STACK OPERATIONS AND

PROCEDURES
Computer Organization and
Assembly Language

Computer Science Department

National University of Computer and Emerging

Sciences Islamabad
STACK OPERATIONS
 Runtime Stack
 PUSH Operation

 POP Operation

 PUSH and POP Instructions

 Using PUSH and POP

 Example: Reversing a String

 Related Instructions

Stack Addressing Computer Organization and Assembly Language – NUCES -slide 2

RUNTIME STACK
 Imagine a stack of plates . . .
 plates are only added to the top
 plates are only removed from the top
 LIFO (Last-In, First-Out) structure
 Push & pop operations

10 top
9
8
7
6
5
4
3
2
1 bottom

Stack Addressing Computer Organization and Assembly Language – NUCES -slide 3

RUNTIME STACK
 Managed by the CPU, using two registers
 SS (stack segment)
 ESP (stack pointer) *
SS
Offset

00001000 00000006
ESP
00000FFC

00000FF8

00000FF4

00000FF0

* SP in Real-address mode
Stack Addressing Computer Organization and Assembly Language – NUCES -slide 4
PUSH OPERATION
 A 32-bit push operation decrements the stack pointer by 4
and copies a value into the location pointed to by the stack
pointer.

BEFORE AFTER

00001000 00000006 ESP 00001000 00000006

00000FFC 00000FFC 000000A5 ESP

00000FF8 00000FF8

00000FF4 00000FF4

00000FF0 00000FF0

PUSH 0A5h
Stack Addressing Computer Organization and Assembly Language – NUCES -slide 5
PUSH OPERATION (CONT.)
 Same stack after pushing two more integers:

Offset
00001000 00000006

00000FFC 000000A5

00000FF8 00000001

00000FF4 00000002 ESP

00000FF0

The stack grows downward. The area below ESP is always available
(unless the stack has overflowed).

Stack Addressing Computer Organization and Assembly Language – NUCES -slide 6

POP OPERATION
 Copies value at stack[ESP] into a register or variable.
 Adds n to ESP, where n is either 2 or 4.
 value of n depends on the attribute of the operand receiving the data

BEFORE AFTER

00001000 00000006 00001000 00000006

00000FFC 000000A5 00000FFC 000000A5

00000FF8 00000001 00000FF8 00000001 ESP

00000FF4 00000002 ESP 00000FF4

00000FF0 00000FF0

Pop EAX
EAX = 00000002
Stack Addressing Computer Organization and Assembly Language – NUCES -slide 7
PUSH AND POP INSTRUCTIONS
 PUSH syntax:
 PUSH r/m16
 PUSH r/m32
 PUSH imm32

 POP syntax:
 POP r/m16
 POP r/m32

Stack Addressing Computer Organization and Assembly Language – NUCES -slide 8

WHEN TO USE STACKS
 To save and restore registers
 To save return address of a procedure

 To pass arguments

 To support local variables

Stack Addressing Computer Organization and Assembly Language – NUCES -slide 9

DEFINING AND USING PROCEDURES
 Creating Procedures
 Example: SumOf Procedure

 CALL and RET Instructions

 Nested Procedure Calls

 Local and Global Labels

 Procedure Parameters

 USES Operator

Stack Addressing Computer Organization and Assembly Language – NUCES -slide 10

CREATING PROCEDURES
 Procedure
 A named block of statements that ends in a return statement
 A procedure is the ASM equivalent of a Java or C++
function
 Following is an assembly language procedure named
sample:

sample PROC
.
.
ret
sample ENDP

Stack Addressing Computer Organization and Assembly Language – NUCES -slide 11

EXAMPLE: SUMOF PROCEDURE
;---------------------------------------------------------
SumOf PROC
;
; Calculates and returns the sum of three 32-bit integers.
; Receives: EAX, EBX, ECX, the three integers. May be
; signed or unsigned.
; Returns: EAX = sum, and the status flags (Carry,
; Overflow, etc.) are changed.
; Requires: nothing
;---------------------------------------------------------
add eax,ebx
add eax,ecx
ret
SumOf ENDP

Stack Addressing Computer Organization and Assembly Language – NUCES -slide 12

CALL AND RET INSTRUCTIONS
 The CALL instruction calls a procedure
 pushes offset of next instruction on the stack
 copies the address of the called procedure into EIP
ESP = ESP - 4 ; push return address
SS:ESP = EIP ; onto the stack
EIP = EIP + relative offset (or displacement)
; update EIP to point to procedure

