| <!--{ |
| "Title": "A Quick Guide to Go's Assembler", |
| "Path": "/doc/asm" |
| }--> |
| |
| <h2 id="introduction">A Quick Guide to Go's Assembler</h2> |
| |
| <p> |
| This document is a quick outline of the unusual form of assembly language used by the <code>gc</code> |
| suite of Go compilers (<code>6g</code>, <code>8g</code>, etc.). |
| It is based on the input to the Plan 9 assemblers, which is documented in detail |
| <a href="http://plan9.bell-labs.com/sys/doc/asm.html">on the Plan 9 site</a>. |
| If you plan to write assembly language, you should read that document although much of it is Plan 9-specific. |
| This document provides a summary of the syntax and |
| describes the peculiarities that apply when writing assembly code to interact with Go. |
| </p> |
| |
| <p> |
| The most important thing to know about Go's assembler is that it is not a direct representation of the underlying machine. |
| Some of the details map precisely to the machine, but some do not. |
| This is because the compiler suite (see |
| <a href="http://plan9.bell-labs.com/sys/doc/compiler.html">this description</a>) |
| needs no assembler pass in the usual pipeline. |
| Instead, the compiler emits a kind of incompletely defined instruction set, in binary form, which the linker |
| then completes. |
| In particular, the linker does instruction selection, so when you see an instruction like <code>MOV</code> |
| what the linker actually generates for that operation might not be a move instruction at all, perhaps a clear or load. |
| Or it might correspond exactly to the machine instruction with that name. |
| In general, machine-specific operations tend to appear as themselves, while more general concepts like |
| memory move and subroutine call and return are more abstract. |
| The details vary with architecture, and we apologize for the imprecision; the situation is not well-defined. |
| </p> |
| |
| <p> |
| The assembler program is a way to generate that intermediate, incompletely defined instruction sequence |
| as input for the linker. |
| If you want to see what the instructions look like in assembly for a given architecture, say amd64, there |
| are many examples in the sources of the standard library, in packages such as |
| <a href="/pkg/runtime/"><code>runtime</code></a> and |
| <a href="/pkg/math/big/"><code>math/big</code></a>. |
| You can also examine what the compiler emits as assembly code: |
| </p> |
| |
| <pre> |
| $ cat x.go |
| package main |
| |
| func main() { |
| println(3) |
| } |
| $ go tool 6g -S x.go # or: go build -gcflags -S x.go |
| |
| --- prog list "main" --- |
| 0000 (x.go:3) TEXT main+0(SB),$8-0 |
| 0001 (x.go:3) FUNCDATA $0,gcargs·0+0(SB) |
| 0002 (x.go:3) FUNCDATA $1,gclocals·0+0(SB) |
| 0003 (x.go:4) MOVQ $3,(SP) |
| 0004 (x.go:4) PCDATA $0,$8 |
| 0005 (x.go:4) CALL ,runtime.printint+0(SB) |
| 0006 (x.go:4) PCDATA $0,$-1 |
| 0007 (x.go:4) PCDATA $0,$0 |
| 0008 (x.go:4) CALL ,runtime.printnl+0(SB) |
| 0009 (x.go:4) PCDATA $0,$-1 |
| 0010 (x.go:5) RET , |
| ... |
| </pre> |
| |
| <p> |
| The <code>FUNCDATA</code> and <code>PCDATA</code> directives contain information |
| for use by the garbage collector; they are introduced by the compiler. |
| </p> |
| |
| <p> |
| To see what gets put in the binary after linking, add the <code>-a</code> flag to the linker: |
| </p> |
| |
| <pre> |
| $ go tool 6l -a x.6 # or: go build -ldflags -a x.go |
| codeblk [0x2000,0x1d059) at offset 0x1000 |
| 002000 main.main | (3) TEXT main.main+0(SB),$8 |
| 002000 65488b0c25a0080000 | (3) MOVQ 2208(GS),CX |
| 002009 483b21 | (3) CMPQ SP,(CX) |
| 00200c 7707 | (3) JHI ,2015 |
| 00200e e83da20100 | (3) CALL ,1c250+runtime.morestack00 |
| 002013 ebeb | (3) JMP ,2000 |
| 002015 4883ec08 | (3) SUBQ $8,SP |
| 002019 | (3) FUNCDATA $0,main.gcargs·0+0(SB) |
| 002019 | (3) FUNCDATA $1,main.gclocals·0+0(SB) |
| 002019 48c7042403000000 | (4) MOVQ $3,(SP) |
| 002021 | (4) PCDATA $0,$8 |
| 002021 e8aad20000 | (4) CALL ,f2d0+runtime.printint |
| 002026 | (4) PCDATA $0,$-1 |
| 002026 | (4) PCDATA $0,$0 |
| 002026 e865d40000 | (4) CALL ,f490+runtime.printnl |
| 00202b | (4) PCDATA $0,$-1 |
| 00202b 4883c408 | (5) ADDQ $8,SP |
| 00202f c3 | (5) RET , |
| ... |
| </pre> |
| |
| |
| <h3 id="symbols">Symbols</h3> |
| |
| <p> |
| Some symbols, such as <code>PC</code>, <code>R0</code> and <code>SP</code>, are predeclared and refer to registers. |
| There are two other predeclared symbols, <code>SB</code> (static base) and <code>FP</code> (frame pointer). |
