c -为什么我的内核崩溃时，我添加更多的参数到一个函数?

Question

我正试图在C中构建一个自定义内核，我想在屏幕上放置一个彩色像素。
我已经切换到保护模式，并将VGA模式设置为0x13，所以我用C编写了一个函数，将一个粉红色的像素放在屏幕的右上角:

#include <stdint.h>
#define VGA_MODE 0x13
#define VRAM 0xA0000
#define MAX_HEIGHT 200
#define MAX_LENGTH 320
void PutPixel(uint8_t color, uint16_t x)
{
// Return if x greater than 320
if(x > MAX_LENGTH) return;
unsigned char* ptr = (unsigned char*) VRAM;
ptr += x;
*ptr = color;
return;
}
void KERNEL_MAIN()
{
PutPixel(5, 320);
return;
}

这段代码运行得非常好，直到我想将y偏移量作为参数添加到PutPixel函数中，以便在另一行上绘制像素:

#include <stdint.h>
#define VGA_MODE 0x13
#define VRAM 0xA0000
#define MAX_HEIGHT 200
#define MAX_LENGTH 320
void PutPixel(uint8_t color, uint16_t x, uint16_t y)
{
// Return if x greater than 320
if(x > MAX_LENGTH) return;
unsigned char* ptr = (unsigned char*) VRAM;
ptr += x;
*ptr = color;
return;
}
void KERNEL_MAIN()
{
PutPixel(5, 320, 1);
return;
}

即使我没有实际使用参数，当我在VirtualBox中运行代码时，它立即崩溃，我在VirtualBox调试器中得到以下错误:

dbgf event: DBGFSTOP (hyper)
File:     VINF_EM_TRIPLE_FAULT
Line:     0
Function: <NULL>
eax=000a013e ebx=00007eae ecx=00000005 edx=00000005 esi=00000000 edi=0000fff0
eip=00000083 esp=0002ffac ebp=490002ff iopl=0 nv up di pl nz na pe nc
cs=0008 ds=0010 es=0010 fs=0010 gs=0010 ss=0010               eflags=00200002
0008:00000083 f0 53                   Illegal opcode
VBoxDbg>

请帮我一下好吗?

编辑:我发现堆栈被一个字节弄乱了，所以我反汇编函数调用，它看起来像这样:

%0000000000007ee7 55                      push ebp
%0000000000007ee8 48                      dec eax
%0000000000007ee9 89 e5                   mov ebp, esp
%0000000000007eeb 48                      dec eax
%0000000000007eec 83 ec 10                sub esp, byte 000000010h
%0000000000007eef 89 d0                   mov eax, edx
%0000000000007ef1 44                      inc esp               ;???
%0000000000007ef2 89 c2                   mov edx, eax
%0000000000007ef4 88 4d 10                mov byte [ebp+010h], cl
%0000000000007ef7 66 89 45 18             mov word [ebp+018h], ax
%0000000000007efb 89 d0                   mov eax, edx
%0000000000007efd 66 89 45 20             mov word [ebp+020h], ax
%0000000000007f01 66 81 7d 18 40 01       cmp word [ebp+018h], word 00140h
%0000000000007f07 77 1c                   jnbe +01ch (000007f25h)
%0000000000007f09 48                      dec eax
%0000000000007f0a c7 45 f8 00 00 0a 00    mov dword [ebp-008h], 0000a0000h
%0000000000007f11 0f b7 45 18             movzx eax, [ebp+018h]
%0000000000007f15 48                      dec eax
%0000000000007f16 01 45 f8                add dword [ebp-008h], eax
%0000000000007f19 48                      dec eax
%0000000000007f1a 8b 45 f8                mov eax, dword [ebp-008h]
%0000000000007f1d 0f b6 55 10             movzx edx, byte [ebp+010h]
%0000000000007f21 88 10                   mov byte [eax], dl
%0000000000007f23 eb 01                   jmp +001h (000007f26h)
%0000000000007f25 90                      nop
%0000000000007f26 48                      dec eax
%0000000000007f27 83 c4 10                add esp, byte 000000010h
%0000000000007f2a 5d                      pop ebp
%0000000000007f2b c3                      retn

当我在0x7ef1处丢弃inc esp指令时，retn正确地弹出返回地址，但是为什么这个指令甚至在那里呢?

Answer 1

我在添加编译器选项时找到了解决方案:

gcc -mno-red-zone

它现在工作完美无瑕，谢谢!