Calling convention

caller_func:
    ...
    pushl arguments
    call callee_func
    popl arguments
    ...

callee_func:
    pushl %ebp
    subl xx, %esp
    ...
    leave
    ret

Before function call.

Content	Base address
previous frames...
other arguments... argument 2 argument 1 argument 0	← %ebp + 8
saved %eip	← %ebp + 4
saved %ebp	← %ebp
local variable 0 local variable 1 other local variables... local variable n	← %esp

Simplified version:

Content	Base address
arguments	← %ebp + 8
saved %eip	← %ebp + 4
saved %ebp	← %ebp
local variables...	← %esp

Caller pushes arguments.

Content	Base address
arguments	← %ebp + 8
saved %eip	← %ebp + 4
saved %ebp	← %ebp
local variables...	(%esp previously pointed here)
argument n ... argument 0	← %esp

Caller uses call inst.

Content	Base address
arguments	← %ebp + 8
saved %eip	← %ebp + 4
saved %ebp	← %ebp
local variables...
argument n ... argument 0	← %esp + 4 (%esp previously pointed here)
saved %eip	← %esp

Callee saves %ebp.

Content	Base address
arguments	← %ebp + 8
saved %eip	← %ebp + 4
saved %ebp	← %ebp
local variables...
argument n ... argument 0	← %esp + 8
saved %eip	← %esp + 4 (%esp previously pointed here)
saved %ebp	← %esp

Callee updates %ebp.

Content	Base address
arguments
saved %eip
saved %ebp	(%ebp previously pointed here)
local variables...
argument n ... argument 0	← %ebp + 8
saved %eip	← %ebp + 4
saved %ebp	← %esp, %ebp

Callee allocates memory for locals.

Content	Base address
arguments
saved %eip
saved %ebp
local variables...
argument n ... argument 0	← %ebp + 8
saved %eip	← %ebp + 4
saved %ebp	← %ebp (%esp previously pointed here)
local variables...	← %esp

Callee finishes execution, uses leave.

leave is the same as:

movl %ebp, %esp
popl %ebp

Content	Base address
arguments	← %ebp + 8
saved %eip	← %ebp + 4
saved %ebp	← %ebp
local variables...
argument n ... argument 0	← %esp + 4
saved %eip	← %esp (%ebp previously pointed here)
(Junk)	(%esp previously pointed here)

Callee uses ret.

Content	Base address
arguments	← %ebp + 8
saved %eip	← %ebp + 4
saved %ebp	← %ebp
local variables...
argument n ... argument 0	← %esp
(Junk)	(%esp previously pointed here)

Caller cleans up arguments.

Content	Base address
arguments	← %ebp + 8
saved %eip	← %ebp + 4
saved %ebp	← %ebp
local variables...	← %esp
(Junk)	(%esp previously pointed here)