| All user-defined symbols other than jump labels are written as offsets to these pseudo-registers. |
| </p> |
| |
| <p> |
| The <code>SB</code> pseudo-register can be thought of as the origin of memory, so the symbol <code>foo(SB)</code> |
| is the name <code>foo</code> as an address in memory. |
| </p> |
| |
| <p> |
| The <code>FP</code> pseudo-register is a virtual frame pointer |
| used to refer to function arguments. |
| The compilers maintain a virtual frame pointer and refer to the arguments on the stack as offsets from that pseudo-register. |
| Thus <code>0(FP)</code> is the first argument to the function, |
| <code>8(FP)</code> is the second (on a 64-bit machine), and so on. |
| When referring to a function argument this way, it is conventional to place the name |
| at the beginning, as in <code>first_arg+0(FP)</code> and <code>second_arg+8(FP)</code>. |
| Some of the assemblers enforce this convention, rejecting plain <code>0(FP)</code> and <code>8(FP)</code>. |
| For assembly functions with Go prototypes, <code>go vet</code> will check that the argument names |
| and offsets match. |
| </p> |
| |
| <p> |
| The <code>SP</code> pseudo-register is a virtual stack pointer |
| used to refer to frame-local variables and the arguments being |
| prepared for function calls. |
| It points to the top of the local stack frame, so references should use negative offsets |
| in the range [−framesize, 0): |
| <code>x-8(SP)</code>, <code>y-4(SP)</code>, and so on. |
| On architectures with a real register named <code>SP</code>, the name prefix distinguishes |
| references to the virtual stack pointer from references to the architectural <code>SP</code> register. |
| That is, <code>x-8(SP)</code> and <code>-8(SP)</code> are different memory locations: |
| the first refers to the virtual stack pointer pseudo-register, while the second refers to the |
| hardware's <code>SP</code> register. |
| </p> |
| |
| <p> |
| Instructions, registers, and assembler directives are always in UPPER CASE to remind you |
| that assembly programming is a fraught endeavor. |
| (Exceptions: the <code>m</code> and <code>g</code> register renamings on ARM.) |
| </p> |
| |
| <p> |
| In Go object files and binaries, the full name of a symbol is the |
| package path followed by a period and the symbol name: |
| <code>fmt.Printf</code> or <code>math/rand.Int</code>. |
| Because the assembler's parser treats period and slash as punctuation, |
| those strings cannot be used directly as identifier names. |
| Instead, the assembler allows the middle dot character U+00B7 |
| and the division slash U+2215 in identifiers and rewrites them to |
| plain period and slash. |
| Within an assembler source file, the symbols above are written as |
| <code>fmt·Printf</code> and <code>math∕rand·Int</code>. |
| The assembly listings generated by the compilers when using the <code>-S</code> flag |
| show the period and slash directly instead of the Unicode replacements |
| required by the assemblers. |
| </p> |
| |
| <p> |
| Most hand-written assembly files do not include the full package path |
| in symbol names, because the linker inserts the package path of the current |
| object file at the beginning of any name starting with a period: |
| in an assembly source file within the math/rand package implementation, |
| the package's Int function can be referred to as <code>·Int</code>. |
| This convention avoids the need to hard-code a package's import path in its |
| own source code, making it easier to move the code from one location to another. |
| </p> |
| |
| <h3 id="directives">Directives</h3> |
| |
| <p> |
| The assembler uses various directives to bind text and data to symbol names. |
| For example, here is a simple complete function definition. The <code>TEXT</code> |
| directive declares the symbol <code>runtime·profileloop</code> and the instructions |
| that follow form the body of the function. |
| The last instruction in a <code>TEXT</code> block must be some sort of jump, usually a <code>RET</code> (pseudo-)instruction. |
| (If it's not, the linker will append a jump-to-itself instruction; there is no fallthrough in <code>TEXTs</code>.) |
| After the symbol, the arguments are flags (see below) |
| and the frame size, a constant (but see below): |
| </p> |
| |
| <pre> |
| TEXT runtime·profileloop(SB),NOSPLIT,$8 |
| MOVQ $runtime·profileloop1(SB), CX |
| MOVQ CX, 0(SP) |
| CALL runtime·externalthreadhandler(SB) |
| RET |
| </pre> |
| |
| <p> |
