title: Where, and why, is the x64 frame pointer supposed to point? (Windows x64 ABI)
body: <p>I've been reading a long catalog of very good articles on the Windows x64 ABI. A very minor aspect of these articles is the description of the frame pointer. The general gist is that, because the Windows x64 call stack rules are so rigid, a dedicated frame pointer is <em>typically</em> not needed, although it is optional.</p>
  
  <p>The one exception I have seen consistently noted is when <a href="http://man7.org/linux/man-pages/man3/alloca.3.html" rel="noreferrer"><code>alloca()</code></a> is used to dynamically allocate memory on the stack. Functions doing so apparently <em>require</em> a frame pointer. For example, to quote from Microsoft's documentation on <a href="http://msdn.microsoft.com/en-us/library/ew5tede7.aspx" rel="noreferrer">"Stack Allocation"</a> (italics and bold added by me):</p>
  
  <blockquote>
    <p>If space is dynamically allocated (alloca) in a function, then <em>a nonvolatile register <strong>must</strong> be used as a frame pointer to mark the base of the <strong>fixed part</strong> of the stack</em> and that register <strong><em>must</em></strong> be saved and initialized in the prolog. Note that when alloca is used, calls to the same callee from the same caller may have different home addresses for their register parameters.</p>
  </blockquote>
  
  <p>To this, Microsoft's x64 ABI <a href="http://msdn.microsoft.com/en-us/library/x9sx5da1.aspx" rel="noreferrer"><code>alloca()</code> documentation</a> cryptically adds:</p>
  
  <blockquote>
    <p>_alloca is required to be 16-byte aligned and additionally <em>required to use</em> a frame pointer.</p>
  </blockquote>
  
  <p>First of all, <strong>why</strong> must it be used? I assume for call stack unwinding on exception but I haven't yet found a satisfactory explanation.</p>
  
  <p>Next question: <strong>where</strong> must it point? In the first of the two above quotations, it says it "must" be used to mark the base of the "<strong>fixed part</strong> of the stack". What's the "fixed part of the stack"? I get the impression this term denotes, in a given frame, the range of addresses that comprises (higher addresses to lower ones):</p>
  
  <ul>
  <li>the caller return address (if you consider it part of the current function's frame);</li>
  <li>the addresses to which non-volatile registers were saved by the function prologue; and</li>
  <li>the addresses where local variables are being stored.</li>
  </ul>
  
  <p>Again, I haven't found a satisfactory definition for this "fixed part". The <a href="http://msdn.microsoft.com/en-us/library/ew5tede7.aspx" rel="noreferrer">"Stack Allocation"</a> page I linked to above contains the diagram below along with the words "if used, the stack pointer will <em>generally</em> point here":</p>
  
  <p><img src="https://i.stack.imgur.com/ZzTJm.png" alt="enter image description here"></p>
  
  <p><a href="http://www.altdev.co/2012/09/27/windows-x64-abi-stack-frames/" rel="noreferrer">This very nifty blog post</a> is equally vague, including a diagram stating the frame pointer "points somewhere in here", where "here" is the addresses for the saved non-volatile registers and the locals.</p>
  
  <p>One last bit of crypticness, from Microsoft's MSDN article entitled <a href="http://msdn.microsoft.com/en-us/library/7d1yf42w.aspx" rel="noreferrer">"Dynamic Parameter Stack Area Construction"</a>, which contains only this:</p>
  
  <blockquote>
    <p>If a frame pointer is used, the option exists to dynamically create the parameter stack area. This is not currently done in the x64 compiler.</p>
  </blockquote>
  
  <p>What does "generally" mean? Where is "somewhere in here"? What's the option that exists? Is there a rule? Who cares?</p>
  
  <p>Or, tl;dr: What the title asks. Any answer containing annotated assembly gratefully accepted.</p>