CHARLES UNIVERSITY IN PRAGUE faculty of mathematics and physics Principles of Computers 12 th Lecture Pavel Ježek, Ph.D.

Slides:

Advertisements

Similar presentations

Presented By Dr. Shazzad Hosain Asst. Prof. EECS, NSU

Advertisements

COMP 2003: Assembly Language and Digital Logic

Princess Sumaya Univ. Computer Engineering Dept. د. بســام كحـالــه Dr. Bassam Kahhaleh.

Lecture 6 Machine Code: How the CPU is programmed.

Pentium 4 and IA-32 ISA ELEC 5200/6200 Computer Architecture and Design, Fall 2006 Lectured by Dr. V. Agrawal Lectured by Dr. V. Agrawal Kyungseok Kim.

CSS 372 Lecture 1 Course Overview: CSS 372 Web page Syllabus Lab Ettiquette Lab Report Format Review of CSS 371: Simple Computer Architecture Traps Interrupts.

PC hardware and x86 3/3/08 Frans Kaashoek MIT

1 Lecture 5: Procedures Assembly Language for Intel-Based Computers, 4th edition Kip R. Irvine.

1 Function Calls Professor Jennifer Rexford COS 217 Reading: Chapter 4 of “Programming From the Ground Up” (available online from the course Web site)

TCSS 372A Computer Architecture. Getting Started Get acquainted (take pictures) Review Web Page (

TCSS 372A Computer Architecture. Getting Started Get acquainted (take pictures) Purpose, scope, and expectations of the course Expectations & strategy.

CEG 320/520: Computer Organization and Assembly Language ProgrammingIntel Assembly 1 Intel IA-32 vs Motorola

6.828: PC hardware and x86 Frans Kaashoek

Computer Architecture and Operating Systems CS 3230 :Assembly Section Lecture 7 Department of Computer Science and Software Engineering University of Wisconsin-Platteville.

Fall 2008CS 334: Computer SecuritySlide #1 Smashing The Stack A detailed look at buffer overflows as described in Smashing the Stack for Fun and Profit.

The Intel Microprocessors. Real Mode Memory Addressing Real mode, also called real address mode, is an operating mode of and later x86-compatible.

Stack Operations LIFO structure (last-in,first-out) –The last value put into the stack is the first value taken out Runtime stack –A memory array that.

13/02/2009CA&O Lecture 04 by Engr. Umbreen Sabir Computer Architecture & Organization Instructions: Language of Computer Engr. Umbreen Sabir Computer Engineering.

Today’s topics Parameter passing on the system stack Parameter passing on the system stack Register indirect and base-indexed addressing modes Register.

University of Washington Roadmap 1 car *c = malloc(sizeof(car)); c->miles = 100; c->gals = 17; float mpg = get_mpg(c); free(c); Car c = new Car(); c.setMiles(100);

VAX. Agenda VAX and its History VAX ISA VAX Virtual Address Microcode.

The x86 Architecture Lecture 15 Fri, Mar 4, 2005.

IA32 (Pentium) Processor Architecture. Processor modes: 1.Protected (mode we will study) – 32-bit mode – 32-bit (4GB) address space 2.Virtual 8086 modes.

Richard P. Paul, SPARC Architecture, Assembly Language Programming, and C Chapter 7 – Subroutines These are lecture notes to accompany the book SPARC Architecture,

PC hardware and x86 programming Lec 2 Jinyang Li.

Oct. 25, 2000Systems Architecture I1 Systems Architecture I (CS ) Lecture 9: Alternative Instruction Sets * Jeremy R. Johnson Wed. Oct. 25, 2000.

EEL5708/Bölöni Lec 8.1 9/19/03 September, 2003 Lotzi Bölöni Fall 2003 EEL 5708 High Performance Computer Architecture Lecture 5 Intel 80x86.

CHARLES UNIVERSITY IN PRAGUE faculty of mathematics and physics Principles of Computers 17 th Lecture Pavel Ježek, Ph.D.

CHARLES UNIVERSITY IN PRAGUE faculty of mathematics and physics Principles of Computers 14 th Lecture Pavel Ježek, Ph.D.

X86 Assembly Language We will be using the nasm assembler (other assemblers: MASM, as, gas)

University of Amsterdam Computer Systems – the instruction set architecture Arnoud Visser 1 Computer Systems The instruction set architecture.

COMPUTER ORGANIZATION LECTURE 3: ISA YASSER MOHAMMAD.

