ARM 调用约定 calling convention

int bar( int a, int b, int c, int d, int e, int f, int g )
{
  int array2[ 7 ];
  array2[ 0 ] = a + b;
  array2[ 1 ] = b + c;
  array2[ 2 ] = c + d;
  array2[ 3 ] = d + e;
  array2[ 4 ] = e + f;
  array2[ 5 ] = f + g;
  array2[ 6 ] = g + a;
  return array2[ 0 ] + array2[ 1 ] + array2[ 2 ] + array2[ 3 ] + array2[ 4 ]
    + array2[ 5 ] + array2[ 6 ];
}

int foo( int a, int b, int c, int d, int e, int f, int g )
{
  int array1[ 7 ];
  array1[ 0 ] = a + b;
  array1[ 1 ] = b + c;
  array1[ 2 ] = c + d;
  array1[ 3 ] = d + e;
  array1[ 4 ] = e + f;
  array1[ 5 ] = f + g;
  array1[ 6 ] = g + a;

  
  return bar( array1[ 0 ], array1[ 1 ], array1[ 2 ], array1[ 3 ], array1[ 4 ],
    array1[ 5 ], array1[ 6 ] );
}

int func( int * buffer )
{
  int a, b, c, d, e, f, g, h;
  a = 1 + buffer[ 0 ];
  b = 2 + buffer[ 1 ];
  c = 3 + buffer[ 2 ];
  d = 4 + buffer[ 3 ];
  e = 5 + buffer[ 4 ];
  f = 6 + buffer[ 5 ];
  g = 7 + buffer[ 6 ];
  h = foo( a, b, c, d, e, f, g );

  return h;
}

int main( )
{
  int array0[ 7 ];
  array0[ 0 ] = 0;
  array0[ 1 ] = 1;
  array0[ 2 ] = 2;
  array0[ 3 ] = 3;
  array0[ 4 ] = 4;
  array0[ 5 ] = 5;
  array0[ 6 ] = 6;
  while ( func( array0 ) )

  {
  }
}

int main( )
{
main:
    0x8070252: 0xb500         PUSH      {LR}
    0x8070254: 0xb087         SUB       SP, SP, #0x1c
  array0[0] = 0;
    0x8070256: 0x2000         MOVS      R0, #0
    0x8070258: 0x9000         STR       R0, [SP]
  array0[1] = 1;

    0x807025a: 0x2001         MOVS      R0, #1
    0x807025c: 0x9001         STR       R0, [SP, #0x4]
  array0[2] = 2;
    0x807025e: 0x2002         MOVS      R0, #2
    0x8070260: 0x9002         STR       R0, [SP, #0x8]
  array0[3] = 3;
    0x8070262: 0x2003         MOVS      R0, #3
    0x8070264: 0x9003         STR       R0, [SP, #0xc]
  array0[4] = 4;
    0x8070266: 0x2004         MOVS      R0, #4
    0x8070268: 0x9004         STR       R0, [SP, #0x10]
  array0[5] = 5;
    0x807026a: 0x2005         MOVS      R0, #5
    0x807026c: 0x9005         STR       R0, [SP, #0x14]
  array0[6] = 6;
    0x807026e: 0x2006         MOVS      R0, #6
    0x8070270: 0x9006         STR       R0, [SP, #0x18]
  while ( func(array0) )
??main_0:
    0x8070272: 0xa800         ADD       R0, SP, #0x0
    0x8070274: 0xf7ff 0xffc3  BL        func                    ; 0x80701fe
    0x8070278: 0x2800         CMP       R0, #0
    0x807027a: 0xd1fa         BNE.N     ??main_0                ; 0x8070272
}

int main( )
{
main:
    0x8070252: 0xb500         PUSH      {LR}
    0x8070254: 0xb087         SUB       SP, SP, #0x1c

执行 PUSH {LR} 之前, SP = 0x20000400, 执行 PUSH {LR} 之后, LR 入栈, SP = 0x200003FC

接着执行 SUB SP, SP, #0x1c, 为局部变量分配空间 28 bytes, SP = 0x200003E0

    0x8070272: 0xa800 ADD R0, SP, #0x0
    0x8070274: 0xf7ff 0xffc3 BL func ; 0x80701fe

调用 func()

int func(int * buffer)
{
func:
    0x80701fe: 0xe92d 0x4ff0  PUSH.W    {R4-R11, LR}
    0x8070202: 0xb085         SUB       SP, SP, #0x14
    0x8070204: 0x0004         MOVS      R4, R0
    ... ... ... ...
  h = foo(a, b, c, d, e, f, g);

