docs: changelog and readme for the instruction wave and the honest corpus rate

Assisted-by: DeepSeek V4.1 Flash

.gitea/workflows/race.yml

@@ -0,0 +1,37 @@
+# Race, Go. Dispatched by hand, and never a gate on a push or a tag: the release tag is
+# cut only after `just gates` has already raced the tree, so this workflow is the
+# explicit second opinion, not a step of the release.
+#
+# The race detector roughly doubles both time and memory, which the shared runner box
+# cannot afford on every push. Locally it belongs to `just gates`, which runs it once per
+# task; here it is a decision rather than a routine.
+#
+# Every step is one command, so the step that fails is the gate that failed.
+name: Race
+
+on:
+  workflow_dispatch:
+
+env:
+  # One core: parallelism buys no speed here and costs memory the box does not have.
+  GOFLAGS: -p=1
+  GOMAXPROCS: "2"
+
+jobs:
+  race:
+    runs-on: fedora
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Install gcc
+        # The race detector needs cgo and the runner image carries no C compiler.
+        run: dnf install -y gcc
+
+      - name: Race
+        run: go test -race -count=1 -timeout 10m ./...

.gitea/workflows/release.yml

@@ -1,73 +1,222 @@
-# Release — gasm binaries. Runs on version tags (v0.28.0) pushed to main.
+# Release, Go binaries. Runs on version tags (v1.2.3) pushed to main.
+#
+# The module sits at the repository root: the toolchain records a version only for a root
+# module, measured on go1.27.1, so a build of a module in a subdirectory reports (devel)
+# even at its own <module>/vX.Y.Z tag and this workflow's smoke test can never pass for
+# it. A Go repository is one module at the root.
+#
+# The version contract these steps implement: nothing is injected.  The toolchain records
+# the tag into the binary's build information, so the build simply has to happen at the
+# tag, which the trigger guarantees.
+#
+# The gates run in their own job, once, before the matrix, minus the race detector: race
+# never runs on a push path or a tag, and the local gate raced this tree before the tag
+# was cut. Putting the gates inside the matrix would run the whole suite once per target
+# on the box that also hosts the forge. Each job validates the tag for itself rather than
+# passing a value between jobs, so no workflow feature has to be trusted for the version
+# to reach the file name.
 name: Release
 
 on:
   push:
     tags: ["v*"]
 
+env:
+  # The box is shared with the forge, so parallelism is bounded on purpose. The gates job
+  # needs it most; the build jobs inherit it for their parallel compilation.
+  GOFLAGS: -p=1
+  GOMAXPROCS: "2"
+
 jobs:
+  gates:
+    runs-on: fedora
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Install Perl
+        # Perl for the steps below. The install is a no-op where the package
+        # is already present.
+        run: dnf install -y perl
+
+      - name: Validate the tag
+        env:
+          VERSION: ${{ gitea.ref_name }}
+        run: |
+          perl -e '
+            my $v = $ENV{VERSION} // q{};
+            $v =~ m{^v[0-9]+(\.[0-9]+){0,2}([-+].*)?$}
+              or die qq{ERROR: expected a semver tag like v1.2.3, got: $v\n};
+            print qq{tag $v\n};
+          '
+
+      - name: Security policy names this release
+        # The supported-versions table is the one part of SECURITY.md that
+        # carries a version, so it goes stale the moment a tag is cut.  Fail
+        # here rather than publish a policy naming the previous release.
+        env:
+          VERSION: ${{ gitea.ref_name }}
+        run: |
+          perl -e '
+            my $v = $ENV{VERSION} // q{};
+            (my $nv = $v) =~ s/^v//;
+            open(my $f, q{<}, q{SECURITY.md}) or die qq{SECURITY.md: $!\n};
+            local $/;
+            my $t = <$f>;
+            close $f;
+            $t =~ m{^\|\s*\Q$nv\E\s*\|\s*yes\s*\|}m
+              or die qq{ERROR: SECURITY.md does not name $nv as supported; update the table before releasing.\n};
+            print qq{SECURITY.md names $nv\n};
+          '
+
+      - name: Build
+        run: go build ./...
+
+      - name: Format
+        run: |
+          perl -e '
+            open(my $g, q{-|}, q{gofmt}, q{-l}, q{.}) or die qq{gofmt: $!};
+            my @bad = <$g>;
+            close($g);
+            print @bad;
+            exit(@bad ? 1 : 0);
+          '
+
+      - name: Vet
+        run: go vet ./...
+
+      - name: Modernise
+        run: go fix -diff ./...
+
+      - name: Tests
+        # The same command as in test.yml, so the floor is the same number everywhere.
+        run: go test -count=1 -timeout 10m -coverprofile=coverage.out ./arch/... ./asm/... ./ast/... ./disasm/... ./format/... ./lexer/... ./lint/... ./lsp/... ./parser/... ./token/... ./verify/...
+
+      - name: Tests outside the coverage set
+        # The same command as in test.yml: the CLI's exit codes and manual-page guard,
+        # and the debugger's architecture-neutral units, run outside the floor.
+        run: go test -count=1 -timeout 10m ./cmd/... ./debug/...
+
+      - name: Coverage floor
+        run: |
+          perl -e '
+            open(my $c, q{-|}, q{go}, q{tool}, q{cover}, q{-func=coverage.out}) or die qq{cover: $!};
+            my $total;
+            while (my $l = <$c>) { $total = $1 if $l =~ m{^total:\s+\S+\s+([0-9.]+)%} }
+            close($c);
+            die qq{no total line in coverage.out\n} unless defined $total;
+            printf qq{Total coverage: %s%%\n}, $total;
+            exit($total < 80 ? 1 : 0);
+          '
+
   build:
     runs-on: fedora
+    timeout-minutes: 25
+    needs: gates
     strategy:
       fail-fast: false
       matrix:
+        # Portable targets: amd64, arm64, loong64 and riscv64 on Linux, at the toolchain
+        # default level. No 32-bit, no wasm, no macOS, no Windows. FreeBSD stays out until
+        # verify/jit.go ports off syscall.Mprotect: the Go syscall package defines no
+        # Mprotect for freebsd, and verify/jit.go:50 calls it to drop the write bit from
+        # the JIT mapping, so every freebsd target fails to build with "undefined:
+        # syscall.Mprotect" (verified for amd64, arm64 and riscv64 on go1.27.1).
         include:
           - goos: linux
             goarch: amd64
           - goos: linux
             goarch: arm64
-          - goos: linux
-            goarch: riscv64
           - goos: linux
             goarch: loong64
+          - goos: linux
+            goarch: riscv64
     steps:
       - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
-          go-version: "1.27"
+          go-version-file: go.mod
+          cache: true
 
-      - name: Download dependencies
-        run: go mod download
+      - name: Install Perl
+        run: dnf install -y perl
 
-      - name: Validate tag and build
-        id: build
+      - name: Validate the tag
+        id: version
         env:
           VERSION: ${{ gitea.ref_name }}
         run: |
-          set -euo pipefail
+          perl -e '
+            my $v = $ENV{VERSION} // q{};
+            $v =~ m{^v[0-9]+(\.[0-9]+){0,2}([-+].*)?$}
+              or die qq{ERROR: expected a semver tag like v1.2.3, got: $v\n};
+            (my $nv = $v) =~ s{^v}{};
+            open(my $o, q{>>}, $ENV{GITEA_OUTPUT}) or die qq{GITEA_OUTPUT: $!};
+            print $o qq{version_no_v=$nv\n};
+            close($o);
+            print qq{version $nv\n};
+          '
 
-          if ! echo "$VERSION" | grep -qE '^v[0-9]+(\.[0-9]+){0,2}([-+].*)?$'; then
-            echo "ERROR: expected a semver tag like v1.2.3, got: '$VERSION'"
-            exit 1
-          fi
-
-          VERSION_NO_V="${VERSION#v}"
-          echo "version_no_v=${VERSION_NO_V}" >> "$GITEA_OUTPUT"
-
-          mkdir -p bin
-          GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} CGO_ENABLED=0 \
-            go build -ldflags "-s -w -X main.version=${VERSION_NO_V}" \
-              -o "bin/gasm-${VERSION_NO_V}-${{ matrix.goos }}-${{ matrix.goarch }}" \
-              ./cmd/gasm
+      - name: Build
+        env:
+          VERSION_NO_V: ${{ steps.version.outputs.version_no_v }}
+          GOOS: ${{ matrix.goos }}
+          GOARCH: ${{ matrix.goarch }}
+          CGO_ENABLED: "0"
+        run: |
+          # Nothing is injected. The toolchain records the tag into the binary's build
+          # information, so the version is right because this build happens at the tag, and
+          # there is no path for anyone to get wrong. -s -w only strips symbols.
+          go build -ldflags "-s -w" -o "bin/gasm-${VERSION_NO_V}-${GOOS}-${GOARCH}" ./cmd/gasm
 
+      # Artifacts stay on v3: v4 and later detect Gitea as GHES and abort.
       - name: Upload artifact
         uses: actions/upload-artifact@v3
         with:
           name: gasm-${{ matrix.goos }}-${{ matrix.goarch }}
-          path: bin/gasm-${{ steps.build.outputs.version_no_v }}-${{ matrix.goos }}-${{ matrix.goarch }}
+          path: bin/gasm-${{ steps.version.outputs.version_no_v }}-${{ matrix.goos }}-${{ matrix.goarch }}
           if-no-files-found: error
 
       - name: Smoke test
+        # Only a binary matching the runner can be run here. The check is not that --version
+        # exits cleanly but that it reports the tag and nothing more: a build outside version
+        # control reports (devel), and a build whose tree was dirty reports +dirty, and both
+        # would otherwise be published.
         if: matrix.goos == 'linux' && matrix.goarch == 'amd64'
+        env:
+          TAG: ${{ gitea.ref_name }}
+          BIN: bin/gasm-${{ steps.version.outputs.version_no_v }}-${{ matrix.goos }}-${{ matrix.goarch }}
         run: |
-          chmod +x bin/gasm-${{ steps.build.outputs.version_no_v }}-${{ matrix.goos }}-${{ matrix.goarch }}
-          ./bin/gasm-${{ steps.build.outputs.version_no_v }}-${{ matrix.goos }}-${{ matrix.goarch }} --version
+          perl -e '
+            my $want = $ENV{TAG} // die qq{ERROR: no tag\n};
+            open(my $bin, q{-|}, $ENV{BIN}, q{--version}) or die qq{$ENV{BIN}: $!};
+            my $got = <$bin>;
+            close($bin);
+            $got = defined $got ? $got : q{};
+            chomp $got;
+            index($got, $want) >= 0
+              or die qq{ERROR: the binary printed "$got", which does not contain $want. Version control was disabled, so there is no recorded version.\n};
+            index($got, q{+dirty}) < 0
+              or die qq{ERROR: the binary printed "$got". The tree was dirty at build time, which means the checkout was not the tag, or the build artefacts are not ignored.\n};
+            print qq{$ENV{BIN} reports $got\n};
+          '
 
   release:
     runs-on: fedora
+    timeout-minutes: 15
     needs: build
     permissions:
+      # contents: read is required for the checkout: a job that declares any
+      # permissions gets a token scoped to exactly those, and releases: write
+      # alone leaves the fetch with no read access, which Gitea answers with
+      # a 404 "Repository not found". Verified on the instance 2026-09-16.
+      contents: read
       releases: write
     steps:
       - uses: actions/checkout@v7
@@ -77,81 +226,162 @@ jobs:
         with:
           path: dist
 
-      - name: Extract CHANGELOG section
+      - name: Install Perl
+        run: dnf install -y perl
+
+      - name: Extract the CHANGELOG section
         env:
           VERSION: ${{ gitea.ref_name }}
         run: |
-          set -euo pipefail
-          VERSION_NO_V="${VERSION#v}"
+          # Each step derives what it needs from the tag, so no value has to travel between
+          # jobs.
+          perl -e '
+            my $v = $ENV{VERSION} // q{};
+            $v =~ s{^v}{};
+            open(my $vout, q{>}, q{version-no-v.txt}) or die qq{version-no-v.txt: $!};
+            print $vout $v;
+            close($vout);
+            open(my $in, q{<}, q{CHANGELOG.md}) or die qq{CHANGELOG.md: $!};
+            my @lines = <$in>;
+            close($in);
+            my ($start, $end) = (-1, scalar @lines);
+            for my $i (0 .. $#lines) {
+              if ($start < 0) { $start = $i if $lines[$i] =~ m{^##\s+\[\Q$v\E\]} }
+              elsif ($lines[$i] =~ m{^##\s+\[}) { $end = $i; last }
+            }
+            $start >= 0 or die qq{ERROR: no CHANGELOG section for $v, expected a heading like: ## [$v] - YYYY-MM-DD\n};
+            my @body = grep { m{\S} } @lines[$start + 1 .. $end - 1];
+            @body or die qq{ERROR: the CHANGELOG section for $v is empty\n};
+            open(my $out, q{>}, q{release-body.md}) or die qq{release-body.md: $!};
+            print $out @body;
+            close($out);
+            printf qq{notes for %s: %d lines\n}, $v, scalar @body;
+          '
 
-          sed -n "/^## \[${VERSION_NO_V}\] /,/^## \[/p" CHANGELOG.md \
-            | sed '$d' \
-            | tail -n +2 \
-            > release-body.md
+      - name: Build the release request
+        run: |
+          perl -e '
+            open(my $vin, q{<}, q{version-no-v.txt}) or die qq{version-no-v.txt: $!};
+            my $v = <$vin>;
+            close($vin);
+            chomp $v;
+            open(my $in, q{<:raw}, q{release-body.md}) or die qq{release-body.md: $!};
+            my $body = do { local $/; <$in> };
+            close($in);
+            # Byte-oriented escaping: JSON is UTF-8, so non-ASCII passes through and only the
+            # characters JSON forbids are rewritten.
+            $body =~ s/([\\"])/\\$1/g;
+            $body =~ s/\t/\\t/g;
+            $body =~ s/\r//g;
+            $body =~ s/\n/\\n/g;
+            $body =~ s/([\x00-\x08\x0b\x0c\x0e-\x1f])/sprintf(q{\u%04x}, ord($1))/ge;
+            my $json = sprintf(qq{{"tag_name":"v%s","name":"v%s","body":"%s","draft":false,"prerelease":false}}, $v, $v, $body);
+            open(my $out, q{>}, q{release.json}) or die qq{release.json: $!};
+            print $out $json;
+            close($out);
+            print qq{release.json written for v$v\n};
+          '
 
-          if [ ! -s release-body.md ]; then
-            echo "ERROR: no CHANGELOG section found for ${VERSION_NO_V}"
-            echo "Expected a heading like: ## [${VERSION_NO_V}] — YYYY-MM-DD"
-            exit 1
-          fi
-
-      - name: Create release
+      - name: Create the release
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
           GITEA_SERVER_URL: ${{ gitea.server_url }}
           GITEA_REPOSITORY: ${{ gitea.repository }}
-          GITEA_REF_NAME: ${{ gitea.ref_name }}
         run: |
-          set -euo pipefail
-
-          BODY=$(sed -e 's/\\/\\\\/g' -e 's/"/\\"/g' -e 's/\t/\\t/g' -e 's/\r//g' release-body.md | sed ':a;N;$!ba;s/\n/\\n/g')
-          BODY="\"${BODY}\""
-
-          response=$(curl -sS -w '\n%{http_code}' \
-            -H "Authorization: token ${GITEA_TOKEN}" \
-            -H "Content-Type: application/json" \
-            -X POST \
-            "${GITEA_SERVER_URL}/api/v1/repos/${GITEA_REPOSITORY}/releases" \
-            -d "{\"tag_name\":\"${GITEA_REF_NAME}\",\"name\":\"${GITEA_REF_NAME}\",\"body\":${BODY},\"draft\":false,\"prerelease\":false}")
-
-          http_code=$(echo "$response" | tail -1)
-          payload=$(echo "$response" | sed '$d')
-
-          echo "HTTP ${http_code}"
-          if [ "$http_code" != "201" ]; then
-            echo "Failed to create release: ${payload}"
-            exit 1
-          fi
-
-          RELEASE_ID=$(echo "$payload" | grep -oE '"id"[[:space:]]*:[[:space:]]*[0-9]+' | head -1 | grep -oE '[0-9]+')
-          echo "Created release ID=${RELEASE_ID}"
-          printf '%s' "${RELEASE_ID}" > release-id.txt
+          perl -e '
+            my @cmd = (q{curl}, q{-sS}, q{-o}, q{response.json}, q{-w}, q{%{http_code}},
+              q{-H}, qq{Authorization: token $ENV{GITEA_TOKEN}},
+              q{-H}, q{Content-Type: application/json},
+              q{-X}, q{POST},
+              qq{$ENV{GITEA_SERVER_URL}/api/v1/repos/$ENV{GITEA_REPOSITORY}/releases},
+              q{--data-binary}, q{@release.json});
+            open(my $curl, q{-|}, @cmd) or die qq{curl: $!};
+            my $code = <$curl>;
+            my $ok = close($curl);
+            my $exit = $? >> 8;
+            $code = defined $code ? $code : q{};
+            $ok or die qq{ERROR: curl failed (exit $exit) calling $ENV{GITEA_SERVER_URL}\n};
+            open(my $r, q{<:raw}, q{response.json}) or die qq{response.json: $!};
+            my $body = do { local $/; <$r> };
+            close($r);
+            $code eq q{201} or die qq{ERROR: the release was not created, HTTP $code: $body\n};
+            $body =~ m{"id"\s*:\s*([0-9]+)} or die qq{ERROR: no release id in the response: $body\n};
+            open(my $o, q{>}, q{release-id.txt}) or die qq{release-id.txt: $!};
+            print $o $1;
+            close($o);
+            print qq{release id $1\n};
+          '
 
       - name: Upload assets
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
           GITEA_SERVER_URL: ${{ gitea.server_url }}
           GITEA_REPOSITORY: ${{ gitea.repository }}
-          GITEA_REF_NAME: ${{ gitea.ref_name }}
         run: |
-          set -euo pipefail
-          RELEASE_ID=$(cat release-id.txt)
-
-          for binary in dist/gasm-*/gasm-*; do
-            [ -f "$binary" ] || continue
-            fname=$(basename "$binary")
-            echo "Uploading ${fname}..."
-            http_code=$(curl -sS -o /dev/null -w '%{http_code}' \
-              -H "Authorization: token ${GITEA_TOKEN}" \
-              -H "Content-Type: application/octet-stream" \
-              -X POST \
-              --data-binary "@${binary}" \
-              "${GITEA_SERVER_URL}/api/v1/repos/${GITEA_REPOSITORY}/releases/${RELEASE_ID}/assets?name=${fname}")
-            echo "  HTTP ${http_code}"
-            if [ "$http_code" != "201" ]; then
-              echo "Failed to upload ${fname}"
-              exit 1
-            fi
-          done
-
-          echo "Release ${GITEA_REF_NAME} is live."
+          perl -e '
+            open(my $f, q{<}, q{release-id.txt}) or die qq{release-id.txt: $!};
+            my $id = <$f>;
+            close($f);
+            chomp $id;
+            my @files = grep { -f $_ } glob(q{dist/*/*});
+            @files or die qq{ERROR: no assets under dist/\n};
+            # A file that arrived empty from the artifact step would be uploaded as an
+            # empty attachment, every status would still be 201, and the run would go
+            # green over a release nobody can install.  Refuse it here, before the
+            # upload, and verify what was stored afterwards.
+            my %size;
+            for my $path (@files) {
+              my $n = -s $path // 0;
+              (my $name = $path) =~ s{.*/}{};
+              $n > 0 or die qq{ERROR: $path is empty, so there is nothing to upload\n};
+              $size{$name} = $n;
+            }
+            my $bad = 0;
+            for my $path (@files) {
+              (my $name = $path) =~ s{.*/}{};
+              my @cmd = (q{curl}, q{-sS}, q{-o}, q{/dev/null}, q{-w}, q{%{http_code}},
+                q{-H}, qq{Authorization: token $ENV{GITEA_TOKEN}},
+                q{-H}, q{Content-Type: application/octet-stream},
+                q{-X}, q{POST}, q{--data-binary}, qq{@$path},
+                qq{$ENV{GITEA_SERVER_URL}/api/v1/repos/$ENV{GITEA_REPOSITORY}/releases/$id/assets?name=$name});
+              open(my $curl, q{-|}, @cmd) or die qq{curl: $!};
+              my $code = <$curl>;
+              my $ok = close($curl);
+              my $exit = $? >> 8;
+              $code = defined $code ? $code : q{};
+              unless ($ok) {
+                printf qq{%s: curl failed (exit %d)\n}, $name, $exit;
+                $bad = 1;
+                next;
+              }
+              printf qq{%s: HTTP %s\n}, $name, $code;
+              $bad = 1 if $code ne q{201};
+            }
+            # Read every asset back through the release download route and require the
+            # served length to be the file that was sent: stored but empty is a broken
+            # release however green the run looks.
+            open(my $v, q{<}, q{version-no-v.txt}) or die qq{version-no-v.txt: $!};
+            my $v = <$v>;
+            close($v);
+            chomp $v;
+            for my $name (sort keys %size) {
+              my $url = qq{$ENV{GITEA_SERVER_URL}/$ENV{GITEA_REPOSITORY}/releases/download/v$v/$name};
+              my @head = (q{curl}, q{-sS}, q{-I}, q{-H}, qq{Authorization: token $ENV{GITEA_TOKEN}}, $url);
+              open(my $h, q{-|}, @head) or die qq{curl: $!};
+              my $len;
+              my $status;
+              while (my $l = <$h>) {
+                $status = $1 if $l =~ m{^HTTP/\S+\s+(\d+)};
+                $len = $1 if $l =~ m{^content-length:\s*(\d+)}i;
+              }
+              my $ok = close($h);
+              $len = defined $len ? $len : 0;
+              if (!$ok || $status != 200 || $len != $size{$name}) {
+                printf qq{ERROR: %s serves %s bytes, expected %d\n}, $name, $len, $size{$name};
+                $bad = 1;
+                next;
+              }
+              printf qq{%s: serves %d bytes\n}, $name, $len;
+            }
+            exit($bad ? 1 : 0);
+          '

.gitea/workflows/test.yml

@@ -1,4 +1,17 @@
-# Test — gasm-devkit. Runs on push and pull request to development.
+# Test, Go. Push and pull request to development. Never on main.
+#
+# The gates are the ones the justfile's `gates` recipe runs, minus race: the shared
+# runner box cannot afford the race detector on every push, so it lives in race.yml.
+# The box is one core and 2 GB beside Gitea, so parallelism is bounded on purpose and
+# everything runs in one job. Extra jobs would duplicate the checkout, the Go setup and
+# the dependency download three times without buying any parallelism.
+#
+# Every step is one command, so the step that fails is the gate that failed, and no shell
+# option has to be trusted for the run to stop. The scripted steps are Perl, not shell and
+# not Python: Perl behaves the same on both runner images, there is no bashism to trip over
+# on ash, and it is one language instead of two. The Perl uses builtins only, because
+# Fedora packages the Perl modules separately and nothing beyond `perl` itself may be
+# assumed present.
 name: Test
 
 on:
@@ -7,90 +20,91 @@ on:
   pull_request:
     branches: [development]
 
+env:
+  # One core: parallelism buys no speed here and costs memory the box does not have.
+  GOFLAGS: -p=1
+  GOMAXPROCS: "2"
+
+# A superseded run of the same ref is cancelled instead of queueing behind one that
+# no longer matters. Verified on Gitea 1.27.1 on 2026-09-17: a queued run whose ref
+# moved on is cancelled before it ever reaches the runner, while a run already
+# dispatched there runs to completion.
+concurrency:
+  group: ${{ gitea.workflow }}-${{ gitea.ref }}
+  cancel-in-progress: true
+
 jobs:
-  vet:
-    runs-on: fedora
-    steps:
-      - uses: actions/checkout@v7
-
-      - uses: actions/setup-go@v6
-        with:
-          go-version: "1.27"
-
-      - name: Download dependencies
-        run: go mod download
-
-      - name: gofmt
-        run: |
-          set -euo pipefail
-          unformatted=$(gofmt -l .)
-          if [ -n "$unformatted" ]; then
-            echo "These files need gofmt:"
-            echo "$unformatted"
-            exit 1
-          fi
-
-      - name: go vet
-        run: go vet ./...
-
   test:
     runs-on: fedora
-    needs: vet
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
-          go-version: "1.27"
+          # The module is the source of truth for the version, so it cannot drift.
+          go-version-file: go.mod
+          cache: true
 
-      - name: Download dependencies
-        run: go mod download
-
-      - name: Install gcc
-        run: dnf install -y gcc
-
-      - name: go test -race
-        run: go test -race -count=1 ./...
-
-      - name: Coverage gate — 80 % minimum
-        run: |
-          set -euo pipefail
-          # Exclude packages inherently untestable without hardware:
-          # debug — interactive ptrace, requires a live process
-          # cmd/gasm — CLI glue, covered by integration tests
-          go test -coverprofile=coverage.out \
-            sourcedock.dev/petrbalvin/gasm-devkit/arch \
-            sourcedock.dev/petrbalvin/gasm-devkit/asm \
-            sourcedock.dev/petrbalvin/gasm-devkit/ast \
-            sourcedock.dev/petrbalvin/gasm-devkit/format \
-            sourcedock.dev/petrbalvin/gasm-devkit/lexer \
-            sourcedock.dev/petrbalvin/gasm-devkit/lint \
-            sourcedock.dev/petrbalvin/gasm-devkit/lsp \
-            sourcedock.dev/petrbalvin/gasm-devkit/parser \
-            sourcedock.dev/petrbalvin/gasm-devkit/token \
-            sourcedock.dev/petrbalvin/gasm-devkit/verify
-          coverage=$(go tool cover -func=coverage.out | awk '/^total:/ { gsub("%", "", $3); print $3 }')
-          echo "Total coverage: ${coverage}%"
-          if awk -v c="$coverage" 'BEGIN { exit !(c+0 < 80) }'; then
-            echo "ERROR: coverage ${coverage}% is below the 80% threshold"
-            exit 1
-          fi
-
-  build:
-    runs-on: fedora
-    needs: test
-    steps:
-      - uses: actions/checkout@v7
-
-      - uses: actions/setup-go@v6
-        with:
-          go-version: "1.27"
-
-      - name: Download dependencies
-        run: go mod download
+      - name: Install Perl
+        # The runner images are minimal and Perl is not guaranteed. The install is a
+        # no-op where it is already present; drop this step once verified on the box.
+        run: dnf install -y perl
 
+      # The steps follow the `gates` order of the justfile contract: build, format,
+      # vet, test. The vet gate is go vet and go fix -diff, two steps here.
       - name: Build
-        run: go build -ldflags="-s -w" -o bin/gasm ./cmd/gasm
+        run: go build ./...
 
-      - name: Smoke test
-        run: ./bin/gasm --version
+      - name: Format
+        run: |
+          perl -e '
+            open(my $g, q{-|}, q{gofmt}, q{-l}, q{.}) or die qq{gofmt: $!};
+            my @bad = <$g>;
+            close($g);
+            print @bad;
+            exit(@bad ? 1 : 0);
+          '
+
+      - name: Vet
+        run: go vet ./...
+
+      - name: Modernise
+        # Exits non-zero when it has something to rewrite, so it needs no output capture.
+        run: go fix -diff ./...
+
+      - name: Tests
+        # The suite must be fast: a push pipeline that cannot finish in a few minutes moves
+        # its heavy part behind a dispatch. The inner timeout matches the job's, so a
+        # hanging test reports its own goroutine dump rather than a silent job kill.
+        # The pattern is `packages` in the project's justfile: the logic packages, since a
+        # thin cmd/ would drag the total under the floor. release.yml runs the same
+        # command, so the floor is the same number everywhere. ./verify/... carries the
+        # live oracle-parity comparison against `go tool asm` (the TestGroundTruth
+        # suites); the runner's Go setup provides both the tool and GOROOT.
+        run: go test -count=1 -timeout 10m -coverprofile=coverage.out ./arch/... ./asm/... ./ast/... ./disasm/... ./format/... ./lexer/... ./lint/... ./lsp/... ./parser/... ./token/... ./verify/...
+
+      - name: Tests outside the coverage set
+        # The CLI and the debugger sit outside `packages` because a thin main and a
+        # ptrace-bound package pull the total under the floor, but their tests guard
+        # shipped surfaces: the command exit codes, the manual pages against the
+        # binary's own help, and the debugger's architecture-neutral units.  They run
+        # here so the floor stays a product measure and nothing is left untested.
+        run: go test -count=1 -timeout 10m ./cmd/... ./debug/...
+
+      - name: Oracle parity
+        # Re-run the live go-tool-asm comparison as its own step so that a parity
+        # regression names the gate that failed instead of hiding inside the suite.
+        run: go test -count=1 -timeout 10m -run 'TestGroundTruth' ./verify/...
+
+      - name: Coverage floor
+        run: |
+          perl -e '
+            open(my $c, q{-|}, q{go}, q{tool}, q{cover}, q{-func=coverage.out}) or die qq{cover: $!};
+            my $total;
+            while (my $l = <$c>) { $total = $1 if $l =~ m{^total:\s+\S+\s+([0-9.]+)%} }
+            close($c);
+            die qq{no total line in coverage.out\n} unless defined $total;
+            printf qq{Total coverage: %s%%\n}, $total;
+            exit($total < 80 ? 1 : 0);
+          '

.gitignore

@@ -1,14 +1,13 @@
-# Binaries
-/gasm
-/bin/
-*.exe
+.idea/
+.zcode/
 
-# Test and coverage artefacts
+# Build output
+/bin/
+/gasm
 coverage.out
 *.test
 
-# Scratch / temporary work
-_scratch/
-
-# ZCode workspace
-.zcode
+# Crash dumps from the emulator runs
+core
+core.*
+*.core

AGENTS.md

@@ -1,119 +0,0 @@
-# AGENTS.md — gasm-devkit
-
-Repository rules for AI agents and contributors. Read before modifying any
-code in this repository.
-
-## AI Contribution Policy
-
-AI agents may assist with code, documentation, tests, and review in this
-repository. All AI-assisted changes must:
-
-- Follow the code style and conventions in this file.
-- Include the trailer `Assisted-by: <model-name>` in every commit message.
-- Not commit directly to `main` — work on `development`.
-- Pass the full Definition of Done before any commit.
-
-## Workflow
-
-- **Branching.** `development` is the working branch. `main` is
-  release-only: merge from `development`, then tag. Never commit directly
-  to `main`.
-- **Release procedure.**
-  1. Bump `version` in `justfile` and `cmd/gasm/main.go`.
-  2. Update `CHANGELOG.md` with a new `## [X.Y.Z] — YYYY-MM-DD` section.
-  3. Update `README.md` and `docs/ARCHITECTURE.md` if user-visible
-     behaviour changed.
-  4. Run the Definition of Done (below).
-  5. Commit on `development`.
-  6. `git checkout main && git merge --ff-only development`.
-  7. `git tag vX.Y.Z`.
-  8. `git checkout development`.
-  9. `GOBIN=~/.local/bin just install-bin`.
-
-## Commit Messages
-
-Conventional Commits, subject line only, imperative mood, lowercase after
-the colon:
-
-```
-feat(asm): add EVEX gather and scatter with VSIB addressing
-```
-
-Allowed types: `feat`, `fix`, `docs`, `style`, `refactor`, `perf`, `test`,
-`chore`, `ci`, `build`, `revert`.
-
-Every commit ends with exactly one trailer, using the model that
-assisted with the change:
-
-```
-Assisted-by: <model-name>
-```
-
-Replace `<model-name>` with the actual model (e.g. `DeepSeek V4 Pro`).
-
-No body, no footers, no trailing period on the subject.
-
-## Code Style
-
-Language: Go 1.27 (`toolchain go1.27.0`).
-
-### Formatter
-
-`gofmt` — zero diff. Run `just fmt` before committing.
-
-### Linter
-
-`go vet` — zero warnings. Run `just build` before committing.
-
-### Tests
-
-`go test -race -count=1 ./...` — all green, coverage ≥ 80 % (hard gate,
-enforced by `just test`).
-
-### Dependencies
-
-- **Production code:** standard library only. No third-party imports in
-  shipped code.
-- **Test code:** `golang.org/x/arch` is the sole test dependency (decode
-  oracle for round-trip validation). It is never linked into the binary.
-- **No cgo, no C, no external toolchains, no JavaScript.**
-
-### Error Handling
-
-Explicit `if err != nil`. Wrap with `fmt.Errorf("context: %w", err)`.
-No panics outside `main`. The one exception: the JIT trampoline's
-`recover`-guarded decoder hot path, which converts bounds panics to
-sentinel errors.
-
-### Assembly
-
-Plan 9 syntax (Go's assembler dialect). Hand-written — no code generators
-except `_gen/gen.go` for instruction tables (which parses the Go
-toolchain source). Every instruction table is committed; no runtime
-dependency on the Go toolchain.
-
-### File Naming
-
-- `_amd64.s`, `_arm64.s`, `_riscv64.s`, `_loong64.s` for
-  architecture-specific assembly.
-- `_linux_amd64.go` for platform-specific Go files.
-- `_test.go` suffix for test files.
-
-## Definition of Done
-
-A task is not complete until all of these pass:
-
-1. `just build` — `go vet` + `gofmt` check, zero errors, zero warnings.
-2. `just test` — full suite with `-race`, coverage ≥ 80 %.
-3. `just fmt` — produces no diff.
-4. Diagnostics — zero warnings across the project.
-5. Non-trivial changes reviewed.
-
-## Licence
-
-BSD-3-Clause. Every source file carries the SPDX header:
-
-```
-// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
-// SPDX-License-Identifier: BSD-3-Clause
-```

CONTRIBUTING.md

@@ -1,101 +1,134 @@
-# Contributing to gasm-devkit
+# Contributing
 
-## Prerequisites
+Contributions to **gasm-devkit** are governed by the Contributor terms
+below; submitting one means you accept them.
 
-- Go 1.27 or later (`toolchain go1.27.0`)
-- `just` command runner
-- A Linux host on amd64, arm64, riscv64 or loong64
+## Contributor terms
 
-## Development Setup
+1. This project belongs to its owner alone. The owner decides what is
+   accepted, in what form and when; the decision is final and needs no
+   justification.
+2. By submitting a contribution you assign to Petr Balvín
+   <opensource@petrbalvin.org> all present and future copyright and
+   related rights in it, worldwide, for the full term of the rights,
+   with the right to relicense and sublicense without restriction,
+   including under proprietary terms.
+3. Where that assignment is not effective, it counts as a perpetual,
+   irrevocable, royalty-free licence with the same scope.
+4. To the fullest extent permitted by law, you waive any right of
+   attribution and integrity in the contribution. The project names no
+   contributors and keeps no credits list.
+5. By submitting you represent that the work is yours and that you
+   hold the rights to assign it as above.
+
+## Development setup
+
+Requirements: Go 1.27.1, the exact version the `go` directive in `go.mod`
+declares, [just](https://github.com/casey/just) for the recipes, and a C
+compiler (gcc), because `just gates` includes `just race` and the race
+detector needs cgo.
 
 ```sh
 git clone https://sourcedock.dev/petrbalvin/gasm-devkit.git
 cd gasm-devkit
-just install        # download module dependencies
-just build          # go vet + gofmt check
-just test           # full test suite with race detector
+just build
+just gates
 ```
 
-## Commands
+## Workflow
 
-Every just recipe:
+1. Branch from `development`. Never commit directly to `main`, which is release-only.
+2. Commit in [Conventional Commits](https://www.conventionalcommits.org/) form:
+   `type(scope): description`, subject line only, imperative mood, lowercase after the
+   colon, no trailing full stop. Allowed types: `feat`, `fix`, `docs`, `style`,
+   `refactor`, `perf`, `test`, `chore`, `ci`, `build`, `revert`.
+3. One logical change per commit. A refactor, a behaviour change and a formatting pass
+   are three commits, never one.
+4. Record every user-visible change in `CHANGELOG.md` under `## [development]`.
+5. Add or update tests. Coverage stays at 80 percent or more; it is a hard gate.
+6. Update the documentation when the public API, the configuration or the behaviour
+   changes.
+7. Open a pull request against `development`.
 
-| Recipe | What it does |
-|--------|-------------|
-| `just` | List all recipes |
-| `just install` | `go mod download` |
-| `just build` | `go vet ./...` + `gofmt -l .` check — zero errors required |
-| `just test` | `go test -race -count=1 -coverprofile=coverage.out ./...` + 80 % coverage gate |
-| `just fmt` | `gofmt -w .` |
-| `just run -- lint file.s` | Run the CLI with `go run` (args after `--`) |
-| `just install-bin` | Install `gasm` into `$GOBIN` with the release version stamped |
-| `just gen` | Regenerate `arch/*_gen.go` instruction tables from the Go toolchain |
-| `just uninstall` | Remove build artefacts (`coverage.out`, `gasm`, `*.test`) |
+Releases are cut by merging `development` into `main` and tagging `vX.Y.Z`. The release
+workflow builds the assets and publishes the release and its notes.
 
-## Running a Single Test
+## Code style
 
-```sh
-go test -run TestVexGroundTruth ./asm/
-go test -run TestDifferentialLZ4Fuzz ./verify/
-```
+`gofmt` and `go vet` run through `just fmt` and `just vet`, with zero diff and zero
+warnings tolerated. `just vet` is two gates, `go vet ./...` and `go fix -diff ./...`,
+so the modernisation rewrites are enforced too. `just gates` is the definition of done in
+one command, and the recipe file names what it contains. Errors are checked explicitly,
+wrapped as `fmt.Errorf("context: %w", err)`, and nothing panics outside `main`. The
+recipe file holds the commands, and the language and standard-library surface is the one
+the `go` directive in `go.mod` pins.
 
-## Testing the Debugger
+- `golang.org/x/arch` is the one module dependency, and it is linked into the binary:
+  `gasm dis` and the debugger's listings decode through it. Everything else is the
+  standard library.
+- No cgo and no C. The standalone encoder paths (`gasm asm --format raw` and `--format
+  elf`) need no Go installation; `gasm verify --ground-truth`, `gasm verify --fuzz`,
+  `gasm audit-instructions` and `gasm asm --format goobj` resolve through the installed
+  Go toolchain.
+- The parser, lexer and formatter are hand-written; the `arch` instruction tables are
+  generated only by `_gen/gen.go` (`just gen`) and never edited by hand.
+- Assembly committed to the repository goes through `gasm fmt` and `gasm lint`, so a
+  `.s` file that `gasm fmt -l .` lists is unfinished.
 
-The interactive debugger (`gasm debug`) requires a compiled binary —
-`go run` does not work for the child process. Install first:
+New source files open with the project's two-line licence header, whose SPDX
+identifier matches `LICENSE`. Configuration files, workflows and dotfiles do not carry
+it.
 
-```sh
-just install-bin
-gasm debug --func add testdata/verify/basic_amd64.s
-```
+## AI contribution policy
 
-## Code Style
+AI tools are welcome as productivity aids and are a normal part of modern software
+development. What matters is that the contribution stays understandable, reviewable and
+genuinely useful.
 