CHARLES UNIVERSITY IN PRAGUE faculty of mathematics and physics Principles of Computers 11 th Lecture Pavel Ježek, Ph.D.

Pushing the Return Address To return to the caller a subroutine must have the correct return address in $ra when the jr instruction is performed. But this.

The Evolution of the Intel 80x86 Architecture Chad Derrenbacker Chris Garvey Manpreet Hundal Tom Opfer CS 350 December 9, 1998.

1 Assembly Language: Function Calls Jennifer Rexford.

The Stack. ARMSim memory space: 0x Unused 0x x11400 Stack 0x x09400 Heap 0x?????-0x01400 Data 0x x????? Text 0x x01000.

CHARLES UNIVERSITY IN PRAGUE faculty of mathematics and physics Principles of Computers 18 th Lecture Pavel Ježek, Ph.D.

Microprocessors CSE- 341 Dr. Jia Uddin Assistant Professor, CSE, BRAC University Dr. Jia Uddin, CSE, BRAC University.

1 Contents: 3.1 Instruction format and Addressing Modes 3.2 Instruction Introduction Chapter 3 Instruction system.

Section 5: Procedures & Stacks

CS 177 Computer Security Lecture 9

Credits and Disclaimers

Storage Classes There are three places in memory where data may be placed: In Data section declared with .data in assembly language in C - Static) On the.

Lecture on Real Mode Memory Addressing

Exploiting & Defense Day 2 Recap

Microprocessor and Assembly Language

Introduction to Compilers Tim Teitelbaum

Principles of Computers 14th Lecture

Principles of Computers 18th Lecture

Principles of Computers 16th Lecture

Computer Organization and Assembly Language (COAL)

CS 301 Fall 2002 Control Structures

Computer Science 210 Computer Organization

Subroutines and the Stack

MIPS Procedure Calls CSE 378 – Section 3.

Understanding Program Address Space

by Richard P. Paul, 2nd edition, 2000.

Computer Science 210 Computer Organization

CSC 497/583 Advanced Topics in Computer Security

CSC 497/583 Advanced Topics in Computer Security

Credits and Disclaimers

Principles of Computers 17th Lecture

Principles of Computers 18th Lecture

Principles of Computers 16th Lecture

Principles of Computers 14th Lecture

Computer Organization

Principles of Computers 15th Lecture

Computer Architecture and System Programming Laboratory

Presentation transcript:

CHARLES UNIVERSITY IN PRAGUE faculty of mathematics and physics Principles of Computers 12 th Lecture Pavel Ježek, Ph.D.

Examples of CPU Architectures CPU arch. CPU nameData widthLogical address width Current instruction register(s) Physical address width Special mode 8-bit 6502 MOS bit data16-bit PC 16-bit (64 kB) 16-bit x86-16 x86 Intel bit data bit CS:IP 20-bit (1 MB) Intel bit data Intel bit data bit CS:IP 24-bit (16 MB) protected 16 (+ real) mode 32-bit x86 IA-32 INTEL32 Intel bit data32-bit EIP 32-bit (4 GB) protected 32 mode Intel Pentium Pro64-bit data32-bit EIP 36-bit (64 GB) PAE 64-bit x64 x86-64 AMD64 INTEL64 EM64T AMD Opteron (Intel Pentium 4) 64-bit data64-bit RIP 40-bit (1 TB) long mode 2015 current (e.g. Core i7) 64-bit data64-bit RIP AMD: 48b → 256 TB Intel: 46b → 64 TB

Examples of CPU Architectures CPU arch. CPU nameData widthLogical address width Current instruction register(s) Physical address width Special modeStack top 8-bit 6502 MOS bit data16-bit PC 16-bit (64 kB) 01 S 16-bit x86-16 x86 Intel bit data bit CS:IP 20-bit (1 MB) SS:SP Intel bit data Intel bit data bit CS:IP 24-bit (16 MB) protected 16 (+ real) mode SS:SP 32-bit x86 IA-32 INTEL32 Intel bit data32-bit EIP 32-bit (4 GB) protected 32 mode ESP Intel Pentium Pro64-bit data32-bit EIP 36-bit (64 GB) PAE ESP 64-bit x64 x86-64 AMD64 INTEL64 EM64T AMD Opteron (Intel Pentium 4) 64-bit data64-bit RIP 40-bit (1 TB) long mode RSP 2015 current (e.g. Core i7) 64-bit data64-bit RIP AMD: 48b → 256 TB Intel: 46b → 64 TB RSP

