Machine-Level Programming (2)

Transcription

1 Machine-Level Programming (2) Yanqiao ZHU Introduction to Computer Systems Project Future (Fall 2017) Google Camp, Tongji University

2 Outline Control Condition Codes Conditional Branches and Conditional Moves Loops Switch Statements Procedures Stack Structure Calling Conventions Passing Control Passing Data Managing Local Data

3 Conditional Branches Introduction to Computer Systems

4 Processor State (x86-64, Partial) Information about currently executing program: Temporary data (%rax, ) Location of runtime stack (%rsp) Location of current code control point (%rip, ) Status of recent tests (CF, ZF, SF, OF)

5 Condition Codes (Implicit Setting) Single bit registers CF Carry Flag (for unsigned) SF Sign Flag (for signed) ZF Zero Flag OF Overflow Flag (for signed) Implicitly set (as side effect) of arithmetic operations. Example: addq Src,Dest t = a+b CF set if carry out from most significant bit (unsigned overflow) ZF set if t == 0 SF set if t < 0 (as signed) OF set if two s-complement (signed) overflow (a>0 && b>0 && t<0) (a<0 && b<0 && t>=0) Not set by leaq instruction.

6 Condition Codes (Explicit Setting: Compare) Explicit setting by compare instruction: cmpq Src2, Src1 cmpq b,a like computing a-b without setting destination CF set if carry out from most significant bit (used for unsigned comparisons) ZF set if a == b SF set if (a-b) < 0 (as signed) OF set if two s-complement (signed) overflow (a>0 && b<0 && (a-b)<0) (a<0 && b>0 && (a-b)>0)

7 Condition Codes (Explicit Setting: Test) Explicit setting by test instruction: testq Src2, Src1 testq b,a like computing a&b without setting destination Sets condition codes based on value of Src1 & Src2. Useful to have one of the operands be a mask. ZF set when a&b == 0 SF set when a&b < 0

8 Reading Condition Codes setx instructions: Set low-order byte of destination to 0 or 1 based on combinations of condition codes. Does not alter remaining 7 bytes. setx Condition Description sete ZF Equal / Zero setne ~ZF Not Equal / Not Zero sets SF Negative setns ~SF Nonnegative setg ~(SF^OF)&~ZF Greater (Signed) setge ~(SF^OF) Greater or Equal (Signed) setl (SF^OF) Less (Signed) setle (SF^OF) ZF Less or Equal (Signed) seta ~CF&~ZF Above (unsigned) setb CF Below (unsigned)

9 Reading Condition Codes (cont.) setx instructions: Set single byte based on combination of condition codes. One of addressable byte registers: Does not alter remaining bytes. Typically use movzbl to finish job. 32-bit instructions also set upper 32 bits to 0.

10 Reading Condition Codes (cont.) Figure 3.1: Understanding gt().

11 Jumping jx Instructions: Jump to different part of code depending on condition codes. jx Condition Description jmp 1 Unconditional je ZF Equal / Zero jne ~ZF Not Equal / Not Zero js SF Negative jns ~SF Nonnegative jg ~(SF^OF)&~ZF Greater (Signed) jge ~(SF^OF) Greater or Equal (Signed) jl (SF^OF) Less (Signed) jle (SF^OF) ZF Less or Equal (Signed) ja ~CF&~ZF Above (unsigned) jb CF Below (unsigned)

12 Expressing with Goto Code C allows goto statement. Jump to position designated by label. long absdiff (long x, long y) { long result; if (x > y) result = x-y; else result = y-x; return result; } long absdiff_j (long x, long y) { long result; int ntest = x <= y; if (ntest) goto Else; result = x-y; goto Done; Else: result = y-x; Done: return result; }

13 Using Conditional Moves Conditional move instructions: Instruction supports: if (Test) Dest Src Supported in post-1995 x86 processors. GCC tries to use them, but only when known to be safe. Why? Branches are very disruptive to instruction flow through pipelines. Conditional moves do not require control transfer. // C version val = Test? Then_Expr : Else_Expr; // Goto version result = Then_Expr; eval = Else_Expr; nt =!Test; if (nt) result = eval; return result;