-See [AGENTS.md](AGENTS.md) for the full style guide. Key points:
+- **Disclose the assistance.** If AI helped draft any part of a commit, issue, pull
+  request or review, say so.
+- **Commit messages carry exactly one trailer**, as a git trailer on the line after a
+  blank line that closes the subject:
 
-- `gofmt` — zero diff.
-- `go vet` — zero warnings.
-- Standard library only in production code; `golang.org/x/arch` in tests.
-- No cgo, no C, no JavaScript.
-- Hand-written Plan 9 assembly; tables generated only via `_gen/gen.go`.
+  ```
+  Assisted-by: MODEL
+  ```
 
-## Branches and Releases
+  Name the model that did the work, spelled the way its maker spells it, for example
+  `GLM 5.3`, `DeepSeek V4.1 Flash` or `Qwen 3.8 Flash`. No `Co-Authored-By`, no `Signed-off-by`,
+  no other trailers, and no prose: the trailer is the disclosure.
+- **Issues and pull requests** attribute the assistance in a comment, for example
+  `_Assisted-by: GLM 5.3_`. It does not belong in the pull request description.
+- **Take responsibility.** You are accountable for the accuracy, completeness and
+  intent of everything you submit, whether or not AI produced it.
+- **Review before marking ready.** Read the diff carefully, run it locally, and add the
+  tests it needs. Do not mark a pull request ready until you can defend every change in
+  it.
+- **Quality over quantity.** Contributions that look like un-reviewed output, or whose
+  author cannot engage substantively during review, may be closed.
+- **Preferred models.** Prefer open-weight models with transparent training data and
+  minimal output filtering.
 
-- `development` is the working branch.
-- `main` is release-only: `git merge --ff-only development`, then `git tag vX.Y.Z`.
-- Conventional Commits: `feat(asm): add EVEX gather and scatter`.
-- Every commit ends with `Assisted-by: <model-name>`.
+AI assists. It does not replace judgement.
 
-## CI
+## Continuous integration
 
-CI runs on every push to `development` and on pull requests:
+Workflows live in `.gitea/workflows/` and run on the project's own runners:
 
-- **Test** (`test.yml`) — `gofmt` check, `go vet`, `go test -race` and the
-  80 % coverage gate.
-- **Release** (`release.yml`) — cross-compiles release binaries for
-  linux/{amd64,arm64,riscv64,loong64} on version tags and publishes them.
+| Workflow | Trigger | What it does |
+|---|---|---|
+| Test | push or pull request to `development` | build, format check, vet, modernisation, the test suite with the coverage floor, the CLI and debugger tests outside the profile, then the oracle-parity rerun against `go tool asm` |
+| Release | a `v*` tag | the same gates as Test minus the oracle-parity step, then the matrix build, the version smoke test and the release itself; the race detector runs locally in `just gates` before the tag is cut |
 
-The Definition of Done (`just build` + `just test` + `just fmt`) must still
-pass locally before pushing.
+The local equivalent is `just gates`, which is the same set plus the race detector. The
+race detector also has its own workflow, dispatched by hand; it never runs on a push or a
+tag, where it would double the time and the memory a shared runner cannot spare.
 
-## AI-Assisted Contributions
+## Reporting bugs
 
-AI agents may assist with code, documentation, tests, and review. All
-AI-assisted changes must:
+Open an issue at `https://sourcedock.dev/petrbalvin/gasm-devkit/issues` with the
+version, the operating system and architecture, the exact command, the full output,
+and the expected against the actual behaviour.
 
-- Include the trailer `Assisted-by: <model-name>` in the commit message
-  (e.g. `Assisted-by: DeepSeek V4 Pro`).
-- Follow the [AGENTS.md](AGENTS.md) rules.
-- Pass the Definition of Done before committing.
-
-Attribute agent authorship in issues and pull requests on one trailing
-line:
-
-```
-_Assisted-by: Qwen 3.8 Max_
-```
-
-## Questions
-
-Open an issue at
-[sourcedock.dev/petrbalvin/gasm-devkit](https://sourcedock.dev/petrbalvin/gasm-devkit/issues).
+**Security issues do not go in the issue tracker.** Report them as
+[SECURITY.md](SECURITY.md) describes, to **opensource@petrbalvin.org**.

README.md

@@ -1,144 +1,292 @@
-# gasm-devkit
+# Plan 9 assembly tooling, inside and outside Go
 
-Developer tooling for **GAsm** — Go's built-in Plan 9 assembler.
+> **Warning: this is an experiment.** gasm-devkit is under active
+> development and is not stable. The version is 0.x.x: commands, flags,
+> output formats and behaviour can change without warning at any time.
+> A 1.0.0 release is light years away. Nothing in this document is a
+> stability promise. For all of that, this is not a paper project: gasm
+> is already in active use and is tested on real assembly work. Only
+> amd64 is validated on real hardware; the other three architectures run
+> under emulation ([Validation status](#validation-status)).
 
-Go ships an assembler but no tooling for it.  There is no syntax highlighting,
-no autocomplete, no linter, no static analyser, no formatter, no standalone
-assembler and no debugger for `.s` files.  Developers write assembly blind,
-validate it by benchmark, and debug it by print statement.
+**GAsm** is Go's Plan 9 assembler, and Go ships it without tooling:
+there is no formatter, no linter and no debugger for `.s` files, and no
+assembler that works without a Go installation. Developers write
+assembly blind, validate it by benchmark, and debug it by print
+statement. gasm-devkit is the missing toolkit: a single, self-contained
+binary, `gasm`, that serves both purposes.
 
-gasm-devkit is the missing toolkit.  It is a single, self-contained binary —
-`gasm` — that brings proper developer tooling to Plan 9 assembly:
+- **Help develop Plan 9 assembly.** Formatting, linting, disassembly,
+  dynamic verification, a source-level debugger and a language server,
+  for `.s` files in Go programs.
+- **Use Plan 9 assembly outside the Go toolchain.** `gasm asm` encodes
+  on its own and writes raw images or linkable ELF objects with DWARF5
+  debug sections, with no Go installation in the loop; the Go
+  toolchain's own GOOBJ format, which `go build` consumes in place of
+  the toolchain's output, needs the installed toolchain.
 
-```
-gasm tokens   dump the lexical token stream
-gasm parse    parse and report syntax errors
-gasm fmt      canonicalise formatting (gofmt for assembly)
-gasm lint     static checks
-gasm lsp      language server (completion, hover, symbols, diagnostics, highlighting)
-gasm asm      standalone assembler
-gasm verify   dynamic analysis & verification
-gasm debug    source-level debugger
-gasm diff     compare machine code of two .s files
-gasm profile  show basic-block structure of functions
+## Why Plan 9 assembly
+
+Plan 9 assembly is the quiet triumph of the field. One syntax across
+every architecture Go builds for: the same source-first operand order,
+the same four pseudo-registers, the same frame convention, whether the
+target is x86, ARM, RISC-V or LoongArch. Learn it once and you can
+read a kernel on any of them.
+
+Compare the alternatives. Intel syntax and AT&T syntax disagree on the
+one question every instruction answers, which operand is the source
+and which is the destination, so half the world writes it one way,
+half the other, and every assembly programmer carries both in their
+head forever. GNU as settles the argument with directives that switch
+dialects mid-file (`.intel_syntax noprefix`), a percent sign on every
+register and a dollar on every immediate: punctuation that carries
+nothing the operand order did not already say. And the x86 family
+fragments again underneath: NASM is not MASM is not GAS, each with its
+own directive zoo and macro language, so every project picks a dialect
+and every reader learns a different one by accident.
+
+Plan 9 assembly has none of it. Registers are bare names. Memory is
+one notation, `offset(base)`, extended by an index and a scale when
+the instruction needs it. Arguments arrive named and offset-checked:
+`x+0(FP)` is the argument x, on every architecture, and `go vet`
+polices the offsets against the Go prototype.
+
+```text
+AT&T (GNU as):   movq %rax, -16(%rbp)
+Plan 9 (Go):     MOVQ AX, total-16(SP)
 ```
 
-## Architecture support
+The same lines, but only one of them tells you what the number is for.
+The syntax is uppercase, regular and boring, which is the highest
+compliment a language for machine code can earn. gasm-devkit exists
+to give that syntax the tooling it deserves.
 
-gasm-devkit targets every architecture Go's assembler speaks.  The instruction
-tables are **generated from the Go toolchain's own assembler source**
-(`cmd/internal/obj/<arch>`), so gasm-devkit recognises *every* mnemonic the
-real assembler accepts — not a hand-maintained subset that drifts and rots.
+## Features
 
-| Architecture | GOARCH      | File suffix    | Instructions recognised            |
-|--------------|-------------|----------------|------------------------------------|
-| AMD64        | `amd64`     | `_amd64.s`     | 1600 + common opcodes + traditional aliases |
-| ARM64        | `arm64`     | `_arm64.s`     | 538 + common opcodes               |
-| RISC-V       | `riscv64`   | `_riscv64.s`   | 961 + common opcodes               |
-| LoongArch    | `loong64`   | `_loong64.s`   | 799 + common opcodes               |
+- **Front end.**  A hand-written lexer and an error-tolerant parser produce a
+  typed AST with source positions; `gasm tokens` and `gasm parse` expose them
+  directly.
+- **Formatter.**  `gasm fmt` canonicalises indentation, operand spacing,
+  per-function mnemonic alignment and blank-line layout: `gofmt` for assembly,
+  operating recursively on directories the way `go fmt` does.  `-l` lists
+  files whose formatting differs and `-d` prints a unified diff.
+- **Linter.**  `gasm lint` runs 18 conservative static checks, among them
+  `undefined-label`, `abi-argsize` (declared argument area vs the `// func`
+  signature), `register-clobber` (Go ABI register liveness over the
+  control-flow graph), `stack-imbalance`, `abi0-register-args` and
+  `unencodable-instruction`.
+- **Standalone assembler.**  `gasm asm` encodes all four architectures without
+  the Go toolchain and writes raw images or linkable ELF objects (with DWARF5
+  debug sections) with no Go installation needed, or the Go toolchain's own
+  GOOBJ format, which needs the installed toolchain and which `go build`
+  consumes in place of the toolchain's output.  Framed functions get the
+  stack-split guard and the morestack block, byte-identical to the
+  toolchain's, so split functions link too.
+- **Disassembler.**  `gasm dis` lists a `.s` file's functions at their real
+  offsets after assembling, or disassembles raw bytes from a file or stdin.
+- **Dynamic verification.**  `gasm verify` JIT-loads assembled functions into
+  executable memory: smoke calls, ABI checks (sentinel registers, red-zone
+  canary), differential fuzzing against the `go tool asm` build, and
+  byte-for-byte ground-truth comparison of the machine code.
+- **Debugger.**  `gasm debug` is a source-level ptrace debugger with
+  breakpoints (optionally conditional), hardware watchpoints, register and
+  memory inspection, and headless script runs that report instruction and
+  label coverage.
+- **Language server.**  `gasm lsp` serves completion, hover, document symbols,
+  push and pull diagnostics, semantic-token highlighting, go-to-definition,
+  find references, rename, formatting, inlay hints, code actions, signature
+  help, document highlights, workspace symbol search, #include document
+  links and folding ranges over stdio; definition, references and rename
+  work across every open document.
+- **Comparators and audits.**  `gasm diff` compares the machine code of two
+  assembly files byte-for-byte, `gasm profile` shows basic-block structure,
+  `gasm audit-instructions` diffs the encoder against the installed toolchain,
+  and `gasm scaffold` generates a differential test skeleton for a kernel.
+
+### Architecture support
+
+Four architectures, the four that matter in practice:
+
+| Architecture | GOARCH      | File suffix  | Instructions recognised                     |
+|--------------|-------------|--------------|---------------------------------------------|
+| AMD64        | `amd64`     | `_amd64.s`   | 1600 + common opcodes + traditional aliases |
+| ARM64        | `arm64`     | `_arm64.s`   | 538 + common opcodes                        |
+| RISC-V       | `riscv64`   | `_riscv64.s` | 961 + common opcodes                        |
+| LoongArch    | `loong64`   | `_loong64.s` | 799 + common opcodes                        |
 
 "Common opcodes" are the instructions shared by every architecture (`RET`,
-`JMP`, `NOP`, `CALL`, `TEXT`, `FUNCDATA`, `PCDATA`, …).  AMD64 additionally
+`JMP`, `NOP`, `CALL`, `TEXT`, `FUNCDATA`, `PCDATA`, ...).  AMD64 additionally
 carries the traditional conditional-jump spellings (`JZ`, `JNZ`, `JA`, `JC`,
-…) that the assembler accepts as aliases.  Regenerating the tables is one
-command — `just gen` — and requires only a Go installation; the committed
-output has no runtime dependency on the toolchain.
+...) that the assembler accepts as aliases.  The tables are generated from
+the Go toolchain's own assembler source (`just gen` refreshes them), so
+every mnemonic the real assembler accepts is recognised; what the encoder
+can emit today is narrower, and a recognised but unencodable instruction is
+reported as an explicit error, never as a wrong byte.
 
-## Supported Platforms
+The same measurement runs over GOROOT's whole assembly corpus:
+`gasm audit-instructions --corpus` reports 136 of 433 attemptable files
+(31.4 %) assembling for every target architecture today (files named for
+other Go ports are counted but never attempted), with the top failure
+reasons per architecture; the number moves with every release.
 
-The toolkit runs on Linux.  All four Linux architectures are supported as
-hosts — amd64, arm64, riscv64 and loong64 — and the release matrix
-cross-compiles the same four targets.
+### Validation status
 
-**FreeBSD support is planned for a future release.**
+**Only amd64 is validated on real hardware.** The other three
+architectures are validated under qemu-user emulation, because the
+project owns no arm64, riscv64 or loong64 machine, and emulation is the
+only substitute available for the hardware. The distinction matters and
+is stated rather than implied: everything below is a claim about what has
+actually been executed.
 
-## Principles
+| Layer | amd64 | arm64, riscv64, loong64 |
+|---|---|---|
+| Encoding: byte-for-byte against `go tool asm` | native hardware | native hardware (the toolchain cross-assembles any GOARCH on any host) |
+| Execution: JIT calls, ABI checks, differential fuzzing | native hardware | qemu-user emulation |
+| Debugger: ptrace tracing, breakpoints, watchpoints, coverage | native hardware | emulation cannot run ptrace; the layer compiles and its architecture-neutral units run under `go test ./...`, nothing more |
 
-- **Pure Go and GAsm only.**  No C, no cgo, no external toolchains, no native
-  binaries, no JavaScript runtimes.  The parser is hand-written; there is no
-  parser generator.
-- **Self-contained.**  The toolkit's production code depends only on the
-  standard library; one binary, no runtime data files.  The single module
-  dependency, `golang.org/x/arch`, is used **only in tests** to validate the
-  instruction encoder by round-trip decoding — it is never linked into the
-  `gasm` binary.
-- **Linux-only.**  Runs natively on amd64, arm64, riscv64 and loong64 Linux
-  hosts; the release matrix cross-compiles the same four targets.  Latest
-  stable Go only.
-- **No vendor lock-in.**  The integration surface is the Language Server
-  Protocol and a command-line interface — both open standards.  No cloud
-  service, no proprietary API, no dependence on any one editor's internals.
-- **Complete and verifiable.**  Instruction coverage is generated from the
-  assembler's own source and regenerated on demand, so it cannot silently fall
-  behind the toolchain.
+Consequences, stated plainly. An emulator is a model of a CPU, not the
+CPU: instruction semantics are implemented in software and can differ
+from silicon in ways a test suite does not reveal. A kernel that passes
+under qemu-user is therefore not proven correct on real hardware, and a
+discrepancy found on real hardware is a defect in gasm, reported like any
+other. Encoding parity is the exception: the byte comparison against the
+toolchain runs on the host for every architecture, so no emulator stands
+between the claim and the evidence. The debugger is the weakest case: on
+the three emulated architectures its per-architecture ptrace code has
+been compiled and read, never executed. Its architecture-neutral units
+run under `go test ./...`, which the race workflow and a manual run
+perform; the default `just test` gate does not sweep `./debug/...`.
 
-## Components
+## Direction
 
-| Package | Purpose |
-|---------|---------|
-| `token` | Lexical token kinds and source positions. |
-| `lexer` | Hand-written scanner for Plan 9 assembly. |
-| `ast` | The abstract syntax tree. |
-| `parser` | Line-oriented, error-tolerant parser producing the AST. |
-| `arch` | amd64, arm64, riscv64 and loong64 register files and instruction tables. |
-| `lint` | Conservative static checks. |
-| `format` | A canonical formatter — `gofmt` for assembly. |
-| `asm` | The standalone assembler: amd64, RISC-V and LoongArch encoders, linker, object-file emitters (ELF, GOOBJ). |
-| `verify` | JIT execution substrate for dynamic analysis, combined ABI+fuzz differential testing. |
-| `debug` | Interactive ptrace debugger with GPR/YMM register display and named buffer allocation. |
-| `lsp` | Language Server Protocol server. |
-| `cmd/gasm` | The `gasm` binary tying it all together. |
-| `_gen` | The generator that rebuilds the instruction tables from the Go toolchain. |
+The plan, in the order it is being worked:
 
-See [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) for the design rationale and
-data flow, and [`docs/DECISIONS.md`](docs/DECISIONS.md) for design decisions
-deliberately postponed (with the analysis needed to pick them up again).
+- **Extended instruction support.**  Two layers. First, encoding
+  coverage for every mnemonic the Go toolchain itself accepts, closed in
+  order of how often real code needs each instruction;
+  `gasm audit-instructions` measures the gap. Second, the larger work:
+  an extended instruction set the toolchain does not know at all. The
+  toolchain-derived tables stay generated and untouched; only the
+  extended instructions are hand-maintained, with their own spellings
+  and encoders, verified by execution (on real hardware for amd64, under
+  emulation for the rest, per the validation status above) because the
+  toolchain offers no ground truth to compare against. The gaps exist
+  on every architecture, amd64 included.
+- **Full GOOBJ and ELF compilation.**  The destination is a complete,
+  standalone compilation path: linkable ELF objects for consumers outside
+  Go, and GOOBJ objects that `go build` links directly.  Through GOOBJ, a
+  Go program will be able to use machine instructions that the Go
+  toolchain itself does not support; through ELF, Plan 9 assembly becomes
+  usable outside Go entirely.
+- **Platforms: Linux and FreeBSD.**  Linux is supported today on all four
+  architectures and is where the binary builds.  FreeBSD follows: the
+  JIT's executable-memory mapping and the ptrace debugger layer are the
+  two pieces of porting work.  Other unix systems may follow those two.
+- **Four architectures, no more.**  amd64, arm64, riscv64 and loong64.
+  No others are planned.
+
+## Install
+
+Prebuilt binaries for linux/amd64, linux/arm64, linux/riscv64 and
+linux/loong64 are on the
+[releases page](https://sourcedock.dev/petrbalvin/gasm-devkit/releases).
+From source (Go 1.27.1):
+
+```sh
+go install sourcedock.dev/petrbalvin/gasm-devkit/cmd/gasm@latest
+```
+
+Or from a repository checkout:
+
+```sh
+just install
+```
+
+The installed binary reports the version the toolchain recorded: the tag
+on a tagged checkout, a pseudo-version naming the commit below one.
 
 ## Quick start
 
 ```sh
-just install     # download dependencies (there are none)
-just build       # go vet + gofmt check — zero errors, zero warnings
-just test        # full suite, race detector, 80 % coverage gate
-just fmt         # gofmt the tree
-just gen         # regenerate the instruction tables from the Go toolchain
+cat > hello_amd64.s <<'EOF'
+#include "textflag.h"
+
+// func add(a, b int) int
+TEXT ·add(SB), NOSPLIT, $0-24
+	MOVQ a+0(FP), AX
+	ADDQ b+8(FP), AX
+	MOVQ AX, ret+16(FP)
+	RET
+EOF
+
+gasm lint hello_amd64.s                         # static checks
+gasm asm -o hello.bin hello_amd64.s             # assemble to a raw image
+gasm verify --call add --args a=2,b=3 hello_amd64.s   # JIT-call it with arguments
 ```
 
-Install the binary and use it:
+## Usage
 
