Chapter 5. The Stack

Chapter 5. The Stack

Introduction

A Real-World Analogy

Stacks in x86 and x86-64 Architectures

What Is a Stack Frame?

How Does the Stack Work?

Referencing and Modifying Data on the Stack

Viewing the Raw Stack in a Debugger

Examining the Raw Stack in Detail

Conclusion

第5章堆栈
介绍
一个真实的类比
在x86和x86-64架构中堆叠
什么是堆栈框架？
堆栈如何工作？
在堆栈上引用和修改数据
在调试器中查看原始堆栈
详细检查原始堆栈
结论

5.1. Introduction

The stack is one of the most important and fundamental parts of a computer’s architecture. It is something that many computer users may have heard of but likely don’t know much about what it is used for or how it works. Many software problems can involve the stack, so it is important to have a working knowledge to troubleshoot effectively. Let’s start out by defining the term stack. The definition taken directly from Dictionary.com is

堆栈是计算机架构中最重要和最基本的部分之一。 许多计算机用户可能听说过堆栈，但可能不太了解它的用途或工作原理。许多软件问题都可能涉及堆栈，因此有必要学习堆栈的知识来解决问题。我们首先定义术语堆栈。 直接从Dictionary.com获取的定义是

stack(stak)

n.

1. A large, usually conical pile of straw or fodder arranged for outdoor storage.

1. 一个大的，通常是圆锥形的稻草或饲料堆，用于室外存放。

2. An orderly pile, especially one arranged in layers. See Synonyms at heap.

2. 一堆有序的堆，尤指排列成一层的堆。 请参阅堆中的同义词。

3. Computer Science. A section of memory and its associated registers used for temporary storage of information in which the item most recently stored is the first to be retrieved.

3.计算机科学。 一段存储器及其相关寄存器用于临时存储信息，其中最近存储的项目是首先被检索的。

4. A group of three rifles supporting each other, butt downward and forming a cone.

1.   A chimney or flue.
2.   A group of chimneys arranged together.

4. 一组三支相互支撑的步枪，向下翘起并形成一个圆锥体。
a）烟囱或烟道。
b）一组烟囱排列在一起。

5. A vertical exhaust pipe, as on a ship or locomotive.

5. 一条垂直排气管，如在船上或机车上。

6. An extensive arrangement of bookshelves. Often used in the plural.

6. 书架的广泛安排。 通常使用其复数形式。

7. stacks The area of a library in which most of the books are shelved.

7. 堆栈图书馆的大部分书籍都被搁置的区域。

8. A stackup.

8. 叠加

9. An English measure of coal or cut wood, equal to 108 cubic feet (3.06 cubic meters).

9. 煤炭或切割木材的英制尺寸，等于108立方英尺（3.06立方米）。

10. Informal. A large quantity: a stack of work to do.

10. 非正式的。 大量：一堆工作要做。

Of course, 3) is the definition that we’re looking for in the context of this book. That definition is very accurate and should lay out a great starting point for readers who aren’t familiar with what a stack is or what it is used for. Stacks exist and are integral for program execution on most major architectures, but the layout and exact functionality of them vary on certain architectures. The basic idea, though, is the same: As a program calls functions and uses storage local to those functions, data gets pushed or placed onto the stack. As the program returns from the functions, the data is popped or removed from the stack. In the sense of data storage, the heap can be thought of as opposite to the stack. Data storage in the heap does not need to be local to any particular function. This is an important difference to understand. Heaps are discussed in more detail in the “Heap Segment” section of Chapter 3, “The /proc Filesystem.”

当然，3）是我们在本书中寻找的定义。该定义非常准确，应该为不熟悉堆栈或其用途的读者提供一个很好的起点。堆栈在大多数主要体系结构上都存在并且是程序执行不可缺少的部分，但是它们的布局和确切功能在某些体系结构上有所不同。然而，基本思想是一样的：当一个程序调用函数并使用这些函数的本地存储时，数据被压入堆栈。 当程序从函数返回时，数据将从堆栈弹出。在数据存储的意义上，堆可以被认为与栈相反。堆中的数据存储不需要是任何特定功能的本地存储。这是一个重要的区别理解。堆在第3章“/ proc文件系统”的“堆段”一节中有更详细的讨论。

5.2. A Real-World Analogy

To help understand the purpose and functionality of a program stack, a real-world analogy is useful. Consider Joe who likes to explore new places, but once he gets to his destination he is always afraid that he’ll forget how to get back home. To prevent this, Joe devises a plan that he calls his “travel stack.” The only supplies he needs are several pieces of paper, a pencil, and a box to hold the paper. When he leaves his apartment, he writes down “My apartment” on a piece of paper and places it in the empty box. As he walks and sees landmarks or things of interest, he writes them down on another piece of paper and places that piece of paper onto the forming pile in the box. So for example, the first landmark he passed was a hot dog stand on the sidewalk, so he wrote down “Bob’s Hot Dog Stand” on a piece of paper and placed it in the box. He did the same thing for several more landmarks:

Tim’s Coffee Shop

Large statue of Linus Torvalds

George’s Auto Body Shop

Penguin Park

He finally made it to his destination—the bookstore where he could purchase a good Linux book such as this one! So now that he’s at the bookstore, he wants to make sure he makes it home safely with his new purchase. To do this, he simply pulls the first piece of paper out of the box and reads it. “Penguin Park” is written on the top piece of paper, so he walks toward it. When he reaches it, he discards the piece of paper and gets the next piece from the box. It reads “George’s Auto Body Shop,” so Joe walks toward it next. He continues this process until he reaches his apartment where he can begin learning fabulous things about Linux!

This example is exactly how a computer uses a stack to execute a program. In a computer, Joe would be the CPU, the box would be the program stack, the pieces of paper would be the stack frames, and the landmarks written on the paper would be the function return addresses.

The stack is a crucial part of program execution. Each stack frame, which will be discussed in more detail later, corresponds to a single instance of a function and stores variables and data local to that instance of the function. This concept allows function recursion to work because each time the function is executed, a stack frame for it is created and placed onto the stack with its own copy of the variables, which could be very different from the previous execution instance of the very same function. If a recursive function was executed 10 times, there would be 10 stack frames, and as execution finishes, the associated stack frame is removed and execution moves on to the next frame.

