1. Machine-Level Programming I: Basics Comp 21000: Introduction to Computer Organization & Systems
Instructor:
John Barr
* Modified slides from the book “Computer Systems: a Programmer’s Perspective”, Randy Bryant & David O’Hallaron, 2011

2. Today: Machine Programming I: Basics
History of Intel processors and architectures
C, assembly, machine code
Assembly Basics: Registers, operands, move
Intro to x86-64
Real programmers can write assembly code in any language.
-- Larry Wall, creator of the Perl language

3. Processor Families High-end servers Desktop/servers Phones/embedded
Xenon (owned by Intel)
Opterons (AMD)
SPARC (Oracle retired in 2017, Fujitsu still manufactures))
Power (IBM)
Desktop/servers
Intel
AMD
Phones/embedded
ARM
Embedded
MIPS (routers, Playstation, Nintendo 64)
Each family has it own machine language

4. Intel x86 Processors Totally dominate laptop/desktop/server market
but not the phone/tablet market (that’s ARM)
Evolutionary design
Backwards compatible up until 8086, introduced in 1978
Added more features as time goes on
Complex instruction set computer (CISC)
Many different instructions with many different formats
But, only small subset encountered with Linux programs
Hard to match performance of Reduced Instruction Set Computers (RISC)
But, Intel has done just that!
In terms of speed. Less so for low power.

5. Intel x86 Evolution: Milestones
Name Date Transistors MHz
K 5-10
First 16-bit Intel processor. Basis for IBM PC & DOS
1MB address space
K 16-33
First 32 bit Intel processor , referred to as IA32
Added “flat addressing”, capable of running Unix
Pentium 4E M
First 64-bit Intel x86 processor, referred to as x86-64
Core M
First multi-core Intel processor
Core i M
Four cores (our arda machine)

6. Intel x86 Processors, cont.
Machine Evolution M
Pentium M
Pentium/MMX M
PentiumPro M
Pentium III M
Pentium M
Core 2 Duo M
Core i M
Added Features
Instructions to support multimedia operations
Instructions to enable more efficient conditional operations
Transition from 32 bits to 64 bits
More cores

7. Intel x86 Processors: Overview
Architectures
Processors
X86-16
8086
286
X86-32/IA32
386
486
Pentium
Pentium MMX
Pentium III
Pentium 4
Pentium 4E
MMX
SSE
SSE2
SSE3
X86-64 / EM64t
Pentium 4F
Core 2 Duo
Core i7
time
SSE4
IA: often redefined as latest Intel architecture

8. 2015 State of the Art Desktop Model Server Model
Core i7 Broadwell 2015
Desktop Model
4 cores
Integrated graphics
GHz
65W
Server Model
8 cores
Integrated I/O
2-2.6 GHz
45W

9. More Information
Intel processors (Wikipedia)
Intel microarchitectures

10. x86 Clones: Advanced Micro Devices (AMD)
Historically
AMD has followed just behind Intel
A little bit slower, a lot cheaper
Then
Recruited top circuit designers from Digital Equipment Corp. and other downward trending companies
Built Opteron: tough competitor to Pentium 4
Developed x86-64, their own extension to 64 bits
Recent Years
Intel got its act together
Leads the world in semiconductor technology
AMD has fallen behind
Relies on external semiconductor manufacturer

11. Intel’s 64-Bit History
2001: Intel Attempts Radical Shift from IA32 to IA64
Totally different architecture (Itanium)
Executes IA32 code only as legacy
Performance disappointing
2003: AMD Steps in with Evolutionary Solution
x86-64 (now called “AMD64”)
Intel Felt Obligated to Focus on IA64
Hard to admit mistake or that AMD is better
2004: Intel Announces EM64T extension to IA32
Extended Memory 64-bit Technology
Almost identical to x86-64!
All but low-end x86 processors support x86-64
But, lots of code still runs in 32-bit mode

12. Our Coverage x86-64/EM64T Presentation The standard
server> gcc hello.c
Presentation
Book covers x86-64
Web aside on IA32
We will only cover x86-64

13. Today: Machine Programming I: Basics
History of Intel processors and architectures
C, assembly, machine code
Assembly Basics: Registers, operands, move
Intro to x86-64