 ```sh
-just install-bin                    # installs gasm into $GOBIN
-
-gasm --help                         # overview of commands and flags
-gasm tokens kernel_amd64.s          # dump the token stream
-gasm parse  kernel_amd64.s          # parse, report syntax errors
-gasm fmt    -w kernel_amd64.s       # canonicalise in place
-gasm fmt                            # reformat every .s below here, like go fmt
-gasm lint   *.s                     # static checks
-gasm asm --format elf -o k.o k.s    # assemble to a linkable ELF object
-gasm verify kernel_amd64.s           # JIT-load and report functions
-gasm verify --ground-truth k.s      # byte-for-byte vs go tool asm
-gasm verify --call decodeBlockAVX2 --buf src:64:hex...,dst:256:zero k.s
-gasm debug --func name k.s           # interactive debugger
-gasm diff a.s b.s                    # compare machine code byte-for-byte
+gasm fmt                                # reformat every .s below here, like go fmt
+gasm fmt    -w kernel_amd64.s           # canonicalise one file in place
+gasm fmt    -l *.s                      # list files whose formatting differs
+gasm fmt    -d kernel_amd64.s           # print a unified diff instead
+gasm lint   *.s                         # static checks
+gasm asm --format elf -o k.o k.s        # assemble to a linkable ELF object
+gasm asm --format goobj -p pkg/path -o k.o k.s   # Go object, consumed by go build
+gasm dis k.s                            # assemble, then list each function
+gasm dis -a amd64 - < dump.bin          # disassemble raw bytes from stdin
+gasm verify --ground-truth k.s          # byte-for-byte vs go tool asm
+gasm verify --fuzz k.s                  # differential fuzz vs the go tool asm build
+gasm debug --func name k.s              # interactive debugger
+gasm debug --func name --script cmds.txt --timeout 30s k.s   # headless run
+gasm debug --func name --cover k.s      # instruction and label coverage
+gasm diff a.s b.s                       # compare machine code byte-for-byte
 gasm diff --map wideCopyAVX2=wideCopyAVX512 avx2.s avx512.s
-gasm profile k.s                     # show basic-block structure
+gasm profile k.s                        # show basic-block structure
+gasm audit-instructions                 # encoder vs go tool asm name diff
+gasm scaffold differential k.s          # generate a differential test skeleton
 ```
 
-See [CONTRIBUTING.md](CONTRIBUTING.md) for the full development workflow,
-[docs/CLI.md](docs/CLI.md) for the command reference, and
-[docs/DEVELOPMENT.md](docs/DEVELOPMENT.md) for setup and recipes.
+Run `gasm --help` for the command overview and `gasm <command> -h` for a
+command's flags.  [docs/CLI.md](docs/CLI.md) is the full reference.
 
-## Editor integration
+### Editor integration
 
 `gasm lsp` speaks the Language Server Protocol over standard input/output, so
-any LSP-capable editor can use it — point your editor's LSP client at the
+any LSP-capable editor can use it: point your editor's LSP client at the
 binary and associate it with `.s` files.  Syntax highlighting is delivered as
-**LSP semantic tokens**, so no editor-specific grammar is required.  The server
+LSP semantic tokens, so no editor-specific grammar is required.  The server
 infers the target architecture from the file-name suffix
 (`_amd64.s` / `_arm64.s` / `_riscv64.s` / `_loong64.s`).
 
-## License
+## Development
+
+```sh
+just build        # compile, zero errors and zero warnings
+just test         # the suite, no cache, the 80 % coverage floor
+just gates        # build, fmt-check, vet, test, race: the definition of done
+just fmt          # gofmt the tree
+just gen          # regenerate the instruction tables from the Go toolchain
+```
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for the development workflow and
+[docs/DEVELOPMENT.md](docs/DEVELOPMENT.md) for setup details and every
+recipe.
+
+## Documentation
+
+- [docs/CLI.md](docs/CLI.md): full command reference
+- man pages: `just install-man` installs gasm(1) and one page per command
+  except `version`, which is documented inside gasm(1) instead, into
+  ~/.local/share/man (MANDIR overrides); `just uninstall-man` removes
+  them
+- [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md): components and data flow
+- [docs/DEVELOPMENT.md](docs/DEVELOPMENT.md): development setup and recipes
+- [CHANGELOG.md](CHANGELOG.md): release history
+
+## Licence
+
+BSD-3-Clause; see [LICENSE](LICENSE).
 
-BSD-3-Clause — see [LICENSE](LICENSE).  
 Copyright © 2026 [Petr Balvín](https://petrbalvin.org)

SECURITY.md

@@ -0,0 +1,41 @@
+# Security policy
+
+## Supported versions
+
+Security fixes go to the newest release and to the `development` branch. Older
+releases do not receive them.
+
+| Version | Supported |
+|---|---|
+| 0.34.0 | yes |
+| older releases | no |
+
+## Reporting a vulnerability
+
+**Do not open a public issue for a security problem.** A public report tells everyone
+about the flaw before there is a fix. Report it privately to
+**opensource@petrbalvin.org**.
+
+Include:
+
+- the version or commit you tested, and the platform
+- what the problem is, and what an attacker gains from it
+- the smallest reproducer you have, ideally a test or a single command
+- a suggested fix, if you have one
+
+## What to expect
+
+- A human reads the report, and you get an acknowledgement.
+- You are kept informed while the fix is being made, and told when it ships.
+- The fix is released before the details are published, and the timing is agreed with
+  you.
+- The fix ships without naming you: the project keeps no credits list, so the release
+  notes, the changelog and the commits name no reporter.
+
+## Out of scope
+
+- Findings that require the attacker to already run code as the user, or to have local
+  access.
+- Missing hardening with no demonstrated impact.
+- Flaws in a third-party dependency: report them to that project, and to this one only
+  when this project's use of it makes them reachable.

arch/amd64.go

@@ -70,6 +70,10 @@ func amd64Registers() []Register {
 	for i := 0; i <= 7; i++ {
 		add(fmt.Sprintf("K%d", i), Mask, "AVX-512 mask register")
 	}
+	// x87 stack registers (FMOVD and the other x87 moves).
+	for i := 0; i <= 7; i++ {
+		add(fmt.Sprintf("F%d", i), Float, "x87 stack register")
+	}
 	return regs
 }
 
@@ -270,6 +274,8 @@ func amd64Curated() []Instr {
 		"VMINPD", "VMINPS", "VMINSD", "VMINSS", "VMAXPD", "VMAXPS", "VMAXSD", "VMAXSS",
 		"VXORPD", "VXORPS", "VANDPD", "VANDPS", "VANDNPD", "VANDNPS", "VORPD", "VORPS",
 		"VUNPCKHPD", "VUNPCKLPD", "VUNPCKHPS", "VUNPCKLPS",
+		"PSHUFD", "PSHUFHW", "PSHUFLW", "SHUFPS", "SHUFPD",
+		"UNPCKLPS", "UNPCKHPS", "UNPCKLPD", "UNPCKHPD",
 		"VSQRTPD", "VSQRTPS", "VSQRTSD", "VSQRTSS", "VRSQRTPS", "VRCPPS",
 		"VCMPPD", "VCMPPS", "VCMPSD", "VCMPSS",
 	} {

arch/arch.go

@@ -55,6 +55,7 @@ const (
 	Mask                    // AVX-512 mask register (K)
 	Float                   // arm64 floating-point register (F)
 	VecARM                  // arm64 SIMD/vector register (V)
+	VecSIMD                 // architecture-neutral SIMD/vector register (LoongArch LSX/LASX)
 	Special                 // architecture-special register
 )
 
@@ -73,6 +74,8 @@ func (c RegClass) String() string {
 		return "float"
 	case VecARM:
 		return "vector (arm64)"
+	case VecSIMD:
+		return "vector"
 	case Special:
 		return "special"
 	default:

arch/arm64.go

@@ -29,7 +29,7 @@ func arm64Registers() []Register {
 		regs = append(regs, Register{Name: name, Class: class, Desc: desc})
 	}
 
-	// General-purpose integer registers R0–R30.
+	// General-purpose integer registers R0-R30.
 	for i := 0; i <= 30; i++ {
 		add(fmt.Sprintf("R%d", i), GPR, "64-bit general-purpose register")
 	}
@@ -145,11 +145,38 @@ func arm64Curated() []Instr {
 	for _, op := range []string{
 		"LDAXR", "LDAXRB", "LDAXRH", "LDAXRW", "STXR", "STXRB", "STXRH", "STXRW",
 		"LDAR", "LDARB", "LDARH", "LDARW", "STLR", "STLRB", "STLRH", "STLRW",
-		"LDADD", "LDCLR", "LDEOR", "LDSET", "SWP", "CAS", "CASAL", "CASL", "CASAL",
+		"LDADD", "LDCLR", "LDEOR", "LDSET", "SWP", "CAS", "CASAL", "CASL",
 	} {
 		t = append(t, i(op, "Atomic memory operation"))
 	}
 
+	// Register-pair loads and stores.
+	for _, op := range []string{"LDP", "STP", "LDPW", "STPW", "FLDPD", "FSTPD"} {
+		t = append(t, ic(op, "Register-pair load or store", 2, 2))
+	}
+
+	// Cache maintenance and prefetch.
+	t = append(t, i("DC", "Data cache maintenance"))
+	t = append(t, i("PRFM", "Memory prefetch"))
+	for _, op := range []string{"LDADDAL", "LDCLRAL", "LDORAL", "SWPAL"} {
+		t = append(t, i(op, "Atomic memory operation with acquire and release semantics"))
+	}
+
+	// Cryptographic extensions.
+	for _, op := range []string{"AESE", "AESD", "AESMC", "AESIMC"} {
+		t = append(t, i(op, "AES round"))
+	}
+	for _, op := range []string{
+		"SHA1C", "SHA1P", "SHA1M", "SHA1H", "SHA1SU0", "SHA1SU1",
+		"SHA256H", "SHA256H2", "SHA256SU0", "SHA256SU1",
+		"SHA512H", "SHA512H2", "SHA512SU0", "SHA512SU1",
+	} {
+		t = append(t, i(op, "SHA round"))
+	}
+	for _, op := range []string{"VEOR3", "VBCAX", "VXAR", "VRAX1"} {
+		t = append(t, i(op, "Three-way XOR / rotate crypto vector operation"))
+	}
+
 	// Floating-point scalar.
 	for _, op := range []string{
 		"FADD", "FSUB", "FMUL", "FDIV", "FNEG", "FABS", "FSQRT", "FMIN", "FMAX",

arch/loong64.go

@@ -31,10 +31,10 @@ func loong64Registers() []Register {
 		add(fmt.Sprintf("F%d", i), Float, "floating-point register")
 	}
 	for i := 0; i <= 31; i++ {
-		add(fmt.Sprintf("V%d", i), VecARM, "LSX 128-bit vector register")
+		add(fmt.Sprintf("V%d", i), VecSIMD, "LSX 128-bit vector register")
 	}
 	for i := 0; i <= 31; i++ {
-		add(fmt.Sprintf("X%d", i), VecARM, "LASX 256-bit vector register")
+		add(fmt.Sprintf("X%d", i), VecSIMD, "LASX 256-bit vector register")
 	}
 	return regs
 }

asm/aarch64_goobj_test.go

@@ -4,6 +4,7 @@
 package asm
 
 import (
+	"encoding/binary"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -61,6 +62,62 @@ TEXT ·add(SB), NOSPLIT, $0-24
 	}
 }
 
+// TestGOObjectAARCH64PairReloc pins the ADRP-pair relocation shape against
+// the toolchain's own object for the same source: exactly one R_ADDRARM64
+// of Siz 8 at the ADRP word (cmd/internal/obj/arm64/asm7.go adds a single
+// Siz-8 relocation per pair and the linker patches both instructions from
+// it).  gasm's assembler records the ADRP+ADD form as two word relocs; the
+// emitter must coalesce them, not emit two Siz-4 records.
+func TestGOObjectAARCH64PairReloc(t *testing.T) {
+	f, errs := parser.Parse("gv_arm64.s", `
+#include "textflag.h"
+
+TEXT ·getv(SB), NOSPLIT, $0-8
+	MOVD $v<>(SB), R4
+	MOVD R4, ret+0(FP)
+	RET
+
+GLOBL v<>(SB), RODATA, $8
+DATA v<>+0(SB)/8, $7
+`)
+	if len(errs) > 0 {
+		t.Fatalf("parse: %v", errs)
+	}
+	img, err := AssembleFileARM64(f)
+	if err != nil {
+		t.Fatalf("AssembleFileARM64: %v", err)
+	}
+	obj, err := img.GOObjectAARCH64("main", "gv_arm64.s")
+	if err != nil {
+		t.Fatalf("GOObjectAARCH64: %v", err)
+	}
+	v := openGoobj(t, obj)
+	relocs := v.blk(blkReloc)
+	le := binary.LittleEndian
+	// Two DWARF relocs on the lines/DIE symbols, then the code's one pair
+	// relocation.
+	if len(relocs) != 3*23 {
+		t.Fatalf("relocs = %d bytes, want three entries", len(relocs))
+	}
+	cr := relocs[2*23:]
+	if off := int32(le.Uint32(cr[0:])); off != 0 {
+		t.Errorf("pair reloc off = %d, want 0 (the ADRP word)", off)
+	}
+	if siz := cr[4]; siz != 8 {
+		t.Errorf("pair reloc siz = %d, want 8", siz)
+	}
+	if typ := le.Uint16(cr[5:]); typ != relocArm64Addr {
+		t.Errorf("pair reloc type = %d, want %d (R_ADDRARM64)", typ, relocArm64Addr)
+	}
+	if pkg := le.Uint32(cr[15:]); pkg != pkgIdxSelf {
+		t.Errorf("pair reloc PkgIdx = %#x, want pkgIdxSelf", pkg)
+	}
+	// The GLOBL is the first package definition.
+	if sym := le.Uint32(cr[19:]); sym != 0 {
+		t.Errorf("pair reloc SymIdx = %d, want 0 (the GLOBL definition)", sym)
+	}
+}
+
 // TestGOObjectAARCH64Link does an end-to-end link test: it cross-compiles a
 // Go program for arm64, substitutes the gasm-produced object into the package
 // archive, re-links with cmd/link, and verifies the symbol appears in the
@@ -79,6 +136,14 @@ TEXT ·add(SB), NOSPLIT, $0-24
 	ADD R5, R4, R4
 	MOVD R4, ret+16(FP)
 	RET
+
+TEXT ·getv(SB), NOSPLIT, $0-8
+	MOVD $v<>(SB), R4
+	MOVD R4, ret+0(FP)
+	RET
+
+GLOBL v<>(SB), RODATA, $8
+DATA v<>+0(SB)/8, $7
 `
 	if err := os.WriteFile(filepath.Join(dir, "main_arm64.s"), []byte(asmSrc), 0o644); err != nil {
 		t.Fatal(err)
@@ -86,11 +151,15 @@ TEXT ·add(SB), NOSPLIT, $0-24
 	mainSrc := `package main
 
 func add(a, b int64) int64
+func getv() *int64
 
 func main() {
 	if add(20, 22) != 42 {
 		panic("bad add")
 	}
+	if getv() == nil {
+		panic("bad getv")
+	}
 }
 `
 	if err := os.WriteFile(filepath.Join(dir, "main.go"), []byte(mainSrc), 0o644); err != nil {
@@ -109,16 +178,13 @@ func main() {
 	if err != nil {
 		t.Fatalf("baseline build: %v\n%s", err, buildLog)
 	}
-	var pkgArch, work, linkLine, asmObj string
-	for _, line := range strings.Split(string(buildLog), "\n") {
+	var work, linkLine, asmObj string
+	for line := range strings.SplitSeq(string(buildLog), "\n") {
 		switch {
 		case strings.HasPrefix(line, "WORK="):
 			work = strings.TrimPrefix(line, "WORK=")
 		case strings.Contains(line, "/asm ") && strings.Contains(line, "main_arm64.s") && !strings.Contains(line, "-gensymabis"):
 			asmObj = fieldAfter(line, "-o")
-		case strings.Contains(line, "pack r") && strings.Contains(line, "_pkg_.a"):
-			pkgArch = strings.TrimSpace(strings.SplitN(line, "pack r", 2)[1])
-			pkgArch = strings.Fields(strings.SplitN(pkgArch, "#", 2)[0])[0]
 		case strings.Contains(line, "/link ") && strings.Contains(line, "-importcfg"):
 			linkLine = line
 		}

asm/arm64_encode.go

@@ -9,7 +9,7 @@ package asm
 // an opcode constant, and the format selects the bit layout.  The opcode
 // constants and formats are transcribed from the Go toolchain's own arm64
 // backend (cmd/internal/obj/arm64), so the emitted bytes match `go tool asm`
-// exactly — the ground-truth oracle for the verify suite.
+// exactly, the ground-truth oracle for the verify suite.
 //
 // All AArch64 instructions are 32 bits, little-endian.  The formats used here
 // (per the ARM Architecture Reference Manual):
@@ -27,8 +27,16 @@ package asm
 //	Uncond-branch   0x6B<<25 | opc<<21 | Rn<<5 | Rd   (BR/BLR/RET)
 //	ADR/ADRP        p<<31 | 0x10<<24 | immlo<<29 | immhi<<5 | Rd
 
+import (
+	"maps"
+	"strconv"
+	"strings"
+
+	"sourcedock.dev/petrbalvin/gasm-devkit/ast"
+)
+
 // arm64RegNum returns the 5-bit register number for an AArch64 register name:
-// R0–R30 (integer), F0–F31 (floating point), and the ABI aliases the
+// R0-R30 (integer), F0-F31 (floating point), and the ABI aliases the
 // runtime's assembly uses.  Returns -1 for an unrecognised name.
 func arm64RegNum(name string) int {
 	switch name {
@@ -96,10 +104,14 @@ func arm64RegNum(name string) int {
 		return 30
 	case "R31", "ZR":
 		return 31
-	case "SP":
-		return 31 // SP and ZR share encoding 31; context determines meaning
+	case "SP", "RSP":
+		// RSP is the toolchain's spelling for register 31 (it rejects
+		// R31 in an operand); SP stays for sources that spell it the
+		// amd64 way.  SP and ZR share encoding 31; context determines
+		// the meaning.
+		return 31
 	}
-	// F0–F31.
+	// F0-F31.
 	if len(name) >= 1 && name[0] == 'F' {
 		n := 0
 		for i := 1; i < len(name); i++ {
@@ -115,12 +127,6 @@ func arm64RegNum(name string) int {
 	return -1
 }
 
-// arm64IsSP reports whether a register operand is the stack pointer (R31/SP),
-// which uses a different encoding path for some instructions.
-func arm64IsSP(name string) bool {
-	return name == "SP"
-}
-
 // ---- format helpers ----
 
 // a64wordLE encodes a uint32 as 4 little-endian bytes.
@@ -137,14 +143,6 @@ func a64WordsLE(ws ...uint32) []byte {
 	return out
 }
 
-// ---- data-processing (shifted register) ----
-
-// a64DPSR encodes a data-processing (shifted register) instruction:
-// sf<<31 | op<<30 | S<<29 | 0x0b<<24 | shift<<22 | 0<<21 | Rm<<16 | imm6<<10 | Rn<<5 | Rd.
-func a64DPSR(sf, op, S, shift, rm, imm6, rn, rd uint32) uint32 {
-	return sf<<31 | op<<30 | S<<29 | 0x0b<<24 | shift<<22 | rm<<16 | imm6<<10 | rn<<5 | rd
-}
-
 // ---- data-processing (immediate) ----
 
 // a64AddSub encodes an ADD/SUB (immediate) instruction:
@@ -153,14 +151,6 @@ func a64AddSub(sf, op, S, sh, imm12, rn, rd uint32) uint32 {
 	return sf<<31 | op<<30 | S<<29 | 0x11<<24 | sh<<22 | imm12<<10 | rn<<5 | rd
 }
 
-// ---- logical (immediate) ----
-
-// a64LogicalImm encodes a logical (immediate) instruction:
-// sf<<31 | opc<<29 | 0x24<<23 | N<<22 | immr<<16 | imms<<10 | Rn<<5 | Rd.
-func a64LogicalImm(sf, opc, N, immr, imms, rn, rd uint32) uint32 {
-	return sf<<31 | opc<<29 | 0x24<<23 | N<<22 | immr<<16 | imms<<10 | rn<<5 | rd
-}
-
 // ---- move wide ----
 
 // a64MoveWide encodes a MOVZ/MOVK/MOVN instruction:
@@ -198,38 +188,6 @@ func a64LSP(opc, V, L uint32, imm7 int32, rt2, rn, rt uint32) uint32 {
 	return opc<<30 | 5<<27 | V<<26 | 2<<23 | L<<22 | (uint32(imm7)&0x7F)<<15 | rt2<<10 | rn<<5 | rt
 }
 
-// ---- load/store pair (pre-index) ----
-
-// a64LSPPre encodes a load/store pair (pre-index):
-// opc<<30 | 0x5<<27 | V<<26 | 0b11<<23 | L<<22 | imm7<<15 | Rt2<<10 | Rn<<5 | Rt.
-func a64LSPPre(opc, V, L uint32, imm7 int32, rt2, rn, rt uint32) uint32 {
-	return opc<<30 | 5<<27 | V<<26 | 3<<23 | L<<22 | (uint32(imm7)&0x7F)<<15 | rt2<<10 | rn<<5 | rt
-}
-
-// ---- load/store pair (post-index) ----
-
-// a64LSPPost encodes a load/store pair (post-index):
-// opc<<30 | 0x5<<27 | V<<26 | 0b01<<23 | L<<22 | imm7<<15 | Rt2<<10 | Rn<<5 | Rt.
-func a64LSPPost(opc, V, L uint32, imm7 int32, rt2, rn, rt uint32) uint32 {
-	return opc<<30 | 5<<27 | V<<26 | 1<<23 | L<<22 | (uint32(imm7)&0x7F)<<15 | rt2<<10 | rn<<5 | rt
-}
-
-// ---- pre-index load/store ----
-
-// a64LSPreIndex encodes a load/store register (pre-index):
-// size<<30 | 0x7<<27 | V<<26 | opc<<22 | 1<<11 | 1<<10 | imm9<<12 | Rn<<5 | Rt.
-func a64LSPreIndex(size, V, opc uint32, imm9 int32, rn, rt uint32) uint32 {
-	return size<<30 | 7<<27 | V<<26 | opc<<22 | 3<<10 | (uint32(imm9)&0x1FF)<<12 | rn<<5 | rt
-}
-
-// ---- post-index load/store ----
-
-// a64LSPostIndex encodes a load/store register (post-index):
-// size<<30 | 0x7<<27 | V<<26 | opc<<22 | 0<<11 | 1<<10 | imm9<<12 | Rn<<5 | Rt.
-func a64LSPostIndex(size, V, opc uint32, imm9 int32, rn, rt uint32) uint32 {
-	return size<<30 | 7<<27 | V<<26 | opc<<22 | 1<<10 | (uint32(imm9)&0x1FF)<<12 | rn<<5 | rt
-}
-
 // ---- branches ----
 
 // a64Branch encodes an unconditional branch (B/BL):
@@ -259,14 +217,6 @@ func a64ADR(p uint32, immhi int32, immlo uint32, rd uint32) uint32 {
 	return p<<31 | immlo<<29 | 0x10<<24 | (uint32(immhi)&0x7FFFF)<<5 | rd
 }
 
-// ---- EXTR ----
-
-// a64EXTR encodes an EXTR instruction:
-// sf<<31 | 0<<29 | 0x27<<23 | N<<22 | 0<<21 | Rm<<16 | imms<<10 | Rn<<5 | Rd.
-func a64EXTR(sf, N, rm, imms, rn, rd uint32) uint32 {
-	return sf<<31 | 0x27<<23 | N<<22 | rm<<16 | imms<<10 | rn<<5 | rd
-}
-
 // ---- system ----
 
 // a64NOP encodes a NOP: 0xd503201f.
@@ -296,8 +246,6 @@ const (
 	a64CondLT = 0xb
 	a64CondGT = 0xc
 	a64CondLE = 0xd
-	a64CondAL = 0xe
-	a64CondNV = 0xf
 )
 
 // arm64CondMap maps Go assembler condition mnemonics to AArch64 condition codes.
@@ -326,19 +274,15 @@ type a64Format uint8
 
 const (
 	a64FDPSR         a64Format = iota // data-processing (shifted register): ADD, SUB, AND, ORR, EOR, etc.
-	a64FDPIR                          // data-processing (immediate): ADD/SUB $imm
-	a64FLogImm                        // logical (immediate): AND/ORR/EOR $imm
 	a64FMovWide                       // move wide: MOVZ, MOVN, MOVK
-	a64FLSU                           // load/store (unsigned immediate, scaled)
-	a64FLSUnscaled                    // load/store (unscaled immediate)
-	a64FLSPair                        // load/store pair
 	a64FBranch                        // unconditional branch (B/BL)
 	a64FBranchCond                    // conditional branch (B.cond)
 	a64FUncondBranch                  // unconditional branch register (BR/BLR/RET)
 	a64FADR                           // ADR/ADRP
 	a64FEXTR                          // EXTR
 	a64FBitfield                      // bitfield: BFI/BFXIL/SBFM/UBFM/BFM
-	a64FSystem                        // system: NOP, BRK, etc.
+	a64FShift                         // shifts: LSL/LSR/ASR alias SBFM/UBFM, ROR aliases EXTR; register forms are two-source
+	a64FDPR4                          // data-processing 4-register: MADD/MSUB, Ra in bits 14:10
 	a64FFP3                           // FP 3-operand (Rm, Rn, Rd): FADD, FSUB, FMUL, FDIV, etc.
 	a64FFPUnary                       // FP unary (Rn, Rd): FMOV, FABS, FNEG, FSQRT, FCVT, FRINT*
 	a64FFP4                           // FP 4-operand FMA (Ra, Rm, Rn, Rd): FMADD, FMSUB, etc.
@@ -346,12 +290,29 @@ const (
 	a64FFPCCmp                        // FP conditional compare (Rm, Rn, nzcv, cond): FCCMP, FCCMPE
 	a64FFPCvt                         // FP↔integer conversion: FCVTZS, SCVTF, etc.
 	a64FFPSel                         // FP conditional select (Rm, Rn, Rd, cond): FCSEL
-	a64FFMovGR                        // FMOV between GP and FP registers
 	a64FCRC32                         // CRC32
 	a64FCSEL                          // conditional select: CSEL, CSINC, CSINV, CSNEG
-	a64FExcl                          // exclusive load/store: LDXR, STXR, LDAXR, STLXR
+	a64FExcl                          // exclusive load/store: LDXR, STXR, LDAXR, STLXR and pair forms LDXP, STXP
 	a64FLSE                           // LSE atomics: LDADD, CAS, SWP
-	a64FSIMD3                         // SIMD 3-operand: VADD, VSUB, VMUL
+	a64FDP1                           // data-processing (1 source): RBIT, REV, CLZ, CLS
+	a64FBitfield2                     // bitfield extract: UBFX, SBFX and the W forms
+	a64FCondCmp                       // conditional compare: CCMP, CCMN
+	a64FBranch19                      // compare-and-branch: CBZ, CBNZ and the W forms
+	a64FTestBranch                    // test-and-branch: TBZ, TBNZ and the W forms
+	a64FPair                          // load/store pair: LDP, STP, LDPW, STPW, FLDPD, FSTPD
+	a64FAcqRel                        // acquire/release: LDAR family, STLR family
+	a64FSys                           // system: BRK, SVC, DMB, DSB, ISB, DC, MRS, MSR, PRFM
+	a64FCrypto2                       // crypto 2-register: AESD, AESE, AESIMC, AESMC, SHA1H, ...
+	a64FCrypto3                       // crypto 3-register: SHA1C, SHA256H, SHA512SU1, ...
+	a64FSIMDV                         // SIMD 3-register with arrangement: VADD, VAND, VCMEQ, VZIP1, ...
+	a64FSIMDVZero                     // SIMD compare against zero: VCMEQ $0, Vn, Vd
+	a64FSIMDV2                        // SIMD 2-register with arrangement: VREV32, VREV64, VUADDLV, VMOV
+	a64FSIMDV4                        // SIMD 4-register / imm 3-register: VEOR3, VBCAX, VXAR, VEXT
+	a64FVTBL                          // SIMD table lookup: VTBL
+	a64FDUP                           // SIMD element moves: VDUP, VMOV with element indices
+	a64FVLDST                         // SIMD structure loads/stores: VLD1, VST1, VLD1R, VLD4R
+	a64FShiftImm                      // SIMD shift by immediate: VSHL, VUSHR, VSRI
+	a64FMoviLit                       // VMOVS/VMOVD/VMOVQ with a large constant (literal pool)
 )
 
 // a64Enc is one instruction's encoding: its bit layout (format) and the
@@ -359,7 +320,6 @@ const (
 type a64Enc struct {
 	format a64Format
 	op     uint32 // the pre-positioned opcode bits
-	size   int    // 4 for most, 8 for DP-imm with shift, etc.
 }
 
 // a64InstrTable maps AArch64 mnemonics (as the Go assembler spells them) to
@@ -397,30 +357,14 @@ func init() {
 		"ANDSW": 0<<31 | 3<<29 | 0x0a<<24,
 		"BICS":  1<<31 | 3<<29 | 0x0a<<24 | 1<<21,
 		"BICSW": 0<<31 | 3<<29 | 0x0a<<24 | 1<<21,
-		// Shift
-		"LSL":  1<<31 | 0<<29 | 0x0a<<24, // alias of UBFM
-		"LSLW": 0<<31 | 0<<29 | 0x0a<<24,
-		"LSR":  1<<31 | 0<<29 | 0x0a<<24,
-		"LSRW": 0<<31 | 0<<29 | 0x0a<<24,
-		"ASR":  1<<31 | 0<<29 | 0x0a<<24,
-		"ASRW": 0<<31 | 0<<29 | 0x0a<<24,
-		"ROR":  1<<31 | 0<<29 | 0x0a<<24,
-		"RORW": 0<<31 | 0<<29 | 0x0a<<24,
-		// Multiply
-		"MADD":  1<<31 | 0<<29 | 0x1b<<24 | 0<<21,
-		"MADDW": 0<<31 | 0<<29 | 0x1b<<24 | 0<<21,
-		"MSUB":  1<<31 | 0<<29 | 0x1b<<24 | 1<<21,
-		"MSUBW": 0<<31 | 0<<29 | 0x1b<<24 | 1<<21,
-		// Divide
-		"SDIV":  1<<31 | 0<<29 | 0x0d<<24,
-		"SDIVW": 0<<31 | 0<<29 | 0x0d<<24,
-		"UDIV":  1<<31 | 0<<29 | 0x0d<<24 | 1<<10,
-		"UDIVW": 0<<31 | 0<<29 | 0x0d<<24 | 1<<10,
-		// CRC
-		"CRC32B": 0<<31 | 0<<29 | 0x1b<<24 | 4<<10,
-		"CRC32H": 0<<31 | 0<<29 | 0x1b<<24 | 5<<10,
-		"CRC32W": 0<<31 | 0<<29 | 0x1b<<24 | 6<<10,
-		"CRC32X": 1<<31 | 0<<29 | 0x1b<<24 | 7<<10,
+		// Divide (data-processing 2 source): the opcode occupies bits 15:10
+		// of the 0xd6<<21 fixed field, UDIV=0b0010 and SDIV=0b0011 (ARM ARM
+		// "Data-processing (2 source)"; the toolchain spells them OPDP2(2)
+		// and OPDP2(3)).  sf=1 selects the X forms.
+		"SDIV":  1<<31 | 0xd6<<21 | 3<<10,
+		"SDIVW": 0<<31 | 0xd6<<21 | 3<<10,
+		"UDIV":  1<<31 | 0xd6<<21 | 2<<10,
+		"UDIVW": 0<<31 | 0xd6<<21 | 2<<10,
 		// Conditional select
 		"CSEL":   1<<31 | 0<<29 | 0x1d<<24 | 0<<10,
 		"CSELW":  0<<31 | 0<<29 | 0x1d<<24 | 0<<10,
@@ -450,14 +394,37 @@ func init() {
 	a64InstrTable["MOV"] = a64Enc{format: a64FDPSR, op: dpsr["ORR"]}
 	a64InstrTable["MOVW"] = a64Enc{format: a64FDPSR, op: dpsr["ORRW"]}
 
-	// ---- data-processing (immediate) ----
-	// ADD/SUB $imm, Rn, Rd
-	a64InstrTable["ADDImm"] = a64Enc{format: a64FDPIR, op: 1<<31 | 0<<30 | 0<<29 | 0x11<<24}
-	a64InstrTable["ADDWImm"] = a64Enc{format: a64FDPIR, op: 0<<31 | 0<<30 | 0<<29 | 0x11<<24}
-	a64InstrTable["SUBImm"] = a64Enc{format: a64FDPIR, op: 1<<31 | 1<<30 | 0<<29 | 0x11<<24}
-	a64InstrTable["SUBWImm"] = a64Enc{format: a64FDPIR, op: 0<<31 | 1<<30 | 0<<29 | 0x11<<24}
-	a64InstrTable["ADDSImm"] = a64Enc{format: a64FDPIR, op: 1<<31 | 0<<30 | 1<<29 | 0x11<<24}
-	a64InstrTable["SUBSImm"] = a64Enc{format: a64FDPIR, op: 1<<31 | 1<<30 | 1<<29 | 0x11<<24}
+	// ---- shifts ----
+	// The mnemonic serves both forms: with an immediate the aliases of the
+	// data-processing (immediate) group apply (ARM ARM "Shifts"), with a
+	// register the data-processing (2 source) LSLV/LSRV/ASRV/RORV.  The op
+	// field carries the immediate-alias base; encodeARM64Shift derives both
+	// it and the two-source opcode.  Identities, W = 64 (X) or 32 (W):
+	//
+	//	LSL $sh, Rn, Rd = UBFM Rd, Rn, #(-sh) mod W, #(W-1)-sh
+	//	LSR $sh, Rn, Rd = UBFM Rd, Rn, #sh, #(W-1)
+	//	ASR $sh, Rn, Rd = SBFM Rd, Rn, #sh, #(W-1)
+	//	ROR $sh, Rn, Rd = EXTR Rd, Rn, Rn, #sh
+	shifts := map[string]a64Enc{
+		"LSL":  {format: a64FShift, op: 1<<31 | 2<<29 | 0x26<<23 | 1<<22}, // UBFM X
+		"LSLW": {format: a64FShift, op: 0<<31 | 2<<29 | 0x26<<23 | 0<<22}, // UBFM W
+		"LSR":  {format: a64FShift, op: 1<<31 | 2<<29 | 0x26<<23 | 1<<22}, // UBFM X
+		"LSRW": {format: a64FShift, op: 0<<31 | 2<<29 | 0x26<<23 | 0<<22}, // UBFM W
+		"ASR":  {format: a64FShift, op: 1<<31 | 0<<29 | 0x26<<23 | 1<<22}, // SBFM X
+		"ASRW": {format: a64FShift, op: 0<<31 | 0<<29 | 0x26<<23 | 0<<22}, // SBFM W
+		"ROR":  {format: a64FShift, op: 1<<31 | 0x27<<23 | 1<<22},         // EXTR X
+		"RORW": {format: a64FShift, op: 0<<31 | 0x27<<23 | 0<<22},         // EXTR W
+	}
+	maps.Copy(a64InstrTable, shifts)
+
+	// ---- multiply accumulate ----
+	// MADD/MSUB Rm, Ra, Rn, Rd: sf 00 11011 o0(15) Rm Ra Rn Rd.  The
+	// toolchain's optab has no shorter row, so all four operands are
+	// mandatory, and Ra is the SECOND operand.
+	a64InstrTable["MADD"] = a64Enc{format: a64FDPR4, op: 1<<31 | 0x1b<<24}
+	a64InstrTable["MADDW"] = a64Enc{format: a64FDPR4, op: 0<<31 | 0x1b<<24}
+	a64InstrTable["MSUB"] = a64Enc{format: a64FDPR4, op: 1<<31 | 0x1b<<24 | 1<<15}
+	a64InstrTable["MSUBW"] = a64Enc{format: a64FDPR4, op: 0<<31 | 0x1b<<24 | 1<<15}
 
 	// ---- move wide ----
 	// MOVZ/MOVN/MOVK
@@ -472,22 +439,9 @@ func init() {
 	a64InstrTable["ADR"] = a64Enc{format: a64FADR, op: 0}
 	a64InstrTable["ADRP"] = a64Enc{format: a64FADR, op: 1}
 
-	// ---- load/store (unsigned immediate) ----
-	a64InstrTable["MOVD"] = a64Enc{format: a64FLSU, op: 3<<30 | 7<<27 | 1<<22}          // LDR 64-bit
-	a64InstrTable["MOVWU"] = a64Enc{format: a64FLSU, op: 2<<30 | 7<<27 | 1<<22}         // LDR 32-bit unsigned
-	a64InstrTable["MOVHU"] = a64Enc{format: a64FLSU, op: 1<<30 | 7<<27 | 1<<22}         // LDRH unsigned
-	a64InstrTable["MOVBU"] = a64Enc{format: a64FLSU, op: 0<<30 | 7<<27 | 1<<22}         // LDRB unsigned
-	a64InstrTable["MOVW"] = a64Enc{format: a64FLSU, op: 2<<30 | 7<<27 | 2<<22}          // LDRSW (signed 32→64)
-	a64InstrTable["MOVH"] = a64Enc{format: a64FLSU, op: 1<<30 | 7<<27 | 2<<22}          // LDRSH (signed half)
-	a64InstrTable["MOVB"] = a64Enc{format: a64FLSU, op: 0<<30 | 7<<27 | 2<<22}          // LDRSB (signed byte)
-	a64InstrTable["FMOVS"] = a64Enc{format: a64FLSU, op: 2<<30 | 7<<27 | 1<<26 | 1<<22} // FLDR 32-bit FP
-	a64InstrTable["FMOVD"] = a64Enc{format: a64FLSU, op: 3<<30 | 7<<27 | 1<<26 | 1<<22} // FLDR 64-bit FP
-
-	// Store opcodes (load ^ (1<<22)):
-	// STR 64-bit: size=3, V=0, opc=00 → 3<<30 | 7<<27 | 0<<22
-	// STR 32-bit: size=2, V=0, opc=00 → 2<<30 | 7<<27 | 0<<22
-	// STRH:      size=1, V=0, opc=00 → 1<<30 | 7<<27 | 0<<22
-	// STRB:      size=0, V=0, opc=00 → 0<<30 | 7<<27 | 0<<22
+	// Load/store mnemonics never enter this table: the MOV pseudo-instruction
+	// dispatch handles them through a64LoadTable, which also carries the store
+	// opcode (integer and FP stores both use opc=00, differing only in V).
 
 	// ---- branches ----
 	a64InstrTable["B"] = a64Enc{format: a64FBranch, op: 0<<31 | 5<<26}
@@ -510,10 +464,8 @@ func init() {
 	a64InstrTable["RET"] = a64Enc{format: a64FUncondBranch, op: 0x6B<<25 | 2<<21}
 
 	// ---- system ----
-	a64InstrTable["NOP"] = a64Enc{format: a64FSystem, op: a64NOP}
-	a64InstrTable["NOOP"] = a64Enc{format: a64FSystem, op: a64NOP}
-	a64InstrTable["BRK"] = a64Enc{format: a64FSystem, op: 0xd4200000}
-	a64InstrTable["UNDEF"] = a64Enc{format: a64FSystem, op: a64BRK(0)}
+	// NOP/NOOP/UNDEF are spelled out in encodeARM64Instr's pseudo switch,
+	// so they carry no table entry; a64NOP and a64BRK are the encoders.
 
 	// ---- EXTR ----
 	a64InstrTable["EXTR"] = a64Enc{format: a64FEXTR, op: 1<<31 | 0x27<<23 | 1<<22}
@@ -614,8 +566,8 @@ func init() {
 		a64InstrTable[m] = a64Enc{format: a64FFPCvt, op: op}
 	}
 
-	// ---- FMOV between GP and FP registers ----
-	a64InstrTable["FMOVGR"] = a64Enc{format: a64FFMovGR, op: 0x1e260000} // placeholder, actual encoding depends on direction
+	// FMOV between GP and FP registers needs no table entry: the MOV
+	// pseudo-instruction dispatches it by operand class (encodeARM64RegMove).
 
 	// ---- conditional select: CSEL, CSINC, CSINV, CSNEG ----
 	csel := map[string]uint32{
@@ -651,6 +603,10 @@ func init() {
 	}
 
 	// ---- exclusive load/store ----
+	// Single-register forms pre-set the unused Rs and Rt2 fields to 31 (the
+	// 0x7c00/0x1f0000 halves of the constants below); the register-pair
+	// forms carry a real Rt2 in bits 14:10, so their opcodes pre-set
+	// neither field.
 	a64InstrTable["LDXR"] = a64Enc{format: a64FExcl, op: 0xc85f7c00}
 	a64InstrTable["LDXRB"] = a64Enc{format: a64FExcl, op: 0x085f7c00}
 	a64InstrTable["LDXRH"] = a64Enc{format: a64FExcl, op: 0x485f7c00}
@@ -659,6 +615,12 @@ func init() {
 	a64InstrTable["LDAXRB"] = a64Enc{format: a64FExcl, op: 0x085ffc00}
 	a64InstrTable["LDAXRH"] = a64Enc{format: a64FExcl, op: 0x485ffc00}
 	a64InstrTable["LDAXRW"] = a64Enc{format: a64FExcl, op: 0x885ffc00}
+	// Pair loads, LDSTX(sz, 0, l=1, o1=1, o0) in asm7.go: LDXP/ LDXPW have
+	// o0=0, LDAXP/LDAXPW o0=1 (bit 15).  Rs (bits 20:16) stays 31.
