Carnegie Mellon
Machine-Level Programming I: Basics
Slides based on from those of Bryant and O’Hallaron
1
Carnegie Mellon
Machine Programming: Basics




History of Intel processors and architectures
C, assembly, machine code
Assembly Basics: Registers, operands, move
Arithmetic & logical operations
2
Carnegie Mellon
Intel x86 Evolution: Milestones
Name
 8086
Date
1978
Transistors
29K
MHz
5-10
 First 16-bit Intel processor. Basis for IBM PC & DOS
 1MB address space

386
1985
275K
16-33
 First 32 bit Intel processor , referred to as IA32
 Added “flat addressing”, capable of running Unix

Pentium 4E 2004
125M
2800-3800
 First 64-bit Intel x86 processor, referred to as x86-64

Core 2
2006
291M
1060-3500
 First multi-core Intel processor

Core i7
2008
731M
1700-3900
 Four cores (our shark machines)
3
Carnegie Mellon
Intel x86 Processors, cont.

Machine Evolution











8086
386
Pentium
Pentium/MMX
PentiumPro
Pentium III
Pentium 4
Pentium 4E
Core 2 Duo
Core i7
Core i7
1978
1985
1993
1997
1995
1999
2001
2004
2006
2008
2014
0.03M
0.3M
3.1M
4.5M
6.5M
8.2M
42M
125M
291M
731M
2.6 Billion
Intel’s first 32-bit
processor
Intel’s first 64-bit
processor
Intel’s first multi-core
processor
4
Carnegie Mellon
2015 State of the Art
 Core i7 Broadwell 2015

Desktop Model





4 cores
Integrated graphics
3.3-3.8 GHz
65W
Server Model




8 cores
Integrated I/O
2-2.6 GHz
45W
5
Carnegie Mellon
Machine Programming I: Basics




History of Intel processors and architectures
C, assembly, machine code
Assembly Basics: Registers, operands, move
Arithmetic & logical operations
6
Carnegie Mellon
ISA

ISA (instruction set architecture) is a specification
of the machine instructions implemented by a
processor
 The part of microprocessor design that one needs to
understand or write assembly/machine code.
 Includes: registers, native data types, addressing modes etc.

Example ISAs:
 Intel/AMD: IA32, x86-64
 ARM: Used in almost all mobile phones
7
Carnegie Mellon
Machine Code View
CPU
Registers
Memory
Addresses
Code
Data
Stack
Data
PC
Condition
Codes
Instructions
(Programmer-Visible) CPU State
 PC: Program counter

Store address of next instruction
 Called “RIP” (x86-64)
 Memory

Byte addressable array
 Code and user data
 Registers

Store frequently used program data
 Condition codes

Store status of most recent arithmetic
or logical operation
 Used for conditional branching
8
Carnegie Mellon
Turning C into Object Code
 Compiler transforms statements, expressions,
procedures into low-level instruction sequences
text
C program (p1.c p2.c)
Compiler (gcc –Og –c p1.c p2.c)
binary
Object program (p1.o p2.o)
Linker (gcc or ld)
binary
Executable program (p)
9
Carnegie Mellon
Compiling Into Assembly
C Code (sum.c)
long plus(long x, long y);
void sumstore(long x, long y,
long *dest)
{
long t = plus(x, y);
*dest = t;
}
sum.s
sumstore:
pushq
movq
call
movq
popq
ret
%rbx
%rdx, %rbx
plus
%rax, (%rbx)
%rbx
To generate sum.s: gcc –Og –S sum.c
To generate sum.o: gcc –Og –c sum.c
Assembly: the human readable form of machine code
sum.s is the human readable version of sum.o
10
Carnegie Mellon
Machine-level programming:
Data Types

“Integer” data of 1, 2, 4, or 8 bytes
 Data values
 Memory Addresses


Floating point data of 4, 8, or 10 bytes
No aggregate types such as arrays or structures
11
Carnegie Mellon
Machine-level programming:
Operations


Perform arithmetic function on register or memory data
Transfer data between memory and register
 Load data from memory into register
 Store register data into memory

Transfer Control
 Unconditional jumps
 Conditional branches
12
Carnegie Mellon
Machine-level programming: An
Example
*dest = t;
movq %rax, (%rbx)

C Code

Assembly
 Move 8-byte value (quad-words)
from register %rax to memory
0x40059e:
48 89 03

Object Code
 3-byte instruction
 Stored at address 0x40059e
13
Carnegie Mellon
Object Code
Code for sum.o
0x0400595:
0x53
0x48
0x89
0xd3
0xe8
0xf2
0xff
0xff
0xff
•
0x48
0x89 •
0x03
0x5b •
0xc3

Assembler
 Translates .s into .o
 Binary encoding of each instruction
 Not executable due to missing linkages
between code in different files

Total of 14 bytes
Linker
 Resolves references between files
 Combines with libraries

E.g., code for malloc, printf
Each instruction
1, 3, or 5 bytes
Starts at address
0x0400595
14
Carnegie Mellon
Disassembling Object Code
Disassembled
0000000000400595
400595: 53
400596: 48 89
400599: e8 f2
40059e: 48 89
4005a1: 5b
4005a2: c3

