操作系统版本
Linux e982ba054bfa 4.9.125-linuxkit x86_64 x86_64 x86_64 GNU/Linux
gcc version 6.4.0 运行与mac下的docker
执行代码//递归函数调用实现斐波那契
int fib(int n)
{
if (n <= 2)
{
return 1;
}
else
{
return fib(n - 1) + fib(n - 2);
}
}
int main()
{
fib(4);
return 0;
}
编译gcc fib.c -g -o fib //-g选项使目标文件fib包含程序的调试信息
开始gdb fib
(gdb) start //拉起被调试程序,并执行至main函数的开始位置
Temporary breakpoint 1 at 0x40050f: file fib.c, line 14.
Starting program: /home/work/fib
Temporary breakpoint 1, main () at fib.c:14
14 fib(4);
查看当前栈层信息及rbp,rsp的值(gdb) info f //打印出当前栈层的信息
Stack level 0, frame at 0x7fffffffe6e0:
rip = 0x40050f in main (fib.c:14); saved rip = 0x7ffff7a303d5
source language c.
Arglist at 0x7fffffffe6d0, args:
Locals at 0x7fffffffe6d0, Previous frame's sp is 0x7fffffffe6e0
Saved registers:
rbp at 0x7fffffffe6d0, rip at 0x7fffffffe6d8
(gdb) info registers rbp rsp //当前rbp rsp的值
rbp 0x7fffffffe6d0 0x7fffffffe6d0
rsp 0x7fffffffe6d0 0x7fffffffe6d0
查看当前函数的汇编信息,可以看到当前汇编指令执行到0x000000000040050f(貌似我的跟别人的好像不一样,具体可以以自己的为准),我这里已经执行完main的frame初始化了Dump of assembler code for function main:
13 {
0x000000000040050b : 55 push %rbp //将rbp寄存器的值压栈
0x000000000040050c : 48 89 e5 mov %rsp,%rbp //将rsp寄存器的值赋给rbp寄存器,初始化当前函数的栈底
14 fib(4);
=> 0x000000000040050f : bf 04 00 00 00 mov $0x4,%edi
0x0000000000400514 : e8 b4 ff ff ff callq 0x4004cd
15 return 0;
0x0000000000400519 : b8 00 00 00 00 mov $0x0,%eax
16 }
0x000000000040051e : 5d pop %rbp
0x000000000040051f : c3 retq
End of assembler dump.
在上面的代码可以看到接下来将要执行的两步分别是0x000000000040050f 把4付给edi寄存器
0x0000000000400514 fib函数调用
好了执行一下(gdb) si 2 //si是汇编级别的执行下一条,si 2 执行2条到fib中
查看一下当前寄存器及内存信息(gdb) info registers rbp rsp edi
rbp 0x7fffffffe6d0 0x7fffffffe6d0
rsp 0x7fffffffe6c8 0x7fffffffe6c8
edi 0x4 4
(gdb) x/20x 0x7fffffffe6a0 //从0x7fffffffe6a0开始以16进制打印20条信息
0x7fffffffe6a0: 0x00000000 0x00000000 0x00000000 0x00000000
0x7fffffffe6b0: 0x00400520 0x00000000 0x004003e0 0x00000000
0x7fffffffe6c0: 0xffffe7b0 0x00007fff 0x00400519 0x00000000
0x7fffffffe6d0: 0x00000000 0x00000000 0xf7a303d5 0x00007fff
0x7fffffffe6e0: 0x00000000 0x00000000 0xffffe7b8 0x00007fff
可以看到现在寄存器edi的值是4,rsp的值是0x7fffffffe6c8,怎么变了呢?仔细看下面的内存信息在0x7fffffffe6c8到0x7fffffffe6d0之前压入了一个地址0x00400519往上翻翻是不是fib函数下一条要执行的汇编指令的地址呢。而rsp代表的是栈顶的地址,也就跟着扩容到了0x7fffffffe6c。接下来打印一下当前汇编指令,应该已经跳到fib函数内部了(gdb) disassemble /rm
Dump of assembler code for function fib:
2 {
=> 0x00000000004004cd : 55 push %rbp
0x00000000004004ce : 48 89 e5 mov %rsp,%rbp
0x00000000004004d1 : 53 push %rbx
0x00000000004004d2 : 48 83 ec 18 sub $0x18,%rsp
