

21 swap() Setup #1 Eterig %ebp Resultig %ebp &zip2 &zip1 Rt adr yp xp Rt adr Old %ebp swap: pushl %ebp movl,%ebp pushl %ebx , F 17

22 swap() Setup #2 Eterig %ebp Resultig &zip2 &zip1 Rt adr swap: pushl %ebp movl,%ebp pushl %ebx yp xp Rt adr Old %ebp %ebp , F 17

23 swap() Setup #3 Eterig %ebp Resultig &zip2 &zip1 Rt adr swap: pushl %ebp movl,%ebp pushl %ebx Observatio yp xp Rt adr Old %ebp %ebp Old %ebx Savig caller s register %ebx , F 17

24 Effect of swap() Setup Eterig %ebp Offset (relative to %ebp) Resultig &zip2 &zip1 Rt adr 12 yp 8 xp 4 Rt adr 0 Old %ebp %ebp -4 Old %ebx movl 12(%ebp),%ecx # get yp movl 8(%ebp),%edx # get xp... Body , F 17

25 swap() Fiish #1 swap s Offset Observatio yp xp Rt adr 0 Old %ebp %ebp -4 Old %ebx Restorig caller s register %ebx Offset yp xp Rt adr 0 Old %ebp %ebp -4 Old %ebx movl -4(%ebp),%ebx movl %ebp, popl %ebp ret , F 17

26 swap() Fiish #2 swap s Offset yp xp Rt adr 0 Old %ebp %ebp -4 Old %ebx swap s Offset yp xp Rt adr 0 Old %ebp %ebp movl -4(%ebp),%ebx movl %ebp, popl %ebp ret , F 17

27 swap() Fiish #3 swap s Offset swap s Offset %ebp yp xp Rt adr 0 Old %ebp %ebp yp xp Rt adr movl -4(%ebp),%ebx movl %ebp, popl %ebp ret , F 17

28 swap() Fiish #4 swap s Offset yp xp Rt adr %ebp &zip2 &zip1 %ebp Exitig Observatio/query Saved & restored caller's register %ebx Did't do so for %eax, %ecx, or %edx! movl -4(%ebp),%ebx movl %ebp, popl %ebp ret , F 17

29 Register Savig Covetios Whe procedure yoo() calls who(): yoo() is the caller, who() is the callee Ca a register be used for temporary storage? yoo: movl $15213, %edx call who addl %edx, %eax ret who: movl 8(%ebp), %edx addl $91125, %edx ret Cotets of register %edx overwritte by who() , F 17

30 Register Savig Covetios Whe procedure yoo() calls who(): yoo() is the caller, who() is the callee Ca a register be used for temporary storage? Defiitios Caller Save register Caller saves temporary i its frame before callig Callee Save register Callee saves temporary i its frame before usig Covetios Which registers are caller-save, callee-save? , F 17

31 IA32/Liux Register Usage Iteger Registers Two have special uses %ebp, Three maaged as callee-save %ebx, %esi, %edi Old values saved o stack prior to usig Three maaged as caller-save %eax, %edx, %ecx Do what you please, but expect ay callee to do so, as well Register %eax also holds retur value Caller-Save Temporaries Callee-Save Temporaries Special 32 bits %eax %edx %ecx %ebx %esi %edi %ebp , F 17

32 Summary makes recursio work Private storage for each istace of procedure call Istatiatios do't clobber each other Addressig of locals + argumets ca be relative to stack positios Ca be maaged by stack disciplie Procedures retur i iverse order of calls IA32 procedures: istructios + covetios call / ret istructios mix %eip, i a fixed way Register usage covetios Caller / Callee save %ebp ad frame orgaizatio covetios Which argumet is pushed first , F 17

33 Before & After mai() it mai(it argc, char *argv[]) { if (argc > 1) { pritf( %s\, argv[1]); } else { char * av[3] = { 0, 0, 0 }; av[0] = argv[0]; av[1] = Fred ; execvp(av[0], av); } retur (0); } , F 17

34 The Mysterious Parts argc, argv Strigs from oe program Which part of the memory map are they i? How did they get there? What happes whe mai() does retur(0)??? There's o more program to ru...right? Where does the 0 go? How does it get there? 410 studets should seek to abolish mystery , F 17

35 The Mysterious Parts structure whe a ew program starts argc, argv, evp Come from the program that called execve Kerel copies strigs from old address space to ew 0xbffffa7c Null-termiated eviromet variable strigs Null-termiated commad-lie arg strigs evp[] == NULL evp[-1]... evp[0] argv[argc] = NULL argv[argc-1]... argv[0] evp argv argc retur address Future stack frame for mai Bottom of stack eviro Top of stack , F 17

36 The Mysterious Parts What happes whe mai() does retur(0)? Defied by C to have same effect as exit(0) But how?? , F 17

37 The Mysterious Parts What happes whe mai() does retur(0)? Defied by C to have same effect as exit(0) But how?? The mai() wrapper Receives argc, argv from OS Calls mai(), the calls exit() Provided by C library, traditioally i crt0.s Ofte has a strage ame /* ot actual code */ void mai(it argc, char *argv[]) { exit(mai(argc, argv, eviro)); } , F 17

38 Project 0 - Crawler C/Assembly fuctio Ca be called by ay C fuctio Prits stack frames i a symbolic way --- Trace Follows--- Fuctio fu3(c='c', d= ), i Fuctio fu2(f= ), i Fuctio fu1(cout=0), i Fuctio fu1(cout=1), i Fuctio fu1(cout=2), i , F 17

39 Project 0 - Crawler Coceptually easy Callig covetio specifies layout of stack is just memory - C happily lets you read & write Key questios How do I kow 0x is fu1? How do I kow fu3()'s secod parameter is called d? How do I kow whe to stop? , F 17

40 Project 0 Data Flow fu.c tb.c tb_globals.c symbol-table array may slots, blak , F 17

41 Project 0 Data Flow - Compilatio libtraceback.a fu.o tb.o tb_globals.o , F 17

42 Project 0 Data Flow - Likig fu fu.o tb.o tb_globals.o debugger ifo , F 17

43 Project 0 Data Flow - P0 Post-Likig fu mutate symtabge simplify fu.o tb.o tb_globals.o debugger ifo , F 17

44 Summary Review of stack kowledge What makes mai() special Project 0 overview Look for hadout this eveig Start iterviewig Project 2/3/4 parters! (visit ad select Web Asides ) , F 17

45 Movie Night Primer Thursday, August 29 th 19:30, GHC 4401 ( Rashid Auditorium ) $1 Pizza Preseted by #!/cmu/cc Fuded i part by your Studet Activities Fee , F 17

46 Upper 2 hex digits of address FF C0 BF 80 7F Red Hat v. 6.2 ~1920MB memory limit 40 3F Heap Shared Libraries Heap Data Text Liux Memory Layout Heap Rutime stack (8MB limit by default) Dyamically allocated storage Maaged by malloc(), calloc(), ew Shared/Dyamic Libraries aka Shared Objects Library routies (e.g., pritf(), malloc()) Liked ito object code whe first executed Widows has DLLs (sematic differeces) Data, BSS Statically allocated data (BSS starts all-zero) e.g., arrays & variables declared i code Text, RODATA Text - Executable machie istructios RODATA Read-oly (e.g., cost ) Strig literals , F 17

47 , F 17 Liux Memory Allocatio Loaded BF 7F 3F Libraries Text Data 08 Some Heap BF 7F 3F Libraries Text Data Heap 08 More Heap BF 7F 3F Libraries Text Data Heap Heap 08 ELF biary BF 7F 3F Text Data 08