14 Using Conditional Moves (cont.) Figure 3.2: Conditional move example.

15 Bad Cases for Conditional Move Expensive computations Bad performance: both values get computed. Only makes sense when computations are very simple. Risky computations val = Test(x)? Hard1(x) : Hard2(x); val = p? *p : 0; Unsafe: both values get computed but may have undesirable effects. Computations with side effects Illegal: must be side-effect free. val = x > 0? x*=7 : x+=3;

16 Loops Introduction to Computer Systems

17 Do-While Loop Figure 3.3: Do-while loop example.

18 Do-While Loop (cont.) Figure 3.4: Do-while loop compilation.

19 General While Translation #1 Jump-to-middle translation Used with -Og While version while (Test) Body Goto Version goto test; loop: Body test: if (Test) goto loop; done:

20 General While Translation #2 Do-while conversion Used with -O1 While version while (Test) Body Goto Version if (!Test) goto done; loop: Body if (Test) goto loop; done: Do-While Version if (!Test) goto done; do Body while(test); done:

21 Switch Statements Introduction to Computer Systems

22 Jump Table Figure 3.5: Jump table structure.

23 Switch Statement Figure 3.6: Switch statement example.

24 Assembly Setup Explanation Table Structure Each target requires 8 bytes. Base address at.l4. Jumping Direct: jmp.l8 Jump target is denoted by label.l8. Indirect: jmp *.L4(,%rdi,8) Start of jump table:.l4. Must scale by factor of 8 (addresses are 8 bytes). Fetch target from effective Address.L4 + x * 8. Only for 0 x 6. Jump table.section.rodata.align 8.L4:.quad.L8 # x = 0.quad.L3 # x = 1.quad.L5 # x = 2.quad.L9 # x = 3.quad.L8 # x = 4.quad.L7 # x = 5.quad.L7 # x = 6

25 Wrapping Up Assembler Control Conditional jump Conditional move Indirect jump (via jump tables) Compiler generates code sequence to implement more complex control Standard Techniques Loops converted to do-while or jump-to-middle form Large switch statements use jump tables Sparse switch statements may use decision trees (if-elseif-elseif-else)

26 Procedures Introduction to Computer Systems

27 Mechanisms in Procedures (1/5) Passing control To beginning of procedure code Back to return point Passing data Procedure arguments Return value Memory management Allocate during procedure execution Deallocate upon return P() { y = Q(x); print(y) } int Q(int i) { int t = 3 * i; int v[10]; return v[t]; }

28 Mechanisms in Procedures (2/5) Passing control To beginning of procedure code Back to return point Passing data Procedure arguments Return value Memory management Allocate during procedure execution Deallocate upon return P() { y = Q(x); print(y) } int Q(int i) { int t = 3 * i; int v[10]; return v[t]; }

29 Mechanisms in Procedures (3/5) Passing control To beginning of procedure code Back to return point Passing data Procedure arguments Return value Memory management Allocate during procedure execution Deallocate upon return P() { y = Q(x); print(y) } int Q(int i) { int t = 3 * i; int v[10]; return v[t]; }

30 Mechanisms in Procedures (4/5) Passing control To beginning of procedure code Back to return point Passing data Procedure arguments Return value Memory management Allocate during procedure execution Deallocate upon return P() { y = Q(x); print(y) } int Q(int i) { int t = 3 * i; int v[10]; return v[t]; }

31 Mechanisms in Procedures (5/5) Mechanisms all implemented with machine instructions. x86-64 implementation of a procedure uses only those mechanisms require. Machine instructions implement the mechanisms, but the choices are determined by designers. These choices make up the Application Binary Interface (ABI).

