Functions and stack frame, C/C++ Programming

Each function has its own stack frame between %fp and %sp. Let Caller calls Callee. Then Caller's %sp becomes callee's %fp, and callee's %sp set to be a new value (a smaller one because stack grows from large address to small address). You can think that Callee's stack frame is on top of Caller's stack frame.

In Caller: put arguments in %o0 to %o5 registers or if number of arguments more than 6, prepare values in call linkage of the current stack frame. Then "call" address_of_callee; %o7 stored the returned address. (This %o7 will becomes %i7 in callee after the callee executes save instruction.)

In Callee: it executes "save" instruction:

  • 0. Caller's %i (input registers) and %l (local registers) are reserved in its own stack frame. They are put in the top portion of the caller's stack frame. Implication: the return address of Caller (NOT CALLEE), %i7, is stored there.
  • 1. set callee's %i (input registers) by callers %o (output registers). The implication: pass parameters and return address now is in %i7. And now callee's fp (%i6) <-- caller's sp (%o6).
  • 2. Allocate space for new frame pointers. Caller's sp (%o6) is now set to be the new value.

So at this point in callee, %i6 (%fp was caller's %o6) is set, and %o6 (%sp is set to be a new value). Question: where is the old %fp? It is stored somewhere in the top portion of the previous stack frame (see step 0.) The return address of Callee is stored in %i7. Is it possible to write a program to overflow this %i7? What return address that you really can overflow? Question: how to access that return address.

The "restore" instruction is the inverse function of save. Then the "ret" instruction should branch to %i7+8. The normal address should be %i7+4 as the next instruction address after call. The extra 4 is because sparc has a "branch delay" instruction that is executed BEFORE the call is made even it is put just after CALL. Is it strange. Not really. This is because modern CPU is a pipeline machine. It loads instruction every clock cycle, and branch (or jump or call) somewhat cannot be really done until the later stage the pipeline. And then it is already too late because the one JUST after this branch has already been executed. If you want to know more, you should take a look at computer architecture textbook which I think every graduate should know.

You should be very clear what return address in server.c is overflowed? Is it the return address of main() or the return address of copy()?

Posted Date: 2/19/2013 12:58:03 AM | Location : United States







Related Discussions:- Functions and stack frame, Assignment Help, Ask Question on Functions and stack frame, Get Answer, Expert's Help, Functions and stack frame Discussions

Write discussion on Functions and stack frame
Your posts are moderated
Related Questions
Q: How can one encourage his (older) compiler to check new to see automatically if it returns NULL?       A: His compiler eventually will. If he contain an old compiler wh

Study the given hierarchical class diagram and additional information, and answer the questions that follow: Sale Company: string unitPrice: double

how to fill the blank spaces in the board of 4*4 matrix with the minimum of 4 colors and the condition is the adjacent element should not have the same colour

A: No.       While realloc() need to copy the allocation, this uses a bitwise copy operation, that will tear several C++ objects to shreds. C++ objects must be allowed to copy t

i need to do my home work

In this lab, please complete a given program to perform the following tasks: 1. Allocate a 10 by 5 2D byte array dynamically. The way of allocation must be consistent with page

Define Generic Bitwise Operations? Bitwise operators only work on an incomplete number of types int and char. It turns out there's above one kind of int. In particular there's

There are ''n'' ants on a ''n+1'' length rod. The ants are numbered from 1 to n and are initially placed at positions starting from position 1 till position n. They are moving eith

Question: (a) A bank has four types of accounts with annual interest rates as follows: Savings 8% Savings with Cheque Book 5% Current 4% Fixed deposits 10% Using

C Program to check FACTORIAL   main() {             int i,j,m,fact,sum=0;           clrscr();           printf("ENTER THE NO.: ");           scanf("%d",&m);