14. Today: Machine Programming I: Basics
History of Intel processors and architectures
C, assembly, machine code
Assembly Basics: Registers, operands, move
Intro to x86-64

15. Definitions
Architecture: (also ISA: instruction set architecture) The parts of a processor design that one needs to understand or write assembly/machine code.
Examples: instruction set specification, registers.
Microarchitecture: Implementation of the architecture.
Examples: cache sizes and core frequency.
Code Forms:
Machine Code: The byte-level programs that a processor executes
Assembly Code: A text representation of machine code
Example ISAs:
Intel: x86, IA32, Itanium, x86-64
ARM: Used in almost all mobile phones

16. Assembly Programmer’s View
Memory
CPU
Addresses
Registers
Object Code
Program Data
OS Data PC
Data
Condition
Codes
Instructions
Stack
Programmer-Visible State
PC: Program counter
Address of next instruction
“RIP” (x86-64)
Register file
Heavily used program data
Condition codes
Store status information about most recent arithmetic operation
Used for conditional branching
Memory
Byte addressable array
Code, user data
Stack to support procedures

17. Program’s View: memory
invisible to
user code
Kernel virtual memory
0xC
User stack
(created at runtime)
%esp (stack pointer)
Variables in functions go here
Memory mapped region for
shared libraries 0x
NOTE: MEMORY GROWS UP; 0 IS AT BOTTOM!
brk
Variables in main() go here
Run-time heap
(created at runtime by malloc)
Read/write segment
(.data, .bss)
Loaded from the
executable file
Machine instructions and constants go here
Read0nly segment
(.init, .text, .rodata) 0x
Unused
.data = global and static variables; .bss = global variables initialized to 0; .text = code; .rodata = constants (read only)

18. CPU’s View: fetch, decode, execute
Kernel virtual memory
Memory
invisible to
user code
CPU
0xc
User stack
(created at runtime)
Registers R I P
%esp (stack pointer)
Condition
Codes
Memory mapped region for
shared libraries 0x
brk
Run-time heap
(created at runtime by malloc)
Read/write segment
(.data, .bss)
Fetch instruction from memory (%rip contains the address in memory)
Increment %rip to next instruction address
Loaded from the
executable file
Read-only segment
(.init, .text, .rodata) 0x
Unused

19. CPU’s View CPU Registers R I P Condition Codes Memory invisible to
user code
Kernel virtual memory
CPU
0xc
User stack
(created at runtime)
Registers R I P
%esp (stack pointer)
Condition
Codes
Memory mapped region for
shared libraries 0x
brk
Run-time heap
(created at runtime by malloc)
2. Decode instruction and fetch arguments from memory (if necessary)
Operand could come from R/W segment, heap or user stack
Read/write segment
(.data, .bss)
Loaded from the
executable file
Read-only segment
(.init, .text, .rodata) 0x
Unused

20. CPU’s View CPU Registers R I P Condition Codes Memory invisible to
user code
Kernel virtual memory
CPU
0xc
User stack
(created at runtime)
Registers R I P
%esp (stack pointer)
Condition
Codes
Memory mapped region for
shared libraries 0x
brk
Run-time heap
(created at runtime by malloc)
3. Execute instruction and store results
Operand could go to R/W segment, heap or user stack
Read/write segment
(.data, .bss)
Loaded from the
executable file
Read-only segment
(.init, .text, .rodata) 0x
Unused

21. CPU’s View CPU Registers R I P Condition Codes Memory invisible to
user code
Kernel virtual memory
CPU
0xc
User stack
(created at runtime)
Registers R I P
%esp (stack pointer)
Condition
Codes
Memory mapped region for
shared libraries 0x
brk
Run-time heap
(created at runtime by malloc)
Read/write segment
(.data, .bss)
1. Repeat: Fetch next instruction from memory (%rip contains the addess in memory)
Loaded from the
executable file
Read-only segment
(.init, .text, .rodata) 0x
Unused

22. Example
See:
Much simpler than the IA32 architecture.
Does not make the register file explicit.
Uses an accumulator (not in IA32).