+	a64InstrTable["LDXP"] = a64Enc{format: a64FExcl, op: 0xc8600000}
+	a64InstrTable["LDXPW"] = a64Enc{format: a64FExcl, op: 0x88600000}
+	a64InstrTable["LDAXP"] = a64Enc{format: a64FExcl, op: 0xc8608000}
+	a64InstrTable["LDAXPW"] = a64Enc{format: a64FExcl, op: 0x88608000}
 	a64InstrTable["STXR"] = a64Enc{format: a64FExcl, op: 0xc8007c00}
 	a64InstrTable["STXRB"] = a64Enc{format: a64FExcl, op: 0x08007c00}
 	a64InstrTable["STXRH"] = a64Enc{format: a64FExcl, op: 0x48007c00}
@@ -667,6 +629,12 @@ func init() {
 	a64InstrTable["STLXRB"] = a64Enc{format: a64FExcl, op: 0x0800fc00}
 	a64InstrTable["STLXRH"] = a64Enc{format: a64FExcl, op: 0x4800fc00}
 	a64InstrTable["STLXRW"] = a64Enc{format: a64FExcl, op: 0x8800fc00}
+	// Pair stores, LDSTX(sz, 0, l=0, o1=1, o0): STXP/STXPW have o0=0,
+	// STLXP/STLXPW o0=1 (bit 15).  Both Rs and Rt2 are real fields.
+	a64InstrTable["STXP"] = a64Enc{format: a64FExcl, op: 0xc8200000}
+	a64InstrTable["STXPW"] = a64Enc{format: a64FExcl, op: 0x88200000}
+	a64InstrTable["STLXP"] = a64Enc{format: a64FExcl, op: 0xc8208000}
+	a64InstrTable["STLXPW"] = a64Enc{format: a64FExcl, op: 0x88208000}
 
 	// ---- LSE atomics ----
 	a64InstrTable["LDADDD"] = a64Enc{format: a64FLSE, op: 3<<30 | 0x1c1<<21 | 0x00<<10}
@@ -678,10 +646,403 @@ func init() {
 	a64InstrTable["SWPD"] = a64Enc{format: a64FLSE, op: 3<<30 | 0x1c1<<21 | 0x20<<10}
 	a64InstrTable["SWPW"] = a64Enc{format: a64FLSE, op: 2<<30 | 0x1c1<<21 | 0x20<<10}
 
-	// ---- SIMD basics ----
-	a64InstrTable["VADD"] = a64Enc{format: a64FSIMD3, op: 0x0e208400}
-	a64InstrTable["VSUB"] = a64Enc{format: a64FSIMD3, op: 0x2e208400}
-	a64InstrTable["VMUL"] = a64Enc{format: a64FSIMD3, op: 0x0e209c00}
+	// ---- SIMD: the arrangement-aware tables in this file carry VADD,
+	// VSUB, VMUL and every other three-register vector op. ----
+
+	// ---- data-processing (1 source): sf 10 11010110 opcode 00000 Rn Rd ----
+	dp1 := map[string]uint32{
+		"RBIT": 0xdac00000, "REV16": 0xdac00400, "REV32": 0xdac00800,
+		"REV": 0xdac00c00, "CLZ": 0xdac01000, "CLS": 0xdac01400,
+		"RBITW": 0x5ac00000, "REVW": 0x5ac00800, "CLZW": 0x5ac01000, "CLSW": 0x5ac01400,
+	}
+	for m, op := range dp1 {
+		a64InstrTable[m] = a64Enc{format: a64FDP1, op: op}
+	}
+
+	// ---- bitfield extract: the UBFM/SBFM bases, immediate operands wrap ----
+	a64InstrTable["UBFX"] = a64Enc{format: a64FBitfield2, op: 0xd3400000}
+	a64InstrTable["SBFX"] = a64Enc{format: a64FBitfield2, op: 0x93400000}
+	a64InstrTable["UBFXW"] = a64Enc{format: a64FBitfield2, op: 0x53000000}
+	a64InstrTable["SBFXW"] = a64Enc{format: a64FBitfield2, op: 0x13000000}
+
+	// ---- conditional compare: sf 1 1 101001 0 imm5/Rm cond op2 Rn nzcv ----
+	a64InstrTable["CCMP"] = a64Enc{format: a64FCondCmp, op: 0xfa400000}
+	a64InstrTable["CCMN"] = a64Enc{format: a64FCondCmp, op: 0xba400000}
+	a64InstrTable["CCMPW"] = a64Enc{format: a64FCondCmp, op: 0x7a400000}
+	a64InstrTable["CCMNW"] = a64Enc{format: a64FCondCmp, op: 0x3a400000}
+
+	// ---- system operations ----
+	for _, m := range []string{"BRK", "SVC", "DMB", "DSB", "ISB", "DC", "MRS", "MSR", "PRFM"} {
+		a64InstrTable[m] = a64Enc{format: a64FSys}
+	}
+
+	// ---- compare/test and branch ----
+	a64InstrTable["CBZ"] = a64Enc{format: a64FBranch19, op: 0xb4000000}
+	a64InstrTable["CBZW"] = a64Enc{format: a64FBranch19, op: 0x34000000}
+	a64InstrTable["CBNZ"] = a64Enc{format: a64FBranch19, op: 0xb5000000}
+	a64InstrTable["CBNZW"] = a64Enc{format: a64FBranch19, op: 0x35000000}
+	a64InstrTable["TBZ"] = a64Enc{format: a64FTestBranch, op: 0x36000000}
+	a64InstrTable["TBNZ"] = a64Enc{format: a64FTestBranch, op: 0x37000000}
+
+	// ---- load/store pair (signed offset) ----
+	a64InstrTable["LDP"] = a64Enc{format: a64FPair, op: 0xa9400000}
+	a64InstrTable["LDPW"] = a64Enc{format: a64FPair, op: 0x29400000}
+	a64InstrTable["STP"] = a64Enc{format: a64FPair, op: 0xa9000000}
+	a64InstrTable["STPW"] = a64Enc{format: a64FPair, op: 0x29000000}
+	a64InstrTable["FLDPD"] = a64Enc{format: a64FPair, op: 0x6d400000}
+	a64InstrTable["FSTPD"] = a64Enc{format: a64FPair, op: 0x6d000000}
+
+	// ---- acquire/release loads and stores ----
+	a64InstrTable["LDAR"] = a64Enc{format: a64FAcqRel, op: 0xc8dffc00}
+	a64InstrTable["LDARB"] = a64Enc{format: a64FAcqRel, op: 0x08dffc00}
+	a64InstrTable["LDARH"] = a64Enc{format: a64FAcqRel, op: 0x48dffc00}
+	a64InstrTable["LDARW"] = a64Enc{format: a64FAcqRel, op: 0x88dffc00}
+	a64InstrTable["STLR"] = a64Enc{format: a64FAcqRel, op: 0xc89ffc00}
+	a64InstrTable["STLRB"] = a64Enc{format: a64FAcqRel, op: 0x089ffc00}
+	a64InstrTable["STLRH"] = a64Enc{format: a64FAcqRel, op: 0x489ffc00}
+	a64InstrTable["STLRW"] = a64Enc{format: a64FAcqRel, op: 0x889ffc00}
+
+	// ---- LSE atomics with acquire and release semantics ----
+	// CAS carries a preset fixed op field and a real Rs; the LDADD/LDCLR/
+	// LDOR/SWP families leave Rs free for the returned value.
+	lse := map[string]uint32{
+		"CASALD":   0xc8e0fc00,
+		"CASALW":   0x88e0fc00,
+		"LDADDALD": 0xf8e00000,
+		"LDADDALW": 0xb8e00000,
+		"LDCLRALB": 0x38e01000,
+		"LDCLRALW": 0xb8e01000,
+		"LDCLRALD": 0xf8e01000,
+		"LDORALB":  0x38e03000,
+		"LDORALW":  0xb8e03000,
+		"LDORALD":  0xf8e03000,
+		"SWPALB":   0x38e08000,
+		"SWPALW":   0xb8e08000,
+		"SWPALD":   0xf8e08000,
+	}
+	for m, op := range lse {
+		a64InstrTable[m] = a64Enc{format: a64FLSE, op: op}
+	}
+
+	// ---- carry-setting/carry-using arithmetic and widening multiply ----
+	// MUL and SMULH/UMULH are the MADD/MSUB layout with the accumulate
+	// register preset to ZR (bits 14:10 = 11111).
+	dpsrExtra := map[string]uint32{
+		"ADC": 0x9a000000, "ADCW": 0x1a000000,
+		"ADCS": 0xba000000, "ADCSW": 0x3a000000,
+		"SBC": 0xda000000, "SBCW": 0x5a000000,
+		"SBCS": 0xfa000000, "SBCSW": 0x7a000000,
+		"MUL": 0x9b007c00, "MULW": 0x1b007c00,
+		"SMULH": 0x9b407c00, "UMULH": 0x9bc07c00,
+	}
+	for m, op := range dpsrExtra {
+		a64InstrTable[m] = a64Enc{format: a64FDPSR, op: op}
+	}
+
+	// ---- crypto, 2-register (Rn, Rd) and 3-register (Rm, Rn, Rd) forms ----
+	crypto2 := map[string]uint32{
+		"AESD": 0x4e285800, "AESE": 0x4e284800,
+		"AESIMC": 0x4e287800, "AESMC": 0x4e286800,
+		"SHA1H": 0x5e280800, "SHA1SU1": 0x5e281800,
+		"SHA256SU0": 0x5e282800, "SHA512SU0": 0xcec08000,
+	}
+	for m, op := range crypto2 {
+		a64InstrTable[m] = a64Enc{format: a64FCrypto2, op: op}
+	}
+	crypto3 := map[string]uint32{
+		"SHA1C": 0x5e000000, "SHA1P": 0x5e001000,
+		"SHA1M": 0x5e002000, "SHA1SU0": 0x5e003000,
+		"SHA256H": 0x5e004000, "SHA256H2": 0x5e005000,
+		"SHA256SU1": 0x5e006000, "SHA512H": 0xce608000,
+		"SHA512H2": 0xce608400, "SHA512SU1": 0xce608800,
+	}
+	for m, op := range crypto3 {
+		a64InstrTable[m] = a64Enc{format: a64FCrypto3, op: op}
+	}
+
+	// ---- arrangement-aware SIMD, see a64SimdVTable and a64SimdV2Table ----
+	a64InstrTable["VEOR3"] = a64Enc{format: a64FSIMDV4, op: 0xce000000}
+	a64InstrTable["VBCAX"] = a64Enc{format: a64FSIMDV4, op: 0xce200000}
+	a64InstrTable["VXAR"] = a64Enc{format: a64FSIMDV4, op: 0xce800000}
+	a64InstrTable["VEXT"] = a64Enc{format: a64FSIMDV4, op: 0x2e000000}
+	a64InstrTable["VTBL"] = a64Enc{format: a64FVTBL}
+	a64InstrTable["VDUP"] = a64Enc{format: a64FDUP}
+	a64InstrTable["VMOVS"] = a64Enc{format: a64FMoviLit, op: 0xbd400000}
+	a64InstrTable["VMOVD"] = a64Enc{format: a64FMoviLit, op: 0xfd400000}
+	a64InstrTable["VMOVQ"] = a64Enc{format: a64FMoviLit, op: 0x3dc00000}
+	a64InstrTable["VSHL"] = a64Enc{format: a64FShiftImm, op: 0x0f000000 | 21<<10}
+	a64InstrTable["VUSHR"] = a64Enc{format: a64FShiftImm, op: 0x2f000000 | 1<<10}
+	a64InstrTable["VSRI"] = a64Enc{format: a64FShiftImm, op: 0x2f000000 | 17<<10}
+	a64InstrTable["VLD1"] = a64Enc{format: a64FVLDST}
+	a64InstrTable["VLD1.P"] = a64Enc{format: a64FVLDST, op: 1}
+	a64InstrTable["VST1"] = a64Enc{format: a64FVLDST}
+	a64InstrTable["VST1.P"] = a64Enc{format: a64FVLDST, op: 1}
+	a64InstrTable["VLD1R"] = a64Enc{format: a64FVLDST}
+	a64InstrTable["VLD4R"] = a64Enc{format: a64FVLDST}
+}
+
+// a64SimdVSpec is one arrangement-aware SIMD instruction: the 8B base word,
+// the set of arrangements it accepts as a bitmask over the a64Arr index and,
+// for instructions that exist at a single arrangement and carry that
+// arrangement's bits inside the base already, the fixed flag.
+type a64SimdVSpec struct {
+	base  uint32
+	arrs  uint16
+	fixed bool
+}
+
+// a64Arr names the vector arrangements the encoders deal with, indexed by
+// a64Arr.  The source spellings put the element letter first: B8, H4, S2,
+// D1 and the 128-bit halves B16, H8, S4, D2.
+const (
+	a64Arr8B = iota
+	a64Arr16B
+	a64Arr4H
+	a64Arr8H
+	a64Arr2S
+	a64Arr4S
+	a64Arr2D
+	a64ArrD1
+	a64ArrQ1
+	a64ArrCount
+)
+
+// a64ArrNames maps an arrangement to its source spelling (element letter
+// first, as the toolchain writes it).
+var a64ArrNames = [a64ArrCount]string{
+	a64Arr8B: "B8", a64Arr16B: "B16", a64Arr4H: "H4", a64Arr8H: "H8",
+	a64Arr2S: "S2", a64Arr4S: "S4", a64Arr2D: "D2", a64ArrD1: "D1", a64ArrQ1: "Q1",
+}
+
+// a64ArrIndex resolves a source spelling to its a64Arr index, -1 when
+// unknown.
+func a64ArrIndex(s string) int {
+	for i, n := range a64ArrNames {
+		if n == s {
+			return i
+		}
+	}
+	return -1
+}
+
+// a64ElemLetter reports whether s is a bare element spelling (B, H, S, D, Q)
+// as it appears in element operands such as V13.S[0].
+func a64ElemLetter(s string) bool {
+	switch s {
+	case "B", "H", "S", "D", "Q":
+		return true
+	}
+	return false
+}
+
+// a64ArrBits carries the fixed bits an arrangement contributes to the
+// three-same word shape: the element size at bits 23:22 and the 128-bit
+// flag at bit 30.  Bit 29 belongs to the instruction's own base.
+var a64ArrBits = [a64ArrCount]uint32{
+	a64Arr8B:  0,
+	a64Arr16B: 1 << 30,
+	a64Arr4H:  1 << 22,
+	a64Arr8H:  1<<30 | 1<<22,
+	a64Arr2S:  1 << 23,
+	a64Arr4S:  1<<30 | 1<<23,
+	a64Arr2D:  1<<30 | 1<<23 | 1<<22,
+	a64ArrD1:  1<<23 | 1<<22,
+	a64ArrQ1:  0,
+}
+
+// a64SimdVTable holds the arrangement-aware three-register SIMD
+// instructions (word = base | arrBits | Rm<<16 | Rn<<5 | Rd).  Every base
+// word and arrangement bit was read off go tool asm.
+var a64SimdVTable = map[string]a64SimdVSpec{
+	"VADD":    {0x0e208400, 0x7f, false},
+	"VSUB":    {0x2e208400, 0x7f, false},
+	"VMUL":    {0x0e209c00, 0x3f, false}, // no 2D: integer multiply stops at 4S
+	"VAND":    {0x0e201c00, 0x03, false}, // logical ops accept 8B and 16B only
+	"VEOR":    {0x2e201c00, 0x03, false},
+	"VORR":    {0x0ea01c00, 0x03, false},
+	"VADDP":   {0x0e20bc00, 0x7f, false},
+	"VZIP1":   {0x0e003800, 0x7f, false},
+	"VZIP2":   {0x0e007800, 0x7f, false},
+	"VCMEQ":   {0x2e208c00, 0x7f, false},
+	"VRAX1":   {0xce608c00, 1 << a64Arr2D, true}, // SHA3 group, D2 only
+	"VPMULL":  {0x0e20e000, 1<<a64Arr8B | 1<<a64ArrD1, false},
+	"VPMULL2": {0x0e20e000, 1<<a64Arr16B | 1<<a64Arr2D, false},
+}
+
+// a64SimdV2Table holds the arrangement-aware two-register SIMD instructions
+// (word = base | arrBits | Rn<<5 | Rd).  VMOV is served from here too, with
+// the register pair spelling ORR Vd, Vn, Vm.
+var a64SimdV2Table = map[string]a64SimdVSpec{
+	"VREV32":  {0x2e200800, 1<<a64Arr8B | 1<<a64Arr16B | 1<<a64Arr4H | 1<<a64Arr8H, false},
+	"VREV64":  {0x0e200800, 0x3f, false},
+	"VUADDLV": {0x2e303800, 0x3f, false},
+	"VMOV":    {0x0ea01c00, 1<<a64Arr8B | 1<<a64Arr16B, false},
+}
+
+// a64CryptoArr is the arrangement each crypto instruction's operands must
+// carry when they spell one at all; a bare V/F spelling is accepted as is.
+var a64CryptoArr = map[string]int{
+	"AESD": a64Arr16B, "AESE": a64Arr16B, "AESIMC": a64Arr16B, "AESMC": a64Arr16B,
+	"SHA1H": a64Arr4S, "SHA1SU1": a64Arr4S, "SHA256SU0": a64Arr4S, "SHA512SU0": a64Arr2D,
+	"SHA1C": a64Arr4S, "SHA1P": a64Arr4S, "SHA1M": a64Arr4S, "SHA1SU0": a64Arr4S,
+	"SHA256H": a64Arr4S, "SHA256H2": a64Arr4S, "SHA256SU1": a64Arr4S,
+	"SHA512H": a64Arr2D, "SHA512H2": a64Arr2D, "SHA512SU1": a64Arr2D,
+}
+
+// a64DCOps maps the data-cache maintenance operation names to their fixed
+// word (the register rides bits 4:0).
+var a64DCOps = map[string]uint32{
+	"IVAC": 0xd5087620, "ZVA": 0xd50b7420,
+	"CVAC": 0xd50b7a20, "CVAU": 0xd50b7b20, "CIVAC": 0xd50b7e20,
+}
+
+// a64MRSOps maps the system register names GOROOT reads to their fixed word
+// (the destination register rides bits 4:0).
+var a64MRSOps = map[string]uint32{
+	"ELR_EL1": 0xd5384020, "MIDR_EL1": 0xd5380000,
+	"ID_AA64PFR0_EL1": 0xd5380400, "ID_AA64ISAR0_EL1": 0xd5380600,
+	"ID_AA64ISAR1_EL1": 0xd5380620, "CNTFRQ_EL0": 0xd53be000,
+	"CNTPCT_EL0": 0xd53be020, "CNTVCT_EL0": 0xd53be040,
+	"DCZID_EL0": 0xd53b00e0, "DIT": 0xd53b42a0, "ID_AA64ZFR0_EL1": 0xd5380480,
+}
+
+// a64MSROps maps the system register names GOROOT writes to their fixed
+// word; the immediate rides CRm at bits 11:8 and Rt is the fixed 11111.
+var a64MSROps = map[string]uint32{
+	"SPSel": 0xd50040a0, "DAIFSet": 0xd50340c0, "DAIFClr": 0xd50340e0, "DIT": 0xd5034040,
+}
+
+// a64PRFOps maps the prefetch operation names to their prfop immediate
+// (word = 0xf9800000 | Rn<<5 | prfop).
+var a64PRFOps = map[string]int{
+	"PLDL1KEEP": 0x00, "PLDL1STRM": 0x01, "PLDL2KEEP": 0x02, "PLDL2STRM": 0x03,
+	"PLDL3KEEP": 0x04, "PLDL3STRM": 0x05,
+	"PLIL1KEEP": 0x08, "PLIL1STRM": 0x09, "PLIL2KEEP": 0x0a, "PLIL2STRM": 0x0b,
+	"PLIL3KEEP": 0x0c, "PLIL3STRM": 0x0d,
+	"PSTL1KEEP": 0x10, "PSTL1STRM": 0x11, "PSTL2KEEP": 0x12, "PSTL2STRM": 0x13,
+	"PSTL3KEEP": 0x14, "PSTL3STRM": 0x15,
+}
+
+// a64VLD1Base holds the fixed words of the multi-register structure
+// accesses, indexed by register count 1..4, before the Q and size bits.
+// Post-index spellings add 0x9f0000 (post bit and Rm = 11111).
+var a64VLD1Base = [5]uint32{0, 0x0c407000, 0x0c40a000, 0x0c406000, 0x0c402000}
+var a64VST1Base = [5]uint32{0, 0x0c007000, 0x0c00a000, 0x0c006000, 0x0c002000}
+
+// a64Vec is a parsed vector operand: the register number, the arrangement
+// ("" when the operand spells none) and, for element forms, the lane index.
+type a64Vec struct {
+	reg    int
+	arr    string
+	idx    int
+	hasIdx bool
+}
+
+// a64VecReg parses a vector register operand: V0..V31 (F0..F31 as an alias,
+// the same architectural registers the scalar floating-point spellings use),
+// optionally with an arrangement suffix such as V0.B16 and, for element
+// forms, a lane index such as V13.S[0].  It reports ok=false for anything
+// else, including X/W and R spellings, which the toolchain's vector
+// operands reject as well.
+func a64VecReg(name string) (v a64Vec, ok bool) {
+	s := strings.TrimSpace(name)
+	if i := strings.IndexByte(s, '.'); i >= 0 {
+		v.arr = strings.TrimSpace(s[i+1:])
+		s = s[:i]
+	}
+	if v.arr != "" {
+		// Element form: B[3], S[2] and friends.
+		if j := strings.IndexByte(v.arr, '['); j >= 0 {
+			k := strings.LastIndexByte(v.arr, ']')
+			if k < j {
+				return v, false
+			}
+			n, err := strconv.Atoi(strings.TrimSpace(v.arr[j+1 : k]))
+			if err != nil || n < 0 {
+				return v, false
+			}
+			v.idx, v.hasIdx = n, true
+			v.arr = strings.TrimSpace(v.arr[:j])
+		}
+		if a64ArrIndex(v.arr) < 0 && !a64ElemLetter(v.arr) {
+			return v, false
+		}
+	}
+	if len(s) < 2 || (s[0] != 'V' && s[0] != 'F') {
+		return v, false
+	}
+	n := 0
+	for i := 1; i < len(s); i++ {
+		if s[i] < '0' || s[i] > '9' {
+			return v, false
+		}
+		n = n*10 + int(s[i]-'0')
+	}
+	if n > 31 {
+		return v, false
+	}
+	v.reg = n
+	return v, true
+}
+
+// a64ElemField encodes a lane index for the copy/insert group: imm5 = the
+// index shifted by the element scale, with the scale's own bit set.  B gets
+// shift 1 (the Q bit rides elsewhere), H shift 2, S shift 3 and D shift 4.
+func a64ElemField(arr string, idx int) (uint32, bool) {
+	var shift, low uint32
+	switch arr {
+	case "B8", "B16", "B":
+		shift, low = 1, 1
+	case "H4", "H8", "H":
+		shift, low = 2, 2
+	case "S2", "S4", "S":
+		shift, low = 3, 4
+	case "D1", "D2", "D":
+		shift, low = 4, 8
+	default:
+		return 0, false
+	}
+	if idx < 0 || idx >= 1<<(5-shift) {
+		return 0, false
+	}
+	return uint32(idx)<<shift | low, true
+}
+
+// a64VecListOf recovers the register list of a VLD1/VST1/VTBL operand run.
+// The parser keeps parenthesised groups whole but splits bracketed lists on
+// the commas, so a list arrives as one operand run whose first Raw starts
+// with "[" and whose last Raw ends with "]".  It returns the parsed
+// registers with the brackets and spaces removed.
+func a64VecListOf(ops []*ast.Operand, start int) (vs []a64Vec, end int, ok bool) {
+	if start >= len(ops) || !strings.HasPrefix(strings.TrimSpace(ops[start].Raw), "[") {
+		return nil, 0, false
+	}
+	end = start
+	for end < len(ops) {
+		if strings.HasSuffix(strings.TrimSpace(ops[end].Raw), "]") {
+			break
+		}
+		end++
+	}
+	if end >= len(ops) {
+		return nil, 0, false
+	}
+	for i := start; i <= end; i++ {
+		s := strings.TrimSpace(ops[i].Raw)
+		s = strings.TrimPrefix(s, "[")
+		s = strings.TrimSuffix(s, "]")
+		if s == "" && len(ops) > start+1 {
+			return nil, 0, false
+		}
+		for part := range strings.SplitSeq(s, ",") {
+			v, ok := a64VecReg(part)
+			if !ok {
+				return nil, 0, false
+			}
+			vs = append(vs, v)
+		}
+	}
+	return vs, end, true
 }
 
 // ---- load/store helper tables ----
@@ -707,26 +1068,11 @@ var a64LoadTable = map[string]a64LSType{
 	"FMOVD": {3, 1, 1}, // LDR D (64-bit FP)
 }
 
-// a64StoreOpc returns the store opc for a given load type.
-// For integer: store opc = 00 (the load opc bits cleared).
-// For FP: store opc = 00 (same pattern).
+// a64StoreOpc returns the store opc for a given load type: integer and FP
+// stores both encode opc=00 (the load's signedness bit sits in opc[1], which
+// the store form clears; FP registers are selected by V, not opc).
 func a64StoreOpc(t a64LSType) int {
-	if t.V == 1 {
-		return 0 // FP store
-	}
-	return 0 // integer store
-}
-
-// a64MovRegTable maps register-to-register MOV mnemonic expansions.
-// The Go toolchain encodes MOV Rn, Rd as ORR Rn, ZR, Rd.
-var a64MovRegTable = map[string]uint32{
-	"MOVD":  1<<31 | 1<<29 | 0x0a<<24, // ORR 64-bit
-	"MOVW":  0<<31 | 1<<29 | 0x0a<<24, // ORR 32-bit
-	"MOVB":  0<<31 | 1<<29 | 0x0a<<24, // ORR 32-bit (byte move)
-	"MOVBU": 0<<31 | 1<<29 | 0x0a<<24, // ORR 32-bit
-	"MOVH":  0<<31 | 1<<29 | 0x0a<<24, // ORR 32-bit
-	"MOVHU": 0<<31 | 1<<29 | 0x0a<<24, // ORR 32-bit
-	"MOVWU": 0<<31 | 1<<29 | 0x0a<<24, // ORR 32-bit
+	return 0
 }
 
 // arm64RegClass discriminates integer (R), floating-point (F) registers for

asm/arm64_encode_test.go

@@ -472,12 +472,456 @@ TEXT ·f(SB), NOSPLIT, $0-0
 	}
 }
 
-// TestArm64SIMD tests SIMD encoding (via the instruction table).
+// TestArm64SIMD tests SIMD encoding (via the arrangement-aware table).
 func TestArm64SIMD(t *testing.T) {
-	// Verify SIMD instructions are in the table.
-	for _, mnem := range []string{"VADD", "VSUB", "VMUL"} {
-		if _, ok := a64InstrTable[mnem]; !ok {
-			t.Errorf("%s not in instruction table", mnem)
+	// Verify SIMD instructions are in the arrangement table.
+	for _, mnem := range []string{"VADD", "VSUB", "VMUL", "VAND", "VEOR", "VORR", "VCMEQ", "VZIP1", "VZIP2"} {
+		if _, ok := a64SimdVTable[mnem]; !ok {
+			t.Errorf("%s not in the SIMD arrangement table", mnem)
+		}
+	}
+}
+
+// TestArm64CarryAndBitOps pins the carry-setting arithmetic, the widening
+// multiplies and the data-processing (1 source) group against go tool asm.
+func TestArm64CarryAndBitOps(t *testing.T) {
+	got := arm64Words(t, "\tADC R0, R2, R12\n\tADCS $0, R1\n\tSBCS R5, R9, R5\n\tSBC R25, R10, R26\n"+
+		"\tMUL R4, R3, R0\n\tUMULH R24, R20, R24\n\tSMULH R1, R2, R3\n\tMSUB R19, R16, R26, R2\n"+
+		"\tRBIT R11, R4\n\tREV R1, R2\n\tCLZ R21, R9\n\tREVW R1, R2\n\tCLSW R1, R2\n")
+	want := []uint32{
+		0x9a00004c, // ADC R12, R2, R0
+		0xba1f0021, // ADCS R1, R1, ZR
+		0xfa050125, // SBCS R5, R9, R5
+		0xda19015a, // SBC R26, R10, R25
+		0x9b047c60, // MUL R0, R3, R4
+		0x9bd87e98, // UMULH R24, R20, R24
+		0x9b417c43, // SMULH R3, R2, R1
+		0x9b13c342, // MSUB R2, R26, R19, R16
+		0xdac00164, // RBIT R4, R11
+		0xdac00c22, // REV R2, R1
+		0xdac012a9, // CLZ R9, R21
+		0x5ac00822, // REVW R2, R1
+		0x5ac01422, // CLSW R2, R1
+		0xd65f03c0, // RET
+	}
+	if len(got) != len(want) {
+		t.Fatalf("word count = %d, want %d", len(got), len(want))
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Errorf("word %d = %08x, want %08x", i, got[i], want[i])
+		}
+	}
+}
+
+// TestArm64BitfieldExtract pins UBFX/SBFX: immr wraps to the register
+// width, an out-of-range imms is an error.
+func TestArm64BitfieldExtract(t *testing.T) {
+	got := arm64Words(t, "\tUBFX $33, R17, $25, R5\n\tUBFXW $4, R1, $9, R2\n")
+	want := []uint32{
+		0xd361e625, // UBFX immr=1 (33 wrapped), imms=25
+		0x53043022, // UBFXW immr=4, imms=9
+		0xd65f03c0,
+	}
+	if len(got) != len(want) {
+		t.Fatalf("word count = %d, want %d", len(got), len(want))
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Errorf("word %d = %08x, want %08x", i, got[i], want[i])
+		}
+	}
+	for _, body := range []string{"\tUBFX $33, R17, $70, R5\n", "\tUBFX $-1, R17, $3, R5\n"} {
+		f, errs := parser.Parse("test_arm64.s", "#include \"textflag.h\"\n\nTEXT ·f(SB), NOSPLIT, $0-0\n"+body+"\tRET\n")
+		if len(errs) > 0 {
+			t.Fatalf("parse: %v", errs)
+		}
+		if _, err := AssembleFileARM64(f); err == nil {
+			t.Errorf("%s: expected an error, got none", body)
+		}
+	}
+}
+
+// TestArm64CondCompare pins CCMP/CCMN.
+func TestArm64CondCompare(t *testing.T) {
+	got := arm64Words(t, "\tCCMP LE, R7, $19, $3\n\tCCMP LT, R30, R6, $7\n\tCCMN EQ, R1, R2, $3\n\tCCMPW LE, R7, $19, $3\n")
+	want := []uint32{
+		0xfa53d8e3, // CCMP imm form
+		0xfa46b3c7, // CCMP register form
+		0xba420023, // CCMN register form
+		0x7a53d8e3, // CCMPW
+		0xd65f03c0,
+	}
+	if len(got) != len(want) {
+		t.Fatalf("word count = %d, want %d", len(got), len(want))
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Errorf("word %d = %08x, want %08x", i, got[i], want[i])
+		}
+	}
+}
+
+// TestArm64CompareBranch pins CBZ/CBNZ/TBZ/TBNZ against a label five and
+// six words ahead, matching go tool asm's own offsets.
+func TestArm64CompareBranch(t *testing.T) {
+	// Layout: CBZ(0) TBZ(4) TBNZ(8) CBNZ(12) NOP(16) NOP(17th word...) done.
+	src := "#include \"textflag.h\"\n\nTEXT ·f(SB), NOSPLIT, $0-0\n" +
+		"\tCBZ R1, done\n\tTBZ $4, R7, done\n\tTBNZ $33, R7, done\n\tCBNZW R2, done\n" +
+		"\tNOP\n\tNOP\n\tdone:\tNOP\n\tRET\n"
+	f, errs := parser.Parse("test_arm64.s", src)
+	if len(errs) > 0 {
+		t.Fatalf("parse: %v", errs)
+	}
+	img, err := AssembleFileARM64(f)
+	if err != nil {
+		t.Fatalf("AssembleFileARM64: %v", err)
+	}
+	got := leWords(img.Code)
+	// done sits at word 6 from each branch's own pc: CBZ rel 6, TBZ rel 5,
+	// TBNZ rel 4, CBNZW rel 3.
+	want := []uint32{
+		0xb40000c1, // CBZ R1, +6
+		0x362000a7, // TBZ $4, R7, +5
+		0xb7080087, // TBNZ $33, R7, +4
+		0x35000062, // CBNZW R2, +3
+		0xd503201f, 0xd503201f, 0xd503201f,
+		0xd65f03c0,
+	}
+	if len(got) != len(want) {
+		t.Fatalf("word count = %d, want %d", len(got), len(want))
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Errorf("word %d = %08x, want %08x", i, got[i], want[i])
+		}
+	}
+}
+
+// TestArm64ADR pins ADR against a forward label.
+func TestArm64ADR(t *testing.T) {
+	src := "#include \"textflag.h\"\n\nTEXT ·f(SB), NOSPLIT, $0-0\n" +
+		"\tADR done, R10\n\tNOP\n\tNOP\n\tdone:\tNOP\n\tRET\n"
+	f, errs := parser.Parse("test_arm64.s", src)
+	if len(errs) > 0 {
+		t.Fatalf("parse: %v", errs)
+	}
+	img, err := AssembleFileARM64(f)
+	if err != nil {
+		t.Fatalf("AssembleFileARM64: %v", err)
+	}
+	got := leWords(img.Code)
+	// rel = 12 bytes: immlo 0, immhi 3.
+	want := []uint32{0x1000006a, 0xd503201f, 0xd503201f, 0xd503201f, 0xd65f03c0}
+	if len(got) != len(want) {
+		t.Fatalf("word count = %d, want %d", len(got), len(want))
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Errorf("word %d = %08x, want %08x", i, got[i], want[i])
+		}
+	}
+}
+
+// TestArm64PairLoadStore pins LDP/STP/LDPW/FLDPD/FSTPD.
+func TestArm64PairLoadStore(t *testing.T) {
+	got := arm64Words(t, "\tSTP (R2, R3), 8(R5)\n\tLDP -8(R5), (R2, R3)\n\tLDPW 4(R0), (R1, R2)\n\tSTPW (R1, R2), 4(R0)\n"+
+		"\tFLDPD 8(R0), (F1, F2)\n\tFSTPD (F3, F4), -8(R5)\n")
+	want := []uint32{
+		0xa9008ca2, // STP (R2, R3), 8(R5)
+		0xa97f8ca2, // LDP -8(R5), (R2, R3)
+		0x29408801, // LDPW 4(R0), (R1, R2)
+		0x29008801, // STPW (R1, R2), 4(R0)
+		0x6d408801, // FLDPD 8(R0), (F1, F2)
+		0x6d3f90a3, // FSTPD (F3, F4), -8(R5)
+		0xd65f03c0,
+	}
+	if len(got) != len(want) {
+		t.Fatalf("word count = %d, want %d", len(got), len(want))
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Errorf("word %d = %08x, want %08x", i, got[i], want[i])
+		}
+	}
+}
+
+// TestArm64AcquireRelease pins LDAR/STLR and the acquire/release LSE
+// families.
+func TestArm64AcquireRelease(t *testing.T) {
+	got := arm64Words(t, "\tLDAR (R27), R22\n\tLDARB (R25), R2\n\tLDARW (R12), R29\n\tSTLR R3, (R24)\n\tSTLRB R11, (R22)\n"+
+		"\tCASALD R5, (R6), R7\n\tLDADDALD R5, (R6), R7\n\tLDCLRALB R5, (R6), R7\n\tLDORALD R5, (RSP), R7\n\tSWPALW R5, (R6), R7\n")
+	want := []uint32{
+		0xc8dfff76, // LDAR R22, (R27)
+		0x08dfff22, // LDARB R2, (R25)
+		0x88dffd9d, // LDARW R29, (R12)
+		0xc89fff03, // STLR R3, (R24)
+		0x089ffecb, // STLRB R11, (R22)
+		0xc8e5fcc7, // CASALD R7, (R6), R5
+		0xf8e500c7, // LDADDALD R7, (R6), R5
+		0x38e510c7, // LDCLRALB R7, (R6), R5
+		0xf8e533e7, // LDORALD R7, (RSP), R5
+		0xb8e580c7, // SWPALW R7, (R6), R5
+		0xd65f03c0,
+	}
+	if len(got) != len(want) {
+		t.Fatalf("word count = %d, want %d", len(got), len(want))
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Errorf("word %d = %08x, want %08x", i, got[i], want[i])
+		}
+	}
+}
+
+// TestArm64System pins BRK, SVC, the barriers, cache maintenance and the
+// system register accesses.
+func TestArm64System(t *testing.T) {
+	got := arm64Words(t, "\tBRK $35943\n\tBRK\n\tSVC $7165\n\tDMB $1\n\tDSB $1\n\tISB $15\n"+
+		"\tDC ZVA, R4\n\tDC IVAC, R1\n\tMRS DCZID_EL0, R3\n\tMRS CNTVCT_EL0, R0\n\tMSR $9, DAIFSet\n\tMSR $3, SPSel\n"+
+		"\tPRFM (R0), PLDL1KEEP\n\tPRFM (R3), PLDL3KEEP\n\tPRFM (R2), $25\n")
+	want := []uint32{
+		0xd4318ce0, // BRK $35943
+		0xd4200000, // BRK
+		0xd4037fa1, // SVC $7165
+		0xd50331bf, // DMB $1
+		0xd503319f, // DSB $1
+		0xd5033fdf, // ISB $15
+		0xd50b7424, // DC ZVA, R4
+		0xd5087621, // DC IVAC, R1
+		0xd53b00e3, // MRS DCZID_EL0, R3
+		0xd53be040, // MRS CNTVCT_EL0, R0
+		0xd50349df, // MSR $9, DAIFSet
+		0xd50043bf, // MSR $3, SPSel
+		0xf9800000, // PRFM (R0), PLDL1KEEP
+		0xf9800064, // PRFM (R3), PLDL3KEEP
+		0xf9800059, // PRFM (R2), $25
+		0xd65f03c0,
+	}
+	if len(got) != len(want) {
+		t.Fatalf("word count = %d, want %d", len(got), len(want))
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Errorf("word %d = %08x, want %08x", i, got[i], want[i])
+		}
+	}
+}
+
+// TestArm64Crypto pins the AES and SHA families.
+func TestArm64Crypto(t *testing.T) {
+	got := arm64Words(t, "\tAESE V31.B16, V29.B16\n\tAESD V22.B16, V19.B16\n\tAESIMC V12.B16, V27.B16\n\tAESMC V14.B16, V28.B16\n"+
+		"\tSHA1C V8.S4, V8, V2\n\tSHA1H V17, V25\n\tSHA1P V3.S4, V20, V27\n\tSHA1SU0 V17.S4, V13.S4, V16.S4\n\tSHA1SU1 V24.S4, V23.S4\n"+
+		"\tSHA256H V4.S4, V2, V11\n\tSHA256H2 V6.S4, V16, V11\n\tSHA256SU0 V0.S4, V16.S4\n\tSHA256SU1 V31.S4, V3.S4, V15.S4\n"+
+		"\tSHA512H V2.D2, V1, V0\n\tSHA512H2 V4.D2, V3, V2\n\tSHA512SU0 V9.D2, V8.D2\n\tSHA512SU1 V7.D2, V6.D2, V5.D2\n")
+	want := []uint32{
+		0x4e284bfd, // AESE
+		0x4e285ad3, // AESD
+		0x4e28799b, // AESIMC
+		0x4e2869dc, // AESMC
+		0x5e080102, // SHA1C
+		0x5e280a39, // SHA1H
+		0x5e03129b, // SHA1P
+		0x5e1131b0, // SHA1SU0
+		0x5e281b17, // SHA1SU1
+		0x5e04404b, // SHA256H
+		0x5e06520b, // SHA256H2
+		0x5e282810, // SHA256SU0
+		0x5e1f606f, // SHA256SU1
+		0xce628020, // SHA512H
+		0xce648462, // SHA512H2
+		0xcec08128, // SHA512SU0
+		0xce6788c5, // SHA512SU1
+		0xd65f03c0,
+	}
+	if len(got) != len(want) {
+		t.Fatalf("word count = %d, want %d", len(got), len(want))
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Errorf("word %d = %08x, want %08x", i, got[i], want[i])
+		}
+	}
+}
+
+// TestArm64SIMDLogical pins the arrangement-aware three- and two-register
+// SIMD paths.
+func TestArm64SIMDLogical(t *testing.T) {
+	got := arm64Words(t, "\tVADD V1.B16, V2.B16, V3.B16\n\tVAND V4.B16, V4.B16, V9.B16\n\tVEOR V0.B16, V1.B16, V0.B16\n"+
+		"\tVORR V5.B16, V4.B16, V3.B16\n\tVADDP V1.H8, V2.H8, V3.H8\n\tVZIP1 V16.H8, V3.H8, V19.H8\n\tVZIP2 V22.D2, V25.D2, V21.D2\n"+
+		"\tVCMEQ V24.S4, V13.S4, V12.S4\n\tVCMEQ $0, V2.H4, V3.H4\n\tVREV32 V2.H8, V1.H8\n\tVREV64 V2.S4, V3.S4\n\tVUADDLV V31.S4, V11\n"+
+		"\tVPMULL V2.D1, V1.D1, V3.Q1\n\tVPMULL2 V2.B16, V1.B16, V4.H8\n\tVRAX1 V26.D2, V29.D2, V30.D2\n\tVMOV V2.B16, V4.B16\n")
+	want := []uint32{
+		0x4e218443, // VADD 16B
+		0x4e241c89, // VAND
+		0x6e201c20, // VEOR
+		0x4ea51c83, // VORR
+		0x4e61bc43, // VADDP 8H
+		0x4e503873, // VZIP1 8H
+		0x4ed67b35, // VZIP2 2D
+		0x6eb88dac, // VCMEQ 4S
+		0x0e609843, // VCMEQ $0, 4H
+		0x6e600841, // VREV32 8H
+		0x4ea00843, // VREV64 4S
+		0x6eb03beb, // VUADDLV 4S
+		0x0ee2e023, // VPMULL D1
+		0x4e22e024, // VPMULL2 16B
+		0xce7a8fbe, // VRAX1 2D
+		0x4ea21c44, // VMOV 16B pair
+		0xd65f03c0,
+	}
+	if len(got) != len(want) {
+		t.Fatalf("word count = %d, want %d", len(got), len(want))
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Errorf("word %d = %08x, want %08x", i, got[i], want[i])
+		}
+	}
+}
+
+// TestArm64SIMDWide pins the four-register crypto group, VXAR, VEXT and the
+// shift-by-immediate encodings.
+func TestArm64SIMDWide(t *testing.T) {
+	got := arm64Words(t, "\tVEOR3 V2.B16, V7.B16, V12.B16, V25.B16\n\tVBCAX V1.B16, V2.B16, V26.B16, V31.B16\n"+
+		"\tVXAR $63, V27.D2, V21.D2, V26.D2\n\tVEXT $4, V2.B8, V1.B8, V3.B8\n\tVEXT $8, V2.B16, V1.B16, V3.B16\n"+
+		"\tVSHL $7, V22.D2, V25.D2\n\tVUSHR $6, V22.H8, V23.H8\n\tVSRI $24, V1.S4, V2.S4\n")
+	want := []uint32{
+		0xce070999, // VEOR3
+		0xce22075f, // VBCAX
+		0xce9bfeba, // VXAR
+		0x2e022023, // VEXT B8
+		0x6e024023, // VEXT B16
+		0x4f4756d9, // VSHL D2 $7
+		0x6f1a06d7, // VUSHR H8 $6
+		0x6f284422, // VSRI S4 $24
+		0xd65f03c0,
+	}
+	if len(got) != len(want) {
+		t.Fatalf("word count = %d, want %d", len(got), len(want))
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Errorf("word %d = %08x, want %08x", i, got[i], want[i])
+		}
+	}
+}
+
+// TestArm64SIMDElement pins VDUP and the VMOV element forms.
+func TestArm64SIMDElement(t *testing.T) {
+	got := arm64Words(t, "\tVDUP V31.B[15], V18\n\tVDUP V19.S[3], V18.S4\n\tVDUP V1.D[1], V2.D2\n"+
+		"\tVMOV V13.S[0], R20\n\tVMOV V11.B[11], V16.B[12]\n\tVMOV R20, V21.B[2]\n")
+	want := []uint32{
+		0x5e1f07f2, // VDUP element to register
+		0x4e1c0672, // VDUP element across S4
+		0x4e180422, // VDUP element across D2
+		0x0e043db4, // VMOV element to register
+		0x6e195d70, // VMOV element to element
+		0x4e051e95, // VMOV register into element
+		0xd65f03c0,
+	}
+	if len(got) != len(want) {
+		t.Fatalf("word count = %d, want %d", len(got), len(want))
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Errorf("word %d = %08x, want %08x", i, got[i], want[i])
+		}
+	}
+}
+
+// TestArm64SIMDLoadStore pins the structure loads and stores.
+func TestArm64SIMDLoadStore(t *testing.T) {
+	got := arm64Words(t, "\tVLD1 (R2), [V21.B16]\n\tVLD1 (R1), [V2.B16, V3.B16]\n\tVLD1 (R29), [V14.D1, V15.D1, V16.D1, V17.D1]\n"+
+		"\tVLD1.P 32(R1), [V2.B16, V3.B16]\n\tVST1 [V2.S4, V3.S4, V4.S4, V5.S4], (R14)\n\tVST1.P [V2.B16], (R1)\n"+
+		"\tVLD1R (R1), [V9.B8]\n\tVLD4R (R0), [V0.B8, V1.B8, V2.B8, V3.B8]\n")
+	want := []uint32{
+		0x4c407055, // VLD1 one register
+		0x4c40a022, // VLD1 two registers
+		0x0c402fae, // VLD1 four registers D1
+		0x4cdfa022, // VLD1.P two registers
+		0x4c0029c2, // VST1 four registers S4
+		0x4c9f7022, // VST1.P one register
+		0x0d40c029, // VLD1R
+		0x0d60e000, // VLD4R