Push Variants on x86 (IA-32) Machine codeIntel assemblerComment 68 xx xx xx xxPUSH xxxxxxxxh (or PUSH DWORD PTR xxxxxxxxh ) push 32-bits of x ( x = immediate) xx xxPUSH xxxxh (or PUSH WORD PTR xxxxh ) push 16-bits of x

Push Variants on x86 (IA-32) Machine codeIntel assemblerComment 68 xx xx xx xxPUSH xxxxxxxxh (or PUSH DWORD PTR xxxxxxxxh ) push 32-bits of x ( x = immediate) xx xxPUSH xxxxh (or PUSH WORD PTR xxxxh ) push 16-bits of x FF 35 xx xx xx xxPUSH [xxxxxxxxh] (or PUSH DWORD PTR [xxxxxxxxh] ) push 32-bits from address x ( x = absolute address) 66 FF 35 xx xx xx xxPUSH WORD PTR xxxxxxxxh push 16-bits from address x

Push and Pop Variants on x86 (IA-32) Machine codeIntel assemblerComment 68 xx xx xx xxPUSH xxxxxxxxh (or PUSH DWORD PTR xxxxxxxxh ) push 32-bits of x ( x = immediate) xx xxPUSH xxxxh (or PUSH WORD PTR xxxxh ) push 16-bits of x FF 35 xx xx xx xxPUSH [xxxxxxxxh] (or PUSH DWORD PTR [xxxxxxxxh] ) push 32-bits from address x ( x = absolute address) 66 FF 35 xx xx xx xxPUSH WORD PTR xxxxxxxxh push 16-bits from address x 8F 05 xx xx xx xxPOP [xxxxxxxxh] (or POP DWORD PTR [xxxxxxxxh] ) pop 32-bits and save them to address x ( x = absolute address) 66 8F 05 xx xx xx xxPOP WORD PTR [xxxxxxxxh] pop 16-bits and save them to address x

$00007A08 00 (00) 00 (20) 00 (00)$00007A04 00 $00007A02 00 $00007A00 B... $ A... $ C2 00 0D F5 JMPE9$ A 04 JMP indir 25 FF$ C1... $ variable j variable ptr padding variable i procedure P2 procedure P1 main program program PascalProgram; type PProc = procedure; procedure P1; begin α end; jmp back procedure P2; begin β end; jmp back var i : word; ptr : PProc; j : word; begin γ 1 ptr ptr; P2; γ 2 end. A B C1 C2 $ ← $ – ($ ) = $ – $ B = $00000DF5 E9 = relative jump $00007A04

$00007A08 00 (00) 00 (20) 00 (00)$00007A04 00 $00007A02 00 $00007A00 B C3... $ A C3... $ C2 00 0D F5 CALLE8$ A 04 CALL indir 15 FF$ C1... $ variable j variable ptr padding variable i procedure P2 procedure P1 main program program PascalProgram; type PProc = procedure; procedure P1; begin α end; jmp back = ret procedure P2; begin β end; jmp back = ret var i : word; ptr : PProc; j : word; begin γ 1 ptr ptr; P2; γ 2 end. A B C1 C2 $ ← $ – ($ ) = $ – $ B = $00000DF5 E8 = relative call ( E9 = relative jump) $00007A04 FF 15 = indirect call ( FF 25 = indirect jump)

procedure P1(a : word; b : longword); begin... P1($AABB, $ );... end; begin... P1(5, 7);... end.... ?? SP →??$ A ??...

procedure P1(a : word; b : longword); $0A50:... push h push AABBh call 00000A50h... ret begin... push h push 0005h $0900: call 00000A50h $0905: nop... end.... ?? SP →??$ A ??... ← IP P1($AABB, $ ); P1(5, 7);

procedure P1(a : word; b : longword); $0A50:... push h push AABBh call 00000A50h... ret begin... push h push 0005h $0900: call 00000A50h $0905: nop... end.... ?? $ A 00 SP →07$ ??... ← IP procedure argument b

procedure P1(a : word; b : longword); $0A50:... push h push AABBh call 00000A50h... ret begin... push h push 0005h $0900: call 00000A50h $0905: nop... end.... ?? $ A 00 SP →07$ ??... ← IP procedure argument b

procedure P1(a : word; b : longword); $0A50:... push h push AABBh call 00000A50h... ret begin... push h push 0005h $0900: call 00000A50h $0905: nop... end.... ?? $ A 00 07$ SP →05$ ??... ← IP procedure argument b procedure argument a

