Assembly (i386, x86_64)

The core of an assembly language program is the instruction codes used to create the program. To help facilitate writing the instruction codes, assemblers equate mnemonic words with instruction code functions.

For example, the instruction code sample:

55
89 E5
83 EC 08
C7 45 FC 01 00 00 00
83 EC 0C
6A 00
E8 D1 FE FF FF

can be written in assembly language as follows:

push %ebp
mov %esp, %ebp
sub $0x8, %esp
movl $0x1, -4(%ebp)
sub $0xc, %esp
push $0x0
call 8048348

Besides the instruction codes, most programs also require data elements to be used to hold variable and constant data values that are used throughout the program.

一般地，汇编语言中有两种方法来存储和获取数据：使用内存和使用栈。

Assemblers reserve special keywords (i.e. directives) for instructing the assembler how to perform special functions as the mnemonics are converted to instruction codes.

Directives are preceded by a period to set them apart from labels.

Many different directives are used to help make the programmer’s job of creating instruction codes easier. Some modern assemblers have lists of directives that can rival many high-level language features, such as while loops, and if-then statements!

参考：
GNU Assembler Directives: https://sourceware.org/binutils/docs-2.25/as/Pseudo-Ops.html

The GNU assembler declares sections using the .section declarative statement. The .section statement takes a single argument, the type of section it is declaring.

The assembly language template should look something like this:

.section .data
    < initialized data here>
.section .bss
    < uninitialized data here>
.section .text
.globl _start
_start:
    <instruction code goes here>

说明 1：
The _start label is used to indicate the instruction from which the program should start running.
如果不想使用 _start 作为默认的起始执行地址，则需要使用链接器的-e 参数来指定特定的起始执行地址。

说明 2：
Besides declaring the starting label in the application, you also need to make the entry point available for external applications. This is done with the .globl directive.
The .globl directive declares program labels that are accessible from external programs. If you are writing a bunch of utilities that are being used by external assembly or C language programs, each function section label should be declared with a .globl directive.

参考：
Intel® 64 and IA-32 Architectures Software Developer Manuals, Volume 1: Basic Architecture, Appendix A EFLAGS Cross-Reference
Intel® 64 and IA-32 Architectures Software Developer Manuals, Volume 1: Basic Architecture, Appendix B EFLAGS Condition Codes

用 gdb 调试 Mac 中的 64 位程序时，gdb 显示 ss,ds,es 这 3 个寄存器为 unavailable。

(gdb) info registers
rax            0x100000f80	4294971264
rbx            0x0	0
rcx            0x7fff5fbffc70	140734799805552
rdx            0x7fff5fbffba0	140734799805344
rsi            0x7fff5fbffb90	140734799805328
rdi            0x1	1
rbp            0x7fff5fbffb70	0x7fff5fbffb70
rsp            0x7fff5fbffb70	0x7fff5fbffb70
r8             0x0	0
r9             0x7fff5fbfec38	140734799801400
r10            0x32	50
r11            0x246	582
r12            0x0	0
r13            0x0	0
r14            0x0	0
r15            0x0	0
rip            0x100000f84	0x100000f84 <main+4>
eflags         0x246	[ PF ZF IF ]
cs             0x2b	43
ss             <unavailable>
ds             <unavailable>
es             <unavailable>
fs             0x0	0
gs             0x0	0

.equ 和.set 作用相同，是同义词，用来设置符号为指定的表达式。

.equ symbol, expression
.set symbol, expression

一旦某符号被设置为指定的表达式后，它将不能被修改。

在引用 static symbol 时，要在 symbol 前面加美元符号。 如：

.equ LINUX_SYS_CALL, 0x80

movl $LINUX_SYS_CALL, %eax

Defining data elements in the bss section is somewhat different from defining them in the data section. Instead of declaring specific data types, you just declare raw segments of memory that are reserved for whatever purpose you need them for.

The GNU assembler uses two directives to declare buffers, as shown in the following table.

One benefit to declaring data in the bss section is that the data is not included in the executable program. When data is defined in the data section, it must be included in the executable program, since it must be initialized with a specific value.

立即数和寄存器类型的操作数，其使用较简单。
当操作数为存储器类型时，有多种表现形式。

存储器寻址的通用形式为：

offset_address(base_address, index, size)

其中，base_address 和 index 必须是寄存器；size 必须为 1，2，4 或 8。

对应 effective address 的计算方法为：

base_address + offset_address + index * size

由计算公式可知，offset_address 和 base_address 的位置在通用形式中可以互换，不影响结果。

通用形式中的某部分为 0 时可以省略，这样就有很多更简单的形式。
如：

movl %ebx, (%edi)   # moves the value in the EBX register to the memory location contained in the EDI register.
movl %edx, -4(%edi) # moves the value in the EDX register to the memory location 4 bytes before the location pointed to by the EDI register.