0x00000000004004d6 : 89 7d ec mov %edi,-0x14(%rbp)
3 if (n <= 2)
0x00000000004004d9 : 83 7d ec 02 cmpl $0x2,-0x14(%rbp)
0x00000000004004dd : 7f 07 jg 0x4004e6
4 {
5 return 1;
0x00000000004004df : b8 01 00 00 00 mov $0x1,%eax
0x00000000004004e4 : eb 1e jmp 0x400504
6 }
7 else
8 {
9 return fib(n - 1) + fib(n - 2);
0x00000000004004e6 : 8b 45 ec mov -0x14(%rbp),%eax
0x00000000004004e9 : 83 e8 01 sub $0x1,%eax
0x00000000004004ec : 89 c7 mov %eax,%edi
0x00000000004004ee : e8 da ff ff ff callq 0x4004cd
0x00000000004004f3 : 89 c3 mov %eax,%ebx
0x00000000004004f5 : 8b 45 ec mov -0x14(%rbp),%eax
0x00000000004004f8 : 83 e8 02 sub $0x2,%eax
0x00000000004004fb : 89 c7 mov %eax,%edi
0x00000000004004fd : e8 cb ff ff ff callq 0x4004cd
0x0000000000400502 : 01 d8 add %ebx,%eax
10 }
11 }
0x0000000000400504 : 48 83 c4 18 add $0x18,%rsp
0x0000000000400508 : 5b pop %rbx
0x0000000000400509 : 5d pop %rbp
0x000000000040050a : c3 retq
End of assembler dump.
接下来先进行fib的frame初始化,然后看一下当前寄存器的情况和内存信息(gdb) si 2
(gdb) info registers rbp rsp edi
rbp 0x7fffffffe6c0 0x7fffffffe6c0
rsp 0x7fffffffe6c0 0x7fffffffe6c0
edi 0x4 4
(gdb) x/20x 0x7fffffffe6a0
0x7fffffffe6a0: 0x00000000 0x00000000 0x00000000 0x00000000
0x7fffffffe6b0: 0x00400520 0x00000000 0x004003e0 0x00000000
0x7fffffffe6c0: 0xffffe6d0 0x00007fff 0x00400519 0x00000000
0x7fffffffe6d0: 0x00000000 0x00000000 0xf7a303d5 0x00007fff
0x7fffffffe6e0: 0x00000000 0x00000000 0xffffe7b8 0x00007fff
可以看到edi的值没有变化,rbp和rsp的值都变成了0x7fffffffe6c0,仔细看下面的内存信息在0x7fffffffe6c0到0x7fffffffe6c8的位置压入了main的rbp的值0xffffe6d0,rsp跟着扩容,接下来把rsp的值赋给rbp。fib的frame初始化完成。
接下来在往下走三步push %rbx //讲rbx寄存器的值压栈,rsp-8
sub $0x18,%rsp //rsp-0x18(24)
mov %edi,-0x14(%rbp) //把edi寄存器的值(4)放到距rbp寄存器存放的地址偏移-0x14(20)位的地方
打印一下寄存器和内存信息(gdb) si 3
(gdb) info registers rbp rsp edi rbx
rbp 0x7fffffffe6c0 0x7fffffffe6c0
rsp 0x7fffffffe6a0 0x7fffffffe6a0
edi 0x4 4
rbx 0x0 0
(gdb) x/20x 0x7fffffffe6a0
0x7fffffffe6a0: 0x00000000 0x00000000 0x00000000 0x00000004
0x7fffffffe6b0: 0x00400520 0x00000000 0x00000000 0x00000000
0x7fffffffe6c0: 0xffffe6d0 0x00007fff 0x00400519 0x00000000
0x7fffffffe6d0: 0x00000000 0x00000000 0xf7a303d5 0x00007fff
0x7fffffffe6e0: 0x00000000 0x00000000 0xffffe7b8 0x00007fff
在往下走cmpl $0x2,-0x14(%rbp) //2和-0x14(%rbp)的值(4)相减,大于等于0执行下一条否则执行jg指令,这里显然不符合
jg 0x4004e6 //这个就是要跳转的地方了,return fib(n - 1) + fib(n - 2);
=> 0x00000000004004e6 : 8b 45 ec mov -0x14(%rbp),%eax
0x00000000004004e9 : 83 e8 01 sub $0x1,%eax
0x00000000004004ec : 89 c7 mov %eax,%edi
0x00000000004004ee : e8 da ff ff ff callq 0x4004cd