23. Turning C into Object Code
Code in files p1.c p2.c
Compile with command: gcc -march=x86-64 –O0 p1.c p2.c -o p
Use basic optimizations (-O0) [-O0 means no optimization]
Put resulting binary in file p compile to 64bit code (-march=x86-64)
text
C program (p1.c p2.c)
Compiler (gcc –O0 -march=x S) (-S means stop after compiling)
text
Asm program (p1.s p2.s)
Assembler (gcc or as)
binary
Object program (p1.o p2.o)
Static libraries (.a)
Linker (gcc or ld)
binary
Executable program (p)

24. Compiling Into Assembly
C Code (sum.c)
Generated x86-64 Assembly
long plus(long x, long y);
void sumstore(long x, long y,
long *dest) {
long t = plus(x, y);
*dest = t; }
sumstore:
pushq %rbp
movq %rdx, %rbx
call plus
movq %rax, (%rbx)
popq %rbp
ret
Some compilers use instruction “leave”
Obtain (on arda machine) with command
gcc –O0 –S sum.c
Produces file sum.s
Warning: Will get very different results on 64 bit machines (Other Linux, Mac OS-X, …) due to different versions of gcc and different compiler settings.
On 32-bit machines can force 64-bit code with the option -march=x86-64
Use the –O0 flag (dash uppercase ‘O’ number 0) to eliminate optimization. Otherwise you’ll get strange register moving.

25. Compiling Into Assembly
C Code (sum.c)
Generated x86-64 Assembly
long plus(long x, long y);
void sumstore(long x, long y,
long *dest) {
long t = plus(x, y);
*dest = t; }
sumstore:
pushq %rbx
movq %rdx, %rbx
call plus
movq %rax, (%rbx)
popq %rbx
ret
Some compilers use instruction “leave”
Obtain (on server machine) with command
gcc –O0 –g sum.c
-g puts in hooks for gdb

26. How it used to be done pdp programming
See

27. gdb run with executable file a.out quit running gdb a.out run stop
Reference:

28. gdb examine source code: break points debugging
list firstLineNum, secondLineNum
where firstLineNum is the first line number of the code that you want to examine secondLineNum is the ending line number of the code.
break points
break lineNum
lineNum is the line number of the statement that you want to break at.
debugging
step // step one C instruction (steps into)
stepi // step one assembly instruction
next // steps one C instruction (steps over)
where // info about where execution is stopped

29. gdb Viewing data print x
This prints the value currently stored in the variable x.
print &x
This prints the memory address of the variable x.
display x
This command will print the value of variable x every time the program stops.

30. gdb Getting low level info about the program info line lineNum
This command provides some information about line number lineNum including the memory address (in hex) where it is stored in RAM.
disassem memAddress1 memAddress2
prints the assembly language instructions located in memory between memAddress1 and memAddress2.
x memAddress
This command prints the contents of the memAdress in hexadecimal notation. You can use this command to examine the contents of a piece of data.
There are many more commands that you can use in gdb. While running you can type help to get a list of commands.

31. Assembly Characteristics: Data Types
“Integer” data of 1, 2, 4 or 8 bytes
Data values
Addresses (untyped pointers)
Floating point data of 4, 8, or 10 bytes
Code: Byte sequences encoding series of instructions
No aggregate types such as arrays or structures
Just contiguously allocated bytes in memory

32. Assembly Characteristics: Operations
Perform arithmetic function on register or memory data
Transfer data between memory and register
Load data from memory into register
Store register data into memory
Transfer control
Unconditional jumps to/from procedures
Conditional branches

33. Assembly Language Versions
There is only one Intel x86-64 machine language (1’s and 0’s)
There are two ways of writing assembly language on top of this:
Intel version
AT&T version
UNIX/LINUX in general and the gcc compiler in particular uses the AT&T version. That’s also what the book uses and what we’ll use in these slides.
Why? UNIX was developed at AT&T Bell Labs!
Most reference material is in the Intel version

34. Assembly Language Versions
There are slight differences, the most glaring being the placement of source and destination in an instruction:
Intel: instruction dest, src
AT&T: instruction src, dest
Intel code omits the size designation suffixes
mov instead of movl
Intel code omits the % before a register
eax instead of %eax
Intel code has a different way of describing locations in memory
[ebp+8] instead of 8(%ebp)