32 x86-64 Stack (1/3) Region of memory managed with stack discipline. Memory viewed as array of bytes. Different regions have different purposes. Like ABI, a policy decision. stack code

33 x86-64 Stack (2/3) Region of memory managed with stack discipline. stack bottom stack code Stack Pointer: %rsp stack top

34 x86-64 Stack (3/3) Region of memory managed with stack discipline. stack bottom Grows toward lower addresses. Register %rsp contains lowest stack address. Address of top element Stack Pointer: %rsp stack top increasing addresses stack grows down

35 x86-64 Stack: Push pushq Src Fetch operand at Src val Decrement %rsp by 8 Write operand at address given by %rsp stack bottom increasing addresses Stack Pointer: %rsp stack top stack grows down

36 x86-64 Stack: Push pushq Src Fetch operand at Src val Decrement %rsp by 8 Write operand at address given by %rsp stack bottom increasing addresses Stack Pointer: %rsp 8 stack top stack grows down

37 x86-64 Stack: Push pushq Src Fetch operand at Src Decrement %rsp by 8 Write operand at address given by %rsp stack bottom increasing addresses Stack Pointer: %rsp 8 val stack grows down stack top

38 x86-64 Stack: Pop popq Dest Read value at address given by %rsp Increment %rsp by 8 Store value at Dest (usually a register) stack bottom increasing addresses stack grows down Stack Pointer: %rsp val stack top

39 x86-64 Stack: Pop popq Dest Read value at address given by %rsp Increment %rsp by 8 Store value at Dest (usually a register) stack bottom increasing addresses Stack Pointer: %rsp +8 val stack grows down stack top

40 x86-64 Stack: Pop popq Dest Read value at address given by %rsp val Increment %rsp by 8 Store value at Dest (usually a register) stack bottom increasing addresses The memory doesn t change, only the value of %rsp. Stack Pointer: %rsp val stack top stack grows down

41 Code Examples void multstore(long x, long y, long *dest) { long t = mult2(x, y); *dest = t; } <multstore>: : push %rbx # Save %rbx : mov %rdx, %rbx # Save dest : callq <mult2> # mult2(x,y) : mov %rax, (%rbx) # Save at dest 40054c: pop %rbx # Restore %rbx 40054d: retq # Return

42 Code Examples (cont.) long mult2(long a, long b) { long s = a * b; return s; } <mult2>: : mov %rdi, %rax # a : imul %rsi, %rax # a * b : retq # Return

43 Procedure Control Flow Use stack to support procedure call and return. Procedure call: call label Push return address on stack Jump to label Return address: Address of the next instruction right after call Example from disassembly Procedure return: ret Pop address from stack Jump to address

44 Control Flow Example (1/4) 0x130 0x128 0x <multstore>: : callq <mult2> : mov %rax, (%rbx) %rsp %rip 0x120 0x <mult2>: : mov %rdi, %rax : retq

45 Control Flow Example (2/4) 0x130 0x128 0x120 0x118 0x <multstore>: : callq <mult2> : mov %rax, (%rbx) %rsp %rip 0x118 0x <mult2>: : mov %rdi, %rax : retq

46 Control Flow Example (3/4) 0x130 0x128 0x120 0x118 0x <multstore>: : callq <mult2> : mov %rax, (%rbx) %rsp %rip 0x118 0x <mult2>: : mov %rdi, %rax : retq

47 Control Flow Example (4/4) 0x130 0x128 0x <multstore>: : callq <mult2> : mov %rax, (%rbx) %rsp %rip 0x120 0x <mult2>: : mov %rdi, %rax : retq

48 Procedure Data Flow Registers First 6 arguments Return value %rdi %rsi %rdx %rcx %r8 %r9 %rax Stack Only allocate stack space when needed Arg n Arg 8 Arg 7

49 Recall: x86-64 Integer Registers

50 Data Flow Examples void multstore(long x, long y, long *dest) { long t = mult2(x, y); *dest = t; } <multstore>: # x in %rdi, y in %rsi, dest in %rdx : mov %rdx,%rbx # Save dest : callq <mult2> # mult2(x,y) # t in %rax : mov %rax,(%rbx) # Save at dest