| In the general case, the frame size is followed by an argument size, separated by a minus sign. |
| (It's not an subtraction, just idiosyncratic syntax.) |
| The frame size <code>$24-8</code> states that the function has a 24-byte frame |
| and is called with 8 bytes of argument, which live on the caller's frame. |
| If <code>NOSPLIT</code> is not specified for the <code>TEXT</code>, |
| the argument size must be provided. |
| </p> |
| |
| <p> |
| Note that the symbol name uses a middle dot to separate the components and is specified as an offset from the |
| static base pseudo-register <code>SB</code>. |
| This function would be called from Go source for package <code>runtime</code> using the |
| simple name <code>profileloop</code>. |
| </p> |
| |
| <p> |
| For <code>DATA</code> directives, the symbol is followed by a slash and the number |
| of bytes the memory associated with the symbol occupies. |
| The arguments are optional flags and the data itself. |
| For instance, |
| </p> |
| |
| <pre> |
| DATA runtime·isplan9(SB)/4, $1 |
| </pre> |
| |
| <p> |
| declares the local symbol <code>runtime·isplan9</code> of size 4 and value 1. |
| Again the symbol has the middle dot and is offset from <code>SB</code>. |
| </p> |
| |
| <p> |
| The <code>GLOBL</code> directive declares a symbol to be global. |
| The arguments are optional flags and the size of the data being declared as a global, |
| which will have initial value all zeros unless a <code>DATA</code> directive |
| has initialized it. |
| The <code>GLOBL</code> directive must follow any corresponding <code>DATA</code> directives. |
| This example |
| </p> |
| |
| <pre> |
| GLOBL runtime·tlsoffset(SB),$4 |
| </pre> |
| |
| <p> |
| declares <code>runtime·tlsoffset</code> to have size 4. |
| </p> |
| |
| <p> |
| There may be one or two arguments to the directives. |
| If there are two, the first is a bit mask of flags, |
| which can be written as numeric expressions, added or or-ed together, |
| or can be set symbolically for easier absorption by a human. |
| Their values, defined in the file <code>src/cmd/ld/textflag.h</code>, are: |
| </p> |
| |
| <ul> |
| <li> |
| <code>NOPROF</code> = 1 |
| <br> |
| (For <code>TEXT</code> items.) |
| Don't profile the marked function. This flag is deprecated. |
| </li> |
| <li> |
| <code>DUPOK</code> = 2 |
| <br> |
| It is legal to have multiple instances of this symbol in a single binary. |
| The linker will choose one of the duplicates to use. |
| </li> |
| <li> |
| <code>NOSPLIT</code> = 4 |
| <br> |
| (For <code>TEXT</code> items.) |
| Don't insert the preamble to check if the stack must be split. |
| The frame for the routine, plus anything it calls, must fit in the |
| spare space at the top of the stack segment. |
| Used to protect routines such as the stack splitting code itself. |
| </li> |
| <li> |
| <code>RODATA</code> = 8 |
| <br> |
| (For <code>DATA</code> and <code>GLOBL</code> items.) |
| Put this data in a read-only section. |
| </li> |
| <li> |
| <code>NOPTR</code> = 16 |
| <br> |
| (For <code>DATA</code> and <code>GLOBL</code> items.) |
| This data contains no pointers and therefore does not need to be |
| scanned by the garbage collector. |
| </li> |
| <li> |
| <code>WRAPPER</code> = 32 |
| <br> |
| (For <code>TEXT</code> items.) |
| This is a wrapper function and should not count as disabling <code>recover</code>. |
| </li> |
| </ul> |
| |
| <h2 id="architectures">Architecture-specific details</h2> |
| |
| <p> |
| It is impractical to list all the instructions and other details for each machine. |
| To see what instructions are defined for a given machine, say 32-bit Intel x86, |
| look in the top-level header file for the corresponding linker, in this case <code>8l</code>. |
| That is, the file <code>$GOROOT/src/cmd/8l/8.out.h</code> contains a C enumeration, called <code>as</code>, |
| of the instructions and their spellings as known to the assembler and linker for that architecture. |
| In that file you'll find a declaration that begins |
| </p> |
| |
| <pre> |
| enum as |
| { |
| AXXX, |
| AAAA, |
| AAAD, |
| AAAM, |
| AAAS, |
| AADCB, |
| ... |
| </pre> |
| |
| <p> |
| Each instruction begins with a initial capital <code>A</code> in this list, so <code>AADCB</code> |
| represents the <code>ADCB</code> (add carry byte) instruction. |
| The enumeration is in alphabetical order, plus some late additions (<code>AXXX</code> occupies |
| the zero slot as an invalid instruction). |