<sumstore>:
push
d3
mov
ff ff ff
callq
03
mov
pop
retq
%rbx
%rdx,%rbx
400590 <plus>
%rax,(%rbx)
%rbx
Disassembler
objdump –d sum.o
 Produces approximate rendition of assembly code
 Can be run on either a.out (complete executable) or .o file
15
Carnegie Mellon
Alternate Disassembly
Disassembled
Object
0x0400595:
0x53
0x48
0x89
0xd3
0xe8
0xf2
0xff
0xff
0xff
0x48
0x89
0x03
0x5b
0xc3
Dump of assembler code for function sumstore:
0x0000000000400595 <+0>: push
%rbx
0x0000000000400596 <+1>: mov
%rdx,%rbx
0x0000000000400599 <+4>: callq 0x400590 <plus>
0x000000000040059e <+9>: mov
%rax,(%rbx)
0x00000000004005a1 <+12>:pop
%rbx
0x00000000004005a2 <+13>:retq

Within gdb Debugger
gdb sum
disassemble sumstore
x/14xb sumstore
 Examine the 14 bytes starting at sumstore
16
Carnegie Mellon
What Can be Disassembled?


Anything can be interpreted as executable code
Disassembler starts at some byte and dissembles one
instruction after another
 Do not know when instructions stop and when data start

Not an exact science, esp. when code is purposefully
obfuscated
17
Carnegie Mellon
Machine Programming: Basics




History of Intel processors and architectures
C, assembly, machine code
Assembly Basics: Registers, operands, move
Arithmetic & logical operations
18
Carnegie Mellon
x86-64 Integer Registers
%rax
%eax
%r8
%r8d
%rbx
%ebx
%r9
%r9d
%rcx
%ecx
%r10
%r10d
%rdx
%edx
%r11
%r11d
%rsi
%esi
%r12
%r12d
%rdi
%edi
%r13
%r13d
%rsp
%esp
%r14
%r14d
%rbp
%ebp
%r15
%r15d
 Can reference low-order 4 bytes (also low-order 1 & 2
bytes)
19
Carnegie Mellon
Moving Data

movq Source, Dest

Operand Types
 Immediate: Constant integer data

Example: $0x400, $-533
Encoded with 1, 2, or 4 bytes
 Register: One of 16 integer registers
 Example: %rax, %r13
 %rsp reserved for special use

Prefixed with $
Some others have special uses for particular instructions
 Memory: 8 consecutive bytes of memory at address given by
register
 Various “address modes”
 Simplest example: (%rax)

20
Carnegie Mellon
movq Operand Combinations
Source
movq
Dest
Src,Dest
C Analog
Imm
Reg movq $0x4,%rax
Mem movq $-147,(%rax)
temp = 0x4;
Reg
Reg movq %rax,%rdx
Mem movq %rax,(%rdx)
temp2 = temp1;
Mem
Reg
movq (%rax),%rdx
*p = -147;
*p = temp;
temp = *p;
Cannot do memory-memory transfer with a single
instruction
21
Carnegie Mellon
Simple Memory Addressing Modes

Normal
(R)
Mem[Reg[R]]
 Register R specifies memory address
movq (%rcx),%rax

Displacement D(R)
Mem[Reg[R]+D]
 Register R specifies start of memory region
 Constant displacement D specifies offset
movq 8(%rbp),%rdx
22
Carnegie Mellon
Example of Simple Addressing
void swap
(long *xp, long *yp)
{
long t0 = *xp;
long t1 = *yp;
*xp = t1;
*yp = t0;
}
swap:
movq
movq
movq
movq
ret
(%rdi), %rax
(%rsi), %rdx
%rdx, (%rdi)
%rax, (%rsi)
23
Carnegie Mellon
Understanding Swap()
Memory
Registers
%rdi
0x120
%rsi
0x100
%rax
Address
123
Value of first
argument
0x118
0x110
Value of second
argument
0x108
%rdx
swap:
movq
movq
movq
movq
ret
456
(%rdi), %rax
(%rsi), %rdx
%rdx, (%rdi)
%rax, (%rsi)
0x120
#
#
#
#
0x100
t0 = *xp
t1 = *yp
*xp = t1
*yp = t0
24
Carnegie Mellon
Understanding Swap()
Memory
Registers
%rdi
0x120
%rsi
0x100
%rax
123
Address
123
0x118
0x110
0x108
%rdx
swap:
movq
movq
movq
movq
ret
0x120
456
(%rdi), %rax
(%rsi), %rdx
%rdx, (%rdi)
%rax, (%rsi)
#
#
#
#
0x100
t0 = *xp
t1 = *yp
*xp = t1
*yp = t0
25
Carnegie Mellon
Understanding Swap()
Memory
Registers
%rdi
0x120
%rsi
0x100
%rax
123
%rdx
456
swap:
movq
movq
movq
movq
ret
Address
123
0x120
0x118
0x110
0x108
456
(%rdi), %rax
(%rsi), %rdx
%rdx, (%rdi)
%rax, (%rsi)
#
#
#
#
0x100
t0 = *xp
t1 = *yp
*xp = t1
*yp = t0
26
Carnegie Mellon
Understanding Swap()
Memory
Registers
%rdi
0x120
%rsi
0x100
%rax
123
%rdx
456
swap:
movq
movq
movq
movq
ret
Address
456
0x120
0x118
0x110
0x108
456
(%rdi), %rax
(%rsi), %rdx
%rdx, (%rdi)
%rax, (%rsi)
#
#
#
#
0x100
t0 = *xp
t1 = *yp
*xp = t1
*yp = t0
27
Carnegie Mellon
Understanding Swap()
Memory
Registers
%rdi
0x120
%rsi
0x100
%rax
123
%rdx
456
swap:
movq
movq
movq
movq
ret
Address
456
0x120
0x118
0x110
0x108
123
(%rdi), %rax
(%rsi), %rdx
%rdx, (%rdi)
%rax, (%rsi)
#
#
#
#
0x100
t0 = *xp
t1 = *yp
*xp = t1
*yp = t0
28
Carnegie Mellon
Complete Memory Addressing Modes