+		0xd65f03c0,
+	}
+	if len(got) != len(want) {
+		t.Fatalf("word count = %d, want %d", len(got), len(want))
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Errorf("word %d = %08x, want %08x", i, got[i], want[i])
+		}
+	}
+}
+
+// TestArm64MoviLiteral pins the VMOVS/VMOVD/VMOVQ constant loads: three
+// words each (ADRP, ADD, wide load) plus the pooled literal in the data
+// section.
+func TestArm64MoviLiteral(t *testing.T) {
+	src := "#include \"textflag.h\"\n\nTEXT ·f(SB), NOSPLIT, $0-0\n" +
+		"\tVMOVS $0x80402010, V11\n\tVMOVD $0x8040201008040201, V20\n" +
+		"\tVMOVQ $0x7040201008040201, $0x8040201008040201, V10\n\tRET\n"
+	f, errs := parser.Parse("test_arm64.s", src)
+	if len(errs) > 0 {
+		t.Fatalf("parse: %v", errs)
+	}
+	img, err := AssembleFileARM64(f)
+	if err != nil {
+		t.Fatalf("AssembleFileARM64: %v", err)
+	}
+	if img.Funcs[0].Size != 12*3+4 {
+		t.Errorf("func size = %d, want %d", img.Funcs[0].Size, 12*3+4)
+	}
+	want := []uint32{
+		0x9000001b, 0x9100037b, 0xbd40036b, // VMOVS: ADRP, ADD, LDR S
+		0x9000001b, 0x9100037b, 0xfd400374, // VMOVD: ADRP, ADD, LDR D
+		0x9000001b, 0x9100037b, 0x3dc0036a, // VMOVQ: ADRP, ADD, LDR Q
+		0xd65f03c0,
+	}
+	got := leWords(img.Code)
+	if len(got) != len(want) {
+		t.Fatalf("word count = %d, want %d", len(got), len(want))
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Errorf("word %d = %08x, want %08x", i, got[i], want[i])
+		}
+	}
+	// The literals sit in the data section.
+	var found32, found64, found128 bool
+	for _, d := range img.DataSyms {
+		switch d.Name {
+		case "$i32.80402010":
+			found32 = d.Size == 4
+		case "$i64.8040201008040201":
+			found64 = d.Size == 8
+		case "$i128.80402010080402017040201008040201":
+			found128 = d.Size == 16
+		}
+	}
+	if !found32 || !found64 || !found128 {
+		t.Errorf("literals missing: i32=%v i64=%v i128=%v", found32, found64, found128)
+	}
+}
+
+// TestArm64MOVK pins standalone MOVK with the hw field derived from the
+// chunk position.
+func TestArm64MOVK(t *testing.T) {
+	got := arm64Words(t, "\tMOVK $1234, R5\n\tMOVK $305397760, R5\n\tMOVKW $1234, R5\n")
+	want := []uint32{
+		0xf2809a45, // MOVK hw=0
+		0xf2a24685, // MOVK hw=1
+		0x72809a45, // MOVKW hw=0
+		0xd65f03c0,
+	}
+	if len(got) != len(want) {
+		t.Fatalf("word count = %d, want %d", len(got), len(want))
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Errorf("word %d = %08x, want %08x", i, got[i], want[i])
 		}
 	}
 }
@@ -572,3 +1016,419 @@ func leWords(b []byte) []uint32 {
 	}
 	return w
 }
+
+// TestArm64IndirectBranch pins the indirect branch forms in a leaf function:
+// JMP (Rn) lowers to BR Rn, matching the toolchain's spelling, and the raw
+// BR/BLR mnemonics encode directly (a gasm superset the toolchain's front
+// end does not accept).  CALL (Rn) shares the BLR path and its non-leaf
+// prologue parity is covered by the ground-truth kernel.
+func TestArm64IndirectBranch(t *testing.T) {
+	src := `#include "textflag.h"
+
+TEXT ·f(SB), NOSPLIT, $0-0
+	JMP (R0)
+	BR R5
+	BLR R6
+	RET
+`
+	f, errs := parser.Parse("test_arm64.s", src)
+	if len(errs) > 0 {
+		t.Fatalf("parse: %v", errs)
+	}
+	img, err := AssembleFileARM64(f)
+	if err != nil {
+		t.Fatalf("AssembleFileARM64: %v", err)
+	}
+	want := []uint32{
+		0xd61f0000, // BR R0
+		0xd61f00a0, // BR R5
+		0xd63f00c0, // BLR R6
+		0xd65f03c0, // RET (BR LR)
+	}
+	got := leWords(img.Code)
+	if len(got) != len(want) {
+		t.Fatalf("word count = %d, want %d", len(got), len(want))
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Errorf("word %d = %08x, want %08x", i, got[i], want[i])
+		}
+	}
+}
+
+// arm64Words assembles a single NOSPLIT leaf body and returns its words.
+func arm64Words(t *testing.T, body string) []uint32 {
+	t.Helper()
+	f, errs := parser.Parse("test_arm64.s", "#include \"textflag.h\"\n\nTEXT ·f(SB), NOSPLIT, $0-0\n"+body+"\tRET\n")
+	if len(errs) > 0 {
+		t.Fatalf("parse: %v", errs)
+	}
+	img, err := AssembleFileARM64(f)
+	if err != nil {
+		t.Fatalf("AssembleFileARM64: %v", err)
+	}
+	return leWords(img.Code)
+}
+
+// TestArm64ShiftEncodings pins the shift words against `go tool asm -S`
+// output (Go 1.27, arm64): immediate forms alias SBFM/UBFM with ROR as EXTR,
+// register forms are the two-source LSLV/LSRV/ASRV/RORV.
+func TestArm64ShiftEncodings(t *testing.T) {
+	got := arm64Words(t, "\tLSL $4, R0, R1\n\tLSR $8, R0, R2\n\tASR $4, R0, R3\n\tROR $12, R0, R4\n"+
+		"\tLSLW $4, R0, R5\n\tLSRW $8, R0, R6\n\tASRW $4, R0, R7\n\tRORW $12, R0, R8\n")
+	want := []uint32{
+		0xd37cec01, // LSL $4  = UBFM X1, X0, #60, #59
+		0xd348fc02, // LSR $8  = UBFM X2, X0, #8, #63
+		0x9344fc03, // ASR $4  = SBFM X3, X0, #4, #63
+		0x93c03004, // ROR $12 = EXTR X4, X0, X0, #12
+		0x531c6c05, // LSLW $4 = UBFM W5, W0, #28, #27
+		0x53087c06, // LSRW $8 = UBFM W6, W0, #8, #31
+		0x13047c07, // ASRW $4 = SBFM W7, W0, #4, #31
+		0x13803008, // RORW $12 = EXTR W8, W0, W0, #12
+		0xd65f03c0, // RET
+	}
+	if len(got) != len(want) {
+		t.Fatalf("word count = %d, want %d", len(got), len(want))
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Errorf("imm shift word %d = %08x, want %08x", i, got[i], want[i])
+		}
+	}
+
+	got = arm64Words(t, "\tLSL R9, R0, R10\n\tLSR R9, R0, R11\n\tASR R9, R0, R12\n\tROR R9, R0, R13\n"+
+		"\tLSLW R9, R0, R14\n\tLSRW R9, R0, R15\n\tASRW R9, R0, R16\n\tRORW R9, R0, R17\n")
+	want = []uint32{
+		0x9ac9200a, // LSLV X10, X0, X9
+		0x9ac9240b, // LSRV X11, X0, X9
+		0x9ac9280c, // ASRV X12, X0, X9
+		0x9ac92c0d, // RORV X13, X0, X9
+		0x1ac9200e, // LSLV W14, W0, W9
+		0x1ac9240f, // LSRV W15, W0, W9
+		0x1ac92810, // ASRV W16, W0, W9
+		0x1ac92c11, // RORV W17, W0, W9
+		0xd65f03c0, // RET
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Errorf("reg shift word %d = %08x, want %08x", i, got[i], want[i])
+		}
+	}
+
+	// Two-operand spellings fold to Rn = Rd.
+	got = arm64Words(t, "\tLSL $4, R1\n\tLSR R9, R1\n\tASR $4, R1\n\tROR R9, R1\n\tLSLW $4, R1\n\tRORW R9, R1\n")
+	want = []uint32{
+		0xd37cec21, // LSL $4, R1 = UBFM X1, X1, #60, #59
+		0x9ac92421, // LSRV X1, X1, X9
+		0x9344fc21, // ASR $4, R1 = SBFM X1, X1, #4, #63
+		0x9ac92c21, // RORV X1, X1, X9
+		0x531c6c21, // LSLW $4, R1 = UBFM W1, W1, #28, #27
+		0x1ac92c21, // RORV W1, W1, W9
+		0xd65f03c0, // RET
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Errorf("2op shift word %d = %08x, want %08x", i, got[i], want[i])
+		}
+	}
+}
+
+// TestArm64ShiftRangeErrors: the toolchain reports "illegal bit number" for
+// shift amounts at or above the operand width.
+func TestArm64ShiftRangeErrors(t *testing.T) {
+	for _, src := range []string{
+		"\tLSL $64, R0, R1\n",
+		"\tLSRW $32, R0, R1\n",
+		"\tRORW $32, R0, R1\n",
+		"\tASR $-1, R0, R1\n",
+	} {
+		f, errs := parser.Parse("test_arm64.s", "#include \"textflag.h\"\n\nTEXT ·f(SB), NOSPLIT, $0-0\n"+src+"\tRET\n")
+		if len(errs) > 0 {
+			t.Fatalf("parse: %v", errs)
+		}
+		if _, err := AssembleFileARM64(f); err == nil {
+			t.Errorf("%s: expected an error, got none", src)
+		}
+	}
+}
+
+// TestArm64DivEncodings pins SDIV/UDIV in both widths: the 2-source opcode
+// field (bits 15:10 of the 0xd6<<21 fixed field) is UDIV=0b0010, SDIV=0b0011.
+func TestArm64DivEncodings(t *testing.T) {
+	got := arm64Words(t, "\tSDIV R1, R2, R3\n\tUDIV R1, R2, R3\n\tSDIVW R1, R2, R3\n\tUDIVW R1, R2, R3\n")
+	want := []uint32{
+		0x9ac10c43, // SDIV X3, X2, X1
+		0x9ac10843, // UDIV X3, X2, X1
+		0x1ac10c43, // SDIV W3, W2, W1
+		0x1ac10843, // UDIV W3, W2, W1
+		0xd65f03c0, // RET
+	}
+	if len(got) != len(want) {
+		t.Fatalf("word count = %d, want %d", len(got), len(want))
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Errorf("div word %d = %08x, want %08x", i, got[i], want[i])
+		}
+	}
+}
+
+// TestArm64MAddSub pins the four-operand MADD/MSUB words (Rm, Ra, Rn, Rd,
+// with Ra in bits 14:10) and rejects the shorter spellings the toolchain
+// also rejects.
+func TestArm64MAddSub(t *testing.T) {
+	got := arm64Words(t, "\tMADD R1, R2, R3, R4\n\tMSUB R1, R2, R3, R4\n\tMADDW R1, R2, R3, R5\n\tMSUBW R1, R2, R3, R5\n")
+	want := []uint32{
+		0x9b010864, // MADD X4, X3, X1, X2 (Rm=1, Ra=2, Rn=3)
+		0x9b018864, // MSUB X4, X3, X1, X2
+		0x1b010865, // MADD W5, W3, W1, W2
+		0x1b018865, // MSUB W5, W3, W1, W2
+		0xd65f03c0, // RET
+	}
+	if len(got) != len(want) {
+		t.Fatalf("word count = %d, want %d", len(got), len(want))
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Errorf("madd word %d = %08x, want %08x", i, got[i], want[i])
+		}
+	}
+
+	// The accumulate operand is mandatory: 2- and 3-operand forms error
+	// rather than silently reading R0 or ZR as the accumulator.
+	for _, body := range []string{
+		"\tMADD R1, R2\n",
+		"\tMADD R1, R2, R3\n",
+		"\tMSUBW R1, R2, R3\n",
+	} {
+		f, errs := parser.Parse("test_arm64.s", "#include \"textflag.h\"\n\nTEXT ·f(SB), NOSPLIT, $0-0\n"+body+"\tRET\n")
+		if len(errs) > 0 {
+			t.Fatalf("parse: %v", errs)
+		}
+		if _, err := AssembleFileARM64(f); err == nil {
+			t.Errorf("%s: expected an error, got none", body)
+		}
+	}
+}
+
+// TestArm64MovImmWidth pins the immediate classifications whose size pass
+// once disagreed with the encoder: negative and 0xFFFFFFFF W values go
+// through MOVN after 32-bit truncation, and 3- to 4-chunk constants expand
+// to one word per non-zero chunk.
+func TestArm64MovImmWidth(t *testing.T) {
+	got := arm64Words(t, "\tMOVW $-1, R0\n\tMOVW $0xFFFFFFFF, R3\n")
+	want := []uint32{
+		0x12800000, // MOVN W0, #0
+		0x12800003, // MOVN W3, #0
+		0xd65f03c0, // RET
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Errorf("movw word %d = %08x, want %08x", i, got[i], want[i])
+		}
+	}
+
+	for _, tt := range []struct {
+		body  string
+		words int
+	}{
+		{"\tMOVD $0x0001000200030000, R2\n", 3}, // three chunks
+		{"\tMOVD $0x0001000200030004, R1\n", 4}, // four chunks
+		{"\tMOVW $-1, R0\n", 1},                 // MOVN after truncation
+	} {
+		if got := arm64Words(t, tt.body); len(got) != tt.words+1 {
+			t.Errorf("%s: %d words, want %d (including RET)", tt.body, len(got), tt.words+1)
+		}
+	}
+}
+
+// TestArm64ExclOffsetErrors: exclusive and atomic encodings carry no
+// immediate field, so a non-zero offset is rejected the way the toolchain
+// reports "illegal combination" for it, never silently dropped.
+func TestArm64ExclOffsetErrors(t *testing.T) {
+	for _, body := range []string{
+		"\tLDXR 8(R1), R2\n",
+		"\tLDAXR 8(R1), R2\n",
+		"\tSTXR R3, 8(R1), R4\n",
+		"\tSTLXR R3, 8(R1), R4\n",
+		"\tCASD R3, 8(R1), R4\n",
+		"\tLDADDD R3, 8(R1), R4\n",
+	} {
+		f, errs := parser.Parse("test_arm64.s", "#include \"textflag.h\"\n\nTEXT ·f(SB), NOSPLIT, $0-0\n"+body+"\tRET\n")
+		if len(errs) > 0 {
+			t.Fatalf("parse: %v", errs)
+		}
+		if _, err := AssembleFileARM64(f); err == nil {
+			t.Errorf("%s: expected an error, got none", body)
+		}
+	}
+}
+
+// TestArm64ExclNoOffset pins the plain (Rn) forms, byte-for-byte against
+// go tool asm.  The toolchain parses the FIRST register of a store as the
+// data register and the LAST as the status register (asm7.go case 59), and
+// the pair forms as (Rt1, Rt2) (case 58/59):
+//
+//	STXR R3, (R1), R4         → c8047c23 (Rt=3, Rn=1, Rs=4)
+//	STXP (R3, R4), (R1), R5   → c8251023 (Rt=3, Rt2=4, Rn=1, Rs=5)
+//	LDXP (R1), (R3, R4)       → c87f1023 (Rn=1, Rt=3, Rt2=4)
+func TestArm64ExclNoOffset(t *testing.T) {
+	got := arm64Words(t, "\tLDXR (R1), R2\n\tSTXR R3, (R1), R4\n"+
+		"\tSTXP (R3, R4), (R1), R5\n\tSTXPW (R3, R4), (R1), R5\n"+
+		"\tLDXP (R1), (R3, R4)\n\tLDXPW (R1), (R3, R4)\n"+
+		"\tSTXR R3, (RSP), R4\n\tLDXR (RSP), R2\n")
+	want := []uint32{
+		0xc85f7c22, // LDXR X2, [X1]
+		0xc8047c23, // STXR W3, [X1], W4 with Rt = R3, Rs = R4
+		0xc8251023, // STXP (R3, R4), [X1], R5
+		0x88251023, // STXPW (R3, R4), [X1], R5
+		0xc87f1023, // LDXP [X1], (R3, R4)
+		0x887f1023, // LDXPW [X1], (R3, R4)
+		0xc8047fe3, // STXR R3, [SP], R4
+		0xc85f7fe2, // LDXR [SP], R2
+		0xd65f03c0, // RET
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Errorf("excl word %d = %08x, want %08x", i, got[i], want[i])
+		}
+	}
+}
+
+// TestArm64AddSubImmRange: immediates that cannot ride the imm12 field are
+// rejected instead of wrapping through int32.
+func TestArm64AddSubImmRange(t *testing.T) {
+	for _, body := range []string{
+		"\tADD $0x100000000, R0, R1\n",
+		"\tSUB $-0x100000000, R0, R1\n",
+		"\tCMP $0x100000000, R0\n",
+	} {
+		f, errs := parser.Parse("test_arm64.s", "#include \"textflag.h\"\n\nTEXT ·f(SB), NOSPLIT, $0-0\n"+body+"\tRET\n")
+		if len(errs) > 0 {
+			t.Fatalf("parse: %v", errs)
+		}
+		if _, err := AssembleFileARM64(f); err == nil {
+			t.Errorf("%s: expected an error, got none", body)
+		}
+	}
+}
+
+// TestArm64LargeRegisterOffset pins the large-offset path for a register
+// base: the ADD offsets from the operand's own base, not from SP, matching
+// the toolchain's `ADD $(256<<12), R2, R27; MOVD (R27), R3`.
+func TestArm64LargeRegisterOffset(t *testing.T) {
+	got := arm64Words(t, "\tMOVD 0x100000(R2), R3\n\tMOVD R3, 0x100000(R2)\n")
+	want := []uint32{
+		0x9144005b, // ADD $(256<<12), R2, R27
+		0xf9400363, // MOVD (R27), R3
+		0x9144005b, // ADD $(256<<12), R2, R27
+		0xf9000363, // MOVD R3, (R27)
+		0xd65f03c0, // RET
+	}
+	if len(got) != len(want) {
+		t.Fatalf("word count = %d, want %d", len(got), len(want))
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Errorf("large offset word %d = %08x, want %08x", i, got[i], want[i])
+		}
+	}
+}
+
+// TestArm64LargeFrameSpadj checks the stack-adjustment boundaries of a frame
+// whose autosize must be materialised into REGTMP: $5000 rounds the autosize
+// to 5024, so the prologue is [MOVD $5024, R27][SUB R27, RSP, R20][STP][ADD
+// R20, SP][SUB $8] and SP moves only at its fourth word, while the RET's
+// epilogue is [LDP][MOVD $5024, R27][ADD R27, RSP, RSP] before the final
+// RET.  These PCs feed the DWARF CFA rules and the goobj stack maps.
+func TestArm64LargeFrameSpadj(t *testing.T) {
+	f, errs := parser.Parse("frame_arm64.s", "#include \"textflag.h\"\n\nTEXT ·framed(SB), $5000-0\n\tCALL ·other(SB)\n\tRET\n\nTEXT ·other(SB), NOSPLIT, $0\n\tRET\n")
+	if len(errs) > 0 {
+		t.Fatalf("parse: %v", errs)
+	}
+	img, err := AssembleFileARM64(f)
+	if err != nil {
+		t.Fatalf("AssembleFileARM64: %v", err)
+	}
+	fn := img.Funcs[0]
+	// autosize 5024: class-2 guard of 6 words (24 bytes), a 5-word prologue
+	// whose ADD R20, SP sits at byte 8 inside it, a one-instruction body,
+	// then a 3-word epilogue before the final RET.
+	wantSpadj := []SpadjStep{{PC: 24 + 12, Value: 5024}, {PC: 24 + 20 + 4 + 12, Value: 0}}
+	if len(fn.Spadj) != len(wantSpadj) {
+		t.Fatalf("spadj = %v, want %v", fn.Spadj, wantSpadj)
+	}
+	for i := range wantSpadj {
+		if fn.Spadj[i] != wantSpadj[i] {
+			t.Errorf("spadj[%d] = %v, want %v", i, fn.Spadj[i], wantSpadj[i])
+		}
+	}
+	// The words those PCs point between: the prologue's ADD R20, SP at byte
+	// 36, and the epilogue's materialised ADD R27, RSP, RSP right before the
+	// final RET at byte 60.
+	words := leWords(img.Code[fn.Offset : fn.Offset+fn.Size])
+	if got := words[(24+12)/4]; got != 0x9100029f {
+		t.Errorf("prologue word at byte 36 = %08x, want 9100029f (ADD R20, SP)", got)
+	}
+	if got := words[(24+20+4+8)/4]; got != 0x8b3b63ff {
+		t.Errorf("epilogue word at byte 56 = %08x, want 8b3b63ff (ADD R27, RSP, RSP)", got)
+	}
+	if got := words[(24+20+4+12)/4]; got != 0xd65f03c0 {
+		t.Errorf("final RET word at byte 60 = %08x, want d65f03c0", got)
+	}
+}
+
+// TestArm64SplitFrameSpadj pins the addcon2 band, where neither imm12 form
+// nor a single MOVZ carries the autosize and the toolchain splits the
+// prologue SUB into two imm12 instructions (asm7.go case 48) while the
+// non-leaf RET still materialises the value into REGTMP (obj7.go ARET,
+// issue 73259).  $65664 rounds the autosize to 65680 = 144 + 16<<12:
+//
+//	[SUB $144, RSP, R20][SUB $(16<<12), R20, R20][STP][MOVD R20, SP][SUB $8]
+//	[CALL]
+//	[LDP][MOVD $144, R27][MOVK $(1<<16), R27][ADD R27, RSP, RSP][RET]
+//
+// SP moves at the fourth word (byte 12) and returns to zero at the final
+// RET (byte 40); the words are go tool asm's own for the same source.
+func TestArm64SplitFrameSpadj(t *testing.T) {
+	f, errs := parser.Parse("frame_arm64.s", "#include \"textflag.h\"\n\nTEXT ·framed(SB), NOSPLIT, $65664-0\n\tCALL ·other(SB)\n\tRET\n\nTEXT ·other(SB), NOSPLIT, $0\n\tRET\n")
+	if len(errs) > 0 {
+		t.Fatalf("parse: %v", errs)
+	}
+	img, err := AssembleFileARM64(f)
+	if err != nil {
+		t.Fatalf("AssembleFileARM64: %v", err)
+	}
+	fn := img.Funcs[0]
+	wantSpadj := []SpadjStep{{PC: 12, Value: 65680}, {PC: 40, Value: 0}}
+	if len(fn.Spadj) != len(wantSpadj) {
+		t.Fatalf("spadj = %v, want %v", fn.Spadj, wantSpadj)
+	}
+	for i := range wantSpadj {
+		if fn.Spadj[i] != wantSpadj[i] {
+			t.Errorf("spadj[%d] = %v, want %v", i, fn.Spadj[i], wantSpadj[i])
+		}
+	}
+	want := []uint32{
+		0xd10243f4, // SUB $144, RSP, R20
+		0xd1404294, // SUB $(16<<12), R20, R20
+		0xa93ffa9d, // STP (R29, R30), -8(R20)
+		0x9100029f, // MOVD R20, RSP
+		0xd10023fd, // SUB $8, RSP, R29
+		0x94000000, // CALL (relocation masked at link time)
+		0xa97ffbfd, // LDP -8(RSP), (R29, R30)
+		0xd280121b, // MOVD $144, R27
+		0xf2a0003b, // MOVK $(1<<16), R27
+		0x8b3b63ff, // ADD R27, RSP, RSP
+		0xd65f03c0, // RET
+	}
+	words := leWords(img.Code[fn.Offset : fn.Offset+fn.Size])
+	if len(words) != len(want) {
+		t.Fatalf("framed = %d words, want %d", len(words), len(want))
+	}
+	for i, w := range want {
+		if words[i] != w {
+			t.Errorf("word %d = %08x, want %08x", i, words[i], w)
+		}
+	}
+}

asm/arm64_frame.go

@@ -63,6 +63,12 @@ type arm64FrameInfo struct {
 	args     int  // the declared -argsize
 	noSplit  bool // the NOSPLIT flag
 	leaf     bool // no call instructions in the body
+
+	// Stack-split guard state: needSplit mirrors the toolchain, which skips
+	// the check for NOSPLIT functions and auto-marks leaf functions with an
+	// autosize below StackSmall as NOSPLIT.
+	needSplit  bool
+	splitClass int // 0: <=StackSmall, 1: <=StackBig, 2: >StackBig
 }
 
 // arm64ComputeFrame derives the frame layout for a TEXT function.
@@ -80,15 +86,68 @@ func arm64ComputeFrame(t *ast.Text) arm64FrameInfo {
 
 	if fi.frame != 0 || !fi.leaf {
 		fi.autosize = fi.frame + 8 // space for the saved LR
-		if fi.autosize%16 != 0 {
-			// The toolchain aligns to 16: if autosize%16 == 8, add 8;
-			// otherwise add whatever is needed.
+		// The toolchain always adds an extrasize: 8 when the total leaves a
+		// 16-byte alignment gap, another 16 when already aligned.
+		switch fi.autosize % 16 {
+		case 8:
+			fi.autosize += 8
+		case 0:
+			fi.autosize += 16
+		default:
+			// The toolchain rejects unaligned frames; round up so such
+			// sources still assemble.
 			fi.autosize += 16 - (fi.autosize % 16)
 		}
 	}
+	switch {
+	case fi.noSplit:
+	case fi.autosize < stackSmall && fi.leaf:
+		// Auto-NOSPLIT, as the toolchain's leaf mark concludes.
+	default:
+		fi.needSplit = true
+		switch {
+		case fi.autosize <= stackSmall:
+			fi.splitClass = 0
+		case fi.autosize <= stackBig:
+			fi.splitClass = 1
+		default:
+			fi.splitClass = 2
+		}
+	}
 	return fi
 }
 
+// arm64GuardLen returns the byte length of the stack-split guard prefix
+// (zero when the function needs no guard).  The big class materialises
+// framesize-StackSmall into REGTMP, whose MOVZ/MOVK sequence length varies.
+func arm64GuardLen(fi arm64FrameInfo) int {
+	if !fi.needSplit {
+		return 0
+	}
+	switch fi.splitClass {
+	case 0:
+		return 12
+	case 1:
+		return 16
+	default:
+		n, err := arm64LoadImmLen(int64(fi.autosize - stackSmall))
+		if err != nil {
+			return 0
+		}
+		return 4 + n + 4 + 4 + 4 + 4
+	}
+}
+
+// arm64LoadImmLen returns the byte length of the MOVZ/MOVK sequence that
+// loads v into a register.
+func arm64LoadImmLen(v int64) (int, error) {
+	b, err := encodeARM64LoadImm(27, v, "MOVD")
+	if err != nil {
+		return 0, err
+	}
+	return len(b), nil
+}
+
 // arm64IsLeaf reports whether a function contains no call instructions
 // (BL/CALL), matching the toolchain's LEAF mark.
 func arm64IsLeaf(t *ast.Text) bool {
@@ -119,12 +178,99 @@ func arm64Prologue(fi arm64FrameInfo) []byte {
 		)
 	}
 	// Large frame: SUB $autosize, SP, R20; STP (FP,LR), -8(R20); ADD $0, R20, SP; SUB $8, SP, FP
-	return a64WordsLE(
-		a64AddSub(1, 1, 0, 0, uint32(fi.autosize), 31, 20), // SUB $autosize, SP, R20
-		a64LSP(2, 0, 0, -1, 30, 20, 29),                    // STP FP, LR, [R20, #-8] (opc=2 for 64-bit pair)
-		a64AddSub(1, 0, 0, 0, 0, 20, 31),                   // ADD $0, R20, SP (= MOV R20, SP)
-		a64AddSub(1, 1, 0, 0, 8, 31, 29),                   // SUB $8, SP, FP (op=1 for SUB)
+	ws := arm64SubImmWords(uint32(fi.autosize), 20)
+	ws = append(ws,
+		a64LSP(2, 0, 0, -1, 30, 20, 29),  // STP FP, LR, [R20, #-8] (opc=2 for 64-bit pair)
+		a64AddSub(1, 0, 0, 0, 0, 20, 31), // ADD $0, R20, SP (= MOV R20, SP)
+		a64AddSub(1, 1, 0, 0, 8, 31, 29), // SUB $8, SP, FP (op=1 for SUB)
 	)
+	return a64WordsLE(ws...)
+}
+
+// arm64SplitImm12 reports whether the toolchain decomposes ADD/SUB $imm into
+// two imm12 instructions instead of materialising it into REGTMP
+// (asm7.go case 48, the C_ADDCON2 class): the value must fit 24 bits
+// unsigned and be neither encodable as one imm12 (checked by the callers
+// first), nor loadable into a register in a single MOVZ/MOVN word, nor a
+// logical immediate, because conclass tests all three before C_ADDCON2.
+func arm64SplitImm12(imm uint32) bool {
+	if imm > 0xFFFFFF {
+		return false
+	}
+	if _, _, _, ok := arm64Bitmask(uint64(imm), 1); ok {
+		return false
+	}
+	return arm64Movcon(int64(imm)) < 0 && arm64Movcon(^int64(imm)) < 0
+}
+
+// arm64SubImmWords emits SUB $imm, SP, Rd with the toolchain's ladder for an
+// ADD/SUB constant (asm7.go conclass and cases 2, 48, 62 and 13): the
+// immediate form when the value fits imm12 (plain, or shifted left by 12
+// when it is a multiple of 4096); a value with a single 16-bit chunk, a
+// logical immediate, or one wider than 24 bits is materialised into REGTMP
+// (R27) and subtracted in the extended-register form; everything else up to
+// 0xFFFFFF is split into two imm12 instructions:
+//
+//	SUB $(imm&0xfff), SP, Rd
+//	SUB $((imm&0xfff000)>>12)<<12, Rd, Rd
+func arm64SubImmWords(imm uint32, rd uint32) []uint32 {
+	if imm <= 0xFFF {
+		return []uint32{a64AddSub(1, 1, 0, 0, imm, 31, rd)}
+	}
+	if imm <= 4095<<12 && imm&0xFFF == 0 {
+		return []uint32{a64AddSub(1, 1, 0, 1, imm>>12, 31, rd)}
+	}
+	if !arm64SplitImm12(imm) {
+		mov, err := encodeARM64LoadImm(27, int64(imm), "MOVD")
+		if err != nil {
+			mov = nil
+		}
+		return append(wordsOf(mov), arm64DPExtWords(arm64OpSub, 27, 31, rd))
+	}
+	return []uint32{
+		a64AddSub(1, 1, 0, 0, imm&0xFFF, 31, rd),
+		a64AddSub(1, 1, 0, 1, (imm&0xFFF000)>>12, rd, rd),
+	}
+}
+
+// arm64AddImmWords emits ADD $imm, SP, Rd with the same imm12, shifted-imm12,
+// split and REGTMP ladder as arm64SubImmWords.
+func arm64AddImmWords(imm uint32, rd uint32) []uint32 {
+	if imm <= 0xFFF {
+		return []uint32{a64AddSub(1, 0, 0, 0, imm, 31, rd)}
+	}
+	if imm <= 4095<<12 && imm&0xFFF == 0 {
+		return []uint32{a64AddSub(1, 0, 0, 1, imm>>12, 31, rd)}
+	}
+	if !arm64SplitImm12(imm) {
+		mov, err := encodeARM64LoadImm(27, int64(imm), "MOVD")
+		if err != nil {
+			mov = nil
+		}
+		return append(wordsOf(mov), arm64DPExtWords(arm64OpAdd, 27, 31, rd))
+	}
+	return []uint32{
+		a64AddSub(1, 0, 0, 0, imm&0xFFF, 31, rd),
+		a64AddSub(1, 0, 0, 1, (imm&0xFFF000)>>12, rd, rd),
+	}
+}
+
+// arm64RetAddWords emits the frame deallocation of a non-leaf RET with a
+// large frame.  The toolchain adds the frame back with a single instruction:
+// a plain imm12 ADD when autosize fits 12 bits, otherwise the value is
+// materialised into REGTMP and added as a register, so the epilogue never
+// leaves a partially deallocated frame (obj7.go ARET, issue 73259).  The
+// shifted-imm12 and split-imm12 forms are therefore never used here, unlike
+// the leaf epilogue's plain ADD instructions.
+func arm64RetAddWords(autosize uint32) []uint32 {
+	if autosize < 1<<12 {
+		return []uint32{a64AddSub(1, 0, 0, 0, autosize, 31, 31)}
+	}
+	mov, err := encodeARM64LoadImm(27, int64(autosize), "MOVD")
+	if err != nil {
+		mov = nil
+	}
+	return append(wordsOf(mov), arm64DPExtWords(arm64OpAdd, 27, 31, 31))
 }
 
 // arm64Return returns the bytes for a RET: the epilogue (restore FP/LR and
@@ -134,10 +280,8 @@ func arm64Return(fi arm64FrameInfo) []byte {
 	if fi.autosize != 0 {
 		if fi.leaf {
 			// Leaf with frame: ADD $autosize-8, SP, FP; ADD $autosize, SP, SP
-			ws = append(ws,
-				a64AddSub(1, 0, 0, 0, uint32(fi.autosize-8), 31, 29), // ADD $autosize-8, SP, FP
-				a64AddSub(1, 0, 0, 0, uint32(fi.autosize), 31, 31),   // ADD $autosize, SP, SP
-			)
+			ws = append(ws, arm64AddImmWords(uint32(fi.autosize-8), 29)...)
+			ws = append(ws, arm64AddImmWords(uint32(fi.autosize), 31)...)
 		} else if fi.autosize <= 0xf0 {
 			// Non-leaf small frame: LDR FP, [SP, #-8]; LDR.P LR, [SP], #autosize
 			ws = append(ws,
@@ -145,11 +289,11 @@ func arm64Return(fi arm64FrameInfo) []byte {
 				arm64PostLoad(3, 0, int32(fi.autosize), 31, 30), // LDR.P LR, [SP], #autosize
 			)
 		} else {
-			// Large frame: LDP -8(SP), (FP, LR); ADD $autosize, SP, SP
+			// Large frame: LDP -8(SP), (FP, LR), then deallocate.
 			ws = append(ws,
-				a64LSP(2, 0, 1, -1, 30, 31, 29),                    // LDP FP, LR, [SP, #-8] (opc=2 for 64-bit pair)
-				a64AddSub(1, 0, 0, 0, uint32(fi.autosize), 31, 31), // ADD $autosize, SP, SP
+				a64LSP(2, 0, 1, -1, 30, 31, 29), // LDP FP, LR, [SP, #-8] (opc=2 for 64-bit pair)
 			)
+			ws = append(ws, arm64RetAddWords(uint32(fi.autosize))...)
 		}
 	}
 	// RET: BR LR (0xd65f03c0)
@@ -166,22 +310,32 @@ func arm64PrologueSpadjPC(fi arm64FrameInfo) int {
 	if fi.autosize <= 0xf0 {
 		return 4 // MOVD.W instruction decrements SP
 	}
-	return 8 // SUB + STP + MOVD (3 instructions, SP updated at the MOVD)
+	// Large frame: [SUB words][STP][ADD R20, SP]; SP moves at the ADD, whose
+	// position depends on how many words the SUB itself took (immediate,
+	// shifted immediate, the two-word imm12 split, or a materialised REGTMP
+	// sequence).
+	return 4 * (len(arm64SubImmWords(uint32(fi.autosize), 20)) + 1)
 }
 
 // arm64ReturnEpilogueLen returns the byte length of the RET's epilogue up to
-// (but not including) the final RET instruction.
+// (but not including) the final RET instruction.  The lengths are read from
+// the same word-emitting helpers the epilogue uses rather than assumed: the
+// leaf path shares the prologue's immediate ladder, and a materialised
+// autosize costs its MOV words plus the ADD itself.
 func arm64ReturnEpilogueLen(fi arm64FrameInfo) int {
 	if fi.autosize == 0 {
 		return 0
 	}
 	if fi.leaf {
-		return 8 // ADD + ADD
+		return 4 * (len(arm64AddImmWords(uint32(fi.autosize-8), 29)) +
+			len(arm64AddImmWords(uint32(fi.autosize), 31)))
 	}
 	if fi.autosize <= 0xf0 {
 		return 8 // LDR + LDR.P
 	}
-	return 8 // LDP + ADD
+	// LDP + the deallocation emitted by arm64RetAddWords, so the length
+	// tracks whatever the MOVD ladder needs.
+	return 4 + 4*len(arm64RetAddWords(uint32(fi.autosize)))
 }
 
 // arm64ResolvePseudo translates a pseudo-register memory reference into a
@@ -235,3 +389,86 @@ func arm64PostLoad(size, V int, imm9 int32, rn, rt int) uint32 {
 	return uint32(size)<<30 | 7<<27 | uint32(V)<<26 | 1<<22 |
 		1<<10 | (uint32(imm9)&0x1FF)<<12 | uint32(rn&31)<<5 | uint32(rt&31)
 }
+
+// Data-processing (shifted register) base opcodes for the guard blocks.
+const (
+	arm64OpAdd  = 1<<31 | 0<<30 | 0<<29 | 0x0b<<24
+	arm64OpSub  = 1<<31 | 1<<30 | 0<<29 | 0x0b<<24
+	arm64OpSubs = 1<<31 | 1<<30 | 1<<29 | 0x0b<<24
+)
+
+// arm64DPSRWords builds one data-processing (shifted register) word:
+// OP Rm, Rn, Rd in the Go assembler's operand order.
+func arm64DPSRWords(base uint32, rm, rn, rd uint32) uint32 {
+	return base | rm<<16 | rn<<5 | rd
+}
+
+// arm64DPExtWords builds one data-processing (extended register) word, the
+// form the toolchain picks when a large immediate was materialised into
+// REGTMP before the operation: base | 1<<21 | Rm<<16 | UXTX<<13 | Rn<<5 | Rd.
+func arm64DPExtWords(base, rm, rn, rd uint32) uint32 {
+	return base | 1<<21 | rm<<16 | 3<<13 | rn<<5 | rd
+}
+
+// wordsOf converts little-endian instruction bytes back to words.
+func wordsOf(b []byte) []uint32 {
+	ws := make([]uint32, 0, len(b)/4)
+	for i := 0; i+4 <= len(b); i += 4 {
+		ws = append(ws, uint32(b[i])|uint32(b[i+1])<<8|uint32(b[i+2])<<16|uint32(b[i+3])<<24)
+	}
+	return ws
+}
+
+// arm64GuardBytes emits the stack-split guard prefix; blockStart is the
+// function-relative byte address of the morestack block the branches target.
+func arm64GuardBytes(fi arm64FrameInfo, blockStart int) []byte {
+	// MOVD 16(R28), R16 (g.stackguard0)
+	ws := []uint32{a64LSU(3, 0, 1, 2, 28, 16)}
+	br := func(from int, cond uint32) uint32 {
+		return a64BranchCond(int32((blockStart-from)>>2), cond)
+	}
+	switch fi.splitClass {
+	case 0:
+		// CMP R16, RSP in the exact encoding go tool asm emits for it.
+		ws = append(ws, 0xeb3063ff)
+		ws = append(ws, br(8, a64CondLS))
+	case 1:
+		ws = append(ws, a64AddSub(1, 1, 0, 0, uint32(fi.autosize-stackSmall), 31, 17))
+		ws = append(ws, arm64DPSRWords(arm64OpSubs, 16, 17, 31)) // CMP R16, R17
+		ws = append(ws, br(12, a64CondLS))
+	default:
+		mov, err := encodeARM64LoadImm(27, int64(fi.autosize-stackSmall), "MOVD")
+		if err != nil {
+			mov = nil
+		}
+		ws = append(ws, wordsOf(mov)...)
+		ml := len(mov) / 4
+		ws = append(ws, arm64DPExtWords(arm64OpSubs, 27, 31, 17)) // SUBS R17, RSP, R27
+		// The branches sit at fixed byte offsets in the guard prefix: after
+		// the LDR (4), the ml MOV words (4*ml) and the SUBS (4) for B.LO,
+		// then a further B.LO word and the CMP for B.LS.
+		ws = append(ws, br(8+4*ml, a64CondLO))
+		ws = append(ws, arm64DPSRWords(arm64OpSubs, 16, 17, 31)) // CMP R16, R17
+		ws = append(ws, br(16+4*ml, a64CondLS))
+	}
+	return a64WordsLE(ws...)
+}
+
+// arm64MoreStackBlock emits the trailing block: MOVD R30, R3 (save LR),
+// BL runtime.morestack_noctxt, B back to the function start.  The BL carries
+// the R_CALLARM64 relocation.
+func arm64MoreStackBlock(blockStart int) ([]byte, Reloc) {
+	ws := []uint32{
+		1<<31 | 1<<29 | 0x0a<<24 | 30<<16 | 31<<5 | 3, // MOVD R30, R3
+		a64Branch(1, 0), // BL, patched by the linker
+	}
+	bPC := blockStart + 8
+	ws = append(ws, a64Branch(0, int32(-bPC>>2))) // B back to the entry
+	reloc := Reloc{
+		Off:   blockStart + 4,
+		After: blockStart + 8,
+		Name:  "runtime\u00b7morestack_noctxt",
+		Kind:  RelArm64Branch,
+	}
+	return a64WordsLE(ws...), reloc
+}

asm/arm64_reloc_test.go

@@ -0,0 +1,126 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: BSD-3-Clause
+
+package asm
+
+import (
+	"encoding/binary"
+	"testing"
+
+	"sourcedock.dev/petrbalvin/gasm-devkit/parser"
+)
+
+// parseArm64File is a helper assembling one arm64 source file.
+func parseArm64File(t *testing.T, src string) *Image {
+	t.Helper()
+	f, errs := parser.Parse("k_arm64.s", src)
+	if len(errs) > 0 {
+		t.Fatalf("parse: %v", errs)
+	}
+	img, err := AssembleFileARM64(f)
+	if err != nil {
+		t.Fatalf("assemble: %v", err)
+	}
+	return img
+}
+
+// TestArm64RelocOffsetsIncludePrologue pins the function-relative relocation
+// offsets of a framed function: the offsets used to exclude the prologue, so
+// every relocation landed on a prologue instruction in the GOOBJ/ELF output.
+// The function calls an external, so it is a non-leaf and carries the
+// stack-split guard (12 bytes, small class) before the prologue.
+func TestArm64RelocOffsetsIncludePrologue(t *testing.T) {
+	img := parseArm64File(t, "TEXT \u00b7f(SB), $16-0\n"+
+		"\tBL ext\u00b7foo(SB)\n"+
+		"\tMOVD $gdata(SB), R5\n"+