5.2。一个真实的类比

为了帮助理解程序堆栈的目的和功能，真实世界的类比是有用的。考虑乔喜欢探索新地方，但一旦他到达目的地，他总是担心他会忘记如何回家。为了防止这种情况，乔设计了一个他称之为“旅行套餐”的计划。他需要的只有几张纸，一支铅笔和一个纸盒。当他离开他的公寓时，他在一张纸上写下“我的公寓”，并将其放在空箱子里。当他走过并看到地标或感兴趣的东西时，他将它们写在另一张纸上，并将那张纸放在盒子中的成型桩上。例如，他通过的第一个地标是人行道上的热狗站，所以他在一张纸上写下了“鲍勃的热狗站”，并将它放在箱子里。他为更多的地标做了同样的事情：

蒂姆的咖啡店

莱纳斯·托沃兹大雕像

乔治的汽车车身商店

企鹅公园

他终于到达了他的目的地 - 他可以购买一本好书籍的书店，比如这本书！所以，现在他在书店，他想确保他在购买新产品时能够安全到家。要做到这一点，他只需将第一张纸从包装盒中取出并读取即可。“企鹅公园”写在最上面的一张纸上，所以他走向它。当他到达它时，他丢弃了这张纸，从盒子里拿出了下一张。上面写着“乔治的汽车车身商店”，所以乔接着走向它。他继续这个过程直到他到达他的公寓，在那里他可以开始学习有关Linux的神话般的事情！

这个例子就是计算机如何使用堆栈来执行程序。在计算机中，Joe是CPU，盒子是程序堆栈，纸张是堆栈帧，写在纸上的地标是函数返回地址。

堆栈是程序执行的关键部分。将在后面更详细讨论的每个堆栈帧对应于函数的单个实例，并存储该函数实例的本地的变量和数据。这个概念允许函数递归工作，因为每次执行该函数时，都会创建一个堆栈框架并将其放置到堆栈中，并使用自己的变量副本，这可能与以前的相同函数的执行实例非常不同。如果递归函数执行了10次，则会有10个堆栈帧，并且在执行结束时，关联的堆栈帧被移除并且执行移至下一帧。

5.3. Stacks in x86 and x86-64 Architectures

x86 和 x86-64 体系结构中的堆栈

Considering the most popular Linux architecture is x86 (also referred to as i386) and because x86-64 is very similar and quickly gaining in popularity, this section focuses on them. Stacks on these architectures are said to grow “down” because they start at a high memory address and grow toward low memory addresses. See section “/proc//maps” in Chapter 3 for more information on the process address space. Figure 5.1 shows a diagram of the process address space with the stack starting at the top and growing down toward lower memory addresses.

Figure 5.1. Example of Stack Growing Down.

考虑到最受欢迎的 Linux 体系结构是 x86 (也称为 i386), 因为 x86-64 非常相似, 而且很快就获得了普及, 本节将重点介绍它们。据说这些架构上的堆栈向下增长, 因为它们从高内存地址开始, 向低内存地址扩展。有关进程地址空间的详细信息, 请参阅3章 "/proc//map" 部分。图5.1 显示了进程地址空间的图表, 堆栈从顶部开始, 向较低的内存地址逐渐增长。图5.1。堆栈向下增长的示例.

So now that we know conceptually where the stack resides and how it works, let’s find out where it really is and how it really works. The exact location will vary by architecture, but it will also vary by distribution. This is because some distributions include various patches and changes to the kernel source that modify the process address space. On SUSE 9.0 Professional and SLES 8 distributions running on x86 hardware, the stack segment starts at 0xc0000000 as shown in this very simple /proc//maps file.

现在我们知道了堆栈驻留的位置以及它的工作原理, 让我们找出它真正的位置以及它的工作原理。确切的位置会因架构而异, 但也会因发行版而异。这是因为某些发行版包含了修改进程地址空间的内核的各种补丁和更改。在 x86 硬件上运行的 SUSE 9.0 professional和 SLES 8 distribution, 堆栈段从0xc0000000 开始, 如这个非常简单/proc//maps中所示。

08048000-08049000 r-xp 00000000 03:08 293559 /u/dbehman/book/working/foo

08049000-0804a000 rw-p 00000000 03:08 293559 /u/dbehman/book/working/foo

40000000-40018000 r-xp 00000000 03:08 6664       /lib/ld-2.3.2.so

40018000-40019000 rw-p 00017000 03:08 6664       /lib/ld-2.3.2.so

40019000-4001b000 rw-p 00000000 00:00 0

40028000-40154000 r-xp 00000000 03:08 6661       /lib/i686/libc.so.6

40154000-40159000 rw-p 0012c000 03:08 6661       /lib/i686/libc.so.6

40159000-4015b000 rw-p 00000000 00:00 0

bfffe000-c0000000 rwxp fffff000 00:00 0

 

Remember, the stack grows down toward smaller addresses, thus the reason why 0xc0000000 is the end value in the stack address range of 0xbfffe000 - 0xc0000000.

Now to prove to ourselves that this range is in fact the stack segment, let’s write a small program that simply declares a local variable and then prints out that variable’s address.

请记住, 堆栈向较小的地址增长, 因此0xc0000000 是 0xbfffe000 - 0xc0000000 堆栈地址范围中的最终值的原因。现在我们自己证明这个范围实际上是堆栈段, 让我们编写一个小程序, 简单地声明一个局部变量, 然后打印出该变量的地址。

Note: Local variables are also referred to as stack variables given that the storage for them is obtained from the stack segment.

