238P: Operating Systems. Lecture 3: Calling conventions. Anton Burtsev October, 2018

Similar documents
143A: Principles of Operating Systems. Lecture 4: Calling conventions. Anton Burtsev October, 2017

143A: Principles of Operating Systems. Lecture 5: Calling conventions. Anton Burtsev January, 2017

Machine Program: Procedure. Zhaoguo Wang

Stack -- Memory which holds register contents. Will keep the EIP of the next address after the call

Lecture 4 CIS 341: COMPILERS

CSC 8400: Computer Systems. Using the Stack for Function Calls

Subprograms: Local Variables

CSC 2400: Computer Systems. Using the Stack for Function Calls

An Introduction to x86 ASM

Systems I. Machine-Level Programming V: Procedures

ICS143A: Principles of Operating Systems. Midterm recap, sample questions. Anton Burtsev February, 2017

Practical Malware Analysis

CMSC 313 Lecture 12. Project 3 Questions. How C functions pass parameters. UMBC, CMSC313, Richard Chang

EECE.3170: Microprocessor Systems Design I Summer 2017 Homework 4 Solution

CSC 2400: Computing Systems. X86 Assembly: Function Calls"

Function Calls COS 217. Reading: Chapter 4 of Programming From the Ground Up (available online from the course Web site)

Assembly Language: Function Calls

x86 assembly CS449 Fall 2017

CSC 2400: Computing Systems. X86 Assembly: Function Calls

W4118: PC Hardware and x86. Junfeng Yang

Assembly Language: Function Calls

Assembly Language: Function Calls" Goals of this Lecture"

Procedure-Calling Conventions October 30

Computer Systems C S Cynthia Lee

Assembly Language: Function Calls" Goals of this Lecture"

Machine Programming 3: Procedures

Assembly Language: Function Calls. Goals of this Lecture. Function Call Problems

See P&H 2.8 and 2.12, and A.5-6. Prof. Hakim Weatherspoon CS 3410, Spring 2015 Computer Science Cornell University

Calling Conventions. See P&H 2.8 and Hakim Weatherspoon CS 3410, Spring 2013 Computer Science Cornell University

Princeton University Computer Science 217: Introduction to Programming Systems. Assembly Language: Function Calls

CSC 2400: Computer Systems. Using the Stack for Function Calls

administrivia today start assembly probably won t finish all these slides Assignment 4 due tomorrow any questions?

Function Call Convention

The IA-32 Stack and Function Calls. CS4379/5375 Software Reverse Engineering Dr. Jaime C. Acosta

Winter Compiler Construction T11 Activation records + Introduction to x86 assembly. Today. Tips for PA4. Today:

CNIT 127: Exploit Development. Ch 1: Before you begin. Updated

X86 Stack Calling Function POV

Subprograms: Arguments

Procedure Calls. Young W. Lim Sat. Young W. Lim Procedure Calls Sat 1 / 27

%r8 %r8d. %r9 %r9d. %r10 %r10d. %r11 %r11d. %r12 %r12d. %r13 %r13d. %r14 %r14d %rbp. %r15 %r15d. Sean Barker

Procedure Calls. Young W. Lim Mon. Young W. Lim Procedure Calls Mon 1 / 29

Where We Are. Optimizations. Assembly code. generation. Lexical, Syntax, and Semantic Analysis IR Generation. Low-level IR code.

Program Exploitation Intro

CS24: INTRODUCTION TO COMPUTING SYSTEMS. Spring 2018 Lecture 4

CMSC 313 COMPUTER ORGANIZATION & ASSEMBLY LANGUAGE PROGRAMMING

How Software Executes

Computer Systems Lecture 9

CS429: Computer Organization and Architecture

Machine-level Programs Procedure

Registers. Ray Seyfarth. September 8, Bit Intel Assembly Language c 2011 Ray Seyfarth

System Software Assignment 1 Runtime Support for Procedures

CS 31: Intro to Systems Functions and the Stack. Martin Gagne Swarthmore College February 23, 2016

CSE351 Spring 2018, Midterm Exam April 27, 2018

Anne Bracy CS 3410 Computer Science Cornell University

Sungkyunkwan University

AS08-C++ and Assembly Calling and Returning. CS220 Logic Design AS08-C++ and Assembly. AS08-C++ and Assembly Calling Conventions

CS 480 Fall Runtime Environments. Mike Lam, Professor. (a.k.a. procedure calls and heap management)

CIT Week13 Lecture

Functions and Procedures

Run-time Environment

CMSC 313 Lecture 12 [draft] How C functions pass parameters

What the CPU Sees Basic Flow Control Conditional Flow Control Structured Flow Control Functions and Scope. C Flow Control.

