What Does Esp Register Mean

x86 Assembly Guide

Contents: Registers | Retentiveness and Addressing | Instructions | Calling Convention

This is a version adjusted by Quentin Carbonneaux from David Evans' original document. The syntax was changed from Intel to AT&T, the standard syntax on UNIX systems, and the HTML code was purified.

This guide describes the basics of 32-flake x86 assembly language programming, covering a small but useful subset of the available instructions and assembler directives. There are several dissimilar assembly languages for generating x86 machine code. The one we volition apply in CS421 is the GNU Assembler (gas) assembler. We will uses the standard AT&T syntax for writing x86 assembly code.

The full x86 instruction gear up is big and complex (Intel'due south x86 instruction set up manuals comprise over 2900 pages), and nosotros practise non comprehend it all in this guide. For instance, there is a 16-bit subset of the x86 instruction gear up. Using the 16-bit programming model tin exist quite complex. It has a segmented memory model, more restrictions on register usage, and so on. In this guide, nosotros will limit our attending to more mod aspects of x86 programming, and delve into the instruction set only in enough detail to become a basic feel for x86 programming.

Registers

Modern (i.e 386 and beyond) x86 processors accept eight 32-bit general purpose registers, as depicted in Figure 1. The register names are mostly historical. For instance, EAX used to be called the accumulator since it was used past a number of arithmetics operations, and ECX was known equally the counter since it was used to hold a loop index. Whereas most of the registers accept lost their special purposes in the modern education set up, by convention, two are reserved for special purposes — the stack pointer (ESP) and the base of operations pointer (EBP).

For the EAX, EBX, ECX, and EDX registers, subsections may be used. For case, the least significant ii bytes of EAX can be treated as a xvi-bit register called AX. The least significant byte of AX can be used equally a single eight-chip register chosen AL, while the most significant byte of AX can be used equally a single eight-chip register called AH. These names refer to the same concrete register. When a two-byte quantity is placed into DX, the update affects the value of DH, DL, and EDX. These sub-registers are mainly concur-overs from older, 16-bit versions of the teaching set. Notwithstanding, they are sometimes user-friendly when dealing with data that are smaller than 32-bits (e.g. ane-byte ASCII characters).

Effigy 1. x86 Registers

Memory and Addressing Modes

Declaring Static Information Regions

You tin can declare static data regions (analogous to global variables) in x86 assembly using special assembler directives for this purpose. Data declarations should be preceded past the .data directive. Following this directive, the directives .byte, .short, and .long can be used to declare ane, two, and four byte data locations, respectively. To refer to the accost of the data created, nosotros can label them. Labels are very useful and versatile in assembly, they give names to memory locations that will exist figured out later by the assembler or the linker. This is like to declaring variables by proper name, simply abides by some lower level rules. For example, locations alleged in sequence will exist located in memory side by side to one some other.

Example declarations:

.information

var:

.byte 64 /* Declare a byte, referred to as location var, containing the value 64. */

.byte ten /* Declare a byte with no label, containing the value ten. Its location is var + one. */

x:

.short 42 /* Declare a 2-byte value initialized to 42, referred to as location ten. */

y:

.long 30000 /* Declare a 4-byte value, referred to as location y, initialized to 30000. */

Unlike in high level languages where arrays tin can have many dimensions and are accessed by indices, arrays in x86 assembly language are simply a number of cells located contiguously in retentiveness. An array can exist declared by simply listing the values, as in the first example below. For the special case of an array of bytes, string literals can be used. In example a large area of memory is filled with zeroes the .zippo directive tin can exist used.

Some examples:

s:

.long 1, 2, 3 /* Declare 3 4-byte values, initialized to i, 2, and 3.
The value at location due south + eight will be 3. */

barr:

.cypher 10 /* Declare 10 bytes starting at location barr, initialized to 0. */

str:

.string "hello" /* Declare 6 bytes starting at the address str initialized to
the ASCII character values for hello followed by a nul (0) byte. */

Addressing Retentiveness

Modern x86-compatible processors are capable of addressing up to 2³² bytes of memory: retentivity addresses are 32-bits wide. In the examples higher up, where we used labels to refer to memory regions, these labels are actually replaced by the assembler with 32-bit quantities that specify addresses in retention. In addition to supporting referring to memory regions by labels (i.eastward. constant values), the x86 provides a flexible scheme for computing and referring to memory addresses: up to two of the 32-bit registers and a 32-chip signed constant can exist added together to compute a memory address. One of the registers can be optionally pre-multiplied by 2, 4, or 8.