注意: 由于本地变量是从堆栈段获得的, 所以也称为堆栈变量。

The source code for the program is as follows:

该程序的源代码如下所示:

#include

 

int main( void )

{

   int stackVar = 3;

   char szCommand[64];

 

   printf( "Address of stackVar is 0x%x\n\n", &stackVar );

 

   sprintf( szCommand, "cat /proc/%d/maps", getpid() );

   system( szCommand );

 

   return 0;

}

Compiling and running this program gives this output:

编译和运行此程序将提供以下输出:

penguin> ./stack

Address of stackVar is 0xbffff2dc

 

08048000-08049000 r-xp 00000000 03:08 293568 /u/dbehman/book/code/stack

08049000-0804a000 rw-p 00000000 03:08 293568 /u/dbehman/book/code/stack

40000000-40018000 r-xp 00000000 03:08 6664   /lib/ld-2.3.2.so

40018000-40019000 rw-p 00017000 03:08 6664   /lib/ld-2.3.2.so

40019000-4001b000 rw-p 00000000 00:00 0

40028000-40154000 r-xp 00000000 03:08 6661   /lib/i686/libc.so.6

40154000-40159000 rw-p 0012c000 03:08 6661   /lib/i686/libc.so.6

40159000-4015b000 rw-p 00000000 00:00 0

bfffe000-c0000000 rwxp fffff000 00:00 0

 

As we can see, 0xbffff2dc does indeed fall within 0xbfffe000 and 0xc0000000. Examining this further, since there was only one stack variable in our very simple program example, what is on the stack in between 0xc0000000 and 0xbffff2dc?

正如我们所看到的, 0xbffff2dc 确实落在0xbfffe000 和0xc0000000之间。进一步检查这一点, 因为在我们非常简单的程序示例中只有一个堆栈变量, 0xc0000000 和0xbffff2dc 之间的堆栈中有什么？

Figure 5.2. Stack space.

The answer to this question is in the standard ELF specification, which is implemented in the kernel source file fs/elf_binfmt.c. Basically, what happens is that beginning with the terminating NULL byte at 0xbffffffb and working down toward lower addresses, the kernel copies the following information into this area:

这个问题的答案是在标准 ELF 规范中, 它是在内核源文件 fs/elf_binfmt.c 中实现的。基本上, 从在0xbffffffb NULL 字节开始，向下到较低内存地址, 内核将以下信息复制到该区域:

the pathname specified to exec()

指定给 exec() 的路径名

the full process environment

全部过程环境

all argv strings

 

argc

the auxiliary vector

We could verify this by enhancing our simple program, which displays the address of a stack variable, to also dump the locations of some of the information just listed. The enhanced code is as follows:

我们可以通过增强我们的简单程序来验证这一点, 来显示堆栈变量的地址, 还能转储刚刚列出的某些信息的位置。增强的代码如下所示:

#include

extern char **environ;

 

int main( int argc, char *argv[] )

{

   int stackVar = 3;

   char szCommand[64];

 

   printf( "Address of stackVar is 0x%x\n", &stackVar );

   printf( "Address of argc is     0x%x\n", &argc );

   printf( "Address of argv is     0x%x\n", argv );

   printf( "Address of environ is  0x%x\n", environ );

   printf( "Address of argv[0] is  0x%x\n", argv[0] );

   printf( "Address of *environ is 0x%x\n\n", *environ );

 

   sprintf( szCommand, "cat /proc/%d/maps", getpid() );

   system( szCommand );

 

   return 0;

}

 

Compiling and running this enhanced program gives the following output:

编译并运行此增强程序将提供以下输出:

penguin> ./stack2

Address of stackVar is 0xbffff2dc

Address of argc is     0xbffff2f0

Address of argv is     0xbffff334

Address of environ is  0xbffff33c

Address of argv[0] is  0xbffff4d5

Address of *environ is 0xbffff4de

 

08048000-08049000 r-xp 00000000 03:08 188004 /u/dbehman/book/code/stack2

08049000-0804a000 rw-p 00000000 03:08 188004 /u/dbehman/book/code/stack2

40000000-40018000 r-xp 00000000 03:08 6664   /lib/ld-2.3.2.so

40018000-40019000 rw-p 00017000 03:08 6664   /lib/ld-2.3.2.so

40019000-4001b000 rw-p 00000000 00:00 0

40028000-40154000 r-xp 00000000 03:08 6661   /lib/i686/libc.so.6

40154000-40159000 rw-p 0012c000 03:08 6661   /lib/i686/libc.so.6

40159000-4015b000 rw-p 00000000 00:00 0

bfffe000-c0000000 rwxp fffff000 00:00 0

 

From the first few lines of output, we can now see some of the things that lie between the top of the stack and the program’s first stack frame.

从最初的几行输出中, 我们现在可以看到位于堆栈顶部和程序的第一个堆栈帧之间的一些东西。

It’s also important to note that with C applications, main() isn’t really the first function to be executed. Functions that get executed before main() include __libc_start_main(), _start(), and __libc_csu_init().

同样重要的是, 在 C 应用程序中, main () 实际上并不是要执行的第一个函数。在 main () 之前执行的函数包括 __libc_start_main ()、_start () 和 __libc_csu_init ()。

5.4. What Is a Stack Frame?

A single stack frame can be thought of as a contiguous address range, usually relatively small, in the stack segment that contains everything local to a particular function. Every function (except special cases such as inline or static functions) has a stack frame. More specifically, every individual execution of a function has an associated stack frame. The stack frame holds all local variables for that function as well as parameters that are passed to other functions that are called during execution. Consider the source code from stack3.c:

单个栈帧可以被认为是一个连续的地址范围, 通常相对较小, 位于包含特定函数本地的所有内容的栈段中。每个函数 (除了特殊情况,如inline或static函数) 都有栈帧。更具体地说, 每个函数的在执行时都有一个关联的栈帧。栈帧保存该函数的所有局部变量以及传递给执行期间调用的其他函数的参数。参考 stack3.c 源代码:

Code View: Scroll / Show All

#include

 

void function3( int *passedByReference )

{

   int dummy = '\0';

 

   printf( "My pid is %d; Press to continue", getpid() );

   dummy = fgetc( stdin );

   *passedByReference = 9;

}

 

void function2( char *paramString )

{

   int localInt = 1;

 

   function3( &localInt );

   printf( "Value of localInt = %d\n", localInt );

}

 

void function1( int paramInt )

{

   char localString[] = "This is a string.";

 

   function2( localString );

}

 

int main( void )

{

   int stackVar = 3;

 

   function1( stackVar );

 

   return 0;

}

There’s a lot going on in the example, but for now we’re most interested in the fact that running this program will cause main() to call function1(), which calls function2(), which then calls function3(). function3() then displays its PID and waits for the user to hit ENTER to continue. Also pay attention to the local variables that are declared in each function. When we run this program and let it pause in function3(), we can visualize the stack frames by what is shown in Figure 5.3:

这个例子中有很多事情, 但是现在我们最感兴趣的是, 运行这个程序会导致 main () 调用 function1 (), 调用 function2 (), 然后调用 function3 ()。function3 () 然后显示其 PID, 等待用户点击 ENTER 继续。还要注意每个函数中声明的局部变量。当我们运行此程序并让它在 function3 () 中暂停时, 我们可以通过图5.3 中显示的内容来可视化堆栈帧:

Figure 5.3. Functions and stack frames.