可用 leal 指令计算有效地址，并保存结果到寄存器。如：

leal -4(%ebp), %eax   # 把-4(%ebp)对应的有效地址保存到EAX寄存器中

把较小源数据复制到较大位置是合法的，高位用符号位扩展(MOVSXX)或者零扩展(MOVZXX)进行填充。

MOVSXX 和 MOVZXX 中的 X 是 b w l q 中的一个，只要第 1 个 X 比第 2 个 X“小”即可。
如：
movsbl
movsbq
movswq

movzbl
movzbq
movzwq

条件数据传递指令是 Intel 在 P6 微处理器架构中开始引入的。
条件数据传递指令可以作为条件转移的一种替代策略。这种策略先计算一个条件操作的两种结果，然后再根据条件是否满足从而选取一个。但只有在某些情况下（如计算两种结果时相互没有副作用）这种策略才可行。
条件数据传递指令比条件转移指令的性能更好，它更好地匹配现代处理器的性能特性（条件数据传递指令没有分支预测错误的处罚，更容易保持流水线是满的）。

参考：Computer Systems A Programmer’s Perspective, 2nd. 3.6.6 Conditional Move Instructions

为了向下兼容，gcc 在 IA32 系统中默认不会生成条件数据传递指令；在 x86_64 系统下，gcc 会优先使用条件数据传递指令。
考虑下面 C 程序：

int max(int x, int y)
{
  return x < y ? y : x;
}

用 gcc -m32 -S max.c 生成 32-bit 汇编代码（使用条件转换指令）：

max:
        pushl   %ebp
        movl    %esp, %ebp
        movl    12(%ebp), %edx
        movl    8(%ebp), %eax
        cmpl    %edx, %eax
        jge     .L3
        movl    %edx, %eax
.L3:
        popl    %ebp
        ret

用 gcc -m64 -S max.c 生成 64-bit 汇编代码（使用条件数据传递指令）：

max:
        pushq   %rbp
        movq    %rsp, %rbp
        movl    %edi, -4(%rbp)
        movl    %esi, -8(%rbp)
        movl    -8(%rbp), %eax    # mov y to eax
        cmpl    %eax, -4(%rbp)    # compare y and x
        cmovge  -4(%rbp), %eax    # If >=, then set y as return value
        popq    %rbp
        ret

The XCHG instruction can exchange data values between two general-purpose registers, or between a register and a memory location.

The format of the instruction is as follows:

xchg operand1, operand2

Either operand1 or operand2 can be a general-purpose register or a memory location (but both cannot be a memory location). The command can be used with any general-purpose register, although the two operands must be the same size.

When one of the operands is a memory location, the processor’s LOCK signal is automatically asserted, preventing any other processor from accessing the memory location during the exchange.

Note: Be careful when using the XCHG instruction with memory locations. The LOCK process is very time-consuming, and can be detrimental to your program’s performance.

The CMPXCHG instruction compares the destination operand with the value in the EAX, AX, or AL registers. If the values are equal, the value of the source operand value is loaded into the destination operand and the zero flag is set. If the values are not equal, the destination operand value is loaded into the EAX, AX, or AL registers and the zero flag is cleared.

In the GNU assembler, the format of the CMPXCHG instruction is as follows:

cmpxchg source, destination

The destination operand can be a register, or a memory location. The source operand must be a register whose size matches the destination operand.

The parity flag indicates the number of bits that should be one in a mathematical answer. This can be used as a crude error-checking system to ensure that the mathematical operation was successful.

If the number of bits set to one in the resultant is even, the parity bit is set (one). If the number of bits set to one in the resultant is odd, the parity bit is not set (zero).

比特位为 1 的个数为偶数时，PF=1；比特位为 1 的个数为奇数时，PF=0。

# paritytest.s - An example of testing the parity flag
.section .text
.globl _start
_start:
    movl $4, %ebx
    subl $3, %ebx       # try: subl $1, %ebx
    jp overhere
    movl $200, %ebx     # exit 200
    movl $1, %eax
    int $0x80
overhere:
    movl $100, %ebx     # exit 100
    movl $1, %eax
    int $0x80

In this snippet, the result from the subtraction is 1, which in binary is 00000001. Because the number of one bits is odd, the parity flag is not set, so the JP instruction should not branch.

