Stack Structure

The IA-32 environment uses a stack that—at the point of function calls—is 16-byte aligned, grows downward, and contains local variables and a function’s parameters. Each routine may add linkage information to its stack frame, but it’s not required to do so. Figure 1 shows the stack before and during a subroutine call. (To help prevent the execution of malicious code on the stack, GCC protects the stack against execution.)

The stack pointer (SP) points to the bottom of the stack. Stack frames contain the following areas:

• The parameter area stores the arguments the caller passes to the called subroutine. This area resides in the caller’s stack frame.

• The linkage area contains the address of the caller’s next instruction.

• The saved frame pointer (optional) contains the base address of the caller’s stack frame.

  You can use the gcc -fomit-frame-pointer option to make the compiler not save, set up, and restore the frame pointer in function calls that don’t need one, making the EBP register available for general use. However, doing so may impair debugging.

• The local storage area contains the subroutine’s local variables and the values of the registers that must be restored before the called function returns. See Register Preservation for details.

• The saved registers area contains the values of the registers that must be restored before the called function returns. See Register Preservation for details.

In this environment, the stack frame size is not fixed.

Prologs and Epilogs

The called subroutine is responsible for allocating its own stack frame. This operation is accomplished by a section of code called the prolog, which the compiler places before the body of the function. After the body of the function, the compiler places an epilog to restore the process to the state it was prior to the subroutine call.

The prolog performs the following tasks:

1. Pushes the value of the stack frame pointer (EBP) onto the stack.

2. Sets the stack frame pointer to the value of the stack pointer (ESP).

3. Pushes the values of the registers that must be preserved (EDI, ESI, and EBX) onto the stack.

4. Allocates space in the stack frame for local storage.

The epilog performs these tasks:

1. Deallocates the space used for local storage in the stack.

2. Restores the preserved registers (EDI, ESI, EBX, EBP) by popping the values saved on the stack by the prolog.

3. Returns.

Listing 1 shows the definition of the simp function.

Listing 1  Definition of the simp function

#include <stdio.h>

void simp(int i, short s, char c) {

    printf("Hi!\n");

}

Listing 2 shows a possible prolog for the simp function.

Listing 2  Example prolog

pushl   %ebp            ; save EBP

movl    %esp,%ebp       ; copy ESP to EBP

pushl   %ebx            ; save EBX

subl    $0x24,%esp      ; allocate space for local storage

Listing 3 shows a possible epilog for the simp function.

Listing 3  Example epilog

addl    $0x24,%esp      ; deallocate space for local storage

popl    %ebx            ; restore EBX

popl    %ebp            ; restore EBP

ret                     ; return

Passing Arguments

The compiler adheres to the following rules when passing arguments to subroutines:

1. The caller ensures that the stack is 16-byte aligned at the point of the function call.

2. The caller aligns nonvector arguments to 4-byte (32 bits) boundaries.

   The size of each argument is a multiple of 4 bytes, with tail padding when necessary. Therefore, 8-bit and 16-bit integral data types are promoted to 32-bit before they are pushed onto the stack.

3. The caller places arguments in the parameter area in reverse order, in 4-byte chunks. That is, the rightmost argument has the highest address.

4. The caller places all the fields of structures (or unions) with no vector elements in the parameter area. These structures are 4-byte aligned .

5. The caller places structures with vector elements on the stack, 16-byte aligned. Each vector within the structure is 16-byte aligned.

6. The caller places 64-bit vectors (__m64) on the parameter area, aligned to 8-byte boundaries.

7. The caller places vectors 128-bit vectors (__m128, __m128d, and __m128i) in registers XMM0 through XMM3). When the usable XMM registers are exhausted, the caller places 128-bit vectors in the parameter area. The caller aligns 128-bit vectors in the parameter area to 16-byte boundaries.

In general, the caller is responsible for removing all the parameters used in a function call after the called function returns. The only exception are parameters that are generated automatically by GCC. When a function returns a structure or union larger than 8 bytes, the caller passes a pointer to appropriate storage as the first argument to the function. GCC adds this parameter automatically in the code generated. See Returning Results for more information. For example, the compiler would translate the code shown in Listing 4 to machine language as if it were written as shown in Listing 5.

Listing 4  Using a large structure—source code

typedef struct {

    float ary[8];

} big_struct;

big_struct callee(int a, float b) {

    big_struct callee_struct;

    ...

    return callee_struct;

}

caller() {

    big_struct caller_struct;

    caller_struct = callee(3, 42.0);

}

Listing 5  Using a large structure—compiler interpretation

typedef struct {

    float ary[8];

} big_struct;

void callee(big_struct *p, int a, float b)

{

    big_struct callee_struct;

    ...

    *p = callee_struct;

    return;

}

caller() {

    big_struct caller_struct;

    callee(&caller_struct, 3, 42.0);

}

Passing Arguments of the Fundamental Data Types

Assume the function foo is declared like this:

void foo(SInt32 i, float f, double d, SInt16 s, UInt8 c);

Figure 2 illustrates the placement of arguments in the parameter area at the point of the function call. Note the padding added to align the stack at 16 bytes.

Passing Structures and Vectors

Assume the structure data and the function bar are declared like this:

struct data {

float f;

long long l;

__m128 vf;

};

void bar(SInt32 i, UInt8 c, struct data b, __m128i vi, void* p);

Figure 3 illustrates the placement of arguments in the parameter area, the stack’s 16-byte alignment padding at the point of the call, and the XMM registers.

Returning Results

This is how functions pass results to their callers:

• Scalar values. Scalar values include structures that contain only one scalar value.

  • The called function places integral or pointer results in EAX.

  • The called function places floating-point results in ST0.

  • The caller removes the value from this register, even when it doesn’t use the value.

• Structures. The called function returns structures according to their aligned size.

  • Structures 1 or 2 bytes in size are placed in EAX.

  • Structures 4 or 8 bytes in size are placed in: EAX and EDX.

  • Structures of other sizes are placed at the address supplied by the caller. For example, the C++ language occasionally forces the compiler to return a value in memory when it would normally be returned in registers. See Passing Arguments for more information.

• Vectors.

  • The called function places vectors at the address supplied by the caller.

Register Preservation

Table 3 lists the IA-32 architecture registers used in this environment and their volatility in procedure calls. Registers that must preserve their value after a function call are called nonvolatile.