51 Data Flow Examples (cont.) long mult2(long a, long b) { long s = a * b; return s; } <mult2>: # a in %rdi, b in %rsi : mov %rdi,%rax # a : imul %rsi,%rax # a * b # s in %rax : retq # Return

52 Stack-Based Languages Languages that support recursion E.g., C, Pascal, Java Code must be Reentrant. Multiple simultaneous instantiations of single procedure. Need some place to store state of each instantiation. Arguments Local variables Return pointer

53 Stack-Based Languages (cont.) Stack discipline State for given procedure needed for limited time. From when called to when return. Callee returns before caller does. Stack allocated in Frames. State for single procedure instantiation

54 Call Chain Example (1/10) Example Call Chain: yoo() { who(); } who() { ami(); ami(); } ami() { ami(); } yoo who ami ami ami Figure 3.7: Procedure ami() is recursive.

55 Stack Frames Contents Return information Local storage (if needed) Temporary space (if needed) Management Space allocated when enter procedure. Set-up code Includes push by call instruction Deallocated when return. Finish code Includes pop by ret instruction Frame Pointer: %rbp (optional) Stack Pointer: %rsp Previous Frame Frame for proc Stack Top

56 Call Chain Example (2/10) Stack yoo() { who(); } yoo who ami ami Previous yoo %rbp %rsp ami

57 Call Chain Example (3/10) Stack yoo() who() { { who(); ami(); } ami(); } yoo who ami ami ami Previous yoo who %rbp %rsp

58 Call Chain Example (4/10) Stack yoo() who() { { ami() who(); ami(); { } ami(); ami(); } } yoo who ami ami ami Previous yoo who ami %rbp %rsp

59 Call Chain Example (5/10) Stack yoo() yoo Previous who() { { who yoo ami() who(); ami(); { ami() ami ami who } { ami(); ami(); ami(); } ami ami } } ami %rbp %rsp

60 Call Chain Example (6/10) Stack yoo() who() { { ami() who(); ami(); { } ami(); ami(); } } yoo who ami ami ami Previous yoo who ami %rbp %rsp

61 Call Chain Example (7/10) Stack yoo() who() { { who(); ami(); } ami(); } yoo who ami ami ami Previous yoo who %rbp %rsp

62 Call Chain Example (8/10) Stack yoo() who() { { ami() who(); ami(); { } ami(); ami(); } } yoo who ami ami ami Previous yoo who ami %rbp %rsp

63 Call Chain Example (9/10) Stack yoo() who() { { who(); ami(); } ami(); } yoo who ami ami ami Previous yoo who %rbp %rsp

64 Call Chain Example (10/10) Stack yoo() { who(); } yoo who ami ami Previous yoo %rbp %rsp ami

65 x86-64/linux Stack Frame Current Stack Frame ( Top to Bottom) Argument build: Parameters for function about to call. Local variables: If can t keep in registers Saved register context Old frame pointer (optional) Caller Stack Frame Return address Pushed by call instruction Arguments for this call Arguments 7+ Return Address Old %rbp Saved Registers + Local Variables Argument Build (optional) Caller Frame Frame Pointer (optional) %rbp Stack Pointer %rsp Figure 3.8: x86-64/linux stack frame.

66 Example: incr long incr(long *p, long val) { long x = *p; long y = x + val; *p = y; return x; } incr: movq addq movq ret (%rdi), %rax %rax, %rsi %rsi, (%rdi) Register %rdi %rsi %rax Use(s) Argument p Argument val, y x, Return value

67 Example: Calling incr (1/6) long call_incr() { long v1 = 15213; long v2 = incr(&v1, 3000); return v1+v2; } Initial Stack Structure Rtn address %rsp Resulting Stack Structure call_incr: subq $16, %rsp movq $15213, 8(%rsp) movl $3000, %esi leaq 8(%rsp), %rdi call incr addq 8(%rsp), %rax addq $16, %rsp ret Rtn address Unused %rsp+8 %rsp