$ gcc -g -m32 -nostdlib paritytest.s -o paritytest
$ ./paritytest
$ echo $?
200

如果把程序中 subl $3, %ebx 修改为 subl $1, %ebx ，则减法操作的结果为 3，二进制表示为 00000011，其中有偶数个 1，PF 会置为 1，jp 指令会跳转到 overhere，故程序退出码会为 100。

do-while 的形式如下：

do
  body-statement
  while (test-expr);

把上面循环转换为 goto 语句版本，如下：

loop:
  body-statement
  t = test-expr;
  if (t)
    goto loop;

while 循环的形式如下：

while (test-expr)
  body-statement

可改为下面的 do-while 循环形式：

if (!test-expr)
  goto done;
do
  body-statement
  while (test-expr);
done:

最终，可得到下面到 goto 语句版本：

  t = test-expr;
  if (!t)
    goto done;
loop:
  body-statement
  t = test-expr;
  if (t)
    goto loop;
done:

for 循环的形式如下：

for (init-expr; test-expr; update-expr)
  body-statement

可改为下面的 do-while 循环形式：

init-expr;
if (!test-expr)
  goto done;
do {
  body-statement
  update-expr;
} while (test-expr);
done:

最终，可得到下面到 goto 语句版本：

  init-expr;
  t = test-expr;
  if (!t)
    goto done;
loop:
  body-statement
  update-expr;
  t = test-expr;
  if (t)
    goto loop;
done:

本节实例来自：深入理解计算机系统（第 2 版），2.4.3 数字示例

内存或寄存器中如何表示单精度浮点数 12345.0 呢？

容易知道整数 12345 的二进制表示为 11000000111001。
将二进制小数点左移 13 位，得到一个规格化的表示 \(12345.0=1.1000000111001_2 \times 2^{13}\) 。
IEEE 单精度浮点数的 significand 部分在编码时占 23 位，这里已经有了 13 位（注意：规格化表示中小数点前面的 1 不用体现在编码中），所以在末尾再增加 10 个 0，这样 significand 部分就构造完成了，为 10000001110010000000000。

为了构造阶码字段，我们用 13 加上单精度浮点数的偏置量（Bias value）127，得到 140，其二进制表示为 10001100。

加上符号位 0，最终得到单精度浮点数 12345.0 的表示为：0100 0110 0100 0000 1110 0100 0000 0000，如果解释为十六进制则为 0x4640e400。

注：“单精度浮点数的偏置量 127”的说明可参考：深入理解计算机系统（第 2 版），2.4.2 IEEE 浮点表示

x86 处理器支持两种浮点体系结构：基于栈的 x87 浮点体系结构和基于寄存器的 SSE 浮点体系结构。
关于浮点操作，在 IA32 平台，GCC 默认产生 x87 代码；在 x86-64 平台，GCC 默认产生 SSE 代码。

# movstest1.s - An example of the MOVS instructions
.section .data
value1:
    .ascii "This is a test string.\n"
.section .bss
    .lcomm output, 23
.section .text
.globl _start
_start:
    nop
    leal value1, %esi      # same as: movl $value1, $esi
    leal output, %edi      # same as: movl $output, $edi
    movsb
    movsw
    movsl

    # exit 0
    movl $1, %eax
    movl $0, %ebx
    int $0x80

$ gcc -g -m32 -nostdlib movstest1.s -o movstest1
$ gdb -q ./movstest1
Reading symbols from ./movstest1...done.
(gdb) break _start
Breakpoint 1 at 0x80480b8: file movstest1.s, line 10.
(gdb) run
Starting program: /home/cig01/test/movstest1 

Breakpoint 1, _start () at movstest1.s:10
10	    nop
(gdb) n
11	    leal value1, %esi      # same as: movl $value1, $esi
(gdb) n
12	    leal output, %edi      # same as: movl $output, $edi
(gdb) n
13	    movsb
(gdb) n
14	    movsw
(gdb) n
15	    movsl
(gdb) n
18	    movl $1, %eax
(gdb) x/s &output
0x80490f0 <output>:	"This is"

movs 指令成功执行后，会自动修改 esi 和 edi，以便为下一次 movs 做准备。
上面例子中，movsb 移动了 1 个字符"T"到 output 中，movsw 移动了 2 个字符"hi"到 output 中，movsl 移动了 4 个字符"s is"到 output 中。

If the DF flag is cleared, the ESI and EDI registers are incremented after each MOVS instruction. If the DF flag is set, the ESI and EDI registers are decremented after each MOVS instruction.