Millions of instructions per second [MIPS] executed by a single chip microprocessor

Assembly Language Programming: Procedures. EECE416 uc. Charles Kim Howard University. Fall

THEORY OF COMPILATION

Mechanisms in Procedures. CS429: Computer Organization and Architecture. x86-64 Stack. x86-64 Stack Pushing

Bryant and O Hallaron, Computer Systems: A Programmer s Perspective, Third Edition. Carnegie Mellon

Question 4.2 2: (Solution, p 5) Suppose that the HYMN CPU begins with the following in memory. addr data (translation) LOAD 11110

Machine-Level Programming III: Procedures

University of Washington

Buffer Overflow Attack (AskCypert CLaaS)

16.317: Microprocessor Systems Design I Fall 2014

Machine- Level Programming III: Switch Statements and IA32 Procedures

Implementing Threads. Operating Systems In Depth II 1 Copyright 2018 Thomas W. Doeppner. All rights reserved.

CS356: Discussion #6 Assembly Procedures and Arrays. Marco Paolieri

Functions. Ray Seyfarth. August 4, Bit Intel Assembly Language c 2011 Ray Seyfarth

CSE 351: Week 4. Tom Bergan, TA

CS412/CS413. Introduction to Compilers Tim Teitelbaum. Lecture 21: Generating Pentium Code 10 March 08

Winter Compiler Construction T10 IR part 3 + Activation records. Today. LIR language

3. Process Management in xv6

Anne Bracy CS 3410 Computer Science Cornell University

Machine-level Programming (3)

Register Allocation, iii. Bringing in functions & using spilling & coalescing

Sample Exam I PAC II ANSWERS

Procedures and the Call Stack

Reverse Engineering II: Basics. Gergely Erdélyi Senior Antivirus Researcher

Machine/Assembler Language Putting It All Together

ASSEMBLY III: PROCEDURES. Jo, Heeseung

Assembly III: Procedures. Jo, Heeseung

Anne Bracy CS 3410 Computer Science Cornell University

Stacks and Frames Demystified. CSCI 3753 Operating Systems Spring 2005 Prof. Rick Han

CPSC W Term 2 Problem Set #3 - Solution

CS 33: Week 3 Discussion. x86 Assembly (v1.0) Section 1G

CS213. Machine-Level Programming III: Procedures

CNIT 127: Exploit Development. Ch 2: Stack Overflows in Linux

Subroutines. int main() { int i, j; i = 5; j = celtokel(i); i = j; return 0;}

CS153: Compilers Lecture 8: Compiling Calls

Assembly III: Procedures. Jin-Soo Kim Computer Systems Laboratory Sungkyunkwan University

x86 assembly CS449 Spring 2016

18-600: Recitation #4 Exploits

Transcription:

238P: Operating Systems Lecture 3: Calling conventions Anton Burtsev October, 2018

What does CPU do internally? (Remember Lecture 01 - Introduction?)

CPU execution loop CPU repeatedly reads instructions from memory Executes them Example ADD EDX, EAX, EBX // EDX = EAX + EBX

Stack and procedure calls

What is stack?

Stack It's just a region of memory Pointed by a special register ESP You can change ESP Get a new stack

Why do we need stack?

Calling functions // some code... foo(); // more code.. Stack contains information for how to return from a subroutine i.e., foo()

Stack Main purpose: Store the return address for the current procedure Caller es return address on the stack Callee pops it and jumps

Stack Main purpose: Store the return address for the current procedure Caller es return address on the stack Callee pops it and jumps

Stack Other uses: Local data storage Parameter passing Evaluation stack Register spill

Call/return CALL instruction Makes an unconditional jump to a subprogram and es the address of the next instruction on the stack eip + sizeof(call); save return ; address jmp _my_function RET instruction Pops off an address and jumps to that address

Manipulating stack ESP register Contains the memory address of the topmost element in the stack PUSH instruction 0xBAR Insert data on the stack Subtract 4 from ESP

Manipulating stack POP instruction pop EAX Removes data from the stack Saves in register or memory Adds 4 to ESP

Calling conventions

Calling conventions Goal: reentrant programs How to pass arguments How to return values On the stack? In registers? On the stack? In registers? Conventions differ from compiler, optimizations, etc.

