Red zone is a fixed size area in memory beyond the stack pointer that has not been "allocated". Compilers do generate assembly to access that area in simple leaf functions.

But I can't see any real advantages for red zone. Accessing memory beyond stack pointer is really dangerous and can easily lead to data corruption. Why even do this? Saving 2 processor instructions (push ebp; mov ebp esp) won't give real speed up.


1 Answer 1


The red zone is, purely and simply, an optimization that can save instructions. It means that it's no longer necessary for the emitted code for every function to subtract from the stack pointer to make local storage like so

sub XXX, %rsp 

at the beginning of every function call, even if they are not leaf functions. Often times the code emitted from the compiler can use the temporary space in the red zone below the stack pointer without needing to save it and before calling other functions. This is a useful optimization to have available.

If you no longer have to sub from the stack pointer, the emitted code can use rsp as the base pointer, a job normally reserved for rbp, and the emitted code can use rbp as another general purpose register.

This ultimately means the prologue and epilogue of each function call can save two instructions that would save and restore rbp:

(gnu assembler)

pushq %rbp       # prologue [ two instructions not necessary ]
movq %rsp,%rbp

.... [code]

movq %rbp,%rsp   # epilogue [ two instructions not necessary ]
popq %rbp        

Note that in gcc you can pass the -mno-red-zone flag if you don't want it (but the x86-64 ABI requires it). The Linux kernel does not need to be ABI compliant and thus all kernel code is compiled with -mno-red-zone.

Furthermore, accessing memory beyond the stack pointer is not dangerous if that is the expected mode of operation. It's only dangerous and can lead to corruption when it's unplanned, and unexpected. When the emitted code does it, it knows what it is doing.

  • 1
    Yes, I understand this. But is saving 1 instruction (sub from esp) is really optimization? I mean saving few bytes and 1 processor cycle for the price of real possibility of corrupting data looks strange. Maybe there are any other reasons for doing that? Feb 24, 2014 at 9:01
  • 5
    It's not really the sub from esp that is the optimization, but since you no longer have to sub from esp, you can use esp as the base pointer (normally done by ebp) and use ebp for something else in the function code. Finally, because esp is now the base pointer, the code can avoid saving and restoring ebp in the prologue/epilogue. I'll clarify the answer with this extra information
    – Brian Onn
    Feb 24, 2014 at 9:30
  • edit and changed to rbp/rsp instead of ebp/esp since the red zone is only a part of the x86-64 ABI (although nothing prevents one from using the same technique with 32 bit registers; but no compilers do it that way today)
    – Brian Onn
    Feb 24, 2014 at 9:49
  • 3
    Frame pointer omission is not related to the red zone at all -- the compiler can index the stack using %rsp as a base pointer either way.
    – alecov
    Jul 22, 2019 at 15:35
  • An x86_64 kernel uses mno-red-zone because when there is an interrupt with no privilege transition, and no IST slot was used (the common case), the CPU will use the current rsp to push the interrupt stack frame. If there were a red zone there, it would be trashed. The kernel wishes it could use the red zone because, as stated in this answer, it saves instructions.
    – doug65536
    May 8, 2021 at 4:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.