To ensure that the DF flag is set in the proper direction, you can use the following commands:
❑ CLD to clear the DF flag
❑ STD to set the DF flag

# movstest3.s - An example of moving an entire string
.section .data
value1:
    .ascii "This is a test string.\n"
.section .bss
    .lcomm output, 23
.section .text
.globl _start
_start:
    nop
    leal value1, %esi      # same as: movl $value1, $esi
    leal output, %edi      # same as: movl $output, $edi
    movl $23, %ecx
    cld
loop1:
    movsb
    loop loop1

    # exit 0
    movl $1, %eax
    movl $0, %ebx
    int $0x80

The REP instruction repeats the string instruction immediately following it until the value in the ECX register is zero.

# reptest1.s - An example of the REP instruction
.section .data
value1:
    .ascii "This is a test string.\n"
.section .bss
    .lcomm output, 23
.section .text
.globl _start
_start:
    nop
    leal value1, %esi
    leal output, %edi
    movl $23, %ecx
    cld
    rep movsb

    # exit 0
    movl $1, %eax
    movl $0, %ebx
    int $0x80

处理器提供了单独的指令 enter 和 leave 来完成准备和撤消栈帧的工作。
enter 建立栈帧，相当于：

pushl %ebp
movl %esp, %ebp

leave 使栈做好返回的准备，相当于：

movl %ebp, %esp
popl %ebp

所以，前面函数对应的汇编模板也可以写为：

function:
    enter
    .
    .
    .
    leave
    ret

注：GCC 很少为 C 函数产生 enter 指令，而是直接使用 movl 和 popl。

由前面的栈帧示意图我们知道，当调用一个函数前，会先把它的参数压入到 caller 的栈中，当函数返回后，这些参数仍然在 caller 的栈中。
所以，在 caller 中调用函数后紧接着的一条语句往往是释放参数所用的栈，如：

pushl %eax      # 压入compute的第2个参数
pushl %ebx      # 压入compute的第1个参数
call compute    # 调用compute
addl $8, %esp   # 释放compute参数所占用的栈

说明：
参数所占用的栈也可以由 callee 释放，如在调用约定 stdcall（Win32 API）下，就是由 callee 释放参数所占的栈。
如果由 callee 释放参数所占的栈，那么在编译时 callee 就需要知道一共有几个参数，所以这种情况下无法使用变长参数。

参考：
https://en.wikipedia.org/wiki/X86_calling_conventions#Callee_clean-up

下面通过生成 C 程序的汇编代码来研究 IA32 栈帧如何支持函数调用。

源 C 程序 test.c 为：

int swap_add(int *xp, int *yp)
{
  int x=*xp;
  int y=*yp;

  *xp=y;
  *yp=x;
  return x+y;
}

int caller()
{
  int var1=534;
  int var2=1057;
  int sum=swap_add(&var1, &var2);
  int diff=var1-var2;

  return sum*diff;
}

用 gcc -m32 -S test.c 生成对应的汇编代码，可以得到上面程序的栈帧示意图如下：

caller:
        pushl   %ebp
        movl    %esp, %ebp
        subl    $16, %esp            # 在栈上预留了16字节内存
        movl    $534, -12(%ebp)      # 设置局部变量var1的值为534
        movl    $1057, -16(%ebp)     # 设置局部变量var2的值为1057
        leal    -16(%ebp), %eax      # 计算 &var2，保存结果到%eax中
        pushl   %eax                 # 把%eax内容（即swqp_add的第2个参数）压入栈中
        leal    -12(%ebp), %eax      # 计算 &var1，保存结果到%eax中
        pushl   %eax                 # 把%eax内容（即swqp_add的第1个参数）压入栈中
        call    swap_add             # 调用swqp_add
        addl    $8, %esp             # 清除swap_add的两个参数所占用的栈
        movl    %eax, -4(%ebp)
        movl    -12(%ebp), %edx
        movl    -16(%ebp), %eax
        subl    %eax, %edx
        movl    %edx, %eax
        movl    %eax, -8(%ebp)
        movl    -4(%ebp), %eax
        imull   -8(%ebp), %eax
        leave
        ret

