CS 31: Intro to Systems Functions and the Stack Martin Gagne - PowerPoint PPT Presentation

CS 31: Intro to Systems Functions and the Stack Martin Gagne Swarthmore College February 23, 2016

Reminders Late policy: • you do not have to send me an email to inform me of a late submission before the deadline • you have to send me an email when you submit your late work Please do not procrastinate on labs, they won’t get any easier Use Piazza!

IA32 Calling Convention (gcc) • In register %eax: – The return value • In the callee’s stack frame: – The caller’s %ebp value (previous frame pointer) • In the caller’s frame (shared with callee): – Function arguments – Return address (saved PC value)

Instructions in Memory funcA: … call funcB 0x0 … Operating system Text funcB: Data pushl %ebp movl %esp, %ebp Heap … Function B Stack Function A … 0xFFFFFFFF

Program Counter Recall: PC stores the address of Text Memory Region the next instruction. funcA: (A pointer to the next instruction.) addl $5, %ecx movl %ecx, -4(%ebp) … Program call funcB Counter (PC) addl %eax, %ecx … What do we do now? funcB: pushl %ebp Follow PC, fetch instruction: movl %esp, %ebp … addl $5, %ecx movl $10, %eax leave ret

Program Counter Recall: PC stores the address of Text Memory Region the next instruction. funcA: (A pointer to the next instruction.) addl $5, %ecx movl %ecx, -4(%ebp) … Program call funcB Counter (PC) addl %eax, %ecx … What do we do now? funcB: pushl %ebp Follow PC, fetch instruction: movl %esp, %ebp … addl $5, %ecx movl $10, %eax leave Update PC to next instruction. ret Execute the addl .

Program Counter Recall: PC stores the address of Text Memory Region the next instruction. funcA: (A pointer to the next instruction.) addl $5, %ecx movl %ecx, -4(%ebp) … Program call funcB Counter (PC) addl %eax, %ecx … What do we do now? funcB: pushl %ebp Follow PC, fetch instruction: movl %esp, %ebp … movl $ecx, -4(%ebp) movl $10, %eax leave ret

Program Counter Recall: PC stores the address of Text Memory Region the next instruction. funcA: (A pointer to the next instruction.) addl $5, %ecx movl %ecx, -4(%ebp) … Program call funcB Counter (PC) addl %eax, %ecx … What do we do now? funcB: pushl %ebp Follow PC, fetch instruction: movl %esp, %ebp … movl $ecx, -4(%ebp) movl $10, %eax leave Update PC to next instruction. ret Execute the movl .

Program Counter Recall: PC stores the address of Text Memory Region the next instruction. funcA: (A pointer to the next instruction.) addl $5, %ecx movl %ecx, -4(%ebp) … Program call funcB Counter (PC) addl %eax, %ecx … What do we do now? funcB: pushl %ebp Keep executing in a straight line movl %esp, %ebp downwards like this until: … movl $10, %eax We hit a jump instruction. leave We call a function. ret

Changing the PC: Functions Text Memory Region funcA: addl $5, %ecx movl %ecx, -4(%ebp) … Program call funcB Counter (PC) addl %eax, %ecx … What we’d like this to do: funcB: pushl %ebp movl %esp, %ebp … movl $10, %eax leave ret

Changing the PC: Functions Text Memory Region funcA: addl $5, %ecx movl %ecx, -4(%ebp) … Program call funcB Counter (PC) addl %eax, %ecx … What we’d like this to do: funcB: pushl %ebp Set up function B’s stack. movl %esp, %ebp … movl $10, %eax leave ret

Changing the PC: Functions Text Memory Region funcA: addl $5, %ecx movl %ecx, -4(%ebp) … Program call funcB Counter (PC) addl %eax, %ecx … What we’d like this to do: funcB: pushl %ebp Set up function B’s stack. movl %esp, %ebp … Execute the body of B, produce movl $10, %eax leave result (stored in %eax). ret

Changing the PC: Functions Text Memory Region funcA: addl $5, %ecx movl %ecx, -4(%ebp) … Program call funcB Counter (PC) addl %eax, %ecx … What we’d like this to do: funcB: pushl %ebp Set up function B’s stack. movl %esp, %ebp … Execute the body of B, produce movl $10, %eax leave result (stored in %eax). ret Restore function A’s stack.

Changing the PC: Functions Text Memory Region funcA: addl $5, %ecx movl %ecx, -4(%ebp) … Program call funcB Counter (PC) addl %eax, %ecx … What we’d like this to do: funcB: pushl %ebp Return: movl %esp, %ebp Go back to what we were doing … before funcB started. movl $10, %eax leave ret Unlike jumping, we intend to go back!

