How are variable arguments implemented in gcc?

Question

int max(int n, ...) 

I am using cdecl calling convention where the caller cleans up the variable after the callee returns.

I am interested in knowing how do the macros va_end, va_start and va_arg work?

Does the caller pass in the address of the array of arguments as the second argument to max?

Answer 1

If you look at the way the C language stores the parameters on the stack, the way the macros work should become clear:-

Higher memory address    Last parameter                          Penultimate parameter                          ....                          Second parameter Lower memory address     First parameter        StackPointer  ->  Return address 

(note, depending on the hardware the stack pointer maybe one line down and the higher and lower may be swapped)

The arguments are always stored like this¹, even without the ... parameter type.

The va_start macro just sets up a pointer to the first function parameter, e.g.:-

 void func (int a, ...)  {     // va_start    char *p = (char *) &a + sizeof a;  } 

which makes p point to the second parameter. The va_arg macro does this:-

 void func (int a, ...)  {     // va_start    char *p = (char *) &a + sizeof a;     // va_arg    int i1 = *((int *)p);    p += sizeof (int);     // va_arg    int i2 = *((int *)p);    p += sizeof (int);     // va_arg    long i2 = *((long *)p);    p += sizeof (long);  } 

The va_end macro just sets the p value to NULL.

NOTES:

1. Optimising compilers and some RISC CPUs store parameters in registers rather than use the stack. The presence of the ... parameter would switch off this ability and for the compiler to use the stack.

Answer 2

As arguments are passed on the stack, the va_ "functions" (they are most of the time implemented as macros) simply manipulate a private stack pointer. This private stack pointer is stored from the argument passed to va_start, and then va_arg "pops" the arguments from the "stack" as it iterates the parameters.

Lets say you call the function max with three parameters, like this:

max(a, b, c); 

Inside the max function, the stack basically looks like this:

       +-----+       |  c  |       |  b  |       |  a  |       | ret | SP -> +-----+ 

SP is the real stack pointer, and it's not really a, b and c that on the stack but their values. ret is the return address, where to jump to when the function is done.

What va_start(ap, n) does is take the address of the argument (n in your function prototype) and from that calculates the position of the next argument, so we get a new private stack pointer:

       +-----+       |  c  | ap -> |  b  |       |  a  |       | ret | SP -> +-----+ 

When you use va_arg(ap, int) it returns what the private stack pointer points to, and then "pops" it by changing the private stack pointer to now point at the next argument. The stack now look like this:

       +-----+ ap -> |  c  |       |  b  |       |  a  |       | ret | SP -> +-----+ 

This description is of course simplified, but shows the principle.