swap_add:
        pushl   %ebp                 # 把%ebp内容（caller的栈帧起始位置）压入栈中
        movl    %esp, %ebp           # 把swap_add的栈帧起始位置保存到%ebp中
        subl    $16, %esp            # 在栈上预留了16字节内存
        movl    8(%ebp), %eax        # 把8(%ebp)处内容（即第1个参数xp）保存到%eax中
        movl    (%eax), %eax         # 把*xp的值临时保存到%eax中
        movl    %eax, -4(%ebp)       # 把*xp的值保存到-4(%ebp)处，即局部变量x中
        movl    12(%ebp), %eax       # 把12(%ebp)处内容（即第2个参数yp）保存到%eax中
        movl    (%eax), %eax         # 把*yp的值临时保存到%eax中
        movl    %eax, -8(%ebp)       # 把*yp的值保存到到-8(%ebp)处，即局部变量y中
        movl    8(%ebp), %eax
        movl    -8(%ebp), %edx
        movl    %edx, (%eax)         # 和前面两条指令一起，把y的值放入到第1个参数的地址处
        movl    12(%ebp), %eax
        movl    -4(%ebp), %edx
        movl    %edx, (%eax)         # 和前面两条指令一起，把x的值放入到第2个参数的地址处
        movl    -4(%ebp), %edx
        movl    -8(%ebp), %eax
        addl    %edx, %eax           # 和前面两条指令一起，计算x+y，并把结果保存在%eax中
        leave
        ret

说明：不同的 GCC 版本生成的汇编代码可能会有差别。本节实例和 Computer Systems A Programmer’s Perspective, 2nd. 3.7.4 Procedure Example 的实例相同，但由于 gcc 版本不同，生成的汇编代码不完全一样（本节汇编代码由 gcc 4.9 生成）。

The set of program registers acts as a single resource shared by all of the procedures.

By convention, registers %eax, %edx, and %ecx are classified as caller-save registers. When procedure Q is called by P, it can overwrite these registers without destroying any data required by P. On the other hand, registers %ebx, %esi, and %edi are classified as callee-save registers. This means that Q must save the values of any of these registers on the stack before overwriting them, and restore them before returning, because P (or some higher-level procedure) may need these values for its future computations.

As an example, consider the following code:

int P(int x) 2{
    int y = x*x;
    int z = Q(y);
    return y + z;
}

Procedure P computes y before calling Q, but it must also ensure that the value of y is available after Q returns. It can do this by one of two means:

• It can store the value of y in its own stack frame before calling Q; when Q returns, procedure P can then retrieve the value of y from the stack. In other words, P, the caller, saves the value.
  
• It can store the value of y in a callee-save register (%ebx, %esi and %edi). If Q, or any procedure called by Q, wants to use this register, it must save the register value in its stack frame and restore the value before it returns (in other words, the callee saves the value). When Q returns to P, the value of y will be in the callee-save register, either because the register was never altered or because it was saved and restored.
  

Either convention can be made to work, as long as there is agreement as to which function is responsible for saving which value.

总结：
caller-save register: 在函数中使用寄存器%eax, %ecx, and %edx 时要小心，它们的值在调用某个子函数的前后可能不相同（这些寄存器可能被子函数修改）。
callee-save register: 如果在函数中使用寄存器%ebx, %esi, and %edi，在改变这些寄存器前必须保存它们的值，在使用完后（函数返回前）要恢复它们之前的值。

利用%ebp 的值，我们可以找到上层函数(caller)的栈帧，接着还可以找到上上层(caller 的 caller)的栈帧，以此追溯，可以得到所有函数的调用顺序，这对于调试一个程序是非常方便的。

帧指针对于支持过程调用来说不是必要的（在函数开始时分配所需要的整个栈存储，这样仅用栈指针也可以访问到函数的参数和局部变量），所以帧指针可以省掉。gcc 有个优化选项：-fomit-frame-pointer 可省略帧指针，指定-fno-omit-frame-pointer 可以保留帧指针。

说明：没有帧指针，gcc 可以利用 Dwarf 中的 Call Frame Information 得到函数的调用顺序。

由前面的 Initial Process Stack 示意图可知，通过栈指针可访问到程序的命令行参数。

# paramtest1.s - Listing command line parameters
# Only work in 32-bit Linux
.section .data
output1:
   .asciz "There are %d parameters:\n"
output2:
    .asciz "%s\n"
.section .text
.globl main
main:
    movl (%esp), %ecx   # read number of command-line parameter from the top of the stack, save it to ECX
    pushl %ecx          # 2nd parameter of printf
    pushl $output1      # 1st parameter of printf
    call printf
    addl $4, %esp       # clean 1st parameter from stack
    popl %ecx           # clean 2st parameter from stack, restore ECX (it may destroyed by printf)
    movl %esp, %ebp
    addl $4, %ebp
loop1:
    pushl %ecx
    pushl (%ebp)
    pushl $output2
    call printf
    addl $8, %esp
    popl %ecx
    addl $4, %ebp
    loop loop1
    pushl $0            # exit(0)
    call exit