PUSH .W {R4-R11, LR}, SUB SP, SP, #0x14, 保存寄存器, 为局部变量分配空间 a, 其他变量b,c,d,e,f,g 使用寄存器R5-R10

h 使用寄存器 R11 <图中没有显示>

同时分配3个变量的空间, 用于通过堆栈传递参数, 调用 foo(a, b, c, d, e, f, g)

  h = foo(a, b, c, d, e, f, g);
    0x8070230: 0xf8cd 0xa008  STR.W     R10, [SP, #0x8]     g
    0x8070234: 0xf8cd 0x9004  STR.W     R9, [SP, #0x4]      f
    0x8070238: 0xf8cd 0x8000  STR.W     R8, [SP]            e
    0x807023c: 0x003b         MOVS      R3, R7              d
    0x807023e: 0x0032         MOVS      R2, R6              c    
    0x8070240: 0x0029         MOVS      R1, R5              b
    0x8070242: 0x9803         LDR       R0, [SP, #0xc]      a 
    0x8070244: 0xf7ff 0xffad  BL        foo                     ; 0x80701a2
    0x8070248: 0x4683         MOV       R11, R0
  return h;
    0x807024a: 0x4658         MOV       R0, R11
    0x807024c: 0xb005         ADD       SP, SP, #0x14
    0x807024e: 0xe8bd 0x8ff0  POP.W     {R4-R11, PC}

 foo(a, b, c, d, e, f, g) : a -> R0, b -> R1, c -> R2, d -> R3, e -> [SP, #0x00], f -> [SP, #0x04], e -> [SP, #0x08]

 

foo:
    0x80701a2: 0xe92d 0x47f0  PUSH.W    {R4-R10, LR}
    0x80701a6: 0xb08a         SUB       SP, SP, #0x28
    0x80701a8: 0x0004         MOVS      R4, R0                a 通过寄存器传递 
    0x80701aa: 0x000d         MOVS      R5, R1                b 通过寄存器传递
    0x80701ac: 0x0016         MOVS      R6, R2                c 通过寄存器传递
    0x80701ae: 0x001f         MOVS      R7, R3                d 通过寄存器传递 
    0x80701b0: 0xf8dd 0x8048  LDR.W     R8, [SP, #0x48]       e 通过堆栈传递
    0x80701b4: 0xf8dd 0x904c  LDR.W     R9, [SP, #0x4c]       f 通过堆栈传递
    0x80701b8: 0xf8dd 0xa050  LDR.W     R10, [SP, #0x50]      g 通过堆栈传递

PUSH .W {R4-R10, LR}, SUB SP, SP, #0x28, 保存寄存器, 为局部变量分配空间 array1[7], 同时分配3个变量的空间, 用于通过堆栈传递参数, 调用

bar( array1[ 0 ], array1[ 1 ], array1[ 2 ], array1[ 3 ], array1[ 4 ], array1[ 5 ], array1[ 6 ] );

foo (a, b, c, d, e, f, g ) : a, b, c, d 通过寄存器传递, e, f, g 通过堆栈传递

获取参数, 运算之后, 存入局部变量 array1[7], 然后准备调用 bar()

array1[ 0 ], array1[ 1 ], array1[ 2 ], array1[ 3 ]  通过寄存器传递

array1[ 4 ], array1[ 5 ], array1[ 6 ] 通过堆栈传递

  return bar( array1[0], array1[1], array1[2], array1[3], array1[4], array1[5], array1[6] );
    0x80701e0: 0x9809         LDR       R0, [SP, #0x24]          array1[6]
    0x80701e2: 0x9002         STR       R0, [SP, #0x8]            

    0x80701e4: 0x9808         LDR       R0, [SP, #0x20]　　　　　　array1[5]　　　　　　
    0x80701e6: 0x9001         STR       R0, [SP, #0x4]

    0x80701e8: 0x9807         LDR       R0, [SP, #0x1c]          array1[4]
    0x80701ea: 0x9000         STR       R0, [SP]

    0x80701ec: 0x9b06         LDR       R3, [SP, #0x18]          array1[3]
    0x80701ee: 0x9a05         LDR       R2, [SP, #0x14]          array1[2]
    0x80701f0: 0x9904         LDR       R1, [SP, #0x10]          array1[1]
    0x80701f2: 0x9803         LDR       R0, [SP, #0xc]           array1[0]

    0x80701f4: 0xf7ff 0xffa5  BL        bar                     ; 0x8070142
    0x80701f8: 0xb00a         ADD       SP, SP, #0x28
    0x80701fa: 0xe8bd 0x87f0  POP.W     {R4-R10, PC}

bar:
    0x8070142: 0xb4f0         PUSH      {R4-R7}
    0x8070144: 0xb087         SUB       SP, SP, #0x1c
    0x8070146: 0x0004         MOVS      R4, R0                 a <- array1[0] 
    0x8070148: 0x9d0b         LDR       R5, [SP, #0x2c]        e <- array1[4] -- 通过堆栈传递的参数
    0x807014a: 0x9e0c         LDR       R6, [SP, #0x30]        f <- array1[5] -- 通过堆栈传递的参数
    0x807014c: 0x9f0d         LDR       R7, [SP, #0x34]        g <- array1[6] -- 通过堆栈传递的参数

PUSH.W {R4-R7, LR}, SUB SP, SP, #0x1C, 保存寄存器, 为局部变量分配空间 array2[7]