procedure P1(a : word; b : longword); $0A50:... push h push AABBh call 00000A50h... ret begin... push h push 0005h $0900: call 00000A50h $0905: nop... end.... ?? $ A 00 07$ SP →05$ ??... ← IP procedure argument b procedure argument a

procedure P1(a : word; b : longword); $0A50:... push h push AABBh call 00000A50h... ret begin... push h push 0005h $0900: call 00000A50h $0905: nop... end.... ?? $ A 00 07$ $ SP →05$ ??... ← IP procedure argument b procedure argument a return address from procedure P1 to main program

procedure P1(a : word; b : longword); $0A50:... push h push AABBh call 00000A50h... ret begin... push h push 0005h $0900: call 00000A50h $0905: nop... end.... ?? $ A 00 07$ $ SP →05$ ??... ← IP procedure argument b procedure argument a return address from procedure P1 to main program

procedure P1(a : word; b : longword); $0A50:... push h push AABBh call 00000A50h... ret begin... push h push 0005h $0900: call 00000A50h $0905: nop... end.... ?? $ A 00 07$ $ SP →05$ ??... ← IP procedure argument b procedure argument a return address from procedure P1 to main program

procedure P1(a : word; b : longword); $0A50:... push h push AABBh call 00000A50h... ret begin... push h push 0005h $0900: call 00000A50h $0905: nop... end.... ?? $ A 00 07$ $ $ SP →44$ C ??... ← IP procedure argument b procedure argument a return address from procedure P1 to main program procedure argument b

procedure P1(a : word; b : longword); $0A50:... push h push AABBh call 00000A50h... ret begin... push h push 0005h $0900: call 00000A50h $0905: nop... end.... ?? $ A 00 07$ $ $ SP →44$ C ??... ← IP procedure argument b procedure argument a return address from procedure P1 to main program procedure argument b

procedure P1(a : word; b : longword); $0A50:... push h push AABBh call 00000A50h... ret begin... push h push 0005h $0900: call 00000A50h $0905: nop... end.... ?? $ A 00 07$ $ $ $ C AA SP →BB$ A ??... ← IP procedure argument b procedure argument a return address from procedure P1 to main program procedure argument b procedure argument a

procedure P1(a : word; b : longword); $0A50:... push h push AABBh call 00000A50h $0A70:... ret begin... push h push 0005h $0900: call 00000A50h $0905: nop... end.... ?? $ A 00 07$ $ $ $ C AA SP →BB$ A ??... ← IP procedure argument b procedure argument a return address from procedure P1 to main program procedure argument b procedure argument a

procedure P1(a : word; b : longword); $0A50:... push h push AABBh call 00000A50h $0A70:... ret begin... push h push 0005h $0900: call 00000A50h $0905: nop... end.... ?? $ A 00 07$ $ $ $ C AA BB$ A 00 0A SP →70$ ??... ← IP procedure argument b procedure argument a return address from procedure P1 to main program procedure argument b procedure argument a return address from procedure P1 to procedure P1

procedure P1(a : word; b : longword); $0A50:... push h push AABBh call 00000A50h $0A70:... ret begin... push h push 0005h $0900: call 00000A50h $0905: nop... end.... ?? $ A 00 07$ $ $ $ C AA BB$ A 00 0A SP →70$ ??... ← IP procedure argument b procedure argument a return address from procedure P1 to main program procedure argument b procedure argument a return address from procedure P1 to procedure P1

procedure P1(a : word; b : longword); $0A50:... push h push AABBh call 00000A50h $0A70:... ret begin... push h push 0005h $0900: call 00000A50h $0905: nop... end.... ?? $ A 00 07$ $ $ $ C AA BB$ A 00 0A SP →70$ ??... ← IP will be used as return address ( ← IP) procedure argument b procedure argument a return address from procedure P1 to main program procedure argument b procedure argument a return address from procedure P1 to procedure P1

procedure P1(a : word; b : longword); $0A50:... push h push AABBh call 00000A50h $0A70:... ret begin... push h push 0005h $0900: call 00000A50h $0905: nop... end.... ?? $ A 00 07$ $ $ $ C AA SP →BB$ A 00 0A 70$ ??... ← IP procedure argument b procedure argument a return address from procedure P1 to main program procedure argument b procedure argument a