This conceptual view can be viewed practically in gdb by compiling and running stack.c and then running the stack program under gdb with a breakpoint set in function3(). Once the breakpoint is hit, enter the command backtrace (synonymous with bt and where) to display the stack frames. The output will look like the following:

通过编译和运行堆栈, 可以在 gdb 中实际查看此概念视图, 然后在 gdb 下运行堆栈程序, 并在 function3 () 中设置断点。中断断点后, 输入命令回溯 (与 bt 和 where 的同义词) 以显示堆栈帧。输出将如下所示:

Code View: Scroll / Show All

penguin> gdb stack3

GNU gdb 5.3.92

Copyright 2003 Free Software Foundation, Inc.

GDB is free software, covered by the GNU General Public License, and

you are welcome to change it and/or distribute copies of it under

certain conditions.

Type "show copying" to see the conditions.

There is absolutely no warranty for GDB. Type "show warranty" for

details.

This GDB was configured as "i586-suse-linux"...

(gdb) break function3

Breakpoint 1 at 0x80483d2: file stack3.c, line 5.

(gdb) run

Starting program: /home/dbehman/book/code/stack3

 

Breakpoint 1, function3 (passedByReference=0xbffff284) at stack3.c:5

5          int dummy = '\0';

(gdb) backtrace

#0  function3 (passedByReference=0xbffff284) at stack3.c:5

#1  0x0804842d in function2 (paramString=0xbffff2a0 "This is a

string.")

    at stack3.c:16

#2  0x08048481 in function1 (paramInt=3) at stack3.c:24

#3  0x080484a8 in main () at stack3.c:31

(gdb)

For more information on the various GDB commands used to view and manipulate stacks, see Chapter 6, “The GNU Debugger (GDB).”

有关用于查看和操作堆栈的各种 GDB 命令的详细信息, 请参阅第6章 "GNU 调试器 (GDB)"。

5.5. How Does the Stack Work?

The stack’s functionality is implemented at many different levels of a computer including low-level processor instructions. On x86 for example, the pop and push instructions are specifically for placing data on and removing data from the stack respectively. Most architectures also supply dedicated registers to use for manipulating and managing the stack. On x86 and x86-64, the bp and sp registers (for “base pointer” and “stack pointer”—see following sections) are used. They are named slightly differently for each architecture in that a prefix is used to indicate the size of the register. For x86, the prefix letter “e” is used to indicate a size of 32-bit, and for x86-64 the prefix letter of “r” is used to indicate a size of 64-bit.

栈的功能在计算机的许多不同级别实现, 其中包括低级处理器指令。例如, 在 x86 上, pop 和push指令专门用于分别在栈上放置数据和从中删除数据。大多数体系结构还提供用于操作和管理栈的专用寄存器。在 x86 和 x86-64 上, 使用 bp 和 sp 寄存器 (用于 "基本指针" 和 "栈指针"-请参见以下部分)。对于每个体系结构, 它们的命名略有不同, 因为前缀用于表示寄存器的大小。对于 x86, 前缀字母 "e" 用于表示32位的大小, 对于 x86-64, "r" 的前缀字母用于指示大小为64位。

5.5.1. The BP and SP Registers

The bp, or base pointer (also referred to as frame pointer) register is used to hold the address of the beginning or base of the current frame. The purpose of this is so that a common reference point for all local stack variables can be used. In other words, stack variables are referenced by the bp register plus an offset. When working in a particular stack frame, the value of this register will never change. Each stack frame has its own unique bp value.

bp 或基指针 (也称为帧指针) 寄存器用于保存当前帧的开头或底部的地址。这样做的目的是为了可以使用所有本地栈变量的公共引用点。换言之, 栈变量由 bp 寄存器引用, 外加一个偏移量。在特定栈帧中工作时, 此寄存器的值永远不会改变。每个栈帧都有其独特的 bp 值。

The sp, or stack pointer register is used to hold the address of the end of the stack. A program’s assembly instructions will modify its value when new space is needed in the current stack frame for local variables. Because the sp is always the end of the stack, when a new frame is created, its value is used to set the new frame’s bp value. The best way to understand exactly how these two registers work is to examine the assembly instructions involved in starting a new function and allocating stack variables within it. Consider the following source code:

sp 或栈指针寄存器用于保存栈末尾的地址。当当前栈帧中的局部变量需要新空间时, 程序的汇编指令将修改其值。由于 sp 始终是栈的末尾, 因此在创建新栈帧时, 它的值用于设置新栈帧的 bp 值。了解这两个寄存器的工作方式的最好方法是检查启动新函数时所涉及的汇编指令, 并在其中分配栈变量。请考虑以下源代码:

#include

 

void function1( int param )

{

   int localVar = 99;

}

 

int main( void )

{

   int stackVar = 3;

 

   function1( stackVar );

 

   return 0;

}

Compiling this code with the -S switch will produce the following assembly listing:

使用-S选项编译此代码将生成以下汇编程序:

Code View: Scroll / Show All

        .file  "stack4.c"

        .text

.globl function1

        .type  function1, @function

function1:

        pushl  %ebp

        movl   %esp, %ebp

        subl   $4, %esp

        movl   $99, -4(%ebp)

        leave

        ret

        .size  function1, .-function1

.globl main

        .type  main, @function

main:

       pushl   %ebp

       movl    %esp, %ebp

       subl    $8, %esp

       andl    $-16, %esp

       movl    $0, %eax

       subl    %eax, %esp

       movl    $3, -4(%ebp)

       subl    $12, %esp

       pushl   -4(%ebp)

       call    function1

       addl    $16, %esp

       movl    $0, %eax

       leave

       ret

       .size   main, .-main

       .ident  "GCC: (GNU) 3.3.1 (SuSE Linux)"

 

Note: Because the source program was very simple, this assembly listing is also quite simple. Without any prior knowledge of or experience with assembly listings, you should be able to easily look at this listing and pick out the beginning of the two functions, function1 and main.