0x00000000004004f3 : 89 c3 mov %eax,%ebx
0x00000000004004f5 : 8b 45 ec mov -0x14(%rbp),%eax
0x00000000004004f8 : 83 e8 02 sub $0x2,%eax
0x00000000004004fb : 89 c7 mov %eax,%edi
0x00000000004004fd : e8 cb ff ff ff callq 0x4004cd
0x0000000000400502 : 01 d8 add %ebx,%eaxmov -0x14(%rbp),%eax //把-0x14(%rbp)的值(4)赋给eax寄存器
sub $0x1,%eax //eax的值-1
mov %eax,%edi //把eax的值赋给edi
callq 0x4004cd //调用fib函数,注意这个地址跟之前的一样
再查看一下寄存器信息和内存信息(gdb) info registers rbp rsp edi rbx eax
rbp 0x7fffffffe6c0 0x7fffffffe6c0
rsp 0x7fffffffe698 0x7fffffffe698
edi 0x3 3
rbx 0x0 0
eax 0x3 3
(gdb) x/20x 0x7fffffffe690
0x7fffffffe690: 0x00000001 0x00000000 0x004004f3 0x00000000
0x7fffffffe6a0: 0x00000000 0x00000000 0x00000000 0x00000004
0x7fffffffe6b0: 0x00400520 0x00000000 0x00000000 0x00000000
0x7fffffffe6c0: 0xffffe6d0 0x00007fff 0x00400519 0x00000000
0x7fffffffe6d0: 0x00000000 0x00000000 0xf7a303d5 0x00007fff
可以看到当前edi,eax的值是3,在0x7fffffffe698到0x7fffffffe6a0之间压入了这次函数调用的下一条指令地址,当前rsp是0x7fffffffe698。
查看汇编指令信息之后发现跟之前基本一样,初始化frame之后,当前寄存器和内存信息如下(gdb) info registers rbp rsp edi rbx eax
rbp 0x7fffffffe690 0x7fffffffe690
rsp 0x7fffffffe690 0x7fffffffe690
edi 0x3 3
rbx 0x0 0
eax 0x3 3
(gdb) x/20x 0x7fffffffe690
0x7fffffffe690: 0xffffe6c0 0x00007fff 0x004004f3 0x00000000
0x7fffffffe6a0: 0x00000000 0x00000000 0x00000000 0x00000004
0x7fffffffe6b0: 0x00400520 0x00000000 0x00000000 0x00000000
0x7fffffffe6c0: 0xffffe6d0 0x00007fff 0x00400519 0x00000000
0x7fffffffe6d0: 0x00000000 0x00000000 0xf7a303d5 0x00007fff
跟上面一样,将之前的rbp压栈,同步rsp信息至rbp,接下来继续上面的三步打印一下寄存器和内存信息(gdb) info registers rbp rsp edi rbx eax
rbp 0x7fffffffe690 0x7fffffffe690
rsp 0x7fffffffe670 0x7fffffffe670
edi 0x3 3
rbx 0x0 0
eax 0x3 3
(gdb) x/20x 0x7fffffffe660
0x7fffffffe660: 0x00000000 0x00000000 0x00000000 0x00000000
0x7fffffffe670: 0x00000000 0x00000000 0x00000000 0x00000003
0x7fffffffe680: 0x00000000 0x00000000 0x00000000 0x00000000
0x7fffffffe690: 0xffffe6c0 0x00007fff 0x004004f3 0x00000000
0x7fffffffe6a0: 0x00000000 0x00000000 0x00000000 0x00000004
将3压入0x7fffffffe678到0x7fffffffe680之间,当前rsp = rsp - push rbx (8) - 0x18 = 0x7fffffffe670。
继续往下走显然3也不满足条件,继续上面的步骤mov -0x14(%rbp),%eax //把-0x14(%rbp)的值(3)赋给eax寄存器
sub $0x1,%eax //eax的值-1
mov %eax,%edi //把eax的值赋给edi
callq 0x4004cd //调用fib函数
查看一下寄存器信息和内存信息(gdb) info registers rbp rsp edi rbx eax
rbp 0x7fffffffe690 0x7fffffffe690
rsp 0x7fffffffe668 0x7fffffffe668
edi 0x2 2
rbx 0x0 0
eax 0x2 2
(gdb) x/20x 0x7fffffffe660
0x7fffffffe660: 0x00000000 0x00000000 0x004004f3 0x00000000