+		"\tMOVD $extsym(SB), R6\n"+
+		"\tRET\n"+
+		"GLOBL gdata(SB), $8\n")
+	fn := img.Funcs[0]
+
+	// Layout: 12-byte guard, 12-byte prologue, BL (24), ADRP+ADD (28, 32),
+	// ADRP+ADD (36, 40), 12-byte epilogue with RET, 12-byte morestack block.
+	want := []struct {
+		off      int
+		after    int
+		name     string
+		kind     RelocKind
+		external bool
+	}{
+		{24, 28, "foo", RelArm64Branch, true},
+		{28, 28, "gdata", RelArm64Addr, false},
+		{32, 32, "gdata", RelArm64Addr, false},
+		{36, 36, "extsym", RelArm64Addr, true},
+		{40, 40, "extsym", RelArm64Addr, true},
+		{60, 64, "runtime\u00b7morestack_noctxt", RelArm64Branch, true},
+	}
+	if len(fn.Relocs) != len(want) {
+		t.Fatalf("relocs = %d, want %d", len(fn.Relocs), len(want))
+	}
+	for i, w := range want {
+		r := fn.Relocs[i]
+		if r.Off != w.off || r.After != w.after || r.Name != w.name || r.Kind != w.kind || r.External != w.external {
+			t.Errorf("reloc %d = {off %d after %d name %q kind %d ext %v}, want {off %d after %d name %q kind %d ext %v}",
+				i, r.Off, r.After, r.Name, r.Kind, r.External, w.off, w.after, w.name, w.kind, w.external)
+		}
+	}
+
+	// The BL with a zero offset sits exactly at the first reloc site.
+	code := img.Code[fn.Offset : fn.Offset+fn.Size]
+	if w := binary.LittleEndian.Uint32(code[24:28]); w != 0x94000000 {
+		t.Errorf("BL word = %08x, want 94000000", w)
+	}
+}
+
+// TestArm64SBLoadStoreMatchesToolchain pins the ADRP scratch register
+// (REGTMP, R27) and the LDST64 relocation kind for sym loads and stores,
+// against the bytes go tool asm emits for MOVD sym(SB), R5.
+func TestArm64SBLoadStoreMatchesToolchain(t *testing.T) {
+	img := parseArm64File(t, "TEXT \u00b7ld(SB), NOSPLIT, $0\n"+
+		"\tMOVD sym(SB), R5\n"+
+		"\tMOVD R5, sym(SB)\n"+
+		"\tRET\n"+
+		"GLOBL sym(SB), $8\n")
+	fn := img.Funcs[0]
+	code := img.Code[fn.Offset : fn.Offset+fn.Size]
+
+	// go tool asm: ADRP 0(PC), R27 (9000001b); MOVD (R27), R5 (f9400365);
+	// ADRP 0(PC), R27; MOVD R5, (R27) (f9000365).
+	for off, want := range map[int]uint32{0: 0x9000001b, 4: 0xf9400365, 8: 0x9000001b, 12: 0xf9000365} {
+		if got := binary.LittleEndian.Uint32(code[off : off+4]); got != want {
+			t.Errorf("word at %d = %08x, want %08x", off, got, want)
+		}
+	}
+
+	if len(fn.Relocs) != 2 {
+		t.Fatalf("relocs = %d, want 2", len(fn.Relocs))
+	}
+	for i, w := range []struct{ off, after int }{{0, 8}, {8, 16}} {
+		r := fn.Relocs[i]
+		if r.Kind != RelArm64LDST64 {
+			t.Errorf("reloc %d kind = %d, want RelArm64LDST64 (%d)", i, r.Kind, RelArm64LDST64)
+		}
+		if r.Off != w.off || r.After != w.after {
+			t.Errorf("reloc %d = {off %d after %d}, want {off %d after %d}", i, r.Off, r.After, w.off, w.after)
+		}
+	}
+}
+
+// TestArm64GOObjRelocTypes checks that GOOBJ emission succeeds with the new
+// relocation kinds in play; the detailed layout is covered by the goobj tests.
+func TestArm64GOObjRelocTypes(t *testing.T) {
+	img := parseArm64File(t, "TEXT \u00b7ld(SB), NOSPLIT, $0\n"+
+		"\tMOVD sym(SB), R5\n"+
+		"\tMOVD R5, sym(SB)\n"+
+		"\tRET\n"+
+		"GLOBL sym(SB), $8\n")
+	obj, err := img.GOObjectAARCH64("testpkg", "k_arm64.s")
+	if err != nil {
+		t.Fatalf("GOObjectAARCH64: %v", err)
+	}
+	if len(obj) == 0 {
+		t.Fatal("empty object")
+	}
+	// The detailed layout is covered by the goobj tests; here we only pin
+	// that emission succeeds with the new relocation kinds in play.
+}

asm/assemble.go

@@ -22,6 +22,11 @@ import (
 // FP/SP frame-relative operands, and local-label jumps.  SB (global symbol)
 // operands require relocations and are not yet supported; the SIMD (VEX/AVX2)
 // integer and shuffle/extract/permute/move set is in.
+//
+// Like the other architectures, the stack-growth guard (the morestack check
+// in the prologue and the call back into the runtime in the epilogue) is not
+// emitted: the bytes match go tool asm only for NOSPLIT functions or
+// zero-frame leaves, where the toolchain emits no guard either.
 func Assemble(t *ast.Text) ([]byte, map[string]int, error) {
 	code, _, labels, _, _, err := assemble(t, nil)
 	return code, labels, err
@@ -31,7 +36,7 @@ func Assemble(t *ast.Text) ([]byte, map[string]int, error) {
 // the set of static symbols a GLOBL in the same file defines.  A nil link
 // rejects SB operands outright (single-function assembly cannot resolve
 // them).  When allowExternal is set, a reference to a symbol no GLOBL in the
-// file defines is recorded as an external relocation instead of failing —
+// file defines is recorded as an external relocation instead of failing
 // the object-file emitters resolve it at link time.
 type linkInfo struct {
 	symbols       map[string]bool
@@ -46,6 +51,7 @@ type sbPatch struct {
 	after  int
 	name   string
 	addend int64
+	kind   RelocKind
 }
 
 // spadjStep is one stack-adjustment boundary within a function: Value is the
@@ -70,13 +76,18 @@ func assemble(t *ast.Text, link *linkInfo) ([]byte, []sbPatch, map[string]int, [
 		return name
 	}
 
-	// Layout: iterate jump sizes to a fixed point.
+	// Layout: iterate jump sizes to a fixed point.  The stack-split guard
+	// prefix and the trailing morestack block participate in the iteration:
+	// their conditional branches relax from rel8 to rel32 when the body
+	// outgrows the short form.
 	long := make([]bool, len(t.Body))
 	sizes := make([]int, len(t.Body))
 	offsets := map[string]int{}
 	pcs := make([]int, len(t.Body))
+	var guardJBlong, guardJBElong, moreJMPlong bool
 	for {
-		pos := len(fi.prologue)
+		guard := fi.guardLen(guardJBlong, guardJBElong)
+		pos := guard + len(fi.prologue)
 		for i, stmt := range t.Body {
 			switch s := stmt.(type) {
 			case *ast.Label:
@@ -91,6 +102,7 @@ func assemble(t *ast.Text, link *linkInfo) ([]byte, []sbPatch, map[string]int, [
 				pos += sz
 			}
 		}
+		bodyLen := pos - (guard + len(fi.prologue))
 		// Expand any short jump whose displacement no longer fits rel8.
 		changed := false
 		for i, stmt := range t.Body {
@@ -102,6 +114,11 @@ func assemble(t *ast.Text, link *linkInfo) ([]byte, []sbPatch, map[string]int, [
 			if !isJumpMnemonic(mnem) || mnem == "CALL" || long[i] {
 				continue
 			}
+			// A zero-operand jump parses; its arity is reported during
+			// emission (encodeJump), so the layout must not index Operands.
+			if len(s.Operands) != 1 {
+				continue
+			}
 			name, ok := labelName(s.Operands[0])
 			if !ok {
 				continue // reported during emission
@@ -116,25 +133,77 @@ func assemble(t *ast.Text, link *linkInfo) ([]byte, []sbPatch, map[string]int, [
 				changed = true
 			}
 		}
+		// The guard's conditional branches target the morestack block, which
+		// starts right after the body: the JBE measures from the end of the
+		// guard, so its displacement is the prologue plus the body.
+		if !guardJBElong && !fits8(int64(len(fi.prologue)+bodyLen)) {
+			guardJBElong = true
+			changed = true
+		}
+		if fi.splitClass == 2 && !guardJBlong {
+			// The underflow JB sits before the CMPQ; its displacement spans
+			// the rest of the guard plus the prologue and the body.  The JB
+			// is still the short form this branch tests (relaxing it is this
+			// branch's job), so guardLen is taken with a short JB and the
+			// subtraction drops the prefix and the JB's own 2 bytes.
+			rest := fi.guardLen(false, guardJBElong) - (9 + 3 + 7 + 2)
+			if !fits8(int64(rest + len(fi.prologue) + bodyLen)) {
+				guardJBlong = true
+				changed = true
+			}
+		}
+		// The morestack JMP returns to the function start, so its
+		// displacement is the negated distance from its own end; while it is
+		// still short, its own length is 2 bytes.
+		if !moreJMPlong && !fits8(-int64(guard+len(fi.prologue)+bodyLen+5+2)) {
+			moreJMPlong = true
+			changed = true
+		}
 		if !changed {
 			break
 		}
 	}
 
-	// Pass 2: emit.
-	out := append([]byte(nil), fi.prologue...)
+	// Pass 2: emit.  The guard comes first, then the prologue, the body and
+	// the morestack block.
+	guardLen := fi.guardLen(guardJBlong, guardJBElong)
+	bodyLen := 0
+	{
+		pos := guardLen + len(fi.prologue)
+		for i, stmt := range t.Body {
+			if _, ok := stmt.(*ast.Instr); ok {
+				pos += sizes[i]
+			}
+		}
+		bodyLen = pos - (guardLen + len(fi.prologue))
+	}
+	var out []byte
 	var patches []sbPatch
+	if fi.needSplit {
+		// The JBE ends the guard, so its displacement is the prologue plus
+		// the body; the underflow JB additionally spans the trailing CMPQ and
+		// JBE, whose combined length is guardLen minus the prefix and the
+		// JB's own length (2 short, 6 long).
+		jbLen := 2
+		if guardJBlong {
+			jbLen = 6
+		}
+		guard, tlsPatch := buildGuard(fi, int32(len(fi.prologue)+bodyLen), int32(fi.guardLen(guardJBlong, guardJBElong)-(9+3+7+jbLen)+len(fi.prologue)+bodyLen))
+		out = append(out, guard...)
+		patches = append(patches, tlsPatch)
+	}
+	out = append(out, fi.prologue...)
 	var steps []spadjStep
 	var lines []LineEntry
 	if fi.useFP {
 		// PUSHQ BP saves the return-address-relative base (+8); the MOVQ
 		// changes nothing; SUBQ $size, SP completes the frame.
 		steps = append(steps,
-			spadjStep{1, 8},
-			spadjStep{len(fi.prologue), 8 + fi.size},
+			spadjStep{guardLen + 1, 8},
+			spadjStep{guardLen + len(fi.prologue), 8 + fi.size},
 		)
 	}
-	pos := len(fi.prologue)
+	pos := guardLen + len(fi.prologue)
 	for i, stmt := range t.Body {
 		s, ok := stmt.(*ast.Instr)
 		if !ok {
@@ -156,11 +225,32 @@ func assemble(t *ast.Text, link *linkInfo) ([]byte, []sbPatch, map[string]int, [
 		if len(code) != sizes[i] {
 			return nil, nil, nil, nil, nil, fmt.Errorf("%s: size mismatch (%d vs %d)", s.Mnemonic.Text, len(code), sizes[i])
 		}
+		if strings.ToUpper(s.Mnemonic.Text) == "CALL" {
+			for k := range ps {
+				ps[k].kind = RelCall
+			}
+		}
 		patches = append(patches, ps...)
 		lines = append(lines, LineEntry{Offset: pos, Line: s.Pos().Line})
 		out = append(out, code...)
 		pos += len(code)
 	}
+	if fi.needSplit {
+		// The morestack block: CALL runtime.morestack_noctxt, then a JMP
+		// back to the function entry.
+		jmpLen := 2
+		if moreJMPlong {
+			jmpLen = 5
+		}
+		jmpDisp := -int64(pos + 5 + jmpLen)
+		suffix, callPatch := buildMoreStack(int32(jmpDisp))
+		callPatch.off += pos
+		callPatch.after = pos + 5
+		patches = append(patches, callPatch)
+		out = append(out, suffix...)
+		pos += len(suffix)
+	}
+	_ = pos
 	return out, patches, offsets, steps, lines, nil
 }
 
@@ -224,16 +314,51 @@ type frameInfo struct {
 	spAdjust int64 // x-N(SP) becomes (spAdjust - N)(SP)
 	prologue []byte
 	epilogue []byte
+
+	// Stack-split guard state (matching the toolchain's stacksplit): needSplit
+	// is false for NOSPLIT functions and for leaf functions whose frame is
+	// below StackSmall, which the toolchain auto-marks NOSPLIT.
+	needSplit  bool
+	splitClass int // 0: <=StackSmall, 1: <=StackBig, 2: >StackBig
+	framesize  int // the size the guard checks: frame+8 for framed functions
 }
 
+// Stack-frame size classes from runtime/stack.go.
+const (
+	stackSmall = 128
+	stackBig   = 4096
+)
+
+// sbPatch gains a kind so the emitters can tell CALL and TLS patches from
+// plain PC-relative displacements.
+
 // computeFrame derives the frame layout, matching the Go assembler's default
-// (a frame pointer is used whenever the function has a non-zero frame).
+// (a frame pointer is used whenever the function has a non-zero frame).  It
+// also decides whether the function needs the stack-split guard, mirroring
+// obj6: a NOSPLIT function never splits, and a leaf function whose frame is
+// below StackSmall is auto-marked NOSPLIT.  One deliberate deviation: the
+// toolchain treats zero-argument runtime calls (duffcopy and friends) as
+// leaf-compatible; here any CALL makes the function a non-leaf.
 func computeFrame(t *ast.Text) frameInfo {
 	fi := frameInfo{}
 	if t.Frame != nil && t.Frame.Imm.HasVal {
 		fi.size = int(t.Frame.Imm.Val)
 	}
-	if fi.size > 0 {
+	if fi.size == 0 && hasCall(t) {
+		// The toolchain gives a frameless function containing a CALL an
+		// 8-byte frame for the pushed base pointer: the prologue saves BP
+		// with no stack adjustment, every RET pops it back, FP references
+		// pass one extra slot, and the virtual SP is the hardware SP.
+		fi.size = 8
+		fi.useFP = true
+		// The push is the frame: the saved BP sits at SP+0 and the
+		// return address at SP+8, so arguments begin at SP+16.  Unlike
+		// a SUBQ frame, the 8-byte size must not be added again.
+		fi.fpAdjust = 16
+		fi.spAdjust = 0
+		fi.prologue = []byte{0x55, 0x48, 0x89, 0xE5} // PUSHQ BP; MOVQ SP, BP
+		fi.epilogue = []byte{0x5D}                   // POPQ BP
+	} else if fi.size > 0 {
 		fi.useFP = true
 		fi.fpAdjust = int64(fi.size) + 16 // frame + saved BP + return address
 		fi.spAdjust = int64(fi.size)
@@ -242,9 +367,131 @@ func computeFrame(t *ast.Text) frameInfo {
 	} else {
 		fi.fpAdjust = 8 // return address only
 	}
+
+	noSplit := false
+	for _, f := range t.Flags {
+		if strings.EqualFold(f, "NOSPLIT") {
+			noSplit = true
+		}
+	}
+	// The toolchain's autoffset: the frame plus the saved base pointer.
+	framesize := fi.size
+	if framesize > 0 {
+		framesize += 8
+	}
+	switch {
+	case noSplit:
+	case framesize < stackSmall && !hasCall(t):
+		// Auto-NOSPLIT, as the toolchain's leaf search concludes.
+	default:
+		fi.needSplit = true
+		fi.framesize = framesize
+		switch {
+		case framesize <= stackSmall:
+			fi.splitClass = 0
+		case framesize <= stackBig:
+			fi.splitClass = 1
+		default:
+			fi.splitClass = 2
+		}
+	}
 	return fi
 }
 
+// hasCall reports whether the function body contains a CALL instruction.
+func hasCall(t *ast.Text) bool {
+	for _, stmt := range t.Body {
+		in, ok := stmt.(*ast.Instr)
+		if !ok {
+			continue
+		}
+		if strings.ToUpper(in.Mnemonic.Text) == "CALL" {
+			return true
+		}
+	}
+	return false
+}
+
+// guardLen returns the byte length of the stack-split guard prefix.  The
+// final conditional branch (JBE, and JB in the big class) is 2 bytes in the
+// short form and 6 in the long form.
+func (fi frameInfo) guardLen(jbLong, jbeLong bool) int {
+	if !fi.needSplit {
+		return 0
+	}
+	jb, jbe := 2, 2
+	if jbLong {
+		jb = 6
+	}
+	if jbeLong {
+		jbe = 6
+	}
+	switch fi.splitClass {
+	case 0:
+		return 9 + 4 + jbe
+	case 1:
+		return 9 + 8 + 4 + jbe
+	default:
+		return 9 + 3 + 7 + jb + 4 + jbe
+	}
+}
+
+// buildGuard emits the stack-split guard prefix.  jbeDisp and jbDisp are the
+// already-computed displacements of the conditional branches that jump to the
+// morestack block (unused in classes without them).  The TLS load carries a
+// R_TLS_LE patch site at offset 5.
+func buildGuard(fi frameInfo, jbeDisp, jbDisp int32) ([]byte, sbPatch) {
+	out := []byte{
+		0x64, 0x4c, 0x8b, 0x34, 0x25, // MOVQ FS:0, R14
+		0, 0, 0, 0, // TLS slot offset, filled by the linker
+	}
+	tls := sbPatch{off: 5, after: 9, kind: RelTLSLE}
+	jmp := func(op8, op32 byte, disp int32) []byte {
+		if disp >= -128 && disp <= 127 {
+			return []byte{op8, byte(disp)}
+		}
+		return append([]byte{0x0F, op32}, le32(int64(disp))...)
+	}
+	switch fi.splitClass {
+	case 0:
+		// CMPQ SP, 16(R14)
+		out = append(out, 0x49, 0x3b, 0x66, 0x10)
+		out = append(out, jmp(0x76, 0x86, jbeDisp)...)
+	case 1:
+		// LEAQ -(framesize-StackSmall)(SP), R12; CMPQ R12, 16(R14)
+		out = append(out, 0x4c, 0x8d, 0xa4, 0x24)
+		out = append(out, le32(-int64(fi.framesize-stackSmall))...)
+		out = append(out, 0x4d, 0x3b, 0x66, 0x10)
+		out = append(out, jmp(0x76, 0x86, jbeDisp)...)
+	default:
+		// MOVQ SP, R12; SUBQ $(framesize-StackSmall), R12; JB; CMPQ R12, 16(R14)
+		out = append(out, 0x49, 0x89, 0xe4)
+		out = append(out, 0x49, 0x81, 0xec)
+		out = append(out, le32(int64(fi.framesize-stackSmall))...)
+		out = append(out, jmp(0x72, 0x82, jbDisp)...)
+		out = append(out, 0x4d, 0x3b, 0x66, 0x10)
+		out = append(out, jmp(0x76, 0x86, jbeDisp)...)
+	}
+	return out, tls
+}
+
+// buildMoreStack emits the trailing block: CALL runtime.morestack_noctxt
+// (patched by the linker) and a JMP back to the function start.
+func buildMoreStack(jmpDisp int32) ([]byte, sbPatch) {
+	out := []byte{0xE8, 0, 0, 0, 0}
+	call := sbPatch{off: 1, after: 5, name: "runtime\u00b7morestack_noctxt", kind: RelCall}
+	out = append(out, jmpBytes(jmpDisp)...)
+	return out, call
+}
+
+// jmpBytes encodes a near JMP in the short or long form.
+func jmpBytes(disp int32) []byte {
+	if disp >= -128 && disp <= 127 {
+		return []byte{0xEB, byte(disp)}
+	}
+	return append([]byte{0xE9}, le32(int64(disp))...)
+}
+
 // prologueBytes emits: PUSHQ BP; MOVQ SP, BP; SUBQ $size, SP.
 func prologueBytes(size int) []byte {
 	out := []byte{0x55, 0x48, 0x89, 0xE5} // PUSHQ BP; MOVQ SP, BP
@@ -258,6 +505,8 @@ func epilogueBytes(size int) []byte {
 }
 
 func subSP(size int) []byte { // SUBQ $size, SP
+	// imm8 holds -128..127; anything larger takes the imm32 form, exactly as
+	// the Go assembler encodes it (verified for 8, 128, 200 and 255).
 	if size >= -128 && size <= 127 {
 		return []byte{0x48, 0x83, 0xEC, byte(int8(size))}
 	}
@@ -277,6 +526,16 @@ func addSP(size int) []byte { // ADDQ $size, SP
 func instrSize(s *ast.Instr, fi frameInfo, long bool, link *linkInfo) (int, error) {
 	mnem := strings.ToUpper(s.Mnemonic.Text)
 	if isJumpMnemonic(mnem) {
+		if (mnem == "CALL" || mnem == "JMP") && isSBCall(s) {
+			return 5, nil // opcode + rel32, always the long form
+		}
+		if (mnem == "CALL" || mnem == "JMP") && indirectJumpTarget(s) {
+			code, err := encodeIndirectJump(s, mnem)
+			if err != nil {
+				return 0, err
+			}
+			return len(code), nil
+		}
 		return jumpSize(mnem, long), nil
 	}
 	code, _, err := encodeInstr(s, 0, nil, fi, false, nil, link)
@@ -326,6 +585,33 @@ func encodeInstr(s *ast.Instr, pc int, offsets map[string]int, fi frameInfo, lon
 	var ps []sbPatch
 	var err error
 	if isJumpMnemonic(mnem) {
+		if (mnem == "CALL" || mnem == "JMP") && isSBCall(s) {
+			// CALL/JMP sym(SB): a rel32 call (or tail call) against a
+			// static or external symbol, resolved by the file-level layout
+			// or the linker.
+			code, ps, err = encodeSBCall(s, link)
+			if err != nil {
+				return nil, nil, err
+			}
+			for i := range ps {
+				ps[i].kind = RelCall
+			}
+			body := pc + len(prefix)
+			for i := range ps {
+				ps[i].off += body
+				ps[i].after = body + len(code)
+			}
+			return append(prefix, code...), ps, nil
+		}
+		if (mnem == "CALL" || mnem == "JMP") && indirectJumpTarget(s) {
+			// JMP/CALL through a register or memory: no relocation and no
+			// label to resolve, the operand fully determines the bytes.
+			code, err = encodeIndirectJump(s, mnem)
+			if err != nil {
+				return nil, nil, err
+			}
+			return append(prefix, code...), nil, nil
+		}
 		code, err = encodeJump(s, mnem, pc+len(prefix), offsets, long, resolve)
 	} else {
 		code, ps, err = encodeNormal(s, fi, link)
@@ -407,6 +693,37 @@ func encodeJump(s *ast.Instr, mnem string, pc int, offsets map[string]int, long
 	}
 }
 
+// isSBCall reports whether the CALL operand is a symbol reference.
+func isSBCall(s *ast.Instr) bool {
+	return len(s.Operands) == 1 && s.Operands[0].Kind == ast.OpAddr &&
+		s.Operands[0].Addr.Sym != nil && s.Operands[0].Addr.Sym.Pseudo == "SB"
+}
+
+// encodeSBCall encodes CALL sym(SB) as E8 rel32 with a patch site.
+func encodeSBCall(s *ast.Instr, link *linkInfo) ([]byte, []sbPatch, error) {
+	o, err := operandFromAST(s.Operands[0], 8, frameInfo{}, link)
+	if err != nil {
+		return nil, nil, err
+	}
+	m, ok := o.(sbMem)
+	if !ok {
+		return nil, nil, fmt.Errorf("CALL: unsupported operand")
+	}
+	opcode := []byte{0xE8}
+	if strings.ToUpper(s.Mnemonic.Text) == "JMP" {
+		opcode = []byte{0xE9} // a tail call, no return address pushed
+	}
+	e := &enc{}
+	if err := e.emit(&instr{opcode: opcode, modrm: -1, sib: -1, disp: le32(0), sb: &sbRef{name: m.name, addend: m.addend}}); err != nil {
+		return nil, nil, err
+	}
+	ps := make([]sbPatch, len(e.patches))
+	for i, p := range e.patches {
+		ps[i] = sbPatch{off: p.off, name: p.name, addend: p.addend, kind: RelCall}
+	}
+	return e.out, ps, nil
+}
+
 // labelName extracts a local-label name from a jump operand.
 func labelName(op *ast.Operand) (string, bool) {
 	if op.Kind == ast.OpAddr && op.Addr.Sym != nil && op.Addr.Sym.Pseudo == "" &&
@@ -416,6 +733,44 @@ func labelName(op *ast.Operand) (string, bool) {
 	return "", false
 }
 
+// indirectJumpTarget reports whether the JMP/CALL operand addresses a
+// register or a memory location rather than a label or a static symbol.
+// A bare identifier is a register when the register table knows the name and
+// a label otherwise, which is exactly how the parser cannot distinguish them.
+func indirectJumpTarget(s *ast.Instr) bool {
+	if len(s.Operands) != 1 || s.Operands[0].Kind != ast.OpAddr {
+		return false
+	}
+	a := s.Operands[0].Addr
+	if a.Base != "" || a.Index != "" {
+		return true
+	}
+	if a.Sym != nil && a.Sym.Pseudo == "" && a.Sym.Name != "" {
+		if _, ok := ParseReg(a.Sym.Name); ok {
+			return true
+		}
+	}
+	return false
+}
+
+// encodeIndirectJump assembles a JMP/CALL through a register or memory
+// operand, which carries no relocation and no label to resolve.
+func encodeIndirectJump(s *ast.Instr, mnem string) ([]byte, error) {
+	ops := make([]Operand, len(s.Operands))
+	for i, op := range s.Operands {
+		o, err := operandFromAST(op, 8, frameInfo{}, nil)
+		if err != nil {
+			return nil, err
+		}
+		ops[i] = o
+	}
+	e := &enc{}
+	if err := e.encodeIndirectBranch(mnem, ops); err != nil {
+		return nil, err
+	}
+	return e.out, nil
+}
+
 // spReg is the hardware stack pointer used to realise FP/SP pseudo-operands.
 var spReg = Reg{idx: 4, size: 8}
 

asm/assemble_test.go

@@ -4,6 +4,7 @@
 package asm
 
 import (
+	"bytes"
 	"strings"
 	"testing"
 
@@ -62,7 +63,7 @@ TEXT ·f(SB), NOSPLIT, $0
 	XORQ AX, AX
 loop:
 	ADDQ $1, AX
-	CMPQ $10, AX
+	CMPQ AX, $10
 	JLT loop
 	RET
 `)
@@ -159,6 +160,57 @@ TEXT ·loadarg(SB), NOSPLIT, $0-24
 	}
 }
 
+// TestAssembleFramelessCall verifies the forced base-pointer frame a $0-frame
+// function containing a CALL receives: the PUSHQ BP prologue with no stack
+// adjustment and the x+N(FP) → (N+16)(SP) translation, against the bytes the
+// Go assembler produces.  The push is the frame, so the offset must not count
+// it twice.
+func TestAssembleFramelessCall(t *testing.T) {
+	f, errs := parser.Parse("frameless_call_amd64.s", `
+#include "textflag.h"
+TEXT ·withcall(SB), NOSPLIT, $0-16
+	MOVQ x+0(FP), AX
+	CALL ·other(SB)
+	MOVQ AX, ret+8(FP)
+	RET
+TEXT ·other(SB), NOSPLIT, $0-0
+	RET
+`)
+	if len(errs) > 0 {
+		t.Fatalf("parse: %v", errs)
+	}
+	img, err := AssembleFile(f)
+	if err != nil {
+		t.Fatalf("AssembleFile: %v", err)
+	}
+	code := append([]byte(nil), img.Code[img.Funcs[0].Offset:img.Funcs[0].Offset+img.Funcs[0].Size]...)
+	for _, r := range img.Funcs[0].Relocs {
+		for j := r.Off; j < r.Off+4 && j < len(code); j++ {
+			code[j] = 0
+		}
+	}
+	// From `go tool objdump` of the Go-assembled function:
+	//   PUSHQ BP           55
+	//   MOVQ SP, BP        4889e5
+	//   MOVQ 0x10(SP), AX  488b442410
+	//   CALL other         e800000000
+	//   MOVQ AX, 0x18(SP)  4889442418
+	//   POPQ BP            5d
+	//   RET                c3
+	want := []byte{
+		0x55,
+		0x48, 0x89, 0xe5,
+		0x48, 0x8b, 0x44, 0x24, 0x10,
+		0xe8, 0x00, 0x00, 0x00, 0x00,
+		0x48, 0x89, 0x44, 0x24, 0x18,
+		0x5d,
+		0xc3,
+	}
+	if hexBytes(code) != hexBytes(want) {
+		t.Errorf("frameless CALL FP translation mismatch:\n got:  %s\n want: %s", hexBytes(code), hexBytes(want))
+	}
+}
+
 // TestAssembleFrame verifies a function with a non-zero frame: the Go-style
 // prologue/epilogue and the x+N(FP) → (N+frame+16)(SP) translation, against
 // the bytes the Go assembler produces.
@@ -201,8 +253,8 @@ TEXT ·withframe(SB), NOSPLIT, $16-16
 }
 
 // TestAssembleVexKernel assembles the horizontal-sum reduction the go-flac
-// kernels end with — exercising the VEX moves, shuffle and extract forms
-// through the full parser → encoder path — and checks the output is
+// kernels end with; exercising the VEX moves, shuffle and extract forms
+// through the full parser → encoder path; and checks the output is
 // byte-identical to the Go assembler's.
 func TestAssembleVexKernel(t *testing.T) {
 	fn := firstText(t, `
@@ -317,3 +369,73 @@ end:
 		t.Errorf("jump-folding mismatch:\n got:  %s\n want: %s", hexBytes(code), hexBytes(want))
 	}
 }
+
+func TestAssemblePrefetch(t *testing.T) {
+	fn := firstText(t, `
+#include "textflag.h"
+TEXT ·pf(SB), NOSPLIT, $0
+	PREFETCHNTA (AX)
+	PREFETCHT0 (BX)
+	PREFETCHT1 8(CX)
+	PREFETCHT2 -1(AX)(R12*1)
+	RET
+`)
+	code, _, err := Assemble(fn)
+	if err != nil {
+		t.Fatalf("Assemble: %v", err)
+	}
+	got := strings.Join(disasm(t, code), "\n")
+	want := strings.Join([]string{
+		"prefetchnta zmmword ptr [rax]",
+		"prefetcht0 zmmword ptr [rbx]",
+		"prefetcht1 zmmword ptr [rcx+0x8]",
+		"prefetcht2 zmmword ptr [rax+r12-0x1]",
+		"ret",
+	}, "\n")
+	if got != want {
+		t.Errorf("prefetch disassembly mismatch:\n got:\n%s\n want:\n%s", got, want)
+	}
+	// Byte-level expectations: 0F 18 with the variant in the reg field.
+	if hex := hexBytes(code[:3]); hex != "0f 18 00" {
+		t.Errorf("PREFETCHNTA bytes: got %s, want 0f 18 00", hex)
+	}
+	if hex := hexBytes(code[3:6]); hex != "0f 18 0b" {
+		t.Errorf("PREFETCHT0 bytes: got %s, want 0f 18 0b", hex)
+	}
+}
+
+// TestAssembleBareJump checks that a zero-operand jump (which parses, because
+// the parser does not arity-check mnemonics) is rejected with an error rather
+// than panicking in the layout loop, which indexes Operands[0] before the
+// emission pass gets a chance to diagnose the arity.
+func TestAssembleBareJump(t *testing.T) {
+	for _, mnem := range []string{"JE", "JMP", "JLT", "CALL"} {
+		fn := firstText(t, "TEXT ·bare(SB), $16-0\n\t"+mnem+"\n")
+		if _, _, err := Assemble(fn); err == nil {
+			t.Errorf("%s with no operand: expected an error, got none", mnem)
+		}
+	}
+}
+
+// TestSubSPEncodings pins the prologue SUB against the bytes go tool asm
+// emits for SUBQ $size, SP: imm8 for -128..127, the imm32 form for anything
+// larger.  The intermediate 129..255 range used to encode an ADD with a
+// truncated immediate, moving SP the wrong way.
+func TestSubSPEncodings(t *testing.T) {
+	for _, tt := range []struct {
+		size int
+		want []byte
+	}{
+		{8, []byte{0x48, 0x83, 0xEC, 0x08}},
+		{127, []byte{0x48, 0x83, 0xEC, 0x7F}},
+		{128, []byte{0x48, 0x81, 0xEC, 0x80, 0x00, 0x00, 0x00}},
+		{200, []byte{0x48, 0x81, 0xEC, 0xC8, 0x00, 0x00, 0x00}},
+		{255, []byte{0x48, 0x81, 0xEC, 0xFF, 0x00, 0x00, 0x00}},
+		{4096, []byte{0x48, 0x81, 0xEC, 0x00, 0x10, 0x00, 0x00}},
+	} {
+		got := subSP(tt.size)
+		if !bytes.Equal(got, tt.want) {
+			t.Errorf("subSP(%d) = %x, want %x", tt.size, got, tt.want)
+		}
+	}
+}

asm/elf.go

@@ -12,12 +12,11 @@ import (
 // Image: a .text section holding the function bodies, a .data section
 // holding the GLOBL initialisers, a symbol table with one symbol per TEXT
 // and GLOBL (file-local <> symbols are STB_LOCAL, the rest STB_GLOBAL), and
-// a .rela.text relocation table — one R_X86_64_PC32 entry per static-symbol
+// a .rela.text relocation table, one R_X86_64_PC32 entry per static-symbol
 // reference, internal references resolving against the local data symbols
 // and external ones against undefined globals.  The output links with the
 // system toolchain (cc/ld) the way a hand-assembled .o would.
 
-// ELF constants (ELF64, little-endian, System V).
 const (
 	elfClass64 = 2
 	elfDataLSB = 1
@@ -36,18 +35,17 @@ const (
 	shfAlloc     = 2
 	shfExecInstr = 4
 
-	stbLocal  = 0
 	stbGlobal = 1
 
-	sttNotype   = 0
 	sttObject   = 1
 	sttFunc     = 2
 	sttSection  = 3
 	stInfoShift = 4
 
-	shnUndef = 0
-
 	rX8664PC32 = 2
+	// R_X86_64_TPOFF32 (debug/elf): the local-exec TLS offset the stack
+	// guard loads from FS.  20 is R_X86_64_TLSLD, a different relocation.
+	rX8664TPOFF32 = 23
 )
 
 // elfSym is one symbol-table entry in construction.
@@ -76,7 +74,7 @@ func (img *Image) ELFObject() ([]byte, error) {
 
 	// Build the symbol table: the null entry and the two section symbols
 	// come first, then the local symbols (static TEXT and GLOBL), then the
-	// globals (exported TEXT and GLOBL, and the undefined externals) — ELF
+	// globals (exported TEXT and GLOBL, and the undefined externals), ELF
 	// requires every local to precede every global, and sh_info records the
 	// boundary.  symIdx maps a symbol name to its index for the relocations.
 	var locals, globals []elfSym
@@ -130,11 +128,19 @@ func (img *Image) ELFObject() ([]byte, error) {
 	type elfRela struct {
 		off    uint64
 		sym    int
+		typ    uint32
 		addend int64
 	}
 	var relas []elfRela
 	for _, fn := range img.Funcs {
 		for _, r := range fn.Relocs {
+			var typ uint32 = rX8664PC32
+			if r.Kind == RelTLSLE {
+				// R_X86_64_TPOFF32 resolves to the local-exec TLS offset and
+				// carries no symbol.
+				relas = append(relas, elfRela{off: uint64(fn.Offset + r.Off), sym: 0, typ: rX8664TPOFF32})
+				continue
+			}
 			idx, ok := symIdx[r.Name]
 			if !ok {
 				return nil, fmt.Errorf("relocation references unknown symbol %q", r.Name)
@@ -142,6 +148,7 @@ func (img *Image) ELFObject() ([]byte, error) {
 			relas = append(relas, elfRela{
 				off: uint64(fn.Offset + r.Off),
 				sym: idx,
+				typ: typ,
 				// R_X86_64_PC32 computes S + A − P with P the patch site; the
 				// assembler measures the symbol from the instruction end,
 				// After − Off bytes past the field, so the addend carries
@@ -160,6 +167,9 @@ func (img *Image) ELFObject() ([]byte, error) {
 	for _, n := range []string{".text", ".data", ".symtab", ".strtab", ".rela.text", ".shstrtab"} {
 		stSections.add(n)
 	}
+	for _, n := range dwarfSectionNames {
+		stSections.add(n)
+	}
 
 	// Section presence: .rela.text only when there are relocations.
 	hasRela := len(relas) > 0
@@ -211,7 +221,7 @@ func (img *Image) ELFObject() ([]byte, error) {
 		for _, r := range relas {
 			var b [24]byte
 			le.PutUint64(b[0:], r.off)
-			le.PutUint64(b[8:], uint64(r.sym)<<32|rX8664PC32)
+			le.PutUint64(b[8:], uint64(r.sym)<<32|uint64(r.typ))
 			le.PutUint64(b[16:], uint64(r.addend))
 			out = append(out, b[:]...)
 		}
@@ -220,6 +230,34 @@ func (img *Image) ELFObject() ([]byte, error) {
 	shstrOff := len(out)
 	out = append(out, stSections.bytes()...)
 
+	// DWARF debug sections; the address placeholders they leave are carried
+	// as .rela.debug_info/.rela.debug_line entries the system linker applies.
+	dwAlign := func(n int) {
+		for len(out)%n != 0 {
+			out = append(out, 0)
+		}
+	}
+	dw := appendDWARFSections(&out, img, dwarfSourceName(img), symIdx, dwAlign, cfiAMD64)
+	dwarfStart := 0 // section index of .debug_abbrev, set when DWARF is present
+	if dw != nil {
+		// Five DWARF sections: .debug_abbrev, .debug_info, .debug_line,
+		// .debug_line_str and .debug_frame (the CIE is unconditional, so
+		// the frame section is always present), plus the relocation
+		// sections below when they carry entries.
+		dwarfStart = nSections
+		nSections += 5
+		appendDWARFRelas(&out, dw, rX8664Abs64, dwAlign)
+		if dw.infoRelaCount > 0 {
+			nSections++
+		}
+		if dw.lineRelaCount > 0 {
+			nSections++
+		}
+		if dw.frameRelaCount > 0 {
+			nSections++
+		}
+	}
+
 	align(8)
 	shoff := len(out)
 
@@ -248,6 +286,40 @@ func (img *Image) ELFObject() ([]byte, error) {
 	}
 	putSh(".shstrtab", shtStrtab, 0, shstrOff, len(stSections.bytes()), 0, 0, 1, 0)
 
+	// DWARF section headers; their indices follow the write order.
+	if dw != nil {
+		// secIdx is a running section index: each putSh below emits the
+		// next header, and the sh_info of a .rela section names the index
+		// of the section it relocates.
+		secIdx := dwarfStart
+		putSh(".debug_abbrev", shtProgbits, 0, dw.abbrevOff, dw.abbrevSize, 0, 0, 1, 0)
+		secIdx++