35. Object Code Code for sumstore Assembler Linker Translates .s into .o
Binary encoding of each instruction
Nearly-complete image of executable code
Missing linkages between code in different files
Linker
Resolves references between files
Combines with static run-time libraries
E.g., code for malloc, printf
Some libraries are dynamically linked
Linking occurs when program begins execution
0x :
0x53
0x48
0x89
0xd3
0xe8
0xf2
0xff
0x03
0x5b
0xc3
Total of 14 bytes
Each instruction 1, 3, or 5 bytes
Starts at address 0x

36. Machine Instruction Example
C Code
Store value t where designated by dest
Assembly
Move 8-byte value to memory
Quad words in x86-64 parlance
Operands:
t: Register %rax
dest: Register %rbx
*dest: Memory M[%rbx]
Object Code
3-byte instruction
Stored at address 0x40059e
Symbol table
Assembler must change labels into memory locations
To do this, keeps a table that associates a memory location for every label
Called a symbol table
*dest = t;
movq %rax, (%rbx)
0x40059e:

37. Disassembling Object Code
Disassembled
<sumstore>:
400595: push %rbx
400596: d mov %rdx,%rbx
400599: e8 f2 ff ff ff callq <plus>
40059e: mov %rax,(%rbx)
4005a1: 5b pop %rbx
4005a2: c retq
Disassembler
objdump –d sum
Otool –tV sum // in Mac OS
Useful tool for examining object code
-d means disassemble
sum is the file name (e.g., could be a.out)
Analyzes bit pattern of series of instructions
Produces approximate rendition of assembly code
Can be run on either a.out (complete executable) or .o file

38. Alternate Disassembly
Disassembled
Object
0x :
0x53
0x48
0x89
0xd3
0xe8
0xf2
0xff
0x03
0x5b
0xc3
Dump of assembler code for function sumstore:
0x <+0>: push %rbx
0x <+1>: mov %rdx,%rbx
0x <+4>: callq 0x <plus>
0x e <+9>: mov %rax,(%rbx)
0x a1 <+12>:pop %rbx
0x a2 <+13>:retq
Within gdb Debugger
gdb sum
disassemble sumstore
Disassemble procedure
x/14xb sum
Examine the 14 bytes starting at sumstore

39. Direct creation of assembly programs
In .s file
% gcc –S p.c
Result is an assembly program in the file p.s
.file "assemTest.c"
.text
.type
sum.0:
pushl %ebp
movl %esp, %ebp
subl $4, %esp
movl 12(%ebp), %eax
addl 8(%ebp), %eax
leave
ret
.size sum.0, .-sum.0
.globl main
.type
main:
subl $8, %esp
andl $-16, %esp
subl $16, %esp
movl $0, %eax
.size main, .-main
.section
.ident "GCC: (GNU) 3.4.6
Assembler directives
Assembly commands
Symbols

40. Features of Disassemblers
Disassemblers determine the assembly code based purely on the byte sequences in the object file.
Do not need source file
Disassemblers use a different naming convention than the GAS assembler.
Example: omits the “l” from the suffix of many instructions.
Disassembler uses nop instruction (no operation).
Does nothing; just fills space.
Necessary in some machines because of branch prediction
Necessary in some machines because of addressing restrictions
And sometimes the disassembler just can’t figure out what’s going on

41. What Can be Disassembled?
% objdump -d WINWORD.EXE
WINWORD.EXE: file format pei-i386
No symbols in "WINWORD.EXE".
Disassembly of section .text:
<.text>:
: push %ebp
: 8b ec mov %esp,%ebp
: 6a ff push $0xffffffff
: push $0x
a: dc 4c 30 push $0x304cdc91
Reverse engineering forbidden by
Microsoft End User License Agreement
Anything that can be interpreted as executable code
Disassembler examines bytes and reconstructs assembly source

42. Machine Programming I: Summary
History of Intel processors and architectures
Evolutionary design leads to many quirks and artifacts
C, assembly, machine code
Compiler must transform statements, expressions, procedures into low-level instruction sequences
Assembly Basics: Registers, operands, move
The x86 move instructions cover wide range of data movement forms
Intro to x86-64
A major departure from the style of code seen in IA32