0x7fffffffe670: 0x00000000 0x00000000 0x00000000 0x00000003
0x7fffffffe680: 0x00000000 0x00000000 0x00000000 0x00000000
0x7fffffffe690: 0xffffe6c0 0x00007fff 0x004004f3 0x00000000
0x7fffffffe6a0: 0x00000000 0x00000000 0x00000000 0x00000004
同样将0x004004f3压栈,rsp-8
初始化frame和参数之后查询寄存器信息和内存信息(gdb) info registers rbp rsp edi rbx eax
rbp 0x7fffffffe660 0x7fffffffe660
rsp 0x7fffffffe640 0x7fffffffe640
edi 0x2 2
rbx 0x0 0
eax 0x2 2
(gdb) x/20x 0x7fffffffe640
0x7fffffffe640: 0x00000002 0x00000000 0x00000000 0x00000002
0x7fffffffe650: 0x00000000 0x00000000 0x00000000 0x00000000
0x7fffffffe660: 0xffffe690 0x00007fff 0x004004f3 0x00000000
0x7fffffffe670: 0x00000000 0x00000000 0x00000000 0x00000003
0x7fffffffe680: 0x00000000 0x00000000 0x00000000 0x00000000
符合预期,继续往下走,2-2显然满足条件
return 1; => 0x00000000004004df : b8 01 00 00 00 mov $0x1,%eax 0x00000000004004e4 : eb 1e jmp 0x400504 mov $0x1,%eax //把1赋给eax寄存器
jmp 0x400504 //跳转
=> 0x0000000000400504 : 48 83 c4 18 add $0x18,%rsp 0x0000000000400508 : 5b pop %rbx 0x0000000000400509 : 5d pop %rbp 0x000000000040050a : c3 retqadd $0x18,%rsp //rsp+0x18(24) = 0x7fffffffe658
pop %rbx // rsp+8 = 0x7fffffffe660
pop %rbp //rbp = 0xffffe690 ; rsp + 8 = 0x7fffffffe668
retq // rsp + 8 = 0x7fffffffe670 ,跳转到0x004004f3
在查看下信息(gdb) info registers rbp rsp edi rbx eax
rbp 0x7fffffffe690 0x7fffffffe690
rsp 0x7fffffffe670 0x7fffffffe670
edi 0x2 2
rbx 0x1 0
eax 0x1 1
(gdb) x/20x 0x7fffffffe640
0x7fffffffe640: 0x00000002 0x00000000 0x00000000 0x00000002
0x7fffffffe650: 0x00000000 0x00000000 0x00000000 0x00000000
0x7fffffffe660: 0xffffe690 0x00007fff 0x004004f3 0x00000000
0x7fffffffe670: 0x00000000 0x00000000 0x00000000 0x00000003
0x7fffffffe680: 0x00000000 0x00000000 0x00000000 0x00000000
跳回来,记得这个fib(3)那个=> 0x00000000004004f3 : 89 c3 mov %eax,%ebx
0x00000000004004f5 : 8b 45 ec mov -0x14(%rbp),%eax
0x00000000004004f8 : 83 e8 02 sub $0x2,%eax
0x00000000004004fb : 89 c7 mov %eax,%edi
0x00000000004004fd : e8 cb ff ff ff callq 0x4004cd
0x0000000000400502 : 01 d8 add %ebx,%eaxmov %eax,%ebx //eax的值赋给ebx
mov -0x14(%rbp),%eax //-0x14(%rbp)位置的值赋给eax
sub $0x2,%eax//eax(3)-2
mov %eax,%edi //eax赋给edi
callq 0x4004cd //调用函数(又来了)
对照一下内存信息(gdb) x/20x 0x7fffffffe660
0x7fffffffe660: 0xffffe690 0x00007fff 0x00400502 0x00000000
0x7fffffffe670: 0x00000000 0x00000000 0x00000000 0x00000003
0x7fffffffe680: 0x00000000 0x00000000 0x00000000 0x00000000
0x7fffffffe690: 0xffffe6c0 0x00007fff 0x004004f3 0x00000000
0x7fffffffe6a0: 0x00000000 0x00000000 0x00000000 0x00000004