+		putSh(".debug_info", shtProgbits, 0, dw.infoOff, dw.infoSize, 0, 0, 1, 0)
+		secInfoIdx := secIdx
+		secIdx++
+		if dw.infoRelaCount > 0 {
+			putSh(".rela.debug_info", shtRela, 0, dw.infoRelaOff, 24*dw.infoRelaCount, secSymtab, secInfoIdx, 8, 24)
+			secIdx++
+		}
+		putSh(".debug_line", shtProgbits, 0, dw.lineOff, dw.lineSize, 0, 0, 1, 0)
+		secLineIdx := secIdx
+		secIdx++
+		if dw.lineRelaCount > 0 {
+			putSh(".rela.debug_line", shtRela, 0, dw.lineRelaOff, 24*dw.lineRelaCount, secSymtab, secLineIdx, 8, 24)
+			secIdx++
+		}
+		putSh(".debug_line_str", shtProgbits, 0, dw.lineStrOff, dw.lineStrSize, 0, 0, 1, 0)
+		secIdx++
+		if dw.frameSize > 0 {
+			putSh(".debug_frame", shtProgbits, 0, dw.frameOff, dw.frameSize, 0, 0, 8, 0)
+			secFrameIdx := secIdx
+			secIdx++
+			if dw.frameRelaCount > 0 {
+				putSh(".rela.debug_frame", shtRela, 0, dw.frameRelaOff, 24*dw.frameRelaCount, secSymtab, secFrameIdx, 8, 24)
+			}
+		}
+	}
+
 	// The ELF header.
 	hdr := out[:64]
 	copy(hdr[0:], []byte{0x7f, 'E', 'L', 'F', elfClass64, elfDataLSB, elfVersion, 0})

asm/elf_dwarf.go

@@ -0,0 +1,406 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: BSD-3-Clause
+
+package asm
+
+import (
+	"encoding/binary"
+)
+
+// DWARF5 section generation for ELF output.  Unlike the GOOBJ path (where
+// the linker assembles the final DWARF), the ELF path must emit complete,
+// self-contained sections because the system linker only performs fixup
+// relocations, not assembly.
+
+// DWARF5 attribute, form and line-table constants (the values the
+// toolchain uses, cmd/internal/dwarf/dwarf_defs.go; the DIE streams below
+// are written against these forms).
+const (
+	dwAtName       = 0x03 // DW_AT_name
+	dwAtStmtList   = 0x10 // DW_AT_stmt_list
+	dwAtLowPC      = 0x11 // DW_AT_low_pc
+	dwAtHighPC     = 0x12 // DW_AT_high_pc
+	dwAtDeclFile   = 0x3a // DW_AT_decl_file
+	dwAtDeclLine   = 0x3b // DW_AT_decl_line
+	dwAtExternal   = 0x3f // DW_AT_external
+	dwAtFrameBase  = 0x40 // DW_AT_frame_base
+	dwTagSubprog   = 0x2e // DW_TAG_subprogram
+	dwTagCompUnit  = 0x11 // DW_TAG_compile_unit
+	dwFormAddr     = 0x01 // DW_FORM_addr
+	dwFormData8    = 0x07 // DW_FORM_data8
+	dwFormString   = 0x08 // DW_FORM_string
+	dwFormData1    = 0x0b // DW_FORM_data1
+	dwFormUdata    = 0x0f // DW_FORM_udata
+	dwFormSecOff   = 0x17 // DW_FORM_sec_offset
+	dwFormExprloc  = 0x18 // DW_FORM_exprloc
+	dwFormLineStrp = 0x1f // DW_FORM_line_strp
+	dwLnctPath     = 0x01 // DW_LNCT_path
+	dwLnctDirIndex = 0x02 // DW_LNCT_directory_index
+)
+
+// dwarfAbbrevTable returns the .debug_abbrev content: a single compilation
+// unit with DW_TAG_compile_unit and DW_TAG_subprogram entries.  The
+// attribute/form pairs must match the DIE streams dwarfBuildInfoSection
+// writes byte for byte, in the same order, or every consumer's parse of
+// .debug_info desynchronises.
+func dwarfAbbrevTable() []byte {
+	var b []byte
+	// Abbrev 1: DW_TAG_compile_unit.
+	b = append(b, 1)                 // abbreviation code
+	b = appendUleb(b, dwTagCompUnit) // DW_TAG_compile_unit
+	b = append(b, 1)                 // DW_CHILDREN_yes
+	b = appendUleb(b, dwAtLowPC)     // DW_AT_low_pc
+	b = appendUleb(b, dwFormAddr)    // DW_FORM_addr
+	b = appendUleb(b, dwAtHighPC)    // DW_AT_high_pc
+	b = appendUleb(b, dwFormData8)   // DW_FORM_data8
+	b = appendUleb(b, dwAtStmtList)  // DW_AT_stmt_list
+	b = appendUleb(b, dwFormSecOff)  // DW_FORM_sec_offset (4 bytes here)
+	b = appendUleb(b, dwAtName)      // DW_AT_name
+	b = appendUleb(b, dwFormString)  // DW_FORM_string
+	b = appendUleb(b, 0)             // end of attributes: attr 0
+	b = appendUleb(b, 0)             // ... paired with form 0
+
+	// Abbrev 2: DW_TAG_subprogram.
+	b = append(b, 2)                 // abbreviation code
+	b = appendUleb(b, dwTagSubprog)  // DW_TAG_subprogram
+	b = append(b, 0)                 // DW_CHILDREN_no
+	b = appendUleb(b, dwAtName)      // DW_AT_name
+	b = appendUleb(b, dwFormString)  // DW_FORM_string
+	b = appendUleb(b, dwAtLowPC)     // DW_AT_low_pc
+	b = appendUleb(b, dwFormAddr)    // DW_FORM_addr
+	b = appendUleb(b, dwAtHighPC)    // DW_AT_high_pc
+	b = appendUleb(b, dwFormData8)   // DW_FORM_data8
+	b = appendUleb(b, dwAtFrameBase) // DW_AT_frame_base
+	b = appendUleb(b, dwFormExprloc) // DW_FORM_exprloc
+	b = appendUleb(b, dwAtDeclFile)  // DW_AT_decl_file
+	b = appendUleb(b, dwFormData1)   // DW_FORM_data1
+	b = appendUleb(b, dwAtDeclLine)  // DW_AT_decl_line
+	b = appendUleb(b, dwFormData1)   // DW_FORM_data1
+	b = appendUleb(b, dwAtExternal)  // DW_AT_external
+	b = appendUleb(b, 0x0c)          // DW_FORM_flag (one byte, 0 or 1)
+	b = appendUleb(b, 0)             // end of attributes: attr 0
+	b = appendUleb(b, 0)             // ... paired with form 0
+
+	// End of table.
+	b = append(b, 0)
+	return b
+}
+
+// dwarfSections holds the generated DWARF section payloads and their
+// relocations (byte offsets within .debug_info and .debug_line that need
+// fixup against .text symbols).
+type dwarfSections struct {
+	debugAbbrev  []byte
+	debugInfo    []byte
+	debugLine    []byte
+	debugLineStr []byte
+	debugFrame   []byte
+	// Relocations for .debug_info: (offset, symbol name, addend).
+	infoRelocs []dwarfReloc
+	// Relocations for .debug_line: (offset, symbol name, addend).
+	lineRelocs []dwarfReloc
+	// Relocations for .debug_frame: (offset, symbol name, addend), one per
+	// FDE initial_location.
+	frameRelocs []dwarfReloc
+}
+
+type dwarfReloc struct {
+	off    uint64
+	name   string
+	addend int64
+}
+
+// emitDWARF generates complete DWARF5 sections for the image.  cfi carries
+// the architecture's .debug_frame register conventions.
+func emitDWARF(img *Image, srcFile string, cfi cfiArch) *dwarfSections {
+	ds := &dwarfSections{}
+	ds.debugAbbrev = dwarfAbbrevTable()
+
+	// Build the string table for .debug_line_str.
+	lineStr := newElfStrtab()
+	lineStr.add(srcFile)
+	ds.debugLineStr = lineStr.bytes()
+
+	// Build .debug_line; the file table references the source name through
+	// its offset in .debug_line_str.
+	ds.debugLine = dwarfBuildLineSection(img, uint32(lineStr.at(srcFile)), ds)
+
+	// Build .debug_info.
+	ds.debugInfo = dwarfBuildInfoSection(img, srcFile, ds)
+
+	// Build .debug_frame.
+	ds.debugFrame = dwarfBuildFrameSection(img, cfi, ds)
+	return ds
+}
+
+// dwarfBuildLineSection builds a complete .debug_line section.  srcStrOff is
+// the source file name's offset in .debug_line_str.
+func dwarfBuildLineSection(img *Image, srcStrOff uint32, ds *dwarfSections) []byte {
+	var b []byte
+	le := binary.LittleEndian
+
+	// We'll build the header first, then the programs, then patch the length.
+	headerStart := len(b)
+	b = append(b, 0, 0, 0, 0) // unit_length (placeholder)
+	b = le.AppendUint16(b, 5) // version (DWARF5)
+	b = append(b, 8)          // address_size
+	b = append(b, 0)          // segment_selector_size
+	b = append(b, 0, 0, 0, 0) // header_length (placeholder)
+
+	// Line program parameters.
+	b = append(b, 1)                     // minimum_instruction_length
+	b = append(b, 1)                     // maximum_ops_per_instruction
+	b = append(b, 1)                     // default_is_stmt
+	b = append(b, byte(dwLineBase&0xFF)) // line_base (-4 as unsigned)
+	b = append(b, uint8(dwLineRange))    // line_range
+	b = append(b, uint8(dwOpcodeBase))   // opcode_base
+	// Standard opcode lengths (opcode 1..opcode_base-1).
+	b = append(b, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0)
+
+	// Directory table (DWARF5 §6.2.4): entry format descriptors followed by
+	// the entries.  One directory, the compilation directory, whose path is
+	// the empty string at .debug_line_str offset 0.
+	b = append(b, 1)                  // directory_entry_format_count
+	b = appendUleb(b, dwLnctPath)     // DW_LNCT_path
+	b = appendUleb(b, dwFormLineStrp) // DW_FORM_line_strp
+	b = appendUleb(b, 1)              // directories_count
+	b = le.AppendUint32(b, 0)         // .debug_line_str offset of ""
+
+	// File table (DWARF5 §6.2.5).  v5 indexes files from 0, so the source
+	// file is entry 0, matching the DW_AT_decl_file value 0 the DIEs carry.
+	b = append(b, 2)                  // file_name_entry_format_count
+	b = appendUleb(b, dwLnctPath)     // DW_LNCT_path
+	b = appendUleb(b, dwFormLineStrp) // DW_FORM_line_strp
+	b = appendUleb(b, dwLnctDirIndex) // DW_LNCT_directory_index
+	b = appendUleb(b, dwFormUdata)    // DW_FORM_udata
+	b = appendUleb(b, 1)              // file_names_count
+	b = le.AppendUint32(b, srcStrOff) // .debug_line_str offset of the source name
+	b = appendUleb(b, 0)              // directory index 0 (the compilation directory)
+
+	headerEnd := len(b)
+
+	// Per-function line programs.
+	for _, fn := range img.Funcs {
+		// LNE_set_address with the function's offset in .text.
+		b = append(b, 0, 9, 2) // extended opcode, length 9, DW_LNE_set_address
+		addrOff := len(b)
+		b = le.AppendUint64(b, 0) // placeholder for address
+		ds.lineRelocs = append(ds.lineRelocs, dwarfReloc{
+			off:    uint64(addrOff),
+			name:   fn.Name,
+			addend: 0,
+		})
+
+		// Build the line entries.
+		pts := make([]LineEntry, 0, len(fn.Lines)+1)
+		if len(fn.Lines) == 0 || fn.Lines[0].Offset > 0 {
+			pts = append(pts, LineEntry{Offset: 0, Line: fn.Line})
+		}
+		pts = append(pts, fn.Lines...)
+
+		line := int64(1)
+		pc := uint64(0)
+		for _, p := range pts {
+			if p.Line == 0 || uint64(p.Offset) < pc {
+				continue
+			}
+			if int64(p.Line) == line {
+				continue
+			}
+			deltaPC := uint64(p.Offset) - pc
+			deltaLC := int64(p.Line) - line
+			b = dwPutPCLCDelta(b, deltaPC, deltaLC)
+			line, pc = int64(p.Line), uint64(p.Offset)
+		}
+
+		// Advance to end of function.
+		if end := uint64(fn.Size) - pc; end > 0 {
+			b = append(b, 2) // DW_LNS_advance_pc
+			b = appendUleb(b, end)
+		}
+		b = append(b, 0, 1, 1) // LNE_end_sequence
+	}
+
+	// Patch unit_length.
+	le.PutUint32(b[headerStart:], uint32(len(b)-headerStart-4))
+	// Patch header_length.  In the v5 header it follows the one-byte
+	// address_size and segment_selector_size (offset 8, not the DWARF2-4
+	// offset 6), and counts from just past itself to the first program
+	// byte.
+	le.PutUint32(b[headerStart+8:], uint32(headerEnd-headerStart-12))
+	return b
+}
+
+// dwarfBuildInfoSection builds a complete .debug_info section.
+func dwarfBuildInfoSection(img *Image, srcFile string, ds *dwarfSections) []byte {
+	var b []byte
+	le := binary.LittleEndian
+
+	cuStart := len(b)
+	b = append(b, 0, 0, 0, 0) // unit_length (placeholder)
+	b = le.AppendUint16(b, 5) // version (DWARF5)
+	b = append(b, 0x01)       // unit_type (DW_UT_compile)
+	b = append(b, 8)          // address_size
+	b = le.AppendUint32(b, 0) // debug_abbrev_offset (0 since single CU)
+
+	// DW_TAG_compile_unit (abbrev 1).
+	b = append(b, 1) // abbreviation code
+	// DW_AT_low_pc: address of .text start.  A data-only image has no
+	// functions to relocate against; its CU covers no code, so the base
+	// stays zero (the DWARF "no base address" value) with no relocation.
+	b = le.AppendUint64(b, 0) // placeholder
+	if len(img.Funcs) > 0 {
+		ds.infoRelocs = append(ds.infoRelocs, dwarfReloc{
+			off:  uint64(len(b) - 8),
+			name: img.Funcs[0].Name,
+		})
+	}
+	// DW_AT_high_pc: size of .text.
+	b = le.AppendUint64(b, uint64(len(img.Code)))
+	// DW_AT_stmt_list: offset into .debug_line (0).
+	b = le.AppendUint32(b, 0)
+	// DW_AT_name: source file name.
+	b = append(b, srcFile...)
+	b = append(b, 0)
+
+	// DW_TAG_subprogram entries (abbrev 2).
+	for _, fn := range img.Funcs {
+		b = append(b, 2) // abbreviation code
+		// DW_AT_name.
+		b = append(b, fn.Name...)
+		b = append(b, 0)
+		// DW_AT_low_pc.
+		addrOff := len(b)
+		b = le.AppendUint64(b, 0) // placeholder
+		ds.infoRelocs = append(ds.infoRelocs, dwarfReloc{
+			off:    uint64(addrOff),
+			name:   fn.Name,
+			addend: 0,
+		})
+		// DW_AT_high_pc: function size.
+		b = le.AppendUint64(b, uint64(fn.Size))
+		// DW_AT_frame_base: DW_OP_call_frame_cfa.
+		b = append(b, 1, 0x9c)
+		// DW_AT_decl_file: the single file-table entry, index 0 (v5 indexes
+		// files from 0).
+		b = append(b, 0)
+		// DW_AT_decl_line.
+		b = append(b, uint8(fn.Line))
+		// DW_AT_external.
+		if fn.Static {
+			b = append(b, 0)
+		} else {
+			b = append(b, 1)
+		}
+	}
+
+	// End of compile unit children.
+	b = append(b, 0)
+
+	// Patch unit_length.
+	le.PutUint32(b[cuStart:], uint32(len(b)-cuStart-4))
+	return b
+}
+
+func appendUleb(b []byte, v uint64) []byte {
+	return binary.AppendUvarint(b, v)
+}
+
+// appendSleb appends v in signed LEB128, the encoding DWARF specifies:
+// two's-complement sign extension, which is NOT Go's zigzag varint
+// (binary.AppendVarint(-8) encodes 15, where DWARF wants 0x78).
+func appendSleb(b []byte, v int64) []byte {
+	for {
+		c := byte(v & 0x7f)
+		v >>= 7
+		if (v == 0 && c&0x40 == 0) || (v == -1 && c&0x40 != 0) {
+			return append(b, c)
+		}
+		b = append(b, c|0x80)
+	}
+}
+
+// cfiArch carries the .debug_frame CIE parameters that differ per
+// architecture: the DWARF register numbers of the stack pointer the initial
+// CFA rule names and of the return address.  The values are the ones the Go
+// linker writes into its own CIE (cmd/link/internal/ld/dwarf.go uses
+// Dwarfregsp and Dwarfreglr; the per-architecture constants live in
+// cmd/link/internal/<arch>/l.go).
+type cfiArch struct {
+	name   string
+	cfaReg byte // the stack-pointer register the initial CFA rule names
+	raReg  byte // the return-address register
+}
+
+var (
+	cfiAMD64   = cfiArch{"amd64", 7, 16}  // RSP, RIP
+	cfiARM64   = cfiArch{"arm64", 31, 30} // SP (X31), LR (X30)
+	cfiRISCV64 = cfiArch{"riscv64", 2, 1} // X2 (sp), X1 (ra)
+	cfiLOONG64 = cfiArch{"loong64", 3, 1} // $r3 (sp), $r1 (ra)
+)
+
+// dwarfBuildFrameSection builds a .debug_frame section with CFI for stack
+// unwinding.  It emits one CIE and one FDE per function, encoding the
+// CFA (Canonical Frame Address) rule changes at each stack-adjustment
+// boundary recorded in FuncLayout.Spadj.
+func dwarfBuildFrameSection(img *Image, cfi cfiArch, ds *dwarfSections) []byte {
+	var b []byte
+	le := binary.LittleEndian
+
+	// CIE (Common Information Entry).
+	cieStart := len(b)
+	b = append(b, 0, 0, 0, 0)            // length (placeholder)
+	b = le.AppendUint32(b, 0xFFFFFFFF)   // CIE marker
+	b = append(b, 3)                     // version (DWARF3, widely supported)
+	b = append(b, 0)                     // augmentation (empty)
+	b = appendUleb(b, 1)                 // code alignment
+	b = appendSleb(b, -8)                // data alignment (-8 for 64-bit)
+	b = appendUleb(b, uint64(cfi.raReg)) // return address register
+	// Initial CFA rule: DW_CFA_def_cfa (SP, 0)
+	b = append(b, 0x0c)                   // DW_CFA_def_cfa
+	b = appendUleb(b, uint64(cfi.cfaReg)) // the architecture's stack pointer
+	b = appendUleb(b, 0)                  // offset: 0
+	b = append(b, 0)                      // DW_CFA_nop (padding)
+	// Patch CIE length.
+	le.PutUint32(b[cieStart:], uint32(len(b)-cieStart-4))
+
+	// FDEs (Frame Description Entries), one per function.
+	for _, fn := range img.Funcs {
+		fdeStart := len(b)
+		b = append(b, 0, 0, 0, 0)                // length (placeholder)
+		b = le.AppendUint32(b, uint32(cieStart)) // CIE pointer (offset from start)
+		// Initial location: function offset in .text, referenced through
+		// the function's symbol so the linker relocates it.
+		ds.frameRelocs = append(ds.frameRelocs, dwarfReloc{
+			off:  uint64(fdeStart + 8),
+			name: fn.Name,
+		})
+		b = le.AppendUint64(b, uint64(fn.Offset))
+		// Address range: function size.
+		b = le.AppendUint64(b, uint64(fn.Size))
+
+		// Emit CFA rule changes at each Spadj boundary.
+		for _, step := range fn.Spadj {
+			if step.Value == 0 {
+				continue
+			}
+			// DW_CFA_def_cfa_offset: set CFA = SP + |delta|.
+			// The delta is negative (stack grows down), so CFA offset = -delta.
+			offset := -step.Value
+			if offset > 0 {
+				b = append(b, 0x0e) // DW_CFA_def_cfa_offset
+				b = appendUleb(b, uint64(offset))
+			}
+		}
+
+		// Pad to alignment.
+		for len(b)%4 != 0 {
+			b = append(b, 0) // DW_CFA_nop
+		}
+
+		// Patch FDE length.
+		le.PutUint32(b[fdeStart:], uint32(len(b)-fdeStart-4))
+	}
+
+	return b
+}

asm/elf_dwarf_sections.go

@@ -0,0 +1,179 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: BSD-3-Clause
+
+package asm
+
+import "encoding/binary"
+
+// Absolute 64-bit relocation types for the DWARF address fixups, one per
+// supported architecture (the numbers debug/elf carries).
+const (
+	rX8664Abs64   = 1   // R_X86_64_64
+	rAARCH64Abs64 = 257 // R_AARCH64_ABS64
+	rRISCVAbs64   = 2   // R_RISCV_64
+	rLarchAbs64   = 2   // R_LARCH_64
+)
+
+// dwarfELFSections holds the laid-out DWARF sections ready for inclusion
+// in an ELF file.
+type dwarfELFSections struct {
+	abbrevOff, abbrevSize   int
+	infoOff, infoSize       int
+	lineOff, lineSize       int
+	lineStrOff, lineStrSize int
+	frameOff, frameSize     int
+	// .rela.debug_info and .rela.debug_line contents: file offsets and
+	// entry counts (zero count: the section is absent).
+	infoRelaOff, infoRelaCount   int
+	lineRelaOff, lineRelaCount   int
+	frameRelaOff, frameRelaCount int
+	// Relocations for .debug_info address references, offsets relative to
+	// the section start (what an r_offset in .rela.debug_info means).
+	infoRelocs []elfDwarfReloc
+	// Relocations for .debug_line address references, section-relative.
+	lineRelocs []elfDwarfReloc
+	// Relocations for .debug_frame FDE initial locations, section-relative.
+	frameRelocs []elfDwarfReloc
+}
+
+type elfDwarfReloc struct {
+	off    uint64 // offset within the target section
+	sym    int    // symbol index in .symtab
+	addend int64
+}
+
+// appendDWARFSections generates and appends DWARF5 debug sections to the ELF
+// output.  It returns the section offsets/sizes and relocations for the caller
+// to emit section headers and relocation records.
+//
+// symIdx maps function names to their .symtab indices (needed for relocations
+// against .text symbols).  The map uses objectName format (pkg.name); the
+// DWARF code uses bare function names, so we build a reverse lookup.  cfi
+// carries the architecture's .debug_frame register conventions.
+func appendDWARFSections(out *[]byte, img *Image, srcFile string, symIdx map[string]int, align func(int), cfi cfiArch) *dwarfELFSections {
+	// Build a lookup from bare function name to symbol index.
+	nameToIdx := make(map[string]int, len(symIdx))
+	for name, idx := range symIdx {
+		// Strip package prefix: "pkg.name" → "name".
+		if i := len(name) - 1; i >= 0 {
+			for j := len(name) - 1; j >= 0; j-- {
+				if name[j] == '.' {
+					nameToIdx[name[j+1:]] = idx
+					break
+				}
+			}
+		}
+		nameToIdx[name] = idx
+	}
+	ds := emitDWARF(img, srcFile, cfi)
+	if ds == nil || len(ds.debugAbbrev) == 0 {
+		return nil
+	}
+
+	result := &dwarfELFSections{}
+
+	// .debug_abbrev
+	align(1)
+	result.abbrevOff = len(*out)
+	result.abbrevSize = len(ds.debugAbbrev)
+	*out = append(*out, ds.debugAbbrev...)
+
+	// .debug_line_str
+	align(1)
+	result.lineStrOff = len(*out)
+	result.lineStrSize = len(ds.debugLineStr)
+	*out = append(*out, ds.debugLineStr...)
+
+	// .debug_line
+	align(1)
+	result.lineOff = len(*out)
+	result.lineSize = len(ds.debugLine)
+	*out = append(*out, ds.debugLine...)
+	for _, dr := range ds.lineRelocs {
+		if idx, ok := nameToIdx[dr.name]; ok {
+			result.lineRelocs = append(result.lineRelocs, elfDwarfReloc{
+				off:    dr.off,
+				sym:    idx,
+				addend: dr.addend,
+			})
+		}
+	}
+
+	// .debug_info
+	align(1)
+	result.infoOff = len(*out)
+	result.infoSize = len(ds.debugInfo)
+	*out = append(*out, ds.debugInfo...)
+	for _, dr := range ds.infoRelocs {
+		if idx, ok := nameToIdx[dr.name]; ok {
+			result.infoRelocs = append(result.infoRelocs, elfDwarfReloc{
+				off:    dr.off,
+				sym:    idx,
+				addend: dr.addend,
+			})
+		}
+	}
+
+	// .debug_frame: the section header declares alignment 8, so the data is
+	// padded to 8, matching it.
+	if len(ds.debugFrame) > 0 {
+		align(8)
+		result.frameOff = len(*out)
+		result.frameSize = len(ds.debugFrame)
+		*out = append(*out, ds.debugFrame...)
+		for _, dr := range ds.frameRelocs {
+			if idx, ok := nameToIdx[dr.name]; ok {
+				result.frameRelocs = append(result.frameRelocs, elfDwarfReloc{
+					off:    dr.off,
+					sym:    idx,
+					addend: dr.addend,
+				})
+			}
+		}
+	}
+
+	return result
+}
+
+// appendDWARFRelas writes the .rela.debug_info and .rela.debug_line section
+// bodies from the relocations appendDWARFSections recorded, with the
+// architecture's absolute 64-bit relocation type, and records their file
+// offsets and entry counts on dw.  Called after the DWARF sections
+// themselves so the r_offsets (section-relative) need no adjustment.
+func appendDWARFRelas(out *[]byte, dw *dwarfELFSections, abs64 uint32, align func(int)) {
+	le := binary.LittleEndian
+	write := func(relas []elfDwarfReloc) (off, count int) {
+		if len(relas) == 0 {
+			return 0, 0
+		}
+		align(8)
+		off = len(*out)
+		for _, r := range relas {
+			var b [24]byte
+			le.PutUint64(b[0:], r.off)
+			le.PutUint64(b[8:], uint64(r.sym)<<32|uint64(abs64))
+			le.PutUint64(b[16:], uint64(r.addend))
+			*out = append(*out, b[:]...)
+		}
+		return off, len(relas)
+	}
+	dw.infoRelaOff, dw.infoRelaCount = write(dw.infoRelocs)
+	dw.lineRelaOff, dw.lineRelaCount = write(dw.lineRelocs)
+	dw.frameRelaOff, dw.frameRelaCount = write(dw.frameRelocs)
+}
+
+// dwarfSourceName returns the source name the DWARF sections record: the
+// image's source path when the assembler captured one, "gasm.s" otherwise.
+func dwarfSourceName(img *Image) string {
+	if img.SourcePath != "" {
+		return img.SourcePath
+	}
+	return "gasm.s"
+}
+
+// dwarfSectionNames returns the DWARF section names for the string table.
+var dwarfSectionNames = []string{
+	".debug_abbrev", ".debug_info", ".debug_line", ".debug_line_str",
+	".debug_frame", ".rela.debug_info", ".rela.debug_line",
+	".rela.debug_frame",
+}

asm/elf_dwarf_test.go

@@ -0,0 +1,372 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: BSD-3-Clause
+
+package asm
+
+import (
+	"bytes"
+	"encoding/binary"
+	"testing"
+
+	"sourcedock.dev/petrbalvin/gasm-devkit/parser"
+)
+
+// ulebIter reads ULEB128 values, the .debug_abbrev and line-header
+// encoding.
+type ulebIter struct {
+	b []byte
+	i int
+}
+
+func (r *ulebIter) uleb(t *testing.T) uint64 {
+	t.Helper()
+	v, n := binary.Uvarint(r.b[r.i:])
+	if n <= 0 {
+		t.Fatalf("bad ULEB at %d", r.i)
+	}
+	r.i += n
+	return v
+}
+
+func (r *ulebIter) byteAt(t *testing.T) byte {
+	t.Helper()
+	if r.i >= len(r.b) {
+		t.Fatalf("read past end at %d", r.i)
+	}
+	c := r.b[r.i]
+	r.i++
+	return c
+}
+
+func (r *ulebIter) uint32At(t *testing.T) uint32 {
+	t.Helper()
+	v := binary.LittleEndian.Uint32(r.b[r.i:])
+	r.i += 4
+	return v
+}
+
+// sleb reads a signed LEB128, the DWARF encoding (sign-extended two's
+// complement, not Go's zigzag varint).
+func (r *ulebIter) sleb(t *testing.T) int64 {
+	t.Helper()
+	var v int64
+	var shift uint
+	for {
+		c := r.byteAt(t)
+		v |= int64(c&0x7f) << shift
+		shift += 7
+		if c&0x80 == 0 {
+			if c&0x40 != 0 {
+				v |= -1 << shift
+			}
+			return v
+		}
+	}
+}
+
+// dwarfAttr is one attribute/form pair of an abbreviation.
+type dwarfAttr struct{ attr, form uint64 }
+
+// dwarfAbbrev is one parsed abbreviation declaration.
+type dwarfAbbrev struct {
+	code     uint64
+	tag      uint64
+	children bool
+	attrs    []dwarfAttr
+}
+
+// parseAbbrevs walks a .debug_abbrev table: abbreviation code, tag,
+// children flag, then attr/form ULEB pairs terminated by a double zero.
+func parseAbbrevs(t *testing.T, b []byte) map[uint64]dwarfAbbrev {
+	t.Helper()
+	out := map[uint64]dwarfAbbrev{}
+	r := &ulebIter{b: b}
+	for {
+		code := r.uleb(t)
+		if code == 0 {
+			return out
+		}
+		ab := dwarfAbbrev{code: code, tag: r.uleb(t)}
+		ab.children = r.byteAt(t) == 1
+		for {
+			attr := r.uleb(t)
+			form := r.uleb(t)
+			if attr == 0 && form == 0 {
+				break
+			}
+			if attr == 0 || form == 0 {
+				t.Fatalf("abbrev %d: half-terminated attr/form pair (%d, %d)", code, attr, form)
+			}
+			ab.attrs = append(ab.attrs, dwarfAttr{attr, form})
+		}
+		out[code] = ab
+	}
+}
+
+func eqAttrs(t *testing.T, ab dwarfAbbrev, want []dwarfAttr) {
+	t.Helper()
+	if len(ab.attrs) != len(want) {
+		t.Fatalf("abbrev %d attrs = %v, want %v", ab.code, ab.attrs, want)
+	}
+	for i, w := range want {
+		if ab.attrs[i] != w {
+			t.Fatalf("abbrev %d attr %d = (%#x, %#x), want (%#x, %#x)", ab.code, i, ab.attrs[i].attr, ab.attrs[i].form, w.attr, w.form)
+		}
+	}
+}
+
+// TestDwarfAbbrevTable walks the abbreviation table as a consumer does and
+// checks the attribute/form sets against the constants the toolchain uses
+// (cmd/internal/dwarf/dwarf_defs.go).  A wrong constant here renames an
+// attribute (0x1b is comp_dir, not low_pc; 0x29 and 0x37 are bounds and
+// count) and a wrong form desynchronises the DIE parse: 0x25 is strx1, one
+// byte, where the writer emits four for a section offset.
+func TestDwarfAbbrevTable(t *testing.T) {
+	abbrev := dwarfAbbrevTable()
+	if len(abbrev) == 0 {
+		t.Fatal("empty abbrev table")
+	}
+	// Must end with a zero byte (end of table).
+	if abbrev[len(abbrev)-1] != 0 {
+		t.Fatalf("abbrev table last byte = %d, want 0", abbrev[len(abbrev)-1])
+	}
+	abs := parseAbbrevs(t, abbrev)
+	if len(abs) != 2 {
+		t.Fatalf("abbreviations = %d, want 2", len(abs))
+	}
+	cu, ok := abs[1]
+	if !ok {
+		t.Fatal("missing abbreviation 1 (compile unit)")
+	}
+	if cu.tag != dwTagCompUnit || !cu.children {
+		t.Errorf("abbrev 1: tag %#x children %v, want compile unit with children", cu.tag, cu.children)
+	}
+	eqAttrs(t, cu, []dwarfAttr{
+		{dwAtLowPC, dwFormAddr},
+		{dwAtHighPC, dwFormData8},
+		{dwAtStmtList, dwFormSecOff},
+		{dwAtName, dwFormString},
+	})
+	sp, ok := abs[2]
+	if !ok {
+		t.Fatal("missing abbreviation 2 (subprogram)")
+	}
+	if sp.tag != dwTagSubprog || sp.children {
+		t.Errorf("abbrev 2: tag %#x children %v, want subprogram without children", sp.tag, sp.children)
+	}
+	eqAttrs(t, sp, []dwarfAttr{
+		{dwAtName, dwFormString},
+		{dwAtLowPC, dwFormAddr},
+		{dwAtHighPC, dwFormData8},
+		{dwAtFrameBase, dwFormExprloc},
+		{dwAtDeclFile, dwFormData1},
+		{dwAtDeclLine, dwFormData1},
+		{dwAtExternal, 0x0c}, // DW_FORM_flag
+	})
+}
+
+// TestDwarfLineHeaderV5 parses the .debug_line header under DWARF5 rules:
+// the directory and file tables are format-descriptor lists, not the
+// DWARF2-4 shape of null-terminated strings, and the file entry references
+// the source name through .debug_line_str.
+func TestDwarfLineHeaderV5(t *testing.T) {
+	src := `#include "textflag.h"
+TEXT ·add(SB), NOSPLIT, $0-24
+	MOVQ a+0(FP), AX
+	MOVQ b+8(FP), BX
+	ADDQ BX, AX
+	MOVQ AX, ret+16(FP)
+	RET
+`
+	f, errs := parser.Parse("test_amd64.s", src)
+	if len(errs) > 0 {
+		t.Fatalf("parse: %v", errs)
+	}
+	img, err := AssembleFile(f)
+	if err != nil {
+		t.Fatalf("assemble: %v", err)
+	}
+
+	ds := emitDWARF(img, "test_amd64.s", cfiAMD64)
+	r := &ulebIter{b: ds.debugLine}
+	r.uint32At(t) // unit_length
+	if v := binary.LittleEndian.Uint16(ds.debugLine[4:]); v != 5 {
+		t.Fatalf("version = %d, want 5", v)
+	}
+	r.i = 6
+	r.byteAt(t)   // address_size
+	r.byteAt(t)   // segment_selector_size
+	r.uint32At(t) // header_length
+	r.byteAt(t)   // minimum_instruction_length
+	r.byteAt(t)   // maximum_ops_per_instruction
+	r.byteAt(t)   // default_is_stmt
+	r.byteAt(t)   // line_base
+	r.byteAt(t)   // line_range
+	opcodeBase := r.byteAt(t)
+	for range int(opcodeBase) - 1 {
+		r.byteAt(t) // standard opcode lengths
+	}
+
+	// Directory table (DWARF5 §6.2.4).
+	if n := r.byteAt(t); n != 1 {
+		t.Fatalf("directory_entry_format_count = %d, want 1", n)
+	}
+	if lnct := r.uleb(t); lnct != dwLnctPath {
+		t.Errorf("directory content type = %#x, want DW_LNCT_path", lnct)
+	}
+	if form := r.uleb(t); form != dwFormLineStrp {
+		t.Errorf("directory form = %#x, want DW_FORM_line_strp", form)
+	}
+	if n := r.uleb(t); n != 1 {
+		t.Fatalf("directories_count = %d, want 1", n)
+	}
+	if off := r.uint32At(t); off != 0 {
+		t.Errorf("compilation directory line_strp = %d, want 0 (the empty string)", off)
+	}
+
+	// File table (DWARF5 §6.2.5).
+	if n := r.byteAt(t); n != 2 {
+		t.Fatalf("file_name_entry_format_count = %d, want 2", n)
+	}
+	if lnct := r.uleb(t); lnct != dwLnctPath {
+		t.Errorf("file content type = %#x, want DW_LNCT_path", lnct)
+	}
+	if form := r.uleb(t); form != dwFormLineStrp {
+		t.Errorf("file path form = %#x, want DW_FORM_line_strp", form)
+	}
+	if lnct := r.uleb(t); lnct != dwLnctDirIndex {
+		t.Errorf("file content type = %#x, want DW_LNCT_directory_index", lnct)
+	}
+	if form := r.uleb(t); form != dwFormUdata {
+		t.Errorf("file dir-index form = %#x, want DW_FORM_udata", form)
+	}
+	if n := r.uleb(t); n != 1 {
+		t.Fatalf("file_names_count = %d, want 1", n)
+	}
+	strOff := r.uint32At(t)
+	if dirIdx := r.uleb(t); dirIdx != 0 {
+		t.Errorf("file directory index = %d, want 0", dirIdx)
+	}
+
+	// The file entry's line_strp must resolve to the source name.
+	end := int(strOff) + len("test_amd64.s")
+	if int(strOff) >= len(ds.debugLineStr) || !bytes.Equal(ds.debugLineStr[strOff:end], []byte("test_amd64.s")) {
+		t.Errorf("file entry line_strp %d does not name the source: %q", strOff, ds.debugLineStr)
+	}
+
+	// The fixed header fields: address_size 8 and a header_length that
+	// points just past the file table (the patch site is offset 8 in the
+	// v5 header, and the field counts from its own end).
+	if ds.debugLine[6] != 8 || ds.debugLine[7] != 0 {
+		t.Errorf("address_size/segment_selector = %d/%d, want 8/0", ds.debugLine[6], ds.debugLine[7])
+	}
+	if hl := binary.LittleEndian.Uint32(ds.debugLine[8:]); hl != uint32(r.i-12) {
+		t.Errorf("header_length = %d, want %d (the byte after the file table is %d)", hl, r.i-12, r.i)
+	}
+}
+
+// TestDwarfFrameCIEArch checks the shared CIE carries each architecture's
+// stack-pointer and return-address registers: the values the Go linker
+// writes (cmd/link/internal/<arch>/l.go dwarfRegSP/dwarfRegLR).
+func TestDwarfFrameCIEArch(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		cfi  cfiArch
+	}{
+		{"amd64", cfiAMD64},
+		{"arm64", cfiARM64},
+		{"riscv64", cfiRISCV64},
+		{"loong64", cfiLOONG64},
+	} {
+		frame := dwarfBuildFrameSection(&Image{}, tc.cfi, &dwarfSections{})
+		r := &ulebIter{b: frame}
+		r.uint32At(t) // length
+		if cid := r.uint32At(t); cid != 0xFFFFFFFF {
+			t.Errorf("%s: CIE id = %#x, want 0xffffffff", tc.name, cid)
+		}
+		if v := r.byteAt(t); v != 3 {
+			t.Errorf("%s: CIE version = %d, want 3", tc.name, v)
+		}
+		if aug := r.byteAt(t); aug != 0 {
+			t.Errorf("%s: CIE augmentation = %d, want 0", tc.name, aug)
+		}
+		if ca := r.uleb(t); ca != 1 {
+			t.Errorf("%s: code alignment = %d, want 1", tc.name, ca)
+		}
+		if da := r.sleb(t); da != -8 {
+			t.Errorf("%s: data alignment = %d, want -8 (signed LEB128, not zigzag)", tc.name, da)
+		}
+		if ra := r.uleb(t); ra != uint64(tc.cfi.raReg) {
+			t.Errorf("%s: return-address register = %d, want %d", tc.name, ra, tc.cfi.raReg)
+		}
+		if op := r.byteAt(t); op != 0x0c {
+			t.Errorf("%s: expected DW_CFA_def_cfa, got opcode %#x", tc.name, op)
+		}
+		if cfa := r.uleb(t); cfa != uint64(tc.cfi.cfaReg) {
+			t.Errorf("%s: CFA register = %d, want %d", tc.name, cfa, tc.cfi.cfaReg)
+		}
+		if off := r.uleb(t); off != 0 {
+			t.Errorf("%s: CFA offset = %d, want 0", tc.name, off)
+		}
+	}
+}
+
+func TestEmitDWARF(t *testing.T) {
+	src := `#include "textflag.h"
+TEXT ·add(SB), NOSPLIT, $0-24
+	MOVQ a+0(FP), AX
+	MOVQ b+8(FP), BX
+	ADDQ BX, AX
+	MOVQ AX, ret+16(FP)
+	RET
+`
+	f, errs := parser.Parse("test_amd64.s", src)
+	if len(errs) > 0 {
+		t.Fatalf("parse: %v", errs)
+	}
+	img, err := AssembleFile(f)
