Red zone is a fixed size area in memory beyond the stack pointer that has not been "allocated". Compilers do generate assembly to access that area in simple leaf functions.

But I can't see any real advantages for red zone. Accessing memory beyond stack pointer is really dangerous and can easily lead to data corruption. Why even do this? Saving 2 processor instructions (push ebp; mov ebp esp) won't give real speed up.

P.S. There was already question on SO that was closed as off-topic (awful injustice).

  • Yeah, some of the people on Stackoverflow are quite something... :-P – Robbie Dee Feb 24 '14 at 17:10
up vote 12 down vote accepted

The red zone is, purely and simply, an optimization that can save instructions. It means that it's no longer necessary for the emitted code for every function to subtract from the stack pointer to make local storage like so

sub XXX, %rsp 

at the beginning of every function call, even if they are not leaf functions. Often times the code emitted from the compiler can use the temporary space in the red zone below the stack pointer without needing to save it and before calling other functions. This is a useful optimization to have available.

If you no longer have to sub from the stack pointer, the emitted code can use rsp as the base pointer, a job normally reserved for rbp, and the emitted code can use rbp as another general purpose register.

This ultimately means the prologue and epilogue of each function call can save two instructions that would save and restore rbp:

(gnu assembler)

pushq %rbp       # prologue [ two instructions not necessary ]
movq %rsp,%rbp

.... [code]

movq %rbp,%rsp   # epilogue [ two instructions not necessary ]
popq %rbp        

Note that in gcc you can pass the -mno-red-zone flag if you don't want it (but the x86-64 ABI requires it). The Linux kernel does not need to be ABI compliant and thus all kernel code is compiled with -mno-red-zone.

Furthermore, accessing memory beyond the stack pointer is not dangerous if that is the expected mode of operation. It's only dangerous and can lead to corruption when it's unplanned, and unexpected. When the emitted code does it, it knows what it is doing.

  • Yes, I understand this. But is saving 1 instruction (sub from esp) is really optimization? I mean saving few bytes and 1 processor cycle for the price of real possibility of corrupting data looks strange. Maybe there are any other reasons for doing that? – Alexander Dzyoba Feb 24 '14 at 9:01
  • 1
    It's not really the sub from esp that is the optimization, but since you no longer have to sub from esp, you can use esp as the base pointer (normally done by ebp) and use ebp for something else in the function code. Finally, because esp is now the base pointer, the code can avoid saving and restoring ebp in the prologue/epilogue. I'll clarify the answer with this extra information – Brian Onn Feb 24 '14 at 9:30
  • edit and changed to rbp/rsp instead of ebp/esp since the red zone is only a part of the x86-64 ABI (although nothing prevents one from using the same technique with 32 bit registers; but no compilers do it that way today) – Brian Onn Feb 24 '14 at 9:49

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.