Maintain stack as frames Each function has a new frame void DrawSquare(...) {... DrawLine(x, y, z); } Use dedicated register EBP (frame pointer) Points to the base of the frame

Maintain stack as frames Each function has a new frame void DrawSquare(...) {... DrawLine(x, y, z); } Use dedicated register EBP (frame pointer) Points to the base of the frame

Stack consists of frames Each function has a new frame void DrawSquare(...) {... DrawLine(x, y, z); } Use dedicated register EBP (frame pointer) Points to the base of the frame

Prologue/epilogue Each function maintains the frame A dedicated register EBP is used to keep the frame pointer Each function uses prologue code (blue), and epilogue (yellow) to maintain the frame my_function: ebp mov ebp, esp. pop ebp ret ; save original EBP value on stack ; new EBP = ESP ; function body ; restore original EBP value

How to allocate local variables Each function has private instances of local variables foo(int x) { int a, b, c;... return; } Function can be called recursively foo(int x) { int a, b, c; a = x + 1; if ( a < 100 ) foo(a); return; }

How to allocate local variables? void my_function() { int a, b, c; }

How to allocate local variables? void my_function() { int a, b, c; } On the stack!

Allocating local variables Stored right after the saved EBP value in the stack Allocated by subtracting the number of bytes required from ESP _my_function: ebp ; save original EBP value on stack mov ebp, esp ; new EBP = ESP sub esp, LOCAL_BYTES ; = # bytes needed by locals ; function body mov esp, ebp ; deallocate locals pop ebp ; restore original EBP value ret

Example void my_function() { int a, b, c; _my_function: ebp ; save the value of ebp mov ebp, esp ; ebp = esp, set ebp to be top of the stack (esp) sub esp, 12 ; move esp down to allocate space for the ; local variables on the stack With frames local variables can be accessed by dereferencing EBP mov [ebp - 4], 10 mov [ebp - 8], 5 mov [ebp - 12], 2 ; location of variable a ; location of b ; location of c

Example void my_function() { int a, b, c; _my_function: ebp ; save the value of ebp mov ebp, esp ; ebp = esp, set ebp to be top of the stack (esp) sub esp, 12 ; move esp down to allocate space for the ; local variables on the stack With frames local variables can be accessed by dereferencing EBP mov [ebp - 4], 10 mov [ebp - 8], 5 mov [ebp - 12], 2 ; location of variable a ; location of b ; location of c

Example void my_function() { int a, b, c; _my_function: ebp ; save the value of ebp mov ebp, esp ; ebp = esp, set ebp to be top of the stack (esp) sub esp, 12 ; move esp down to allocate space for the ; local variables on the stack With frames local variables can be accessed by dereferencing EBP mov [ebp - 4], 10 mov [ebp - 8], 5 mov [ebp - 12], 2 ; location of variable a ; location of b ; location of c

Example void my_function() { int a, b, c; _my_function: ebp ; save the value of ebp mov ebp, esp ; ebp = esp, set ebp to be top of the stack (esp) sub esp, 12 ; move esp down to allocate space for the ; local variables on the stack With frames local variables can be accessed by dereferencing EBP mov [ebp - 4], 10 mov [ebp - 8], 5 mov [ebp - 12], 2 ; location of variable a ; location of b ; location of c

How to pass arguments? Possible options: In registers On the stack

How to pass arguments? x86 32 bit Pass arguments on the stack Return value is in EAX and EDX x86 64 bit more registers! Pass first 6 arguments in registers RDI, RSI, RDX, RCX, R8, and R9 The rest on the stack Return value is in RAX and RDX

x86_32: passing arguments on the stack Example function void my_function(int x, int y, int z) { } Example invocation my_function(2, 5, 10); Generated code call 10 5 2 _my_function

Example stack : : 10 [ebp + 16] 5 [ebp + 12] 2 [ebp + 8] RA [ebp + 4] FP [ebp] [ebp - 4] : : : : [ebp - X] (3rd function argument) (2nd argument) (1st argument) (return address) (old ebp value) EBP points here (1st local variable) (esp - the current stack pointer)

Example stack : : 10 [ebp + 16] 5 [ebp + 12] 2 [ebp + 8] RA [ebp + 4] FP [ebp] [ebp - 4] : : : : [ebp - X] (3rd function argument) (2nd argument) (1st argument) (return address) (old ebp value) EBP points here (1st local variable) (esp - the current stack pointer)