procedure P1(a : word; b : longword); $0A50:... push h push AABBh call 00000A50h $0A70:... ret begin... push h push 0005h $0900: call 00000A50h $0905: nop... end.... ?? $ A 00 07$ $ $ $ C AA SP →BB$ A 00 0A 70$ ??... ← IP will be used as return address ( ← IP) procedure argument b procedure argument a return address from procedure P1 to main program procedure argument b procedure argument a

procedure P1(a : word; b : longword); $0A50:... push h push AABBh call 00000A50h $0A70:... ret begin... push h push 0005h $0900: call 00000A50h $0905: nop... end.... ?? $ A 00 07$ $ $ SP → $ C AA BB$ A 00 0A 70$ ??... ← IP used as return address ( ← IP) correct return address procedure argument b procedure argument a return address from procedure P1 to main program procedure argument b procedure argument a

procedure P1(a : word; b : longword); $0A50:... push h push AABBh call 00000A50h SP := SP + (4+2) $0A70:... ret begin... push h push 0005h $0900: call 00000A50h $0905: SP := SP + (4+2) nop... end.... ?? $ A 00 07$ $ $ $ C AA SP →BB$ A 00 0A 70$ ??... ← IP procedure argument b procedure argument a return address from procedure P1 to main program procedure argument b procedure argument a

procedure P1(a : word; b : longword); $0A50:... push h push AABBh call 00000A50h SP := SP + (4+2) $0A70:... ret begin... push h push 0005h $0900: call 00000A50h $0905: SP := SP + (4+2) nop... end.... ?? $ A 00 07$ $ SP →05$ $ C AA BB$ A 00 0A 70$ ??... ← IP procedure argument b procedure argument a return address from procedure P1 to main program

procedure P1(a : word; b : longword); $0A50:... push h push AABBh call 00000A50h SP := SP + (4+2) $0A70:... ret begin... push h push 0005h $0900: call 00000A50h $0905: SP := SP + (4+2) nop... end.... ?? $ A 00 07$ $ SP →05$ $ C AA BB$ A 00 0A 70$ ??... ← IP will be used as return address ( ← IP) procedure argument b procedure argument a return address from procedure P1 to main program

procedure P1(a : word; b : longword); $0A50:... push h push AABBh call 00000A50h SP := SP + (4+2) $0A70:... ret begin... push h push 0005h $0900: call 00000A50h $0905: SP := SP + (4+2) nop... end.... ?? $ A 00 07$ SP →05$ $ $ C AA BB$ A 00 0A 70$ ??... ← IP procedure argument b procedure argument a

procedure P1(a : word; b : longword); $0A50:... push h push AABBh call 00000A50h SP := SP + (4+2) $0A70:... ret begin... push h push 0005h $0900: call 00000A50h $0905: SP := SP + (4+2) nop... end.... ?? SP →??$ A 00 07$ $ $ $ C AA BB$ A 00 0A 70$ ??... ← IP

procedure P1(a : word; b : longword); $0A50:... push h push AABBh call 00000A50h SP := SP + (4+2) $0A70:... ret begin... push h push 0005h $0900: call 00000A50h $0905: SP := SP + (4+2) nop... end.... ?? SP →??$ A 00 07$ $ $ $ C AA BB$ A 00 0A 70$ ??... ← IP

... ?? $ A 00 07$ $ SP →05$ ??... procedure P1(a : word; b : longword); $0A50: ret begin... push h push 0005h $0900: call 00000A50h $0905: SP := SP + (4+2) nop... end. ← IP procedure argument b procedure argument a return address from procedure P1 to main program

procedure P1(a : word; b : longword); $0A50: ret begin... push h push 0005h $0900: call 00000A50h $0905: SP := SP + (4+2) nop... end.... ?? $ A 00 SP + 607$ SP + 405$ SP →05$ ??... ← IP procedure argument b procedure argument a return address from procedure P1 to main program

procedure P1(a : word; b : longword); var loc1, loc2 : word; $0A50: ret begin... push h push 0005h $0900: call 00000A50h $0905: SP := SP + (4+2) nop... end.... ?? $ A 00 SP + 607$ SP + 405$ SP →05$ ??... ← IP procedure argument b procedure argument a return address from procedure P1 to main program

procedure P1(a : word; b : longword); var loc1, loc2 : word; $0A50: SP := SP – (2+2)... ret begin... push h push 0005h $0900: call 00000A50h $0905: SP := SP + (4+2) nop... end.... ?? $ A 00 SP $ SP + 805$ $ ?? SP + 2??$ E ?? SP →??$ C ??... ← IP procedure argument b procedure argument a return address from procedure P1 to main program local variable loc1 local variable loc2