The addressing modes can be used with many x86 instructions (we'll describe them in the adjacent section). Here we illustrate some examples using the mov instruction that moves information between registers and retention. This education has ii operands: the first is the source and the second specifies the destination.

Some examples of mov instructions using address computations are:

mov (%ebx), %eax /* Load iv bytes from the memory address in EBX into EAX. */

mov %ebx, var(,1) /* Motion the contents of EBX into the four bytes at retention address var.
(Annotation, var is a 32-bit abiding). */

mov -4(%esi), %eax /* Movement iv bytes at retentiveness address ESI + (-4) into EAX. */

mov %cl, (%esi,%eax,1) /* Move the contents of CL into the byte at address ESI+EAX. */

mov (%esi,%ebx,4), %edx /* Move the 4 bytes of data at address ESI+four*EBX into EDX. */

Some examples of invalid address calculations include:

mov (%ebx,%ecx,-ane), %eax /* Tin can only add register values. */

mov %ebx, (%eax,%esi,%edi,i) /* At most 2 registers in accost computation. */

Functioning Suffixes

In general, the intended size of the of the data detail at a given memory address can be inferred from the assembly code education in which it is referenced. For example, in all of the above instructions, the size of the retention regions could be inferred from the size of the register operand. When we were loading a 32-chip register, the assembler could infer that the region of memory we were referring to was 4 bytes wide. When nosotros were storing the value of a i byte annals to retentivity, the assembler could infer that we wanted the address to refer to a single byte in memory.

Notwithstanding, in some cases the size of a referred-to retention region is ambiguous. Consider the pedagogy mov $ii, (%ebx). Should this instruction move the value two into the unmarried byte at address EBX? Perchance it should move the 32-bit integer representation of 2 into the 4-bytes starting at address EBX. Since either is a valid possible estimation, the assembler must be explicitly directed equally to which is correct. The size prefixes b, w, and 50 serve this purpose, indicating sizes of i, 2, and 4 bytes respectively.

For example:

movb $ii, (%ebx) /* Move 2 into the single byte at the address stored in EBX. */

movw $ii, (%ebx) /* Move the xvi-bit integer representation of two into the 2 bytes starting at the address in EBX. */

movl $2, (%ebx) /* Motility the 32-scrap integer representation of 2 into the iv bytes starting at the address in EBX. */

Instructions

Automobile instructions mostly autumn into three categories: data movement, arithmetic/logic, and control-menstruum. In this section, we will look at important examples of x86 instructions from each category. This department should non be considered an exhaustive listing of x86 instructions, but rather a useful subset. For a complete listing, see Intel's didactics set up reference.

Nosotros use the post-obit notation:

<reg32> Any 32-bit register (%eax, %ebx, %ecx, %edx, %esi, %edi, %esp, or %ebp)

<reg16> Any 16-bit register (%ax, %bx, %cx, or %dx)

<reg8> Whatsoever 8-flake register (%ah, %bh, %ch, %dh, %al, %bl, %cl, or %dl)

<reg> Any annals

<mem> A memory address (e.one thousand., (%eax), 4+var(,1), or (%eax,%ebx,1))

<con32> Whatever 32-bit firsthand

<con16> Any 16-bit immediate

<con8> Whatever 8-scrap immediate

<con> Any 8-, xvi-, or 32-flake immediate

In assembly language, all the labels and numeric constants used as immediate operands (i.e. not in an address calculation like 3(%eax,%ebx,8)) are always prefixed past a dollar sign. When needed, hexadecimal notation can be used with the 0x prefix (e.m. $0xABC). Without the prefix, numbers are interpreted in the decimal footing.