Example stack : : 10 [ebp + 16] 5 [ebp + 12] 2 [ebp + 8] RA [ebp + 4] FP [ebp] [ebp - 4] : : : : [ebp - X] (3rd function argument) (2nd argument) (1st argument) (return address) (old ebp value) EBP points here (1st local variable) (esp - the current stack pointer)

Example stack : : 10 [ebp + 16] 5 [ebp + 12] 2 [ebp + 8] RA [ebp + 4] FP [ebp] [ebp - 4] : : : : [ebp - X] (3rd function argument) (2nd argument) (1st argument) (return address) (old ebp value) EBP points here (1st local variable) (esp - the current stack pointer)

Example: caller side code int callee(int, int, int); int caller(void) { int ret; ret = callee(1, 2, 3); ret += 5; return ret; } caller: ; manage own stack frame ebp mov ebp, esp ; call arguments 3 2 1 ; call subroutine 'callee' call callee ; remove arguments from frame add esp, 12 ; use subroutine result add eax, 5 ; restore old call frame pop ebp ; return ret

Example: caller side code int callee(int, int, int); int caller(void) { int ret; ret = callee(1, 2, 3); ret += 5; return ret; } caller: ; manage own stack frame ebp mov ebp, esp ; call arguments 3 2 1 ; call subroutine 'callee' call callee ; remove arguments from frame add esp, 12 ; use subroutine result add eax, 5 ; restore old call frame pop ebp ; return ret

Example: caller side code int callee(int, int, int); int caller(void) { int ret; ret = callee(1, 2, 3); ret += 5; return ret; } caller: ; manage own stack frame ebp mov ebp, esp ; call arguments 3 2 1 ; call subroutine 'callee' call callee ; remove arguments from frame add esp, 12 ; use subroutine result add eax, 5 ; restore old call frame pop ebp ; return ret

Example: caller side code int callee(int, int, int); int caller(void) { int ret; ret = callee(1, 2, 3); ret += 5; return ret; } caller: ; manage own stack frame ebp mov ebp, esp ; call arguments 3 2 1 ; call subroutine 'callee' call callee ; remove arguments from frame add esp, 12 ; use subroutine result add eax, 5 ; restore old call frame pop ebp ; return ret

Example: caller side code int callee(int, int, int); int caller(void) { int ret; ret = callee(1, 2, 3); ret += 5; return ret; } caller: ; manage own stack frame ebp mov ebp, esp ; call arguments 3 2 1 ; call subroutine 'callee' call callee ; remove arguments from frame add esp, 12 ; use subroutine result add eax, 5 ; restore old call frame pop ebp ; return ret

Example: caller side code int callee(int, int, int); int caller(void) { int ret; ret = callee(1, 2, 3); ret += 5; return ret; } caller: ; manage own stack frame ebp mov ebp, esp ; call arguments 3 2 1 ; call subroutine 'callee' call callee ; remove arguments from frame add esp, 12 ; use subroutine result add eax, 5 ; restore old call frame pop ebp ; return ret

Wait, where is return ret;? int callee(int, int, int); int caller(void) { int ret; ret = callee(1, 2, 3); ret += 5; return ret; } caller: ; manage own stack frame ebp mov ebp, esp ; call arguments 3 2 1 ; call subroutine 'callee' call callee ; remove arguments from frame add esp, 12 ; use subroutine result add eax, 5 ; restore old call frame pop ebp ; return ret

my_function(int x, int y, int z) Example: callee void { int a, b, c; side code return; } _my_function: ebp mov ebp, esp sub esp, 12 ; allocate local varaibles ; sizeof(a) + sizeof(b) + sizeof(c) ; x = [ebp + 8], y = [ebp + 12], z = [ebp + 16] ; a=[ebp-4]=[esp+8], ; b=[ebp-8]=[esp+4], c=[ebp-12] = [esp] mov esp, ebp ; deallocate local variables pop ebp ret

my_function(int x, int y, int z) Example: callee void { int a, b, c; side code return; } _my_function: ebp mov ebp, esp sub esp, 12 ; allocate local varaibles ; sizeof(a) + sizeof(b) + sizeof(c) ; x = [ebp + 8], y = [ebp + 12], z = [ebp + 16] ; a=[ebp-4]=[esp+8], ; b=[ebp-8]=[esp+4], c=[ebp-12] = [esp] mov esp, ebp ; deallocate local variables pop ebp ret