Like push , pop , and leave , call and ret are convenience instructions. What should they do to support the PC-changing behavior we need? (The PC is %eip.) call ret In words: In words: In instructions: In instructions:

Functions and the Stack Text Memory Region Executing instruction: call funcB funcA: addl $5, %ecx movl %ecx, -4(%ebp) PC points to next instruction … Program call funcB Counter (%eip) addl %eax, %ecx … funcB: pushl %ebp Stack Memory Region movl %esp, %ebp … movl $10, %eax leave ret Function A …

Functions and the Stack Text Memory Region 1. pushl %eip funcA: addl $5, %ecx movl %ecx, -4(%ebp) … Program call funcB Counter (%eip) addl %eax, %ecx … funcB: pushl %ebp Stack Memory Region movl %esp, %ebp … movl $10, %eax Stored PC in funcA leave ret Function A …

Functions and the Stack Text Memory Region 1. pushl %eip funcA: 2. jump funcB addl $5, %ecx 3. create stack frame movl %ecx, -4(%ebp) 4. (execute funcB) … Program call funcB Counter (%eip) addl %eax, %ecx … funcB: pushl %ebp Stack Memory Region movl %esp, %ebp … Function B movl $10, %eax Stored PC in funcA leave ret Function A …

Functions and the Stack Text Memory Region 1. pushl %eip funcA: 2. jump funcB addl $5, %ecx 3. create stack frame movl %ecx, -4(%ebp) 4. (execute funcB) … Program 5. restore stack call funcB Counter (%eip) 6. popl %eip addl %eax, %ecx … funcB: pushl %ebp Stack Memory Region movl %esp, %ebp … movl $10, %eax Stored PC in funcA leave ret Function A …

Functions and the Stack Text Memory Region 7. (resume funcA) funcA: addl $5, %ecx movl %ecx, -4(%ebp) … Program call funcB Counter (%eip) addl %eax, %ecx … funcB: pushl %ebp Stack Memory Region movl %esp, %ebp … movl $10, %eax leave ret Function A …

Functions and the Stack Text Memory Region 1. pushl %eip funcA: 2. jump funcB addl $5, %ecx 3. create stack frame movl %ecx, -4(%ebp) 4. (execute funcB) … Program 5. restore stack call funcB Counter (%eip) 6. popl %eip addl %eax, %ecx 7. (resume funcA) … funcB: pushl %ebp Stack Memory Region movl %esp, %ebp … movl $10, %eax Stored PC in funcA leave ret Function A …

Functions and the Stack 1. pushl %eip call 2. jump funcB 3. create stack frame 4. (execute funcB) Program leave 5. restore stack Counter (%eip) ret 6. popl %eip 7. (resume funcA) Stack Memory Region Return address : Stored PC in funcA Address of the instruction we should jump back to when we finish (return Function A from) the currently executing function. …

IA32 Stack / Function Call Instructions subl $4, %esp Create space on the stack and place pushl movl src, (%esp) the source there. movl (%esp), dst Remove the top item off the stack and popl addl $4, %esp store it at the destination. push %eip 1. Push return address on stack call jmp target 2. Jump to start of function movl %ebp, %esp Prepare the stack for return leave popl %ebp (restoring caller’s stack frame) Return to the caller, PC ← saved PC ret popl %eip (pop return address off the stack into PC (eip))

IA32 Calling Convention (gcc) • In register %eax: – The return value • In the callee’s stack frame: – The caller’s %ebp value (previous frame pointer) • In the caller’s frame (shared with callee): – Function arguments – Return address (saved PC value)

On the stack between the caller’s and the callee’s local variables … • Caller’s base pointer (to reset the stack). • Caller’s instruction pointer (to continue execution). • Function parameters.

What order should we store all of these things on the stack? Why? B A return address callee parameters caller’s base pointer return address callee parameters caller’s base pointer C D caller’s base pointer callee parameters callee parameters caller’s base pointer return address return address E: some other order.

Putting it all together … Callee’s Callee’s local variables. frame. Caller’s Frame Pointer Return Address Shared by caller First Argument to Callee and callee. … Caller’s Final Argument to Callee frame. Caller’s local variables. … Older stack frames. …

Arguments • Arguments to the callee are stored just underneath the return address. This is why arguments can be found at positive offsets relative • Does it matter what order to %ebp. we store the arguments in? esp Callee • Not really, as long as ebp Return Address we’re consistent Callee Arguments (follow conventions). Caller …

How would we translate this to IA32? What should be on the stack? int func(int a, int b, int c) { return b+c; } int main() { Assume the stack initially looks like: func(1, 2, 3); } %esp main %ebp 0xFFFFFFFF