注: 由于源程序非常简单, 此汇编程序也相当简单。即使没有对汇编程序的任何事先了解或经验, 您应该也能够轻松地查看此汇编程序, 并挑选出 function1 和 main 两个函数的起始点。

In function1, the first instruction pushl %ebp saves the value of the base pointer from the previous frame on the stack. The next instruction movl %esp, %ebp copies the value of the stack pointer into the base pointer register. Recall that the stack pointer, esp in this example, always points to the top of the stack. The next instruction subl $4, %esp subtracts 4 from the current value stored in the stack pointer register. This effectively opens up storage in the newly created stack frame for 4 bytes. This is the space needed for the local variable localVar, which is indeed 4 bytes in size (an int). These three instructions combined form what’s commonly referred to as the function prologue. The function prologue is code added to the beginning of every function that is compiled by gcc and most, if not all, compilers. It is responsible for defining and preparing a new stack frame for upcoming function execution.

在 function1 中, 第一个指令 pushl %ebp 将基指针的值从栈上的上一个帧中保存。下一条指令 movl %esp,%ebp 将栈指针的值复制到基指针寄存器中。请记住, 此示例中的栈指针始终指向堆栈顶部。下一个指令 subl $ 4,%esp 从存储在栈指针寄存器中的当前值减去4。这有效地在新创建的栈帧中打开了4字节的存储。这是局部变量 localVar 所需的空间, 它确实是大小的4个字节 (int)。这三指令组合形成了通常称为函数的序言。函数序言是添加到由 gcc 和大多数 (如果不是全部) 编译器编译的每个函数的开头的代码。它负责定义和准备新的栈帧, 以用于即将执行的函数。

Along with a function prologue is an associated function epilogue. In the assembly code shown for the preceding function1(), the epilogue consists of the leave and ret instructions. The epilogue is effectively the reverse of the prologue. It is hard to tell this because those unfamiliar with the x86 instruction set will not know that the leave instruction is actually a high-level instruction equivalent to these instructions:

跟函数的序言相对应的是一个函数的结语。在为前面的 function1 () 显示的汇编代码中, 结语由leave和 ret 指令组成。结语实际上是序言的反面。很难说这一点, 因为那些不熟悉 x86 指令集的人将不知道假指令实际上是与这些指令等效的高级指令:

 

movl %ebp, %esp

popl %ebp

 

Comparing these two instructions to the first two instructions in the prologue, we can see that they are in fact the mirror image of each other. The function epilogue code is completed by the ret instruction, which transfers program control to the address located at the end of the stack.

The function prologue and epilogue are extremely important contributors to the proper execution and isolation of individual function calls. They make up what’s commonly referred to as the function or procedure calling conventions. We will discuss the remaining details of the calling conventions, but first a special note is required regarding the prologue and epilogue.

将这两个指令与序言中的前两个指令进行比较, 我们可以看到它们实际上是彼此的镜像。函数结语代码由 ret 指令完成, 它将程序控制转移到位于栈末尾的地址。函数的序言和结语是对单个函数调用的正确执行和隔离的非常重要的贡献。它们构成了通常称为函数或过程调用约定的内容。我们将讨论调用约定的其余细节, 但首先需要对序言和结语进行特别说明。

5.5.1.1. Special Case: gcc’s -fomit-frame-pointer Compile Option

Some architectures support gcc’s -fomit-frame-pointer compile option, which is used to avoid the need for the function prologue and epilogue, thus freeing up the frame pointer register to be used for other purposes. This optimization is done at the cost of the ability to debug the application because certain debugging tools and techniques rely on the frame pointer being present. SUSE 9.0 Professional and SLES 8 on the x86-64 architecture have been compiled with the -fomit-frame-pointer option enabled, which could improve performance in certain areas of the operating system. GDB is able to handle this properly, but other debugging techniques might have difficulties such as using a homegrown stack traceback function. It is also important to note that when using gcc 3.3.x with the -O1 or greater optimization level, the -fomit-frame-pointer flag is automatically turned on for the x86-64 architecture. If omitting the frame pointer is not desired but optimization is, be sure to compile your program with something like the following:

有些体系结构支持 gcc 的-fomit-frame-pointer编译选项, 它用于避免函数的序言和结语, 从而释放了用于其他目的的帧指针寄存器。此优化是以调试应用程序的能力为代价的, 因为某些调试工具和技术依赖于帧指针。基于x86-64 体系结构的SUSE 9.0 专业版和 SLES 8 在编译时, -fomit-frame-pointer选项启用, 这可以提高操作系统在某些领域的性能。GDB 能够正确处理这一问题, 但是其他调试技术可能会遇到一些困难, 例如使用本地的栈回溯功能。还要注意的是, 当使用 gcc 3.3.x (-O1 或更高的优化级别) 时, -fomit-frame-pointer标志会自动打开以用于 x86-64 体系结构。如果不想省略帧指针, 但需要优化, 请按照下面的命令编译您的程序:

gcc -o myexe myexe.c -O1 -fno-omit-frame-pointer

5.5.2. Function Calling Conventions

When you strip away all the peripherals, storage, sound, and video devices, computers are relatively simple machines. The “guts” of a computer basically consist of two main things: the CPU and RAM. RAM stores the instructions that run on the CPU, but given that the CPU is really just a huge maze of logic gates, there is a need for intermediate storage areas that are very close to the CPU and still fast enough to feed it as quickly as it can process the instructions. These intermediate storage areas are the system’s registers and are integral parts of a computer system.

Most systems have only a very small number of registers, and some of these registers have a dedicated purpose and so cannot simply be used at will. Because every function that executes has access to and can manipulate the exact same registers, there must be a set of rules that govern how registers are used between function calls. The function caller and function callee must know exactly what to expect from the registers and how to properly use them without clobbering one another. This set of rules is called the function or procedure calling conventions. They are architecture-specific and very important to know and understand for all software developers.