General Form
D(Rb,Ri,S)





Mem[Reg[Rb]+S*Reg[Ri]+ D]
D:
Constant “displacement”
Rb: Base register: Any of 16 integer registers
Ri: Index register: Any, except for %rsp
S:
Scale: 1, 2, 4, or 8 (why these numbers?)
Special Cases
(Rb,Ri)
D(Rb,Ri)
(Rb,Ri,S)
Mem[Reg[Rb]+Reg[Ri]]
Mem[Reg[Rb]+Reg[Ri]+D]
Mem[Reg[Rb]+S*Reg[Ri]]
29
Carnegie
Carnegie Mellon
Mellon
Address Computation Examples
%rdx
0xf000
%rcx
0x0100
Expression
Address Computation
Address
0x8(%rdx)
0xf000 + 0x8
0xf008
(%rdx,%rcx)
0xf000 + 0x100
0xf100
(%rdx,%rcx,4)
0xf000 + 4*0x100
0xf400
0x80(,%rdx,2)
2*0xf000 + 0x80
0x1e080
30
Carnegie Mellon
Machine Programming I: Basics




History of Intel processors and architectures
C, assembly, machine code
Assembly Basics: Registers, operands, move
Arithmetic & logical operations
31
Carnegie
Carnegie Mellon
Mellon
Address Computation Instruction

leaq Src, Dst (load effective address)
 Set Dst to address denoted by src address mode expression

Uses
 Computing addresses without a memory reference

E.g., translation of p = &x[i];
 Computing arithmetic expressions of the form x + k*y


k = 1, 2, 4, or 8
Example
long m3(long x)
{
return x*3;
}
Assembly (gcc –Og –S m3.c)
leaq (%rdi,%rdi,2), %rax # t = x+x*2
32
Carnegie
Carnegie Mellon
Mellon
Some Arithmetic Operations

Two Operand Instructions:
addq
subq
imulq
salq
sarq
shrq
xorq
andq
orq

Src,Dest
Src,Dest
Src,Dest
Src,Dest
Src,Dest
Src,Dest
Src,Dest
Src,Dest
Src,Dest
Dest = Dest + Src
Dest = Dest  Src
Dest = Dest * Src
Dest = Dest << Src
Dest = Dest >> Src
Dest = Dest >> Src
Dest = Dest ^ Src
Dest = Dest & Src
Dest = Dest | Src
Also called shlq
Arithmetic
Logical
No distinction between signed and unsigned int
(why?)
33
Carnegie
Carnegie Mellon
Mellon
Some Arithmetic Operations

One Operand Instructions
incq
decq
negq
notq
Dest
Dest
Dest
Dest
Dest = Dest + 1
Dest = Dest  1
Dest =  Dest
Dest = ~Dest
34
Carnegie
Carnegie Mellon
Mellon
Arithmetic Expression Example
long arith
(long x, long y, long z)
{
long t1 = x+y;
long t2 = z+t1;
long t3 = x+4;
long t4 = y * 48;
long t5 = t3 + t4;
long rval = t2 * t5;
return rval;
}
Register
Use(s)
%rdi
Argument x
%rsi
Argument y
%rdx
Argument z
%rax
Return val
leaq
addq
leaq
salq
leaq
imulq
ret
(%rdi,%rsi), %rax
%rdx, %rax
(%rsi,%rsi,2), %rdx
$4, %rdx
4(%rdi,%rdx), %rcx
%rcx, %rax
rax = t1
rax = t2
rdx = 3*y
rdx = 48 *y = t4
rcx = x+4+t4 = t5
rax = t2*t5
35
Carnegie Mellon
Machine Programming I: Summary

History of Intel processors and architectures
 Evolutionary design leads to many quirks and artifacts

C, assembly, machine code
 Low-level machine abstraction: program counter, registers,
machine operations ...
 Compiler must transform C statements into low-level machine
abstraction

Assembly Basics: Registers, operands, move,
arithmetic
 C compiler will figure out different instruction combinations to
carry out computation
36