Information Motion Instructions

mov — Motility

The mov instruction copies the data item referred to by its first operand (i.due east. annals contents, memory contents, or a abiding value) into the location referred to past its second operand (i.e. a annals or retention). While register-to-register moves are possible, direct retentiveness-to-retention moves are not. In cases where memory transfers are desired, the source retentivity contents must first exist loaded into a register, then can be stored to the destination memory address.
Syntax
mov <reg>, <reg>
mov <reg>, <mem>
mov <mem>, <reg>
mov <con>, <reg>
mov <con>, <mem>

Examples
mov %ebx, %eax — copy the value in EBX into EAX
movb $5, var(,1) — store the value 5 into the byte at location var

push — Push button on stack

The button didactics places its operand onto the top of the hardware supported stack in memory. Specifically, button outset decrements ESP by 4, and so places its operand into the contents of the 32-chip location at address (%esp). ESP (the stack pointer) is decremented by push since the x86 stack grows downwardly — i.e. the stack grows from loftier addresses to lower addresses.
Syntax
push <reg32>
push <mem>
button <con32>

Examples
push %eax — button eax on the stack
push var(,ane) — push the iv bytes at address var onto the stack

popular — Popular from stack

The pop teaching removes the four-byte data element from the top of the hardware-supported stack into the specified operand (i.eastward. annals or retention location). It first moves the four bytes located at memory location (%esp) into the specified annals or memory location, and then increments ESP past iv.
Syntax
pop <reg32>
pop <mem>
Examples
pop %edi — popular the height chemical element of the stack into EDI.
pop (%ebx) — pop the top element of the stack into memory at the four bytes starting at location EBX.

lea — Load effective accost

The lea education places the address specified by its first operand into the register specified past its 2d operand. Annotation, the contents of the memory location are not loaded, only the effective address is computed and placed into the register. This is useful for obtaining a arrow into a retentivity region or to perform uncomplicated arithmetics operations.
Syntax
lea <mem>, <reg32>

Examples
lea (%ebx,%esi,viii), %edi — the quantity EBX+8*ESI is placed in EDI.
lea val(,ane), %eax — the value val is placed in EAX.

Arithmetic and Logic Instructions

add — Integer addition

The add instruction adds together its two operands, storing the result in its second operand. Note, whereas both operands may be registers, at about one operand may be a retention location.
Syntax
add <reg>, <reg>
add <mem>, <reg>
add together <reg>, <mem>
add <con>, <reg>
add together <con>, <mem>

Examples
add together $10, %eax — EAX is set to EAX + 10
addb $ten, (%eax) — add 10 to the single byte stored at memory accost stored in EAX

sub — Integer subtraction

The sub instruction stores in the value of its second operand the upshot of subtracting the value of its starting time operand from the value of its second operand. As with add, whereas both operands may be registers, at most one operand may be a retention location.
Syntax
sub <reg>, <reg>
sub <mem>, <reg>
sub <reg>, <mem>
sub <con>, <reg>
sub <con>, <mem>

Examples
sub %ah, %al — AL is set to AL - AH
sub $216, %eax — subtract 216 from the value stored in EAX

inc, dec — Increment, Decrement

The inc education increments the contents of its operand by ane. The dec teaching decrements the contents of its operand past one.
Syntax
inc <reg>
inc <mem>
dec <reg>
dec <mem>

Examples
december %eax — subtract one from the contents of EAX
incl var(,1) — add together ane to the 32-bit integer stored at location var

imul — Integer multiplication

The imul instruction has two basic formats: two-operand (get-go ii syntax listings in a higher place) and iii-operand (last ii syntax listings higher up).
The ii-operand form multiplies its two operands together and stores the effect in the 2d operand. The result (i.e. second) operand must be a register.

The three operand grade multiplies its 2nd and third operands together and stores the consequence in its final operand. Over again, the upshot operand must exist a register. Furthermore, the commencement operand is restricted to existence a constant value.