my_function(int x, int y, int z) Example: callee void { int a, b, c; side code return; } _my_function: ebp mov ebp, esp ; ebp = esp sub esp, 12 ; allocate local varaibles ; sizeof(a) + sizeof(b) + sizeof(c) ; x = [ebp + 8], y = [ebp + 12], z = [ebp + 16] ; a=[ebp-4]=[esp+8], ; b=[ebp-8]=[esp+4], c=[ebp-12] = [esp] mov esp, ebp ;deallocate local variables (esp = ebp) pop ebp ret

my_function(int x, int y, int z) Example: callee void { int a, b, c; side code return; } _my_function: ebp mov ebp, esp ; ebp = esp sub esp, 12 ; allocate local varaibles ; sizeof(a) + sizeof(b) + sizeof(c) ; x = [ebp + 8], y = [ebp + 12], z = [ebp + 16] ; a=[ebp-4]=[esp+8], ; b=[ebp-8]=[esp+4], c=[ebp-12] = [esp] mov esp, ebp ;deallocate local variables (esp = ebp) pop ebp ret

my_function(int x, int y, int z) Example: callee void { int a, b, c; side code return; } _my_function: ebp mov ebp, esp ; ebp = esp sub esp, 12 ; allocate local varaibles ; sizeof(a) + sizeof(b) + sizeof(c) ; x = [ebp + 8], y = [ebp + 12], z = [ebp + 16] ; a=[ebp-4]=[esp+8], ; b=[ebp-8]=[esp+4], c=[ebp-12] = [esp] mov esp, ebp ;deallocate local variables (esp = ebp) pop ebp ret

leave instruction void my_function(int x, int y, int z) { int a, b, c; return; } _my_function: ebp mov ebp, esp ; ebp = esp sub esp, 12 ; allocate local varaibles ; sizeof(a) + sizeof(b) + sizeof(c) ; x = [ebp + 8], y = [ebp + 12], z = [ebp + 16] ; a=[ebp-4]=[esp+8], ; b=[ebp-8]=[esp+4], c=[ebp-12] = [esp] mov esp, ebp x86 has a special instruction pop ebp for this ret leave

Back to stack frames, so why do we need them? They are not strictly required GCC compiler option -fomit-frame-pointer can disable them Don't keep the frame pointer in a register for functions that don't need one. This avoids the instructions to save, set up and restore frame pointers; it also makes an extra register available in many functions. It also makes debugging impossible on some machines.

Referencing args without frames Initially parameter is [ESP + 4] Later as the function es things on the stack it changes, e.g. [ESP + 8]

Debugging becomes hard As ESP changes one has to manually keep track where local variables are relative to ESP (ESP + 4 or +8) Compiler can easily do this and generate correct code! But it's hard for a human It's hard to unwind the stack in case of a crash To print out a backtrace

And you only save... A couple instructions required to maintain the stack frame And 1 register (EBP) x32 has 8 registers (and one is ESP) So taking another one is 12.5% of register space Sometimes its worse it! x64 has 16 registers, so it doesn't really matter That said, GCC sets -fomit-frame-pointer to on At -O, -O1, -O2 Don't get surprised

Relevant part of the GCC manual 3.10 Options That Control Optimization https://gcc.gnu.org/onlinedocs/gcc/optimize-options.html -O -O1 With -O, the compiler tries to reduce code size and execution time, without performing any optimizations that take a great deal of compilation time. -O turns on the following optimization flags: -fauto-inc-dec -fbranch-count-reg... -fomit-frame-pointer -freorder-blocks

Saving and restoring registers

Saving register state across invocations Processor doesn't save registers General purpose, segment, flags Again, a calling convention is needed Agreement on what gets saved by the callee and the caller

Saving register state across invocations Registers EAX, ECX, and EDX are caller-saved The function is free to use them... the rest are callee-saved If the function uses them it has to restore them to the original values

In general there multiple calling conventions We described cdecl Make sure you know what you're doing https://en.wikipedia.org/wiki/x86_calling_conventio ns#list_of_x86_calling_conventions It's easy as long as you know how to read the table

Questions?

References https://en.wikibooks.org/wiki/x86_disassembly/ Functions_and_Stack_Frames https://en.wikipedia.org/wiki/calling_convention https://en.wikipedia.org/wiki/x86_calling_conve ntions http://stackoverflow.com/questions/14666665/tr ying-to-understand-gcc-option-fomit-framepointer