参考：Professional Assembly Language. Chapter 11.5 Using Command-Line Parameters

用 movq 可以把数据放到 MMX 寄存器中。

# mmxtest.s - An example of using the MMX data types
.section .data
values1:
.int 1, -1
values2:
.byte 0x10, 0x05, 0xff, 0x32, 0x47, 0xe4, 0x00, 0x01

.section .text
.globl _start
_start:
    nop
    movq values1, %mm0
    movq values2, %mm1

    # exit 0
    movl $1, %eax
    movl $0, %ebx
    int $0x80

$ gcc -g -m32 -nostdlib  mmxtest.s -o mmxtest
$ gdb -q ./mmxtest
Reading symbols from ./mmxtest...done.
(gdb) break _start
Breakpoint 1 at 0x80480b8: file mmxtest.s, line 11.
(gdb) r
Starting program: /home/cig01/test/mmxtest 

Breakpoint 1, _start () at mmxtest.s:11
11	    nop
(gdb) n
12	    movq values1, %mm0
(gdb) n
13	    movq values2, %mm1
(gdb) n
16	    movl $1, %eax
(gdb) print $mm0
$1 = {uint64 = -4294967295, v2_int32 = {1, -1}, v4_int16 = {1, 0, -1, -1}, 
  v8_int8 = {1, 0, 0, 0, -1, -1, -1, -1}}
(gdb) print $mm1
$2 = {uint64 = 72308588487312656, v2_int32 = {855573776, 16835655}, 
  v4_int16 = {1296, 13055, -7097, 256}, v8_int8 = {16, 5, -1, 50, 71, -28, 0, 
    1}}
(gdb) print/x $mm1
$3 = {uint64 = 0x100e44732ff0510, v2_int32 = {0x32ff0510, 0x100e447}, 
  v4_int16 = {0x510, 0x32ff, 0xe447, 0x100}, v8_int8 = {0x10, 0x5, 0xff, 0x32, 
    0x47, 0xe4, 0x0, 0x1}}
(gdb) print $st0
$1 = -nan(0xffffffff00000001)
(gdb) print $st1
$2 = -nan(0x100e44732ff0510)
(gdb) 

Once the data is loaded into the MMX register, parallel operations can be performed on the packed data using a single instruction. The operations are performed on each packed integer value in the register, utilizing the same placed packed integer values.

There are three overflow methods for performing the mathematical operations:
❑ Wraparound arithmetic
❑ Signed saturation arithmetic
❑ Unsigned saturation arithmetic

The wraparound arithmetic method assumes that you will check the operands before performing the operation to ensure that an overflow condition will not be present. If it is, the resulting value will be truncated, removing any carry values.
The signed and unsigned saturation arithmetic methods set the result of an overflow condition to a preset value.

实例程序：

# mmxadd.s - An example of performing MMX addition
.section .data
value1:
    .int 10, 20
value2:
    .int 30, 40

.section .bss
    .lcomm result, 8

.section .text
.globl _start
_start:
    nop
    movq value1, %mm0
    movq value2, %mm1
    paddd %mm1, %mm0
    movq %mm0, result

    # exit 0
    movl $1, %eax
    movl $0, %ebx
    int $0x80

测试如下：

$ gcc -g -m32 -nostdlib  mmxadd.s -o mmxadd
$ gdb -q ./mmxadd
Reading symbols from ./mmxadd...done.
(gdb) break _start
Breakpoint 1 at 0x80480b8: file mmxadd.s, line 13.
(gdb) r
Starting program: /home/cig01/test/mmxadd 

Breakpoint 1, _start () at mmxadd.s:13
13	_start: nop
(gdb) n
14	    movq value1, %mm0
(gdb) n
15	    movq value2, %mm1
(gdb) n
16	    paddd %mm1, %mm0
(gdb) n
17	    movq %mm0, result
(gdb) n
20	    movl $1, %eax
(gdb) x/2d &value1
0x80490dd:	10	20
(gdb) x/2d &value2
0x80490e5:	30	40
(gdb) x/2d &result 
0x80490f0 <result>:	40	60
(gdb)