Understanding x86-64 Memory Layout and Data Representation in C

1. Odds and Ends • Intro to x86-64 • Memory Layout

2. Data Representations: IA32 + x86-64 • Sizes of C Objects (in Bytes) • C Data TypeGeneric 32-bitIntel IA32x86-64 • unsigned 4 4 4 • int 4 4 4 • long int 4 4 8 • char 1 1 1 • short 2 2 2 • float 4 4 4 • double 8 8 8 • long double 8 10/12 16 • char * 4 4 8 • Or any other pointer

3. x86-64 Integer Registers %rax %r8 %eax %r8d • Extend existing registers. Add 8 new ones. • Make %ebp/%rbpgeneral purpose %rbx %r9 %ebx %r9d %rcx %r10 %ecx %r10d %rdx %r11 %edx %r11d %rsi %r12 %esi %r12d %rdi %r13 %edi %r13d %rsp %r14 %esp %r14d %rbp %r15 %ebp %r15d

4. Instructions • Long word l (4 Bytes) ↔ Quad word q (8 Bytes) • New instructions: • movl ➙ movq • addl ➙ addq • sall ➙ salq • etc. • 32-bit instructions that generate 32-bit results • Set higher order bits of destination register to 0 • Example: addl

5. 32-bit code for swap swap: pushl %ebp movl %esp,%ebp pushl %ebx movl 8(%ebp), %edx movl 12(%ebp), %ecx movl (%edx), %ebx movl (%ecx), %eax movl %eax, (%edx) movl %ebx, (%ecx) popl %ebx popl %ebp ret void swap(int *xp, int *yp) { int t0 = *xp; int t1 = *yp; *xp = t1; *yp = t0; } Set Up Body Finish

6. 64-bit code for swap swap: movl (%rdi), %edx movl (%rsi), %eax movl %eax, (%rdi) movl %edx, (%rsi) ret Set Up • Operands passed in registers (why useful?) • First (xp) in %rdi, second (yp) in %rsi • 64-bit pointers • No stack operations required • 32-bit data • Data held in registers %eax and %edx • movl operation void swap(int *xp, int *yp) { int t0 = *xp; int t1 = *yp; *xp = t1; *yp = t0; } Body Finish

7. 64-bit code for long int swap swap_l: movq (%rdi), %rdx movq (%rsi), %rax movq %rax, (%rdi) movq %rdx, (%rsi) ret Set Up • 64-bit data • Data held in registers %rax and %rdx • movq operation • “q” stands for quad-word void swap(long*xp, long *yp) { long t0 = *xp; long t1 = *yp; *xp = t1; *yp = t0; } Body Finish

8. Carnegie Mellon Reading Condition Codes: x86-64 • SetX Instructions: • Set single byte based on combination of condition codes • Does not alter remaining 3 bytes intgt (long x, long y) { return x > y; } long lgt (long x, long y) { return x > y; } Bodies cmpl %esi, %edi setg %al movzbl %al, %eax cmpq%rsi, %rdi setg %al movzbl %al, %eax Is %raxzero? Yes: 32-bit instructions set high order 32 bits to 0!

9. not drawn to scale IA32 Linux Memory Layout FF Stack 8MB • Stack • Runtime stack (8MB limit) • E. g., local variables • Heap • Dynamically allocated storage • When call to malloc(), calloc(), new() • Data • Statically allocated data • E.g., arrays & strings declared in code • Text • Executable machine instructions • Read-only Heap Data Text Upper 2 hex digits = 8 bits of address 08 00

10. not drawn to scale Memory Allocation Example FF Stack char big_array[1<<24]; /* 16 MB */ char huge_array[1<<28]; /* 256 MB */ int beyond; char *p1, *p2, *p3, *p4; int useless() { return 0; } int main() { p1 = malloc(1 <<28); /* 256 MB */ p2 = malloc(1 << 8); /* 256 B */ p3 = malloc(1 <<28); /* 256 MB */ p4 = malloc(1 << 8); /* 256 B */ /* Some print statements ... */ } Heap Data Text Where does everything go? 08 00

11. not drawn to scale IA32 Example Addresses FF Stack address range ~232 $esp 0xffffbcd0 p3 0x65586008 p1 0x55585008 p4 0x1904a110 p2 0x1904a008 big_array 0x18049780 &p2 0x18049760 huge_array 0x08049760 &beyond 0x08049744 useless() 0x08049744 main() 0x080483c6 finalmalloc() 0x006be166 80 Heap Data malloc() is dynamically linked address determined at runtime Text 08 00

12. not drawn to scale x86-64 Example Addresses 00007F Stack address range ~247 $rsp0x00007ffffff8d1f8 p3 0x00002aaabaadd010 p1 0x00002aaaaaadc010 p4 0x0000000011501120 p2 0x0000000011501010 big_array0x0000000010500a80 &p2 0x0000000010500a60 huge_array0x0000000000500a50 &beyond 0x0000000000500a44 main() 0x0000000000400510 useless() 0x0000000000400500 finalmalloc() 0x000000386ae6a170 000030 Heap Data malloc() is dynamically linked address determined at runtime Text 000000