procedure P1(a : word; b : longword); var loc1, loc2 : word; $0A50: SP := SP – (2+2)... ret begin... push h push 0005h $0900: call 00000A50h $0905: SP := SP + (4+2) nop... end.... ?? $ A 00 SP $ SP + 805$ $ xx SP + 2xx$ E xx SP →Xx$ C ??... ← IP will be used as return address ( ← IP) procedure argument b procedure argument a return address from procedure P1 to main program local variable loc1 local variable loc2

procedure P1(a : word; b : longword); var loc1, loc2 : word; $0A50: SP := SP – (2+2)... SP := SP + (2+2) ret begin... push h push 0005h $0900: call 00000A50h $0905: SP := SP + (4+2) nop... end.... ?? $ A 00 SP $ SP + 805$ $ xx SP + 2xx$ E xx SP →xx$ C ??... ← IP procedure argument b procedure argument a return address from procedure P1 to main program local variable loc1 local variable loc2

procedure P1(a : word; b : longword); var loc1, loc2 : word; $0A50: SP := SP – (2+2)... SP := SP + (2+2) ret begin... push h push 0005h $0900: call 00000A50h $0905: SP := SP + (4+2) nop... end.... ?? $ A 00 SP + 607$ SP + 405$ SP →05$ xx $ E xx $ C ??... ← IP will be used as return address ( ← IP) procedure argument b procedure argument a return address from procedure P1 to main program

procedure P1(a : word; b : longword); var loc1, loc2 : word; $0A50: SP := SP – (2+2)... SP := SP + (2+2) ret begin... push h push 0005h $0900: call 00000A50h $0905: SP := SP + (4+2) nop... end.... ?? $ A 00 SP + 607$ SP + 405$ $ xx SP + 2xx$ E xx SP →xx$ C ??... procedure argument b procedure argument a return address from procedure P1 to main program procedure prolog procedure body procedure epilog local variable loc1 local variable loc2

function F1(a : word; b : longword ) : word; var loc1, loc2 : word; $0A50: SP := SP – (2+2)... SP := SP + (2+2) ret var x : word; begin... push h push 0005h $0900: call 00000A50h $0905: ($00000B00)^ := ? SP := SP + (4+2) nop... end.... ?? $ A 00 SP $ SP + 805$ $ ?? SP + 2??$ E ?? SP →??$ C ??... ?? $00000B00... ← IP procedure argument b procedure argument a return address from procedure P1 to main program local variable loc1 local variable loc2 x := F1(5, 7); global variable x begin... end;

function F1(a : word; b : longword ) : word; var loc1, loc2 : word; $0A50: SP := SP – (2+2)... SP := SP + (2+2) ret var x : word; begin... push h push 0005h SP := SP - 2 $0900: call 00000A50h $0905: ($00000B00)^ := ? SP := SP + (4+2+2) nop... end.... ?? $ A 00 SP $ SP $ ?? SP + 8??$ $ E ?? SP + 2??$ C ?? SP →??$ A ??... ?? $00000B00... procedure argument b procedure argument a return address from procedure P1 to main program local variable loc1 local variable loc2 reserved space for return value global variable x x := F1(5, 7); ← IP begin... end;

function F1(a : word; b : longword ) : word; var loc1, loc2 : word; $0A50: SP := SP – (2+2)... (SP + 8)^ := retval SP := SP + (2+2) ret var x : word; begin... push h push 0005h SP := SP - 2 $0900: call 00000A50h $0905: ($00000B00)^ := ? SP := SP + (4+2+2) nop... end.... ?? $ A 00 SP $ SP $ ?? SP + 8??$ $ E ?? SP + 2??$ C ?? SP →??$ A ??... ?? $00000B00... procedure argument b procedure argument a return address from procedure P1 to main program local variable loc1 local variable loc2 reserved space for return value global variable x begin... F1 := retval; end; x := F1(5, 7);

function F1(a : word; b : longword ) : word; var loc1, loc2 : word; $0A50: SP := SP – (2+2)... (SP + 8)^ := retval SP := SP + (2+2) ret var x : word; begin... push h push 0005h SP := SP - 2 $0900: call 00000A50h $0905: (^word($00000B00))^ := SP^ SP := SP + (4+2+2) nop... end.... ?? $ A 00 SP + 407$ SP + 205$ ?? SP →??$ $ E ?? $ C ?? $ A ??... ?? $00000B00... procedure argument b procedure argument a reserved space for return value global variable x x := F1(5, 7); ← IP