68 Example: Calling incr (2/6) long call_incr() { long v1 = 15213; long v2 = incr(&v1, 3000); return v1+v2; } call_incr: subq $16, %rsp movq $15213, 8(%rsp) movl $3000, %esi leaq 8(%rsp), %rdi call incr addq 8(%rsp), %rax addq $16, %rsp ret Stack Structure Rtn address Aside 1: movl $3000, %esi Remember, movl -> %exx zeros out high order %rsp+8 32 bits. Why use movl instead of movq? 1 byte shorter. Aside 2: leaq 8(%rsp), %rdi Unused %rsp Computes %rsp+8 Actually, used for what it is meant! Register %rdi Use(s) &v1 %rsi 3000

69 Example: Calling incr (3/6) long call_incr() { long v1 = 15213; long v2 = incr(&v1, 3000); return v1+v2; } Stack Structure Rtn address call_incr: subq $16, %rsp movq $15213, 8(%rsp) movl $3000, %esi leaq 8(%rsp), %rdi call incr addq 8(%rsp), %rax addq $16, %rsp ret Unused Register Use(s) %rdi &v1 %rsi 3000 %rsp+8 %rsp

70 Example: Calling incr (4/6) long call_incr() { long v1 = 15213; long v2 = incr(&v1, 3000); return v1+v2; } call_incr: subq $16, %rsp movq $15213, 8(%rsp) movl $3000, %esi leaq 8(%rsp), %rdi call incr addq 8(%rsp), %rax addq $16, %rsp ret Stack Structure Rtn address Unused Register Use(s) %rax Return value %rsp+8 %rsp

71 Stack Structure Example: Calling incr (5/6) long call_incr() { long v1 = 15213; long v2 = incr(&v1, 3000); return v1+v2; } Rtn address Unused %rsp+8 %rsp call_incr: subq $16, %rsp movq $15213, 8(%rsp) movl $3000, %esi leaq 8(%rsp), %rdi call incr addq 8(%rsp), %rax addq $16, %rsp ret Register Use(s) %rax Return value Updated Stack Structure Rtn address %rsp

72 Example: Calling incr (6/6) Updated Stack Structure long call_incr() { long v1 = 15213; long v2 = incr(&v1, 3000); return v1+v2; } Rtn address %rsp call_incr: subq $16, %rsp movq $15213, 8(%rsp) movl $3000, %esi leaq 8(%rsp), %rdi call incr addq 8(%rsp), %rax addq $16, %rsp ret Register Use(s) %rax Return value Final Stack Structure %rsp

73 Register Saving Conventions When procedure yoo calls who: yoo is the caller. who is the callee. Can register be used for temporary storage? Contents of register %rdx overwritten by who. This could be trouble something should be done! Need some coordination. yoo: movq $15213, %rdx call who addq %rdx, %rax ret who: subq $18213, %rdx ret

74 Register Saving Conventions (cont.) When procedure yoo calls who: yoo is the caller. who is the callee. Conventions Caller Saved Caller saves temporary values in its frame before the call. Callee Saved Callee saves temporary values in its frame before using. Callee restores them before returning to caller.

75 x86-64 Linux Register Usage %rax Return value, also caller-saved Can be modified by procedure %rdi,, %r9 Arguments, also caller-saved Can be modified by procedure %r10, %r11 Caller-saved Can be modified by procedure %rax %rdi %rsi %rdx %rcx %r8 %r9 %r10 %r11 Return value Arguments Caller-saved temporaries

76 x86-64 Linux Register Usage (cont.) %rbx, %r12, %r13, %r14 Callee-saved Callee must save and restore %rbp Callee-saved Callee must save and restore May be used as frame pointer Can mix and match %rsp Special form of callee save Restored to original value upon exit from procedure Special %rbx %r12 %r13 %r14 %rbp %rsp Callee-saved Temporaries

77 Callee-Saved Example (1/8) x comes in register %rdi. We need %rdi for the call to incr. Where should be put x, so we can use it after the call to incr? long call_incr2(long x) { long v1 = 15213; long v2 = incr(&v1, 3000); return x + v2; } Initial Stack Structure Rtn address %rsp

