Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!mailrus!tut.cis.ohio-state.edu!cs.utexas.edu!uunet!microsoft!paulc
From: paulc@microsoft.UUCP (Paul Canniff 2/1011)
Newsgroups: comp.windows.ms
Subject: Re: Windows prolog/epilog
Message-ID: <5789@microsoft.UUCP>
Date: 23 May 89 15:55:39 GMT
References: <1992@dataio.Data-IO.COM>
Reply-To: paulc@microsoft.UUCP (Paul Canniff 2/1011)
Organization: Microsoft Corp., Redmond WA
Lines: 42

In article <1992@dataio.Data-IO.COM> bright@dataio.Data-IO.COM (Walter Bright) writes:
>In examining the Windows prolog and epilog code for functions, it is:
>prolog:
>	mov	AX,DS		;?????
>	nop			;?????
>	inc	BP		;?????
>	push	BP		;save previous
>	mov	BP,SP		;setup frame pointer for locals
>	push	DS
>	mov	DS,AX
>	sub	SP,xx		;make room for locals
>
>epilog:
>	sub	BP,2		;account for the PUSH DS
>	mov	SP,BP		;remove locals
>	pop	DS
>	pop	BP
>	dec	BP		;????
>	ret
>
>Can anybody explain what's going on with the DS manipulation, the NOP
>and the inc and dec of BP? I suspect that the MOV AX,DS NOP is replaced
>at runtime with a MOV AX,VALUE, but I can't figure the INC BP.

Your assumption on DS is correct.  The BP stuff is to allow Windows to
"walk the stack" backwards, differentiating far calls from near
calls, so it can move data around.  When it moves data, it needs
to clean up all those "pushed" DS values that are on the stack,
or else when you start returning from functions you will be loading
DS with an out-of-date value.  And when it moves code, it must change
any RETF's (actually the value of 'CS' on the stack) to the new
value.  And if code is discarded, RETF's actually jump to the
cde which reloads the application code segment.

Windows could not know which functions were entered with a FAR
call and which with a NEAR.  If that were the case it would be 
impossible to "walk the stack" accurately.  By tweaking BP on
each FAR function entry, it is possible to tell NEAT from FAR.

For more info on this and other such tidbits, I recommend picking up
_Programming Windows_  (CHarles Petzold, Microsoft Press), which is
a great addition to any Windows SDK.