 The RET instruction returns from a procedure

 pops top of stack into EIP
EIP = SS:ESP ; pop return address
ESP = ESP + 4 ; from the stack

Stack Addressing Computer Organization and Assembly Language – NUCES -slide 13

CALL-RET EXAMPLE
main PROC
00000020 call MySub
0000025 is the offset of 00000025 mov eax,ebx
the instruction .
immediately following .
the CALL instruction main ENDP

MySub PROC
00000040 is the offset 00000040 mov eax,edx
.
of the first instruction
.
inside MySub
ret
MySub ENDP

Stack Addressing Computer Organization and Assembly Language – NUCES -slide 14

CALL-RET EXAMPLE (CONT.)
00000025 ESP 00000040
The CALL
instruction pushes EIP
00000025 onto the
stack, and loads
00000040 into EIP

The RET 00000025 ESP 00000025

instruction pops
00000025 from the EIP
stack into EIP

(stack shown before RET executes)

Stack Addressing Computer Organization and Assembly Language – NUCES -slide 15

NESTED PROCEDURE CALLS
main PROC
.
.
call Sub1
By the time Sub3 is called, the stack contains
exit all three return addresses:
main ENDP

Sub1 PROC
.
.
call Sub2
ret
Sub1 ENDP (ret to main)

Sub2 PROC (ret to Sub1)

.
.
call Sub3
(ret to Sub2) ESP
ret
Sub2 ENDP

Sub3 PROC
.
.
ret
Sub3 ENDP

Stack Addressing Computer Organization and Assembly Language – NUCES -slide 16

LOCAL AND GLOBAL LABELS
A local label is visible only to statements inside the same procedure. A
global label is visible everywhere.

main PROC
jmp L2 ; error
L1:: ; global label
exit
main ENDP

sub2 PROC
L2: ; local label
jmp L1 ; ok
ret
sub2 ENDP

Stack Addressing Computer Organization and Assembly Language – NUCES -slide 17

PARAMETER PASSING MECHANISMS
 Call-by-value
 Receives only values
 Similar to mathematical functions

 Call-by-reference
 Receives pointers
 Directly manipulates parameter storage

Stack Addressing Computer Organization and Assembly Language – NUCES -slide 18

PARAMETER PASSING
 Parameter passing is different and complicated
than in a high-level language
 In assembly language
 You should first place all required parameters in a
mutually accessible storage area
 Then call the procedure
 Types of storage area used
 Registers (general-purpose registers are used)
 Memory (stack is used)
 Two common methods of parameter passing:
 Register method
 Stack method

Stack Addressing Computer Organization and Assembly Language – NUCES -slide 19

PARAMETER PASSING: REGISTER METHOD
The ArraySum procedure calculates the sum of an array. It makes two
references to specific variable names:
Call-by-reference
ArraySum PROC
mov esi,0 ; array index
mov eax,0 ; set the sum to zero
mov ecx,LENGTHOF myarray ; set number of elements

L1: add eax,myArray[esi] ; add each integer to sum

add esi,4 ; point to next integer
loop L1 ; repeat for array size

mov theSum,eax ; store the sum

ret
ArraySum ENDP

What if you wanted to calculate the sum of two or three arrays within
the same program?

Stack Addressing Computer Organization and Assembly Language – NUCES -slide 20

PROCEDURE PARAMETERS (CONT.)
This version of ArraySum returns the sum of any doubleword array whose
address is in ESI. The sum is returned in EAX:

ArraySum PROC
; Receives: ESI points to an array of doublewords,
; ECX = number of array elements.
; Returns: EAX = sum
;-----------------------------------------------------
mov eax,0 ; set the sum to zero

L1: add eax,[esi] ; add each integer to sum

add esi,4 ; point to next integer
loop L1 ; repeat for array size

ret
ArraySum ENDP

Stack Addressing Computer Organization and Assembly Language – NUCES -slide 21

CALLING ARRAYSUM
.data
array DWORD 10000h, 20000h, 30000h,
40000h
theSum DWORD ?
.code
main PROC
mov esi, OFFSET array
mov ecx, LENGTHOF array
call ArraySum
mov theSum, eax

Stack Addressing Computer Organization and Assembly Language – NUCES -slide 22

USES OPERATOR
 Lists the registers that will be preserved

ArraySum PROC USES esi ecx

mov eax,0 ; set the sum to zero
etc.