Syntax
imul <reg32>, <reg32>
imul <mem>, <reg32>
imul <con>, <reg32>, <reg32>
imul <con>, <mem>, <reg32>

Examples

imul (%ebx), %eax — multiply the contents of EAX past the 32-bit contents of the memory at location EBX. Shop the issue in EAX.

imul $25, %edi, %esi — ESI is prepare to EDI * 25

idiv — Integer division

The idiv instruction divides the contents of the 64 bit integer EDX:EAX (constructed by viewing EDX as the virtually pregnant iv bytes and EAX as the least meaning four bytes) by the specified operand value. The caliber outcome of the division is stored into EAX, while the residual is placed in EDX.
Syntax
idiv <reg32>
idiv <mem>

Examples

idiv %ebx — divide the contents of EDX:EAX by the contents of EBX. Place the quotient in EAX and the remainder in EDX.

idivw (%ebx) — divide the contents of EDX:EAS past the 32-scrap value stored at the memory location in EBX. Place the quotient in EAX and the rest in EDX.

and, or, xor — Bitwise logical and, or, and exclusive or

These instructions perform the specified logical operation (logical bitwise and, or, and exclusive or, respectively) on their operands, placing the effect in the outset operand location.
Syntax
and <reg>, <reg>
and <mem>, <reg>
and <reg>, <mem>
and <con>, <reg>
and <con>, <mem>

or <reg>, <reg>
or <mem>, <reg>
or <reg>, <mem>
or <con>, <reg>
or <con>, <mem>

xor <reg>, <reg>
xor <mem>, <reg>
xor <reg>, <mem>
xor <con>, <reg>
xor <con>, <mem>

Examples
and $0x0f, %eax — articulate all merely the final 4 $.25 of EAX.
xor %edx, %edx — set the contents of EDX to zero.

not — Bitwise logical non

Logically negates the operand contents (that is, flips all scrap values in the operand).
Syntax
non <reg>
not <mem>

Example
not %eax — flip all the bits of EAX

neg — Negate

Performs the two's complement negation of the operand contents.
Syntax
neg <reg>
neg <mem>

Case
neg %eax — EAX is set up to (- EAX)

shl, shr — Shift left and right

These instructions shift the $.25 in their first operand'due south contents left and right, padding the resulting empty bit positions with zeros. The shifted operand tin exist shifted upwardly to 31 places. The number of bits to shift is specified past the second operand, which can be either an eight-bit constant or the register CL. In either case, shifts counts of greater so 31 are performed modulo 32.
Syntax
shl <con8>, <reg>
shl <con8>, <mem>
shl %cl, <reg>
shl %cl, <mem>

shr <con8>, <reg>
shr <con8>, <mem>
shr %cl, <reg>
shr %cl, <mem>

Examples

shl $1, eax — Multiply the value of EAX past ii (if the most pregnant bit is 0)

shr %cl, %ebx — Shop in EBX the floor of issue of dividing the value of EBX by 2ⁿ where northward is the value in CL. Caution: for negative integers, it is different from the C semantics of division!

Command Catamenia Instructions

The x86 processor maintains an instruction pointer (EIP) register that is a 32-bit value indicating the location in memory where the current instruction starts. Usually, it increments to point to the adjacent instruction in memory begins after execution an instruction. The EIP register cannot be manipulated directly, but is updated implicitly by provided control menstruum instructions.

We use the notation <label> to refer to labeled locations in the program text. Labels can be inserted anywhere in x86 associates code text by entering a characterization name followed by a colon. For example,

            mov 8(%ebp), %esi begin:        xor %ecx, %ecx        mov (%esi), %eax

The 2nd teaching in this code fragment is labeled begin. Elsewhere in the code, nosotros can refer to the retention location that this pedagogy is located at in memory using the more convenient symbolic name begin. This label is just a convenient mode of expressing the location instead of its 32-chip value.

jmp — Bound

Transfers program control flow to the instruction at the retention location indicated past the operand.
Syntax
jmp <label>

Example
jmp brainstorm — Bound to the didactics labeled begin.

