1. Carnegie Mellon 1 Odds and Ends Intro to x86-64 Memory Layout

2. Carnegie Mellon 2 Data Representations: IA32 + x86-64 Sizes of C Objects (in Bytes)  C Data TypeGeneric 32-bitIntel IA32x86-64  unsigned444  int444  long int448  char111  short222  float444  double888  long double810/1216  char *448 –Or any other pointer

3. Carnegie Mellon 3 %rsp x86-64 Integer Registers  Extend existing registers. Add 8 new ones.  Make %ebp / %rbp general purpose %eax %ebx %ecx %edx %esi %edi %esp %ebp %r8d %r9d %r10d %r11d %r12d %r13d %r14d %r15d %r8 %r9 %r10 %r11 %r12 %r13 %r14 %r15 %rax %rbx %rcx %rdx %rsi %rdi %rbp

4. Carnegie Mellon 4 Instructions Long word l (4 Bytes) ↔ Quad word q (8 Bytes) New instructions:  movl ➙ movq  addl ➙ addq  sall ➙ salq  etc. 32-bit instructions that generate 32-bit results  Set higher order bits of destination register to 0  Example: addl

5. Carnegie Mellon 5 32-bit code for swap void swap(int *xp, int *yp) { int t0 = *xp; int t1 = *yp; *xp = t1; *yp = t0; } Body Set Up Finish swap: pushl %ebp movl %esp,%ebp pushl %ebx movl8(%ebp), %edx movl12(%ebp), %ecx movl(%edx), %ebx movl(%ecx), %eax movl%eax, (%edx) movl%ebx, (%ecx) popl%ebx popl%ebp ret

6. Carnegie Mellon 6 64-bit code for swap Operands passed in registers (why useful?)  First ( xp ) in %rdi, second ( yp ) in %rsi  64-bit pointers No stack operations required 32-bit data  Data held in registers %eax and %edx  movl operation void swap(int *xp, int *yp) { int t0 = *xp; int t1 = *yp; *xp = t1; *yp = t0; } Body Set Up Finish swap: movl(%rdi), %edx movl(%rsi), %eax movl%eax, (%rdi) movl%edx, (%rsi) ret

7. Carnegie Mellon 7 64-bit code for long int swap 64-bit data  Data held in registers %rax and %rdx  movq operation  “q” stands for quad-word void swap(long *xp, long *yp) { long t0 = *xp; long t1 = *yp; *xp = t1; *yp = t0; } Body Set Up Finish swap_l: movq (%rdi), %rdx movq (%rsi), %rax movq %rax, (%rdi) movq %rdx, (%rsi) ret

8. Carnegie Mellon 8 Reading Condition Codes: x86-64 int gt (long x, long y) { return x > y; } int gt (long x, long y) { return x > y; } cmpl %esi, %edi setg %al movzbl %al, %eax Bodies long lgt (long x, long y) { return x > y; } long lgt (long x, long y) { return x > y; } SetX Instructions:  Set single byte based on combination of condition codes  Does not alter remaining 3 bytes Is %rax zero? Yes: 32-bit instructions set high order 32 bits to 0! cmpq %rsi, %rdi setg %al movzbl %al, %eax

9. Carnegie Mellon 9 IA32 Linux Memory Layout Stack  Runtime stack (8MB limit)  E. g., local variables Heap  Dynamically allocated storage  When call malloc(), calloc(), new() Data  Statically allocated data  E.g., arrays & strings declared in code Text  Executable machine instructions  Read-only Upper 2 hex digits = 8 bits of address FF 00 Stack Text Data Heap 08 8MB not drawn to scale

10. Carnegie Mellon 10 Memory Allocation Example char big_array[1<<24]; /* 16 MB */ char huge_array[1<<28]; /* 256 MB */ int beyond; char *p1, *p2, *p3, *p4; int useless() { return 0; } int main() { p1 = malloc(1 <<28); /* 256 MB */ p2 = malloc(1 << 8); /* 256 B */ p3 = malloc(1 <<28); /* 256 MB */ p4 = malloc(1 << 8); /* 256 B */ /* Some print statements... */ } FF 00 Stack Text Data Heap 08 not drawn to scale Where does everything go?

11. Carnegie Mellon 11 IA32 Example Addresses $esp0xffffbcd0 p3 0x65586008 p1 0x55585008 p40x1904a110 p20x1904a008 big_array 0x18049780 &p20x18049760 huge_array 0x08049760 &beyond 0x08049744 useless() 0x08049744 main()0x080483c6 final malloc()0x006be166 address range ~2 32 FF 00 Stack Text Data Heap 08 80 not drawn to scale malloc() is dynamically linked address determined at runtime

12. Carnegie Mellon 12 x86-64 Example Addresses $rsp0x00007ffffff8d1f8 p3 0x00002aaabaadd010 p1 0x00002aaaaaadc010 p40x0000000011501120 p20x0000000011501010 big_array 0x0000000010500a80 &p20x0000000010500a60 huge_array 0x0000000000500a50 &beyond 0x0000000000500a44 main()0x0000000000400510 useless() 0x0000000000400500 final malloc()0x000000386ae6a170 address range ~2 47 00007F 000000 Stack Text Data Heap 000030 not drawn to scale malloc() is dynamically linked address determined at runtime