当您去掉所有外设、存储、声音和视频设备时, 计算机是相对简单的机器。计算机的 "内核" 基本上由两个部分组成: CPU 和 RAM。RAM 存储了运行在 cpu 上的指令, 但是考虑到 cpu 实际上只是一个巨大的逻辑门迷宫, 需要非常接近 CPU而且仍然足够快的中间存储区域  以满足其处理指令的速度。这些中间存储区域是系统的寄存器, 是计算机系统的组成部分。大多数系统只有很少数量的寄存器, 有些寄存器有专门的用途, 因此不能随意使用。由于每个执行的函数都可以访问和操作完全相同的寄存器, 因此必须有一组规则来控制在函数调用之间如何使用寄存器。函数调用方和被调用方必须确切知道要从寄存器中得到什么这组规则称为函数或过程调用约定。它们是特定于体系结构的，所有软件开发人员都需要了解。。

The purpose of this section is to give an overview of the basics of the calling conventions and should not be considered an exhaustive reference. The calling conventions are quite a bit more detailed than what is presented here— for example, what to do when structures contain various data classification types, how to properly align data, and so on. For more detailed information, it is recommended to download and read the calling convention sections from the architecture’s Application Binary Interface (ABI) specification document. The ABI is basically a blueprint for how software interacts with an architecture, so there is great value in reading these documents. The links are:

本节的目的是概述调用约定的基本知识, 不应将其视为详尽的介绍。调用约定文档比此处介绍的更详细一些, 例如, 结构包含各种数据分类类型时，该怎么办，如何正确地对齐数据等,。更详细的信息, 建议下载并阅读体系结构的Application Binary Interface (ABI) 规范文档-调用约定。ABI 基本上是软件与体系结构交互的规范, 因此这些文档有很大的价值。链接有:

x86 ABI - http://www.caldera.com/developers/devspecs/abi386-4.pdf

x86-64 ABI - http://www.x86-64.org/documentation/abi.pdf

Again, the following sections will give an overview of the calling conventions on x86 and x86-64, which will provide a great base understanding.

同样, 以下各节将概述 x86 和 x86-64 的调用约定, 这将提供对x86和x86_64很好的基础理解。

5.5.2.1. x86 Architecture

We have already discussed what a function must do at the very beginning of its execution (prologue) and at the very end (epilogue), which are important parts of the calling conventions. Now we must learn the rules for calling a function. For example, if function1 calls function2 with five parameters, how does function2 know where to find these parameters and what to do with them?

我们已经讨论了函数在其执行的开始 (序言) 和结尾 (结语) 中必须做什么, 这是调用约定的重要部分。现在我们必须学习调用函数的规则。例如, 如果 function1 调用了具有五个参数的 function2, function2 如何知道在哪里找到这些参数以及如何处理它们？

The answer to this is actually quite simple. The calling function simply pushes the function arguments onto the stack starting with the right-most parameter and working toward the left. This is illustrated in the following diagram.

答案其实很简单。调用函数简单地将函数参数推送到栈上, 从最右边的参数开始, 然后向左工作。下图说明了这一点。

Figure 5.4. Illustration of calling conventions on x86.

Also as shown, the arguments are all pushed onto the stack in the calling function’s stack frame.

Let’s consider the following program, pizza.c, to illustrate how this really works.

如图所示, 参数都被推入调用函数的栈帧中的栈上。让我们考虑下面的程序, pizza.c。

Code View: Scroll / Show All

#define pizza 1

#define large 2

#define thin_crust 6

#define meat_lovers 9

 

int make_pizza( int size, int crust_type, int specialty )

{

   int return_value = 0;

 

   /* Do stuff */

 

   return return_value;

}

 

int make_dinner( int meal_type )

{

   int return_value = 0;

 

   return_value = make_pizza( large, thin_crust, meat_lovers );

 

   return return_value;

}

 

int main( void )

{

   int return_value = 0;

 

   return_value = make_dinner( pizza );

 

   return return_value;

}

To really see the calling conventions in action, we need to look at the assembly listing for this program. Recall that creating an assembly listing can be done with the following command assuming our program is called pizza.c:

要真正看到操作中的调用约定, 我们需要查看该程序的汇编程序。回想一下, 创建汇编程序可以通过以下命令完成: 假设我们的程序叫pizza. c:

gcc -S pizza.c

 

This will produce pizza.s, which is shown here:

Code View: Scroll / Show All

        .file  "pizza.c"

        .text

.globl make_pizza

        .type  make_pizza, @function

make_pizza:

        pushl  %ebp

        movl   %esp, %ebp

        subl   $4, %esp

        movl   $0, -4(%ebp)

        movl   -4(%ebp), %eax

        leave

        ret

        .size  make_pizza, .-make_pizza

.globl make_dinner

        .type  make_dinner, @function

make_dinner:

        pushl  %ebp

        movl   %esp, %ebp

        subl   $8, %esp

        movl   $0, -4(%ebp)

        subl   $4, %esp

        pushl  $9

        pushl  $6

        pushl  $2

        call   make_pizza

        addl   $16, %esp

        movl   %eax, -4(%ebp)

        movl   -4(%ebp), %eax

        leave

        ret

        .size  make_dinner, .-make_dinner

.globl main

        .type  main, @function

main:

        pushl  %ebp

        movl   %esp, %ebp

        subl   $8, %esp

        andl   $-16, %esp

        movl   $0, %eax

        subl   %eax, %esp

        movl   $0, -4(%ebp)

        subl   $12, %esp

        pushl  $1

        call   make_dinner

        addl   $16, %esp

        movl   %eax, -4(%ebp)

        movl   -4(%ebp), %eax

        leave

        ret

        .size  main, .-main

        .ident "GCC: (GNU) 3.3.1 (SuSE Linux)"

 

Recall that a C function name, such as make_dinner in our example, will always appear in the assembly listing as a label,—or as make_dinner: in the previous listing, for example. This function contains the instructions of interest that clearly illustrate the x86 calling conventions. In particular, note these instructions:

回想一下, 在我们的示例中, C 函数名称 (如 make_dinner) 将始终显示在汇编程序中作为标签, 或作为 make_dinner: 例如, 在上一个汇编程序中。此函数包含明确说明 x86 调用约定的相关说明。特别是, 请注意以下说明:

pushl $9

pushl $6

pushl $2

call  make_pizza

Note: In Linux assembly, any instruction argument prefixed with “$” is a constant, which means that the value prefixed is the actual value used.