78 Callee-Saved Example (2/8) long call_incr2(long x) { long v1 = 15213; long v2 = incr(&v1, 3000); return x + v2; } call_incr2: pushq %rbx subq $16, %rsp movq %rdi, %rbx movq $15213, 8(%rsp) movl $3000, %esi leaq 8(%rsp), %rdi call incr addq %rbx, %rax addq $16, %rsp popq %rbx ret Initial Stack Structure Rtn address Resulting Stack Structure Rtn address Saved %rbx %rsp %rsp

79 Callee-Saved Example (3/8) Initial Stack Structure long call_incr2(long x) { long v1 = 15213; long v2 = incr(&v1, 3000); return x + v2; } Rtn address Saved %rbx %rsp call_incr2: pushq %rbx subq $16, %rsp movq %rdi, %rbx movq $15213, 8(%rsp) movl $3000, %esi leaq 8(%rsp), %rdi call incr addq %rbx, %rax addq $16, %rsp popq %rbx ret Resulting Stack Structure Rtn address Saved %rbx %rsp + 8 %rsp

80 Callee-Saved Example (4/8) long call_incr2(long x) { long v1 = 15213; long v2 = incr(&v1, 3000); return x + v2; } call_incr2: pushq %rbx subq $16, %rsp movq %rdi, %rbx movq $15213, 8(%rsp) movl $3000, %esi leaq 8(%rsp), %rdi call incr addq %rbx, %rax addq $16, %rsp popq %rbx ret x saved in %rbx A callee saved register. Stack Structure Rtn address Saved %rbx %rsp + 8 %rsp

81 Callee-Saved Example (5/8) long call_incr2(long x) { long v1 = 15213; long v2 = incr(&v1, 3000); return x + v2; } call_incr2: pushq %rbx subq $16, %rsp movq %rdi, %rbx movq $15213, 8(%rsp) movl $3000, %esi leaq 8(%rsp), %rdi call incr addq %rbx, %rax addq $16, %rsp popq %rbx ret Stack Structure Rtn address Saved %rbx Unused %rsp + 8 %rsp

82 Callee-Saved Example (6/8) long call_incr2(long x) { long v1 = 15213; long v2 = incr(&v1, 3000); return x + v2; } call_incr2: pushq %rbx subq $16, %rsp movq %rdi, %rbx movq $15213, 8(%rsp) movl $3000, %esi leaq 8(%rsp), %rdi call incr addq %rbx, %rax addq $16, %rsp popq %rbx ret x is safe in %rbx Return result in %rax Stack Structure Rtn address Saved %rbx Unused %rsp + 8 %rsp

83 Callee-Saved Example (7/8) long call_incr2(long x) { long v1 = 15213; long v2 = incr(&v1, 3000); return x + v2; } call_incr2: pushq %rbx subq $16, %rsp movq %rdi, %rbx movq $15213, 8(%rsp) movl $3000, %esi leaq 8(%rsp), %rdi call incr addq %rbx, %rax addq $16, %rsp popq %rbx ret Stack Structure Rtn address Saved %rbx Unused %rsp

84 Initial Stack Structure Callee-Saved Example (8/8) long call_incr2(long x) { long v1 = 15213; long v2 = incr(&v1, 3000); return x + v2; } Rtn address Saved %rbx Unused %rsp call_incr2: pushq %rbx subq $16, %rsp movq %rdi, %rbx movq $15213, 8(%rsp) movl $3000, %esi leaq 8(%rsp), %rdi call incr addq %rbx, %rax addq $16, %rsp popq %rbx ret Final Stack Structure Rtn address Saved %rbx Unused %rsp

85 Wrapping Up Important Points Stack is the right data structure for procedure call/return. If P calls Q, then Q returns before P. Recursion (& mutual recursion) handled by normal calling conventions. Can safely store values in local stack frame and in callee-saved registers. Put function arguments at top of stack. Result return in %rax. Pointers are addresses of values. On stack or global