MASM generates the code shown in blue:

ArraySum PROC
push esi
push ecx
.
.
pop ecx
pop esi
ret
ArraySum ENDP

Stack Addressing Computer Organization and Assembly Language – NUCES -slide 23

WHEN NOT TO PUSH A REGISTER
The sum of the three registers is stored in EAX on line (3), but the POP
instruction replaces it with the starting value of EAX on line (4):
SumOf PROC ; sum of three integers
push eax ; 1
add eax,ebx ; 2
add eax,ecx ; 3
pop eax ; 4
ret
SumOf ENDP

Call-by-value
SumOf PROC ; sum of three integers
add eax,ebx ; 2
add eax,ecx ; 3
ret
SumOf ENDP
Stack Addressing Computer Organization and Assembly Language – NUCES -slide 24
PROS AND CONS OF THE REGISTER METHOD

 Advantages
 Convenient and easier
 Faster

 Disadvantages
 Only a few parameters can be passed using the register
method
 Only a small number of registers are available

 Often these registers are not free

 freeing them by pushing their values onto the stack

negates the second advantage

Stack Addressing Computer Organization and Assembly Language – NUCES -slide 25

PARAMETER PASSING: STACK METHOD
 All parameter values are pushed onto the stack
before calling the procedure
 Example:

push number1
push number2
call sum

Stack Addressing Computer Organization and Assembly Language – NUCES -slide 26

ACCESSING PARAMETERS ON THE STACK
 Parameter values are buried inside the stack
 We can use the following to read number2
mov EBX,[ESP+4]
Problem: The ESP value changes with push and
pop operations
 Relative offset depends on the stack
operations performed
 Is there a better alternative?
 Use EBP to access parameters on the stack

Stack Addressing Computer Organization and Assembly Language – NUCES -slide 27

USING BP REGISTER TO ACCESS PARAMETERS

 Preferred method of accessing parameters on the

stack is
mov EBP,ESP
mov EAX,[EBP+4]
to access number2 in the previous example
 Problem: BP contents are lost!
 We have to preserve the contents of BP
 Use the stack (caution: offset value changes)

push EBP
mov EBP,ESP
Stack Addressing Computer Organization and Assembly Language – NUCES -slide 28
CLEARING THE STACK PARAMETERS

Stack state after Stack state after Stack state after

saving EBP pop EBP executing ret

Stack Addressing Computer Organization and Assembly Language – NUCES -slide 29

CLEARING THE STACK PARAMETERS (CONT.)
 Two ways of clearing the unwanted parameters on the stack:
 Use the optional-integer in the ret instruction
 in the previous example, you can use
ret 4
EIP = SS:ESP
ESP = ESP + 4 + optional-integer
 Add the constant to ESP in calling procedure (C uses this method)
push number1
push number2
call sum
add ESP,4

Stack Addressing Computer Organization and Assembly Language – NUCES -slide 30

HOUSEKEEPING ISSUES
 Who should clean up the stack of unwanted parameters?
 Calling procedure
 Need to update ESP with every procedure call
 Not really needed if procedures use fixed number of
parameters
 C uses this method because C allows variable number

of parameters
 Called procedure
 Code becomes modular (parameter clearing is done in
only one place)
 Cannot be used with variable number of parameters

Stack Addressing Computer Organization and Assembly Language – NUCES -slide 31

 HOUSEKEEPING ISSUES (CONT.)
 Need to preserve the state (contents of the registers) of the
calling procedure across a procedure call.
 Stack is used for this purpose

 Which registers should be saved?

 Save those registers that are used by the calling procedure but
are modified by the called procedure
 Might cause problems as the set of registers used by
the calling and called procedures changes over time
 Save all registers (brute force method) by using pusha
 Increased overhead (pusha takes 5 clocks as
opposed 1 to save a register)

Stack Addressing Computer Organization and Assembly Language – NUCES -slide 32

HOUSEKEEPING ISSUES (CONT.)

Stack state after pusha

Stack Addressing Computer Organization and Assembly Language – NUCES -slide 33

 HOUSEKEEPING ISSUES (CONT.)
 Who should preserve the state of the calling procedure?
 Calling procedure
 Need to know the registers used by the called procedure
 Need to include instructions to save and restore registers

with every procedure call

 Causes program maintenance problems

 Called procedure
 Preferred method as the code becomes modular (state
preservation is done only once and in one place)
 Avoids the program maintenance problems mentioned

Stack Addressing Computer Organization and Assembly Language – NUCES -slide 34

REFERENCE
 Assembly Language for x86 Processors
Sec 5.1,5.2
Chapter#5

Sec 8.1,8.2,8.3 (16/32 Bits only)

Chapter#8

Kip R. Irvine

7th edition

Stack Addressing Computer Organization and Assembly Language – NUCES -slide 35