开始新一轮的调用,把下一条指令地址0x00400502压栈。rsp-8,初始化frame和参数之后查询寄存器信息和内存信息(gdb) info registers rbp rsp edi rbx eax
rbp 0x7fffffffe660 0x7fffffffe660
rsp 0x7fffffffe640 0x7fffffffe640
edi 0x1 1
rbx 0x1 1
eax 0x1 1
(gdb) x/20x 0x7fffffffe640
0x7fffffffe640: 0x00000002 0x00000000 0x00000000 0x00000001
0x7fffffffe650: 0x00000000 0x00000000 0x00000001 0x00000000
0x7fffffffe660: 0xffffe690 0x00007fff 0x00400502 0x00000000
0x7fffffffe670: 0x00000000 0x00000000 0x00000000 0x00000003
0x7fffffffe680: 0x00000000 0x00000000 0x00000000 0x00000000push %rbx //rbx的值压栈 这次有值了 1, rsp-8
sub $0x18,%rsp //rsp-0x18(24)
mov %edi,-0x14(%rbp) //edi的值赋给-0x14(%rbp)
继续往下走,1-2显然满足条件return 1;
=> 0x00000000004004df : b8 01 00 00 00 mov $0x1,%eax
0x00000000004004e4 : eb 1e jmp 0x400504 mov $0x1,%eax //把1赋给eax寄存器
jmp 0x400504 //跳转=> 0x0000000000400504 : 48 83 c4 18 add $0x18,%rsp
0x0000000000400508 : 5b pop %rbx
0x0000000000400509 : 5d pop %rbp
0x000000000040050a : c3 retqadd $0x18,%rsp //rsp+0x18(24) = 0x7fffffffe658
pop %rbx // rsp+8 = 0x7fffffffe660
pop %rbp //rbp = 0xffffe690 ; rsp + 8 = 0x7fffffffe668
retq // rsp + 8 = 0x7fffffffe670 ,跳转到0x00400502
在查看下信息(gdb) x/20x 0x7fffffffe640
0x7fffffffe640: 0x00000002 0x00000000 0x00000000 0x00000001
0x7fffffffe650: 0x00000000 0x00000000 0x00000001 0x00000000
0x7fffffffe660: 0xffffe690 0x00007fff 0x00400502 0x00000000
0x7fffffffe670: 0x00000000 0x00000000 0x00000000 0x00000003
0x7fffffffe680: 0x00000000 0x00000000 0x00000000 0x00000000
回来继续往下走0x0000000000400502 : 01 d8 add %ebx,%eax
10 }
11 }
0x0000000000400504 : 48 83 c4 18 add $0x18,%rsp
0x0000000000400508 : 5b pop %rbx
0x0000000000400509 : 5d pop %rbp
0x000000000040050a : c3 retqadd %ebx,%eax // eax(2) = ebx(1)+eax(1)
add $0x18,%rsp //rsp+0x18= 0x7fffffffe658
pop %rbx //rsp+8 ,rbx=0
pop %rbp //rsp+8,rbp=0xffffe690
retq //rsp+8 ,跳转0x00400502
查看信息(gdb) x/20x 0x7fffffffe640
0x7fffffffe640: 0x00000002 0x00000000 0x00000000 0x00000001
0x7fffffffe650: 0x00000000 0x00000000 0x00000001 0x00000000
0x7fffffffe660: 0xffffe690 0x00007fff 0x00400502 0x00000000
0x7fffffffe670: 0x00000000 0x00000000 0x00000000 0x00000003
0x7fffffffe680: 0x00000000 0x00000000 0x00000000 0x00000000
后面流程基本一样就不在往下写了。
总结一下栈是FILO(first in last out),先进后出。main函数先进栈,所以最后出来。
%ESP - 堆栈指针
这个32位寄存器由多个CPU指令(PUSH,POP,CALL和RET等)隐式操作,它总是指向堆栈上使用的最后一个元素(不是第一个自由元素)
“堆栈顶部”是一个占用位置,而不是一个空闲位置,并且位于最低内存地址。
%EBP - 基准指针
该32位寄存器用于引用当前堆栈帧中的所有函数参数和局部变量。与%esp寄存器不同,基本指针仅被显式操作。这有时被称为“帧指针”。
%EIP - 指令指针
它保存要执行的下一个CPU指令的地址,并作为CALL 指令的一部分保存到堆栈中。同样,任何“跳转”指令都会直接修改%EIP。