jstatus — Conditional leap

These instructions are conditional jumps that are based on the status of a prepare of condition codes that are stored in a special register chosen the auto status discussion. The contents of the machine status word include information about the concluding arithmetics functioning performed. For example, one bit of this word indicates if the concluding outcome was aught. Some other indicates if the last outcome was negative. Based on these condition codes, a number of conditional jumps tin exist performed. For example, the jz instruction performs a spring to the specified operand label if the effect of the last arithmetic operation was zero. Otherwise, control gain to the next education in sequence.
A number of the conditional branches are given names that are intuitively based on the last operation performed being a special compare instruction, cmp (meet beneath). For example, conditional branches such every bit jle and jne are based on first performing a cmp performance on the desired operands.

Syntax
je <label> (leap when equal)
jne <characterization> (bound when non equal)
jz <label> (jump when terminal result was zero)
jg <label> (spring when greater than)
jge <characterization> (jump when greater than or equal to)
jl <label> (leap when less than)
jle <label> (jump when less than or equal to)

Example
cmp %ebx, %eax jle done          
If the contents of EAX are less than or equal to the contents of EBX, jump to the characterization done. Otherwise, go along to the next instruction.

cmp — Compare

Compare the values of the 2 specified operands, setting the condition codes in the machine status give-and-take appropriately. This instruction is equivalent to the sub instruction, except the result of the subtraction is discarded instead of replacing the first operand.
Syntax
cmp <reg>, <reg>
cmp <mem>, <reg>
cmp <reg>, <mem>
cmp <con>, <reg>

Case
cmpb $ten, (%ebx)
jeq loop

If the byte stored at the retentivity location in EBX is equal to the integer constant 10, jump to the location labeled loop.

call, ret — Subroutine call and render

These instructions implement a subroutine call and render. The call didactics first pushes the current code location onto the hardware supported stack in memory (see the push button instruction for details), and then performs an unconditional jump to the code location indicated past the label operand. Unlike the simple bound instructions, the call instruction saves the location to return to when the subroutine completes.
The ret instruction implements a subroutine return mechanism. This educational activity showtime pops a code location off the hardware supported in-retentivity stack (run into the pop instruction for details). It so performs an unconditional jump to the retrieved code location.

Syntax
telephone call <label>
ret

Calling Convention

To allow split programmers to share code and develop libraries for use by many programs, and to simplify the apply of subroutines in general, programmers typically adopt a common calling convention. The calling convention is a protocol about how to call and return from routines. For example, given a set of calling convention rules, a developer need non examine the definition of a subroutine to determine how parameters should be passed to that subroutine. Furthermore, given a set of calling convention rules, high-level language compilers can exist made to follow the rules, thus allowing paw-coded associates language routines and loftier-level language routines to call one some other.

In practise, many calling conventions are possible. We will describe the widely used C language calling convention. Following this convention will allow you to write assembly language subroutines that are safely callable from C (and C++) code, and volition also enable you lot to telephone call C library functions from your assembly linguistic communication lawmaking.

The C calling convention is based heavily on the use of the hardware-supported stack. It is based on the button, pop, call, and ret instructions. Subroutine parameters are passed on the stack. Registers are saved on the stack, and local variables used by subroutines are placed in memory on the stack. The vast bulk of loftier-level procedural languages implemented on most processors accept used like calling conventions.

The calling convention is broken into two sets of rules. The first prepare of rules is employed by the caller of the subroutine, and the second ready of rules is observed by the author of the subroutine (the callee). Information technology should exist emphasized that mistakes in the observance of these rules apace consequence in fatal program errors since the stack will be left in an inconsistent land; thus meticulous care should be used when implementing the call convention in your own subroutines.

Stack during Subroutine Call

[Thanks to James Peterson for finding and fixing the issues in the original version of this figure!]

A good way to visualize the operation of the calling convention is to draw the contents of the nearby region of the stack during subroutine execution. The epitome above depicts the contents of the stack during the execution of a subroutine with iii parameters and three local variables. The cells depicted in the stack are 32-flake wide memory locations, thus the retention addresses of the cells are four bytes apart. The first parameter resides at an offset of 8 bytes from the base arrow. Higher up the parameters on the stack (and below the base of operations arrow), the telephone call instruction placed the return address, thus leading to an extra 4 bytes of offset from the base pointer to the kickoff parameter. When the ret instruction is used to return from the subroutine, information technology volition jump to the render address stored on the stack.