注意: 在 Linux 汇编程序中, 任何以 "$" 为前缀的指令参数都是常量, 这意味着值前缀是所使用的实际值。

Looking back at pizza.c, we see the following macro definitions:

回头看pizza.c, 我们看到以下宏定义:

#define large 2

#define thin_crust 6

#define meat_lovers 9

 

So we can now clearly see that the calling conventions have been followed, and our function parameters were pushed onto the stack starting with meat_lovers and followed by thin_crust and then large.

因此, 我们现在可以清楚地看到, 调用约定已被遵循, 我们的功能参数被推到栈上开始的 meat_lovers, 其次是 thin_crust, 最后large.

5.5.2.1.1. Return Value

Another important aspect of calling conventions to know and understand is how a function’s return value is passed back to the calling function. In pizza.c just shown, the call to make_pizza is

了解和理解调用约定的另一个重要方面是函数的返回值如何传递回调用函数。在pizza. c 中显示, 调用 make_pizza 是

return_value = make_pizza( large, thin_crust, meat_lovers );

 

This means that we want the return value of the function call to be stored in the return_value variable, which is local to the calling function. The x86 calling conventions state that the %eax register is used to store the function return value between function calls. This is illustrated in the previous assembly listing. At the very end of the make_pizza function, we see the following instructions:

这意味着, 我们希望函数调用的返回值存储在调用函数的 return_value 变量中。x86 调用约定声明%eax 寄存器用于在函数调用之间存储函数返回值。这在上一个程序集列表中进行了说明。在 make_pizza 函数的末尾, 我们看到以下说明:

movl   -4(%ebp), %eax

leave

ret

 

We now know that leave and ret make up the function epilogue and notice immediately before that, a move instruction is done to move the value stored at the address %ebp contains offset by 4 bytes into the %eax register. If we look back through the assembly for the make_pizza function, we will see that -4 (%ebp) does in fact represent the return_value stack variable.

我们现在知道, leave和 ret 组成的函数的结语。注意, 在这之前, 执行move指令, 将存储在地址%ebp 偏移量为4字节的值移动到%eax 寄存器中。如果我们回顾一下汇编程序的 make_pizza 函数, 我们将看到-4 (%ebp) 实际上表示 return_value 栈变量。

So now at this point, the %eax register contains the return value just before the function returns to its caller, so let’s now look at what happens back in the calling function. In our example, that function is make_dinner:

所以现在在这一点上,%eax 寄存器在函数返回给调用方之前包含返回值, 所以现在让我们来看一下调用函数中返回的内容。在我们的示例中, 该函数是 make_dinner 的:

call make_pizza

addl $16, %esp

movl %eax, -4(%ebp)

 

Immediately after the call to make_pizza we can see that the stack is shrunk by 16 bytes by adding 16 to the %esp register. We then see that the value from the %eax register is moved to a stack variable specified by -4 (%ebp), which turns out to be the return_value variable.

在对 make_pizza 的调用之后, 我们可以看到堆栈的收缩为16字节, 通过将16添加到%esp 寄存器。然后, 我们看到%eax 寄存器中的值被移动到由-4 (%ebp) 指定的栈变量中, 它原来是 return_value 变量。

5.5.2.2. x86-64 Architecture

The calling conventions for x86-64 are a bit more complex than for x86. The primary difference is that rather than all the functions’ arguments being pushed on the stack before a function call as is done on x86, x86-64 makes use of some of the general purpose registers first. The reason for this is that the x86-64 architecture provides a few more general purpose registers than x86, and using them rather than pushing the arguments onto the stack that resides on much slower RAM is a very large performance gain.

x86-64 的调用约定比 x86 更复杂一些。主要的区别在于, 在函数调用之前在栈上推送的所有函数参数, 而不是在 x86 上执行之前, x86-64 首先使用一些通用寄存器。原因是 x86-64 体系结构提供了比 x86 更通用的寄存器, 使用它们而不是将参数推送到栈上, 驻留在速度较慢的 RAM 上，这是一个非常大的性能提升。

Function parameters are also handled differently depending on their data type classification. The main classification, referred to as INTEGER, is any integral data type that can fit into one of the general purpose registers (GPR). Because the GPRs on x86-64 are all 64-bit, this covers the majority of data types passed as function arguments. The calling convention that is used for this data classification is (arguments—from left to right—are assigned to the following GPRs)

函数参数的处理方式也不同, 具体取决于它们的数据类型。主分类 (称为整数) 是可放入任何通用寄存器 (GPR) 的整数类型。因为 x86-64 上的 GPRs 都是64位的, 所以它涵盖了作为函数参数传递的大多数数据类型。用于此数据分类的调用约定是 (从左向右的参数) 分配给以下 GPRs：

%rdi

%rsi

%rdx

%rcx

%r8

%r9

 

Remaining arguments are pushed onto the stack as on x86.

To illustrate this, consider a modified pizza.c program:

剩余参数按 x86 推送到堆栈上。为了说明这一点, 请考虑修改后的pizza. c 程序:

Code View: Scroll / Show All

#define pizza      50

#define large      51

#define thin_crust 52

#define cheese     1

#define pepperoni  2

#define onions     3

#define peppers    4

#define mushrooms  5

#define sausage    6

#define pineapple  7

#define bacon      8

#define ham        9

 

int make_pizza( int size, int crust_type, int topping1, int topping2,int topping3, int topping4, int topping5,int topping6, int topping7, int topping8,int topping9 )

{

   int return_value = 0;

 

   /* Do stuff */

 

   return return_value;

}

 

int make_dinner( int meal_type )

{

   int return_value = 0;

 

   return_value = make_pizza( large, thin_crust, cheese, pepperoni,onions, peppers, mushrooms, sausage,pineapple, bacon, ham );

 

   return return_value;

}

 

int main( void )

{

 

   int return_value = 0;

 

   return_value = make_dinner( pizza );

 

   return return_value;

}

 

Again, we produce the assembly listing for this program with the command:

同样, 我们使用以下命令为该程序生成汇编程序:

gcc -S pizza.c

 

The assembly listing produced is:

Code View: Scroll / Show All

        .file   "pizza.c"

        .text

.globl make_pizza

        .type   make_pizza,@function

make_pizza:

.LFB1:

        pushq   %rbp

.LCFI0:

        movq    %rsp, %rbp

.LCFI1:

        movl    %edi, -4(%rbp)

        movl    %esi, -8(%rbp)

        movl    %edx, -12(%rbp)

        movl    %ecx, -16(%rbp)

        movl    %r8d, -20(%rbp)

        movl    %r9d, -24(%rbp)

        movl    $0, -28(%rbp)

        movl    -28(%rbp), %eax

        leave

        ret

.LFE1:

.Lfe1:

        .size   make_pizza,.Lfe1-make_pizza

.globl make_dinner

        .type   make_dinner,@function

make_dinner:

.LFB2:

        pushq   %rbp

.LCFI2:

        movq    %rsp, %rbp

.LCFI3:

        subq    $48, %rsp

.LCFI4:

        movl    %edi, -4(%rbp)

        movl    $0, -8(%rbp)

        movl    $9, 32(%rsp)

        movl    $8, 24(%rsp)

        movl    $7, 16(%rsp)

        movl    $6, 8(%rsp)

        movl    $5, (%rsp)

        movl    $4, %r9d

        movl    $3, %r8d

        movl    $2, %ecx

        movl    $1, %edx

        movl    $52, %esi

        movl    $51, %edi

        call    make_pizza

        movl    %eax, -8(%rbp)

        movl    -8(%rbp), %eax

        leave

        ret

.LFE2:

.Lfe2:

        .size   make_dinner,.Lfe2-make_dinner

.globl main

        .type   main,@function

main:

.LFB3:

        pushq   %rbp

.LCFI5:

        movq    %rsp, %rbp

.LCFI6:

        subq    $16, %rsp

.LCFI7:

        movl    $0, -4(%rbp)

        movl    $50, %edi

        call    make_dinner

        movl    %eax, -4(%rbp)

        movl    -4(%rbp), %eax

        leave

        ret

.LFE3:

.Lfe3:

        .size   main,.Lfe3-main

        .section        .eh_frame,"aw",@progbits

—8<— SNIPPED UNIMPORTANT INFO —8<—

 

 

                                                

 

The instructions we’re most interested in are the ones that come before the call to make_pizza in the make_dinner function. Specifically, they are

我们最感兴趣的是那些在 make_dinner 函数中调用 make_pizza 的指令。具体地说, 它们是

movl    $9, 32(%rsp)

movl    $8, 24(%rsp)

movl    $7, 16(%rsp)

movl    $6, 8(%rsp)

movl    $5, (%rsp)

movl    $4, %r9d

movl    $3, %r8d

movl    $2, %ecx

movl    $1, %edx

movl    $52, %esi

movl    $51, %edi

call    make_pizza

 

We can look at this graphically in Figure 5.5.

我们可以在图5.5 中以图形的形式来查看这一点。

Figure 5.5. Illustration of calling conventions on x86-64.

图5.5。x86-64 调用约定的说明。

As you can see, the six general purpose registers are used up with six left-most function arguments. The remaining five function arguments are pushed onto the stack. Note, however, that the last five arguments are not pushed onto the stack as they are on x86; rather they are moved directly to the addresses in memory referenced by %rsp.

正如您所看到的, 六个通用寄存器保存了从左到右六个函数参数。其余的五函数参数被推送到栈上。但是, 请注意, 最后五个参数不会被推送到栈上,，就像它们在 x86 上一样。相反, 它们直接移动到%rsp 保存的内存地址中。

5.5.2.2.1. Return Value

The convention used to handle the function return value is very similar to x86. The data is first classified to determine the method used to handle the return. For the INTEGER data classification, the %rax register is first used. If it is unavailable at the time of return, the %rdx register can be used instead. There are other possibilities for different return scenarios, but the general idea remains the same. For all the details, it is recommended to refer to the x86-64 ABI.

用于处理函数返回值的约定与 x86 非常相似。首先对数据进行分类, 以确定用于处理返回的方法。对于整数数据, 首先使用%rax 寄存器。如果不可用, 则改用%rdx 寄存器。对于不同的返回方案, 还有其他可能性, 但总体思路仍然相同。对于所有细节, 建议参考 x86-64 ABI。

5.6. Referencing and Modifying Data on the Stack

We’ve seen by now that the stack is crucial for proper and flexible program execution. We’ve also seen that the stack really isn’t as complex as it first may seem to be. This section will explain how data is stored on the stack and how it is manipulated.

我们现在已经看到, 栈对于正确和灵活的程序执行至关重要。我们还看到, 栈实际上并不像它最初看起来那么复杂。本节将解释数据如何存储在栈上以及如何操作。

Recall our simple C program from the earlier section, “The BP and SP Registers,” where we declare a simple stack variable like this:

从前面的部分 "BP 和 SP 寄存器" 中调用简单的 C 程序, 我们声明一个简单的栈变量, 如下所述:

int localVar = 99;

Recall further that the assembly produced for this area of the program consisted of these three instructions, which make up the function prolog:

进一步回顾为程序的这个区域生产的汇编程序包括了这三个指令, 构成函数序言:

pushl   %ebp

movl    %esp, %ebp

subl    $4, %esp

                                    

 

The subl instruction effectively increases the size of the stack by 4 bytes–keep in mind that the stack grows down toward lower addresses on x86. Because we know that the function in question only declares one local variable, int localVar, we know that this space is created for it. Therefore, at this point we could define the memory location holding localVar’s value as whatever the register esp holds. This method does not work very well, however, because the value of esp will change as more local variables are declared. The correct method is to reference ebp (the base or frame pointer) instead. We can see that this is done, in fact, by looking at the next instruction in the assembly listing from our small program:

subl 指令有效地增加了堆栈的大小 4 bytes–考虑到栈在x86上向下增长。因为我们知道这个函数只声明一个局部变量, int localVar, 我们知道这个空间是为它创建的。因此, 在这一点上, 我们可以定义的内存地址保存 localVar 的价, 无论寄存器 esp 是否保存。但是, 此方法工作得不太好, 因为当声明了更多的局部变量时 esp 的值会发生变化。正确的方法是引用 ebp (基或帧指针) 代替。我们可以看到, 事实上, 这是通过查看从我们的小程序的汇编程序的下一条指令:

movl   $99, -4(%ebp)

 

This instruction is taking care of assigning the value 99 to localVar, or as it’s referred to in assembly, -4 (%ebp) which essentially means “the value stored in ebp offset by -4 bytes.” Note that some assembly outputs, for example objdump -d