| The sequence has nothing to do with the actual encoding of the machine instructions. |
| Again, the linker takes care of that detail. |
| </p> |
| |
| <p> |
| One detail evident in the examples from the previous sections is that data in the instructions flows from left to right: |
| <code>MOVQ</code> <code>$0,</code> <code>CX</code> clears <code>CX</code>. |
| This convention applies even on architectures where the usual mode is the opposite direction. |
| </p> |
| |
| <p> |
| Here follows some descriptions of key Go-specific details for the supported architectures. |
| </p> |
| |
| <h3 id="x86">32-bit Intel 386</h3> |
| |
| <p> |
| The runtime pointers to the <code>m</code> and <code>g</code> structures are maintained |
| through the value of an otherwise unused (as far as Go is concerned) register in the MMU. |
| A OS-dependent macro <code>get_tls</code> is defined for the assembler if the source includes |
| an architecture-dependent header file, like this: |
| </p> |
| |
| <pre> |
| #include "zasm_GOOS_GOARCH.h" |
| </pre> |
| |
| <p> |
| Within the runtime, the <code>get_tls</code> macro loads its argument register |
| with a pointer to a pair of words representing the <code>g</code> and <code>m</code> pointers. |
| The sequence to load <code>g</code> and <code>m</code> using <code>CX</code> looks like this: |
| </p> |
| |
| <pre> |
| get_tls(CX) |
| MOVL g(CX), AX // Move g into AX. |
| MOVL m(CX), BX // Move m into BX. |
| </pre> |
| |
| <h3 id="amd64">64-bit Intel 386 (a.k.a. amd64)</h3> |
| |
| <p> |
| The assembly code to access the <code>m</code> and <code>g</code> |
| pointers is the same as on the 386, except it uses <code>MOVQ</code> rather than |
| <code>MOVL</code>: |
| </p> |
| |
| <pre> |
| get_tls(CX) |
| MOVQ g(CX), AX // Move g into AX. |
| MOVQ m(CX), BX // Move m into BX. |
| </pre> |
| |
| <h3 id="arm">ARM</h3> |
| |
| <p> |
| The registers <code>R9</code>, <code>R10</code>, and <code>R11</code> |
| are reserved by the compiler and linker. |
| </p> |
| |
| <p> |
| <code>R9</code> and <code>R10</code> point to the <code>m</code> (machine) and <code>g</code> |
| (goroutine) structures, respectively. |
| Within assembler source code, these pointers must be referred to as <code>m</code> and <code>g</code>; |
| the names <code>R9</code> and <code>R10</code> are not recognized. |
| </p> |
| |
| <p> |
| To make it easier for people and compilers to write assembly, the ARM linker |
| allows general addressing forms and pseudo-operations like <code>DIV</code> or <code>MOD</code> |
| that may not be expressible using a single hardware instruction. |
| It implements these forms as multiple instructions, often using the <code>R11</code> register |
| to hold temporary values. |
| Hand-written assembly can use <code>R11</code>, but doing so requires |
| being sure that the linker is not also using it to implement any of the other |
| instructions in the function. |
| </p> |
| |
| <p> |
| When defining a <code>TEXT</code>, specifying frame size <code>$-4</code> |
| tells the linker that this is a leaf function that does not need to save <code>LR</code> on entry. |
| </p> |
| |
| <p> |
| The name <code>SP</code> always refers to the virtual stack pointer described earlier. |
| For the hardware register, use <code>R13</code>. |
| </p> |
| |
| <h3 id="unsupported_opcodes">Unsupported opcodes</h3> |
| |
| <p> |
| The assemblers are designed to support the compiler so not all hardware instructions |
| are defined for all architectures: if the compiler doesn't generate it, it might not be there. |
| If you need to use a missing instruction, there are two ways to proceed. |
| One is to update the assembler to support that instruction, which is straightforward |
| but only worthwhile if it's likely the instruction will be used again. |
| Instead, for simple one-off cases, it's possible to use the <code>BYTE</code> |
| and <code>WORD</code> directives |
| to lay down explicit data into the instruction stream within a <code>TEXT</code>. |
| Here's how the 386 runtime defines the 64-bit atomic load function. |
| </p> |
| |
| <pre> |
| // uint64 atomicload64(uint64 volatile* addr); |
| // so actually |
| // void atomicload64(uint64 *res, uint64 volatile *addr); |
| TEXT runtime·atomicload64(SB), NOSPLIT, $0-8 |
| MOVL 4(SP), BX |
| MOVL 8(SP), AX |
| // MOVQ (%EAX), %MM0 |
| BYTE $0x0f; BYTE $0x6f; BYTE $0x00 |
| // MOVQ %MM0, 0(%EBX) |
| BYTE $0x0f; BYTE $0x7f; BYTE $0x03 |
| // EMMS |
| BYTE $0x0F; BYTE $0x77 |
| RET |
| </pre> |