Caller Rules

To make a subrouting call, the caller should:

Earlier calling a subroutine, the caller should salvage the contents of certain registers that are designated caller-saved. The caller-saved registers are EAX, ECX, EDX. Since the chosen subroutine is immune to change these registers, if the caller relies on their values afterwards the subroutine returns, the caller must push the values in these registers onto the stack (so they tin be restore after the subroutine returns.
To pass parameters to the subroutine, push them onto the stack before the phone call. The parameters should be pushed in inverted social club (i.eastward. terminal parameter get-go). Since the stack grows down, the first parameter will exist stored at the lowest address (this inversion of parameters was historically used to allow functions to exist passed a variable number of parameters).
To call the subroutine, utilize the telephone call instruction. This instruction places the return address on summit of the parameters on the stack, and branches to the subroutine lawmaking. This invokes the subroutine, which should follow the callee rules beneath.

Afterward the subroutine returns (immediately following the call instruction), the caller can look to find the return value of the subroutine in the annals EAX. To restore the machine land, the caller should:

Remove the parameters from stack. This restores the stack to its state before the call was performed.
Restore the contents of caller-saved registers (EAX, ECX, EDX) past popping them off of the stack. The caller can assume that no other registers were modified by the subroutine.

Instance

The code below shows a role call that follows the caller rules. The caller is calling a office myFunc that takes 3 integer parameters. Showtime parameter is in EAX, the second parameter is the constant 216; the tertiary parameter is in the memory location stored in EBX.

push (%ebx)    /* Push last parameter get-go */ push $216      /* Push the 2d parameter */ push button %eax      /* Push beginning parameter last */  phone call myFunc    /* Telephone call the function (assume C naming) */  add $12, %esp

Note that later the call returns, the caller cleans up the stack using the add together instruction. We have 12 bytes (3 parameters * 4 bytes each) on the stack, and the stack grows downwardly. Thus, to get rid of the parameters, we can merely add 12 to the stack pointer.

The result produced by myFunc is now available for use in the register EAX. The values of the caller-saved registers (ECX and EDX), may accept been inverse. If the caller uses them after the telephone call, it would accept needed to salvage them on the stack before the telephone call and restore them after it.

Callee Rules

The definition of the subroutine should adhere to the following rules at the beginning of the subroutine:

Push the value of EBP onto the stack, and then copy the value of ESP into EBP using the following instructions:
```
              push %ebp     mov  %esp, %ebp            
```
This initial action maintains the base of operations arrow, EBP. The base arrow is used past convention as a indicate of reference for finding parameters and local variables on the stack. When a subroutine is executing, the base pointer holds a copy of the stack pointer value from when the subroutine started executing. Parameters and local variables volition always exist located at known, constant offsets away from the base pointer value. Nosotros push the old base pointer value at the first of the subroutine so that nosotros can afterwards restore the appropriate base arrow value for the caller when the subroutine returns. Remember, the caller is not expecting the subroutine to modify the value of the base of operations pointer. We then move the stack arrow into EBP to obtain our point of reference for accessing parameters and local variables.
Next, classify local variables by making space on the stack. Retrieve, the stack grows down, so to make infinite on the top of the stack, the stack pointer should be decremented. The amount by which the stack pointer is decremented depends on the number and size of local variables needed. For example, if 3 local integers (4 bytes each) were required, the stack pointer would demand to be decremented by 12 to brand space for these local variables (i.e., sub $12, %esp). As with parameters, local variables will be located at known offsets from the base pointer.
Adjacent, save the values of the callee-saved registers that volition be used by the office. To relieve registers, push them onto the stack. The callee-saved registers are EBX, EDI, and ESI (ESP and EBP will also be preserved by the calling convention, but need not be pushed on the stack during this step).

After these three deportment are performed, the body of the subroutine may go along. When the subroutine is returns, it must follow these steps:

Leave the return value in EAX.
Restore the old values of any callee-saved registers (EDI and ESI) that were modified. The annals contents are restored by popping them from the stack. The registers should exist popped in the inverse gild that they were pushed.
Deallocate local variables. The obvious way to do this might be to add the appropriate value to the stack pointer (since the infinite was allocated past subtracting the needed amount from the stack pointer). In practice, a less error-prone manner to deallocate the variables is to move the value in the base pointer into the stack pointer: mov %ebp, %esp. This works because the base pointer always contains the value that the stack pointer contained immediately prior to the resource allotment of the local variables.
Immediately before returning, restore the caller's base pointer value by popping EBP off the stack. Recall that the outset matter we did on entry to the subroutine was to push button the base of operations pointer to save its sometime value.
Finally, return to the caller past executing a ret teaching. This didactics will detect and remove the appropriate return address from the stack.

Note that the callee's rules fall cleanly into ii halves that are basically mirror images of one some other. The first half of the rules apply to the offset of the function, and are commonly said to define the prologue to the role. The latter one-half of the rules apply to the terminate of the part, and are thus normally said to ascertain the epilogue of the function.

Instance

Here is an case function definition that follows the callee rules:

            /* Start the code section */   .text    /* Define myFunc as a global (exported) function. */   .globl myFunc   .type myFunc, @function myFunc:    /* Subroutine Prologue */   push button %ebp      /* Relieve the old base arrow value. */   mov %esp, %ebp /* Ready the new base of operations arrow value. */   sub $four, %esp   /* Make room for i iv-byte local variable. */   push %edi      /* Salve the values of registers that the function */   push %esi      /* will alter. This function uses EDI and ESI. */   /* (no need to relieve EBX, EBP, or ESP) */    /* Subroutine Body */   mov 8(%ebp), %eax   /* Move value of parameter i into EAX. */   mov 12(%ebp), %esi  /* Move value of parameter 2 into ESI. */   mov 16(%ebp), %edi  /* Move value of parameter 3 into EDI. */    mov %edi, -4(%ebp)  /* Move EDI into the local variable. */   add %esi, -four(%ebp)  /* Add ESI into the local variable. */   add -four(%ebp), %eax  /* Add the contents of the local variable */                       /* into EAX (final result). */    /* Subroutine Epilogue */   popular %esi       /* Recover register values. */   pop %edi   mov %ebp, %esp /* Deallocate the local variable. */   pop %ebp       /* Restore the caller's base of operations arrow value. */   ret

The subroutine prologue performs the standard actions of saving a snapshot of the stack pointer in EBP (the base pointer), allocating local variables by decrementing the stack pointer, and saving annals values on the stack.

In the body of the subroutine we can come across the use of the base pointer. Both parameters and local variables are located at constant offsets from the base pointer for the duration of the subroutines execution. In particular, we notice that since parameters were placed onto the stack before the subroutine was called, they are always located below the base pointer (i.eastward. at higher addresses) on the stack. The get-go parameter to the subroutine tin can ever be found at retentiveness location (EBP+8), the second at (EBP+12), the 3rd at (EBP+16). Similarly, since local variables are allocated afterwards the base pointer is ready, they ever reside above the base pointer (i.due east. at lower addresses) on the stack. In item, the kickoff local variable is always located at (EBP-4), the second at (EBP-viii), and then on. This conventional use of the base pointer allows us to quickly identify the apply of local variables and parameters within a function body.

The function epilogue is basically a mirror image of the function prologue. The caller's register values are recovered from the stack, the local variables are deallocated by resetting the stack arrow, the caller's base arrow value is recovered, and the ret pedagogy is used to render to the appropriate code location in the caller.

Credits: This guide was originally created by Adam Ferrari many years ago,
and since updated by Alan Batson, Mike Lack, and Anita Jones.
It was revised for 216 Jump 2006 by David Evans.
It was finally modified by Quentin Carbonneaux to use the AT&T syntax for Yale'due south CS421.