+	if err != nil {
+		t.Fatalf("assemble: %v", err)
+	}
+
+	ds := emitDWARF(img, "test_amd64.s", cfiAMD64)
+
+	// .debug_abbrev must not be empty and must start with abbrev code 1.
+	if len(ds.debugAbbrev) == 0 {
+		t.Fatal("empty .debug_abbrev")
+	}
+	if ds.debugAbbrev[0] != 1 {
+		t.Fatalf(".debug_abbrev first byte = %d, want 1", ds.debugAbbrev[0])
+	}
+
+	// .debug_info must have a compile unit header (DWARF5 version 5).
+	if len(ds.debugInfo) < 12 {
+		t.Fatalf(".debug_info too short: %d bytes", len(ds.debugInfo))
+	}
+	// Version field at offset 4 (after unit_length).
+	if ds.debugInfo[4] != 5 || ds.debugInfo[5] != 0 {
+		t.Fatalf(".debug_info version = %d, want 5", uint16(ds.debugInfo[4])|uint16(ds.debugInfo[5])<<8)
+	}
+
+	// .debug_line must have a header.
+	if len(ds.debugLine) < 20 {
+		t.Fatalf(".debug_line too short: %d bytes", len(ds.debugLine))
+	}
+	// Version at offset 4.
+	if ds.debugLine[4] != 5 || ds.debugLine[5] != 0 {
+		t.Fatalf(".debug_line version = %d, want 5", uint16(ds.debugLine[4])|uint16(ds.debugLine[5])<<8)
+	}
+
+	// .debug_line_str must contain the source file name.
+	if len(ds.debugLineStr) == 0 {
+		t.Fatal("empty .debug_line_str")
+	}
+
+	// Relocations must reference the function.
+	if len(ds.lineRelocs) == 0 {
+		t.Fatal("no .debug_line relocations")
+	}
+	if len(ds.infoRelocs) == 0 {
+		t.Fatal("no .debug_info relocations")
+	}
+}

asm/elf_test.go

@@ -12,6 +12,7 @@ import (
 	"path/filepath"
 	"testing"
 
+	"sourcedock.dev/petrbalvin/gasm-devkit/ast"
 	"sourcedock.dev/petrbalvin/gasm-devkit/parser"
 )
 
@@ -52,7 +53,7 @@ func elfTestImage(t *testing.T) *Image {
 }
 
 // TestAssembleFileExternals checks that a reference to a symbol no GLOBL
-// defines is recorded as an external relocation instead of failing — the
+// defines is recorded as an external relocation instead of failing; the
 // raw image leaves the displacement zero, the object emitters carry it.
 func TestAssembleFileExternals(t *testing.T) {
 	img := elfTestImage(t)
@@ -187,7 +188,7 @@ func TestELFObject(t *testing.T) {
 		end := bytes.IndexByte(strtabRaw[stName:], 0)
 		return string(strtabRaw[stName : int(stName)+end])
 	}
-	for i := 0; i < 2; i++ {
+	for i := range 2 {
 		e := raw[i*24 : (i+1)*24]
 		off := binary.LittleEndian.Uint64(e[0:])
 		info := binary.LittleEndian.Uint64(e[8:])
@@ -211,6 +212,75 @@ func TestELFObject(t *testing.T) {
 	}
 }
 
+// TestELFObjectTLSGuardReloc checks that a non-NOSPLIT function's stack
+// guard carries an R_X86_64_TPOFF32 relocation against the null symbol in
+// .rela.text.  The serialisation must honour the record's type field: a
+// hardcoded R_X86_64_PC32 mislinks the TLS load as an ordinary
+// PC-relative reference.
+func TestELFObjectTLSGuardReloc(t *testing.T) {
+	f, errs := parser.Parse("g_amd64.s", `
+#include "textflag.h"
+
+TEXT ·grow(SB), $0
+	CALL ·other(SB)
+	RET
+
+TEXT ·other(SB), NOSPLIT, $0
+	RET
+`)
+	if len(errs) > 0 {
+		t.Fatalf("parse: %v", errs)
+	}
+	img, err := AssembleFile(f)
+	if err != nil {
+		t.Fatalf("AssembleFile: %v", err)
+	}
+	var haveTLS bool
+	for _, fn := range img.Funcs {
+		for _, r := range fn.Relocs {
+			if r.Kind == RelTLSLE {
+				haveTLS = true
+			}
+		}
+	}
+	if !haveTLS {
+		t.Fatal("test source produced no RelTLSLE relocation")
+	}
+	obj, err := img.ELFObject()
+	if err != nil {
+		t.Fatalf("ELFObject: %v", err)
+	}
+	ef, err := elf.NewFile(bytes.NewReader(obj))
+	if err != nil {
+		t.Fatalf("parse emitted object: %v", err)
+	}
+	defer ef.Close()
+	relaSec := ef.Section(".rela.text")
+	if relaSec == nil {
+		t.Fatal("missing .rela.text")
+	}
+	raw, err := relaSec.Data()
+	if err != nil {
+		t.Fatal(err)
+	}
+	found := false
+	for i := 0; i+24 <= len(raw); i += 24 {
+		e := raw[i:]
+		info := binary.LittleEndian.Uint64(e[8:])
+		typ := info & 0xffffffff
+		sym := int(info >> 32)
+		if typ == uint64(elf.R_X86_64_TPOFF32) {
+			found = true
+			if sym != 0 {
+				t.Errorf("TPOFF32 relocation against symbol %d, want 0 (the null symbol)", sym)
+			}
+		}
+	}
+	if !found {
+		t.Errorf("no R_X86_64_TPOFF32 relocation in .rela.text (%d bytes)", len(raw))
+	}
+}
+
 // TestELFObjectNoRelocations checks a file with no static-symbol references
 // emits a valid object without a .rela.text section.
 func TestELFObjectNoRelocations(t *testing.T) {
@@ -253,6 +323,238 @@ TEXT ·nop(SB), NOSPLIT, $0
 	}
 }
 
+// elfSectionHeaderCount returns the e_shnum the ELF header declares.
+func elfSectionHeaderCount(t *testing.T, obj []byte) int {
+	t.Helper()
+	return int(binary.LittleEndian.Uint16(obj[60:]))
+}
+
+// checkELFSectionAccounting verifies the number of section headers the
+// writer physically laid out equals e_shnum: every DWARF section written
+// after .shstrtab must be counted, or the last ones (always .debug_frame)
+// are invisible to every consumer, debug/elf included.
+func checkELFSectionAccounting(t *testing.T, obj []byte) {
+	t.Helper()
+	shoff := int(binary.LittleEndian.Uint64(obj[40:]))
+	shentsize := int(binary.LittleEndian.Uint16(obj[58:]))
+	shnum := elfSectionHeaderCount(t, obj)
+	if shentsize != 64 {
+		t.Fatalf("e_shentsize = %d, want 64", shentsize)
+	}
+	if (len(obj)-shoff)%shentsize != 0 {
+		t.Fatalf("section header table is not a whole number of entries: shoff=%d len=%d", shoff, len(obj))
+	}
+	if present := (len(obj) - shoff) / shentsize; present != shnum {
+		t.Errorf("e_shnum = %d but %d section headers are laid out", shnum, present)
+	}
+}
+
+// TestELFDWARFSectionAccounting runs the header accounting check over all
+// four architecture emitters, and additionally checks the .debug_frame
+// section is visible (its data aligned as its header declares).
+func TestELFDWARFSectionAccounting(t *testing.T) {
+	parse := func(name, src string) *ast.File {
+		f, errs := parser.Parse(name, src)
+		if len(errs) > 0 {
+			t.Fatalf("parse %s: %v", name, errs)
+		}
+		return f
+	}
+	cases := []struct {
+		name string
+		img  *Image
+		emit func(*Image) ([]byte, error)
+	}{
+		{"amd64", elfTestImage(t), (*Image).ELFObject},
+		{"arm64", mustImage(t, func() (*Image, error) {
+			return AssembleFileARM64(parse("k_arm64.s", `
+#include "textflag.h"
+
+TEXT ·add(SB), NOSPLIT, $0-24
+	MOVD a+0(FP), R4
+	MOVD b+8(FP), R5
+	ADD R5, R4, R4
+	MOVD R4, ret+16(FP)
+	RET
+`))
+		}), (*Image).ELFAARCH64Object},
+		{"riscv64", mustImage(t, func() (*Image, error) {
+			return AssembleFileRISCV(parse("k_riscv64.s", `
+#include "textflag.h"
+
+TEXT ·sb(SB), NOSPLIT, $0-0
+	MOV $answer<>(SB), X10
+	RET
+
+GLOBL answer<>(SB), RODATA, $8
+DATA answer<>+0(SB)/8, $42
+`))
+		}), (*Image).ELFRISCVObject},
+		{"loong64", mustImage(t, func() (*Image, error) {
+			return AssembleFileLOONG64(parse("k_loong64.s", `
+#include "textflag.h"
+
+TEXT ·add(SB), NOSPLIT, $0-24
+	MOVV a+0(FP), R4
+	MOVV b+8(FP), R5
+	ADDV R5, R4, R4
+	MOVV R4, ret+16(FP)
+	RET
+`))
+		}), (*Image).ELFLOONG64Object},
+	}
+	for _, tc := range cases {
+		obj, err := tc.emit(tc.img)
+		if err != nil {
+			t.Fatalf("%s: emit: %v", tc.name, err)
+		}
+		checkELFSectionAccounting(t, obj)
+		ef, err := elf.NewFile(bytes.NewReader(obj))
+		if err != nil {
+			t.Fatalf("%s: parse emitted object: %v", tc.name, err)
+		}
+		frame := ef.Section(".debug_frame")
+		if frame == nil {
+			t.Errorf("%s: .debug_frame invisible to debug/elf (e_shnum too small?)", tc.name)
+			ef.Close()
+			continue
+		}
+		if frame.Offset%8 != 0 || frame.Addralign != 8 {
+			t.Errorf("%s: .debug_frame offset %d align %d, want offset%%8==0 align 8", tc.name, frame.Offset, frame.Addralign)
+		}
+		ef.Close()
+	}
+}
+
+func mustImage(t *testing.T, f func() (*Image, error)) *Image {
+	t.Helper()
+	img, err := f()
+	if err != nil {
+		t.Fatal(err)
+	}
+	return img
+}
+
+// TestELFDWARFRelocations checks the .rela.debug_info and .rela.debug_line
+// sections exist and carry absolute 64-bit relocations against the
+// function symbols, with r_offsets inside their target sections.
+func TestELFDWARFRelocations(t *testing.T) {
+	img := elfTestImage(t)
+	obj, err := img.ELFObject()
+	if err != nil {
+		t.Fatalf("ELFObject: %v", err)
+	}
+	ef, err := elf.NewFile(bytes.NewReader(obj))
+	if err != nil {
+		t.Fatalf("parse emitted object: %v", err)
+	}
+	defer ef.Close()
+	// The DWARF must record the assembled file's path (threaded through
+	// Image.SourcePath), not a placeholder name.
+	info, err := ef.Section(".debug_info").Data()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if img.SourcePath != "t_amd64.s" || !bytes.Contains(info, []byte(img.SourcePath)) {
+		t.Errorf("DWARF compilation unit does not name the source %q", img.SourcePath)
+	}
+	for _, tc := range []struct {
+		rela   string
+		target string
+		want   uint32
+	}{
+		{".rela.debug_info", ".debug_info", rX8664Abs64},
+		{".rela.debug_line", ".debug_line", rX8664Abs64},
+		{".rela.debug_frame", ".debug_frame", rX8664Abs64},
+	} {
+		rs := ef.Section(tc.rela)
+		if rs == nil {
+			t.Fatalf("missing %s", tc.rela)
+		}
+		if rs.Type != elf.SHT_RELA {
+			t.Errorf("%s: type %v, want SHT_RELA", tc.rela, rs.Type)
+		}
+		target := ef.Section(tc.target)
+		if target == nil {
+			t.Fatalf("missing %s", tc.target)
+		}
+		if rs.Link == 0 || ef.Sections[rs.Info] != target {
+			t.Errorf("%s: link %d info %d, want the symtab and %s", tc.rela, rs.Link, rs.Info, tc.target)
+		}
+		b, err := rs.Data()
+		if err != nil {
+			t.Fatal(err)
+		}
+		// .debug_line has one address per function; .debug_info adds the
+		// compile unit's own low_pc.
+		want := len(img.Funcs)
+		if tc.target == ".debug_info" {
+			want++
+		}
+		if len(b)/24 != want {
+			t.Errorf("%s: %d entries, want %d", tc.rela, len(b)/24, want)
+		}
+		for i := 0; i+24 <= len(b); i += 24 {
+			r_offset := binary.LittleEndian.Uint64(b[i:])
+			info := binary.LittleEndian.Uint64(b[i+8:])
+			typ := uint32(info)
+			sym := int(info >> 32)
+			if typ != tc.want {
+				t.Errorf("%s entry %d: type %d, want R_X86_64_64 (%d)", tc.rela, i/24, typ, tc.want)
+			}
+			if r_offset >= uint64(target.Size) {
+				t.Errorf("%s entry %d: r_offset %d outside %s (%d bytes)", tc.rela, i/24, r_offset, tc.target, target.Size)
+			}
+			if sym == 0 {
+				t.Errorf("%s entry %d: against the null symbol", tc.rela, i/24)
+			}
+		}
+	}
+}
+
+// TestELFDataOnly checks a source with GLOBL data and no TEXT emits a valid
+// ELF object: the DWARF compilation unit of a code-less image has no
+// function to relocate against and must not reach for one.
+func TestELFDataOnly(t *testing.T) {
+	f, errs := parser.Parse("d0_amd64.s", `
+GLOBL table<>(SB), RODATA, $8
+DATA table<>+0(SB)/8, $12345
+`)
+	if len(errs) > 0 {
+		t.Fatalf("parse: %v", errs)
+	}
+	img, err := AssembleFile(f)
+	if err != nil {
+		t.Fatalf("AssembleFile: %v", err)
+	}
+	obj, err := img.ELFObject()
+	if err != nil {
+		t.Fatalf("ELFObject: %v", err)
+	}
+	checkELFSectionAccounting(t, obj)
+	ef, err := elf.NewFile(bytes.NewReader(obj))
+	if err != nil {
+		t.Fatalf("parse emitted object: %v", err)
+	}
+	defer ef.Close()
+	syms, err := ef.Symbols()
+	if err != nil {
+		t.Fatal(err)
+	}
+	found := false
+	for _, s := range syms {
+		if s.Name == "table" && s.Size == 8 {
+			found = true
+		}
+	}
+	if !found {
+		t.Errorf("data symbol table missing: %v", syms)
+	}
+	if ef.Section(".rela.debug_info") != nil || ef.Section(".rela.debug_line") != nil {
+		t.Error("data-only image must not emit DWARF address relocations")
+	}
+}
+
 // TestELFLinkAndRun is the end-to-end check: assemble the test functions,
 // link the emitted object with a C driver that defines the external symbol,
 // and run the result.  Skipped when no C compiler is available.
@@ -307,4 +609,144 @@ int main(void) {
 	if got := string(run); got != "42 42 7\n" {
 		t.Errorf("output %q, want \"42 42 7\\n\"", got)
 	}
+
+	// The DWARF addresses must have resolved at link time: the .debug_info
+	// placeholders were carried by .rela.debug_info, so every subprogram's
+	// low_pc must now equal its linked symbol address.
+	bin, err := os.ReadFile(appPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	lef, err := elf.NewFile(bytes.NewReader(bin))
+	if err != nil {
+		t.Fatalf("parse linked binary: %v", err)
+	}
+	defer lef.Close()
+	syms, err := lef.Symbols()
+	if err != nil {
+		t.Fatal(err)
+	}
+	addrByName := map[string]uint64{}
+	for _, s := range syms {
+		if elf.ST_TYPE(s.Info) == elf.STT_FUNC && s.Value != 0 {
+			addrByName[s.Name] = s.Value
+		}
+	}
+	lowPCs := dwarfSubprogramLowPCs(t, lef)
+	if len(lowPCs) == 0 {
+		t.Fatal("no subprogram DW_AT_low_pc parsed from the linked binary")
+	}
+	for name, pc := range lowPCs {
+		addr, ok := addrByName[name]
+		if !ok {
+			t.Errorf("subprogram %q not in the linked symbol table", name)
+			continue
+		}
+		if pc != addr {
+			t.Errorf("subprogram %q: DW_AT_low_pc = %#x, linked address %#x (DWARF relocation unresolved)", name, pc, addr)
+		}
+	}
+}
+
+// dwarfSubprogramLowPCs walks the linked binary's .debug_info with its own
+// .debug_abbrev and returns each DW_TAG_subprogram's DW_AT_low_pc by name.
+func dwarfSubprogramLowPCs(t *testing.T, ef *elf.File) map[string]uint64 {
+	t.Helper()
+	abbrevSec := ef.Section(".debug_abbrev")
+	infoSec := ef.Section(".debug_info")
+	if abbrevSec == nil || infoSec == nil {
+		t.Fatal("linked binary lacks .debug_abbrev or .debug_info")
+	}
+	abbrev, err := abbrevSec.Data()
+	if err != nil {
+		t.Fatal(err)
+	}
+	info, err := infoSec.Data()
+	if err != nil {
+		t.Fatal(err)
+	}
+	abs := parseAbbrevs(t, abbrev)
+	le := binary.LittleEndian
+	out := map[string]uint64{}
+	r := &ulebIter{b: info}
+	r.uint32At(t) // unit_length
+	if v := le.Uint16(info[4:]); v != 5 {
+		t.Fatalf(".debug_info version %d, want 5", v)
+	}
+	r.i = 6
+	r.byteAt(t)   // unit_type
+	r.byteAt(t)   // address_size
+	r.uint32At(t) // debug_abbrev_offset
+	var name string
+	var lowPC uint64
+	for r.i < len(r.b) {
+		code := r.uleb(t)
+		if code == 0 {
+			continue // end of the CU's children
+		}
+		ab, ok := abs[code]
+		if !ok {
+			t.Fatalf("unknown abbreviation code %d", code)
+		}
+		name, lowPC = "", 0
+		for _, a := range ab.attrs {
+			switch a.attr {
+			case dwAtName:
+				readFormKeep(t, r, a.form, &name, nil)
+			case dwAtLowPC:
+				readFormKeep(t, r, a.form, nil, &lowPC)
+			default:
+				readFormSkip(t, r, a.form)
+			}
+		}
+		if ab.tag == dwTagSubprog && name != "" {
+			out[name] = lowPC
+		}
+	}
+	return out
+}
+
+// readFormKeep reads one DIE attribute value, keeping a string or an
+// address into the pointer it was given (nil keeps nothing).
+func readFormKeep(t *testing.T, r *ulebIter, form uint64, name *string, addr *uint64) {
+	t.Helper()
+	switch form {
+	case dwFormString:
+		end := r.i
+		for end < len(r.b) && r.b[end] != 0 {
+			end++
+		}
+		if name != nil {
+			*name = string(r.b[r.i:end])
+		}
+		r.i = end + 1
+	case dwFormAddr:
+		if addr != nil {
+			*addr = binary.LittleEndian.Uint64(r.b[r.i:])
+		}
+		r.i += 8
+	default:
+		readFormSkip(t, r, form)
+	}
+}
+
+func readFormSkip(t *testing.T, r *ulebIter, form uint64) {
+	t.Helper()
+	switch form {
+	case dwFormString:
+		for r.i < len(r.b) && r.b[r.i] != 0 {
+			r.i++
+		}
+		r.i++
+	case dwFormAddr, dwFormData8:
+		r.i += 8
+	case dwFormSecOff:
+		r.i += 4
+	case dwFormExprloc:
+		r.i += int(r.uleb(t))
+	case dwFormData1, 0x0c:
+		r.i++
+	default:
+		t.Fatalf("unsupported form %#x", form)
+	}
 }

asm/elfarm64.go

@@ -15,7 +15,9 @@ const (
 
 	// AArch64 relocation types (the ELF psABI).
 	rArm64PrelPgHi21   = 275 // R_AARCH64_ADR_PREL_PG_HI21 (ADRP page)
-	rArm64AddAbsLo12NC = 277 // R_AARCH64_ADD_ABS_LO12_NC (ADD/STR/LDR page offset)
+	rArm64AddAbsLo12NC = 277 // R_AARCH64_ADD_ABS_LO12_NC (ADD page offset)
+	rArm64Call26       = 283 // R_AARCH64_CALL26 (BL instruction)
+	rArm64Ldst64Lo12NC = 286 // R_AARCH64_LDST64_ABS_LO12_NC (64-bit LDR/STR page offset)
 )
 
 // ELFAARCH64Object returns the image as an ELF64 relocatable object file for
@@ -79,8 +81,19 @@ func (img *Image) ELFAARCH64Object() ([]byte, error) {
 	}
 
 	// Build relocations.  Each SB reference is an ADRP pair:
-	//   ADRP Rd, 0  → R_AARCH64_ADR_PREL_PG_HI21
-	//   ADD/LDR/STR  → R_AARCH64_ADD_ABS_LO12_NC
+	//   ADRP Rd, 0  → R_AARCH64_ADR_PREL_PG_HI21 at the ADRP
+	//   ADD         → R_AARCH64_ADD_ABS_LO12_NC at the ADD word
+	//   LDR/STR X   → R_AARCH64_LDST64_ABS_LO12_NC at the LDR/STR word
+	//   BL          → R_AARCH64_CALL26
+	// cmd/link's own conversion emits the HI21 at sectoff and the LO12 at
+	// sectoff+4 (cmd/link/internal/arm64/asm.go), so the ADD or load word
+	// carries the page-offset relocation, never a second HI21.  The
+	// assembler records two RelArm64Addr relocs per ADRP+ADD pair (one per
+	// word), so the second of the pair is consumed here.
+	// Addends stay raw: ADR_PREL_PG_HI21 and the ABS_LO12_NC forms resolve
+	// against S+A, and CALL26 branches take the branch instruction's own
+	// place as the PC-relative base, so subtracting the field width (the
+	// amd64 R_PCREL convention) would misplace every branch by 4 bytes.
 	type elfRela struct {
 		off    uint64
 		typ    uint32
@@ -89,22 +102,34 @@ func (img *Image) ELFAARCH64Object() ([]byte, error) {
 	}
 	var relas []elfRela
 	for _, fn := range img.Funcs {
-		for _, r := range fn.Relocs {
+		for i := 0; i < len(fn.Relocs); i++ {
+			r := fn.Relocs[i]
 			idx, ok := symIdx[r.Name]
 			if !ok {
 				return nil, fmt.Errorf("relocation references unknown symbol %q", r.Name)
 			}
-			typ := uint32(rArm64PrelPgHi21)
-			if r.Kind == RelArm64Addr && r.Off%4 == 4 {
-				// The second instruction in an ADRP pair uses ADD_ABS_LO12_NC.
-				typ = rArm64AddAbsLo12NC
+			switch r.Kind {
+			case RelArm64Branch:
+				relas = append(relas, elfRela{
+					off: uint64(fn.Offset + r.Off), typ: rArm64Call26, sym: idx, addend: r.Addend,
+				})
+			case RelArm64Addr:
+				// ADRP+ADD: the pair's second reloc (at Off+4) is the
+				// assembler's twin of the same pair; skip it.
+				relas = append(relas,
+					elfRela{off: uint64(fn.Offset + r.Off), typ: rArm64PrelPgHi21, sym: idx, addend: r.Addend},
+					elfRela{off: uint64(fn.Offset + r.Off + 4), typ: rArm64AddAbsLo12NC, sym: idx, addend: r.Addend},
+				)
+				i++
+			case RelArm64LDST64:
+				// ADRP+LDR/STR: one assembler reloc covers the pair.
+				relas = append(relas,
+					elfRela{off: uint64(fn.Offset + r.Off), typ: rArm64PrelPgHi21, sym: idx, addend: r.Addend},
+					elfRela{off: uint64(fn.Offset + r.Off + 4), typ: rArm64Ldst64Lo12NC, sym: idx, addend: r.Addend},
+				)
+			default:
+				return nil, fmt.Errorf("relocation kind %v unsupported in ELF emission", r.Kind)
 			}
-			relas = append(relas, elfRela{
-				off:    uint64(fn.Offset + r.Off),
-				typ:    typ,
-				sym:    idx,
-				addend: r.Addend - int64(r.After-r.Off),
-			})
 		}
 	}
 
@@ -117,6 +142,9 @@ func (img *Image) ELFAARCH64Object() ([]byte, error) {
 	for _, n := range []string{".text", ".data", ".symtab", ".strtab", ".rela.text", ".shstrtab"} {
 		stSections.add(n)
 	}
+	for _, n := range dwarfSectionNames {
+		stSections.add(n)
+	}
 
 	hasRela := len(relas) > 0
 	nSections := 6
@@ -176,6 +204,34 @@ func (img *Image) ELFAARCH64Object() ([]byte, error) {
 	shstrOff := len(out)
 	out = append(out, stSections.bytes()...)
 
+	// DWARF debug sections; the address placeholders they leave are carried
+	// as .rela.debug_info/.rela.debug_line entries the system linker applies.
+	dwAlign := func(n int) {
+		for len(out)%n != 0 {
+			out = append(out, 0)
+		}
+	}
+	dw := appendDWARFSections(&out, img, dwarfSourceName(img), symIdx, dwAlign, cfiARM64)
+	dwarfStart := 0 // section index of .debug_abbrev, set when DWARF is present
+	if dw != nil {
+		// Five DWARF sections: .debug_abbrev, .debug_info, .debug_line,
+		// .debug_line_str and .debug_frame (the CIE is unconditional, so
+		// the frame section is always present), plus the relocation
+		// sections below when they carry entries.
+		dwarfStart = nSections
+		nSections += 5
+		appendDWARFRelas(&out, dw, rAARCH64Abs64, dwAlign)
+		if dw.infoRelaCount > 0 {
+			nSections++
+		}
+		if dw.lineRelaCount > 0 {
+			nSections++
+		}
+		if dw.frameRelaCount > 0 {
+			nSections++
+		}
+	}
+
 	align(8)
 	shoff := len(out)
 
@@ -202,6 +258,39 @@ func (img *Image) ELFAARCH64Object() ([]byte, error) {
 		putSh(".rela.text", shtRela, 0, relaOff, 24*len(relas), secSymtab, secText, 8, 24)
 	}
 	putSh(".shstrtab", shtStrtab, 0, shstrOff, len(stSections.bytes()), 0, 0, 1, 0)
+	// DWARF section headers; their indices follow the write order.
+	if dw != nil {
+		// secIdx is a running section index: each putSh below emits the
+		// next header, and the sh_info of a .rela section names the index
+		// of the section it relocates.
+		secIdx := dwarfStart
+		putSh(".debug_abbrev", shtProgbits, 0, dw.abbrevOff, dw.abbrevSize, 0, 0, 1, 0)
+		secIdx++
+		putSh(".debug_info", shtProgbits, 0, dw.infoOff, dw.infoSize, 0, 0, 1, 0)
+		secInfoIdx := secIdx
+		secIdx++
+		if dw.infoRelaCount > 0 {
+			putSh(".rela.debug_info", shtRela, 0, dw.infoRelaOff, 24*dw.infoRelaCount, secSymtab, secInfoIdx, 8, 24)
+			secIdx++
+		}
+		putSh(".debug_line", shtProgbits, 0, dw.lineOff, dw.lineSize, 0, 0, 1, 0)
+		secLineIdx := secIdx
+		secIdx++
+		if dw.lineRelaCount > 0 {
+			putSh(".rela.debug_line", shtRela, 0, dw.lineRelaOff, 24*dw.lineRelaCount, secSymtab, secLineIdx, 8, 24)
+			secIdx++
+		}
+		putSh(".debug_line_str", shtProgbits, 0, dw.lineStrOff, dw.lineStrSize, 0, 0, 1, 0)
+		secIdx++
+		if dw.frameSize > 0 {
+			putSh(".debug_frame", shtProgbits, 0, dw.frameOff, dw.frameSize, 0, 0, 8, 0)
+			secFrameIdx := secIdx
+			secIdx++
+			if dw.frameRelaCount > 0 {
+				putSh(".rela.debug_frame", shtRela, 0, dw.frameRelaOff, 24*dw.frameRelaCount, secSymtab, secFrameIdx, 8, 24)
+			}
+		}
+	}
 
 	// ELF header.
 	hdr := out[:64]

asm/elfarm64_test.go

@@ -6,6 +6,7 @@ package asm
 import (
 	"bytes"
 	"debug/elf"
+	"encoding/binary"
 	"testing"
 
 	"sourcedock.dev/petrbalvin/gasm-devkit/parser"
@@ -28,6 +29,7 @@ TEXT ·add(SB), NOSPLIT, $0-24
 
 TEXT ·getanswer(SB), NOSPLIT, $0-8
 	MOVD answer<>(SB), R4
+	MOVD $answer<>(SB), R5
 	MOVD R4, ret+0(FP)
 	RET
 
@@ -102,8 +104,63 @@ DATA answer<>+0(SB)/8, $42
 	// Check that .rela.text exists (getanswer has SB reference).
 	relaText := ef.Section(".rela.text")
 	if relaText == nil {
-		t.Error("missing .rela.text section")
+		t.Fatal("missing .rela.text section")
 	}
+
+	// The SB references of getanswer form two ADRP pairs: the load
+	// (MOVD answer<>(SB), R4) is ADRP+LDR carrying HI21 at the ADRP and
+	// LDST64_ABS_LO12_NC at the LDR word, and the address-of
+	// (MOVD $answer<>(SB), R5) is ADRP+ADD carrying HI21 and
+	// ADD_ABS_LO12_NC.  cmd/link's own conversion emits exactly this
+	// sectoff / sectoff+4 pairing; a second HI21 at the ADD or LDR word
+	// corrupts the pair.
+	raw, err := relaText.Data()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(raw)%24 != 0 || len(raw)/24 != 4 {
+		t.Fatalf(".rela.text has %d bytes, want four 24-byte entries", len(raw))
+	}
+	wantRela := []struct {
+		typ elf.R_AARCH64
+		off uint64 // relative to the getanswer function start
+	}{
+		{elf.R_AARCH64_ADR_PREL_PG_HI21, 0},
+		{elf.R_AARCH64_LDST64_ABS_LO12_NC, 4},
+		{elf.R_AARCH64_ADR_PREL_PG_HI21, 8},
+		{elf.R_AARCH64_ADD_ABS_LO12_NC, 12},
+	}
+	getanswer := byNameElf(t, ef, "getanswer")
+	for i, w := range wantRela {
+		e := raw[i*24 : (i+1)*24]
+		off := binary.LittleEndian.Uint64(e[0:])
+		info := binary.LittleEndian.Uint64(e[8:])
+		typ := elf.R_AARCH64(info & 0xffffffff)
+		sym := int(info >> 32)
+		if typ != w.typ || off != getanswer.Value+w.off {
+			t.Errorf("reloc %d: type %v off %d, want %v at %d", i, typ, off, w.typ, getanswer.Value+w.off)
+		}
+		if sym != 3 { // NULL, .text, .data, then the first local: answer
+			t.Errorf("reloc %d: symbol index %d, want 3 (answer)", i, sym)
+		}
+	}
+}
+
+// byNameElf returns the symbol table entry for name from the raw .symtab,
+// which carries every entry including the null and section symbols in order.
+func byNameElf(t *testing.T, ef *elf.File, name string) elf.Symbol {
+	t.Helper()
+	syms, err := ef.Symbols()
+	if err != nil {
+		t.Fatalf("symbols: %v", err)
+	}
+	for _, s := range syms {
+		if s.Name == name {
+			return s
+		}
+	}
+	t.Fatalf("symbol %q not found", name)
+	return elf.Symbol{}
 }
 
 // TestELFAARCH64ObjectNoRelocations checks the ELF output when there are no

asm/elfloong64.go

@@ -13,9 +13,16 @@ import (
 const (
 	emLOONGARCH = 258 // EM_LOONGARCH
 
+	// EF_LOONGARCH_ABI_DOUBLE_FLOAT | EF_LOONGARCH_OBJABI_V1: the flags the
+	// Go toolchain writes (cmd/link/internal/ld/elf.go: Flags = 0x43 for
+	// Loong64).  System linkers refuse to merge ET_REL objects whose float
+	// ABI differs, so 0 (soft-float) would make the object unlinkable.
+	efLarchAbiDoubleObjV1 = 0x43
+
 	// LoongArch relocation types (the ELF psABI).
 	rLarchPCALAHI20 = 71 // R_LARCH_PCALA_HI20 (pcalau12i)
 	rLarchPCALALO12 = 72 // R_LARCH_PCALA_LO12 (addi.d/ld/st)
+	rLarchB26       = 66 // R_LARCH_B26 (b/bl, matches the Go linker's mapping)
 )
 
 // ELFLOONG64Object returns the image as an ELF64 relocatable object file for
@@ -95,14 +102,17 @@ func (img *Image) ELFLOONG64Object() ([]byte, error) {
 				return nil, fmt.Errorf("relocation references unknown symbol %q", r.Name)
 			}
 			typ := uint32(rLarchPCALAHI20)
-			if r.Kind == RelLoong64AddrLo {
+			switch r.Kind {
+			case RelLoong64AddrLo:
 				typ = rLarchPCALALO12
+			case RelLoong64Branch:
+				typ = rLarchB26
 			}
 			relas = append(relas, elfRela{
 				off:    uint64(fn.Offset + r.Off),
 				typ:    typ,
 				sym:    idx,
-				addend: r.Addend - int64(r.After-r.Off),
+				addend: r.Addend,
 			})
 		}
 	}
@@ -116,6 +126,9 @@ func (img *Image) ELFLOONG64Object() ([]byte, error) {
 	for _, n := range []string{".text", ".data", ".symtab", ".strtab", ".rela.text", ".shstrtab"} {
 		stSections.add(n)
 	}
+	for _, n := range dwarfSectionNames {
+		stSections.add(n)
+	}
 
 	hasRela := len(relas) > 0
 	nSections := 6
@@ -175,6 +188,32 @@ func (img *Image) ELFLOONG64Object() ([]byte, error) {
 	shstrOff := len(out)
 	out = append(out, stSections.bytes()...)
 
+	dwAlign := func(n int) {
+		for len(out)%n != 0 {
+			out = append(out, 0)
+		}
+	}
+	dw := appendDWARFSections(&out, img, dwarfSourceName(img), symIdx, dwAlign, cfiLOONG64)
+	dwarfStart := 0 // section index of .debug_abbrev, set when DWARF is present
+	if dw != nil {
+		// Five DWARF sections: .debug_abbrev, .debug_info, .debug_line,
+		// .debug_line_str and .debug_frame (the CIE is unconditional, so
+		// the frame section is always present), plus the relocation
+		// sections below when they carry entries.
+		dwarfStart = nSections
+		nSections += 5
+		appendDWARFRelas(&out, dw, rLarchAbs64, dwAlign)
+		if dw.infoRelaCount > 0 {
+			nSections++
+		}
+		if dw.lineRelaCount > 0 {
+			nSections++
+		}
+		if dw.frameRelaCount > 0 {
+			nSections++
+		}
+	}
+
 	align(8)
 	shoff := len(out)
 
@@ -201,6 +240,39 @@ func (img *Image) ELFLOONG64Object() ([]byte, error) {
 		putSh(".rela.text", shtRela, 0, relaOff, 24*len(relas), secSymtab, secText, 8, 24)
 	}
 	putSh(".shstrtab", shtStrtab, 0, shstrOff, len(stSections.bytes()), 0, 0, 1, 0)
+	// DWARF section headers; their indices follow the write order.
+	if dw != nil {
+		// secIdx is a running section index: each putSh below emits the
+		// next header, and the sh_info of a .rela section names the index
+		// of the section it relocates.
+		secIdx := dwarfStart
+		putSh(".debug_abbrev", shtProgbits, 0, dw.abbrevOff, dw.abbrevSize, 0, 0, 1, 0)
+		secIdx++
+		putSh(".debug_info", shtProgbits, 0, dw.infoOff, dw.infoSize, 0, 0, 1, 0)
+		secInfoIdx := secIdx
+		secIdx++
+		if dw.infoRelaCount > 0 {
+			putSh(".rela.debug_info", shtRela, 0, dw.infoRelaOff, 24*dw.infoRelaCount, secSymtab, secInfoIdx, 8, 24)
+			secIdx++
+		}
+		putSh(".debug_line", shtProgbits, 0, dw.lineOff, dw.lineSize, 0, 0, 1, 0)
+		secLineIdx := secIdx
+		secIdx++
+		if dw.lineRelaCount > 0 {
+			putSh(".rela.debug_line", shtRela, 0, dw.lineRelaOff, 24*dw.lineRelaCount, secSymtab, secLineIdx, 8, 24)
+			secIdx++
+		}
+		putSh(".debug_line_str", shtProgbits, 0, dw.lineStrOff, dw.lineStrSize, 0, 0, 1, 0)
+		secIdx++
+		if dw.frameSize > 0 {
+			putSh(".debug_frame", shtProgbits, 0, dw.frameOff, dw.frameSize, 0, 0, 8, 0)
+			secFrameIdx := secIdx
+			secIdx++
+			if dw.frameRelaCount > 0 {
+				putSh(".rela.debug_frame", shtRela, 0, dw.frameRelaOff, 24*dw.frameRelaCount, secSymtab, secFrameIdx, 8, 24)
+			}
+		}
+	}
 
 	// ELF header.
 	hdr := out[:64]
@@ -211,7 +283,7 @@ func (img *Image) ELFLOONG64Object() ([]byte, error) {
 	le.PutUint64(hdr[24:], 0)
 	le.PutUint64(hdr[32:], 0)
 	le.PutUint64(hdr[40:], uint64(shoff))
-	le.PutUint32(hdr[48:], 0)
+	le.PutUint32(hdr[48:], efLarchAbiDoubleObjV1)
 	le.PutUint16(hdr[52:], 64)
 	le.PutUint16(hdr[54:], 0)
 	le.PutUint16(hdr[56:], 0)

asm/elfloong64_test.go

@@ -55,6 +55,11 @@ DATA answer<>+0(SB)/8, $42
 	if ef.Type != elf.ET_REL || ef.Machine != elf.EM_LOONGARCH {
 		t.Errorf("type/machine = %v/%v, want ET_REL/EM_LOONGARCH", ef.Type, ef.Machine)
 	}
+	// The double-float ABI plus OBJABI_V1 flags the Go toolchain writes;
+	// system linkers refuse ABI-mismatched merges.
+	if flags := binary.LittleEndian.Uint32(obj[48:]); flags != efLarchAbiDoubleObjV1 {
+		t.Errorf("e_flags = %#x, want %#x (double-float, OBJABI_V1)", flags, efLarchAbiDoubleObjV1)
+	}
 
 	text := ef.Section(".text")
 	data := ef.Section(".data")
@@ -139,7 +144,7 @@ DATA answer<>+0(SB)/8, $42
 		t.Fatalf(".rela.text has %d bytes, want two 24-byte entries", len(raw))
 	}
 	le := binary.LittleEndian
-	for i := 0; i < 2; i++ {
+	for i := range 2 {
 		e := raw[i*24 : (i+1)*24]
 		off := le.Uint64(e[0:])
 		info := le.Uint64(e[8:])
@@ -198,3 +203,45 @@ TEXT ·nop(SB), NOSPLIT, $0
 		t.Error("function symbol nop not found")
 	}
 }
+
+// TestELFLOONG64BranchRelocation checks that the morestack call and an
+// internal CALL both carry R_LARCH_B26 in the emitted object, matching the
+// Go linker's mapping of its call relocation.
+func TestELFLOONG64BranchRelocation(t *testing.T) {
+	f, errs := parser.Parse("k_loong64.s", "TEXT \u00b7callbig(SB), $8192-0\n\tCALL \u00b7other(SB)\n\tRET\nTEXT \u00b7other(SB), NOSPLIT, $0\n\tRET\n")
+	if len(errs) > 0 {
+		t.Fatalf("parse: %v", errs)
+	}
+	img, err := AssembleFileLOONG64(f)
+	if err != nil {
+		t.Fatalf("AssembleFileLOONG64: %v", err)
+	}
+	obj, err := img.ELFLOONG64Object()
+	if err != nil {
+		t.Fatalf("ELFLOONG64Object: %v", err)
+	}
+	ef, err := elf.NewFile(bytes.NewReader(obj))
+	if err != nil {
+		t.Fatalf("parse emitted object: %v", err)
+	}
+	defer ef.Close()
+	relaSec := ef.Section(".rela.text")
+	if relaSec == nil {
+		t.Fatal("missing .rela.text")
+	}
+	raw, err := relaSec.Data()
+	if err != nil {
+		t.Fatal(err)
+	}
+	// The guard's morestack call plus the body's CALL to other.
+	if len(raw)%24 != 0 || len(raw)/24 != 2 {
+		t.Fatalf(".rela.text has %d bytes, want two 24-byte entries", len(raw))
+	}
+	le := binary.LittleEndian
+	for i := range 2 {
+		info := le.Uint64(raw[i*24+8:])
+		if elf.R_LARCH(info&0xffffffff) != elf.R_LARCH_B26 {
+			t.Errorf("relocation %d type = %v, want R_LARCH_B26", i, elf.R_LARCH(info&0xffffffff))
+		}
+	}
+}

asm/elfriscv.go

@@ -13,8 +13,13 @@ import (
 const (
 	emRISCV = 243 // EM_RISCV
 
+	// EF_RISCV_FLOAT_ABI_DOUBLE: the double-precision float ABI the Go
+	// toolchain targets (cmd/link/internal/ld/elf.go writes Flags = 0x4 for
+	// RISCV64).  System linkers refuse to merge ET_REL objects whose float
+	// ABI differs, so 0 (soft-float) would make the object unlinkable.
+	efRISCVFloatAbiDouble = 0x4
+
 	// RISC-V relocation types.
-	rRISCV32         = 1
 	rRISCVJAL        = 17 // R_RISCV_JAL
 	rRISCVPCRELHI20  = 23 // R_RISCV_PCREL_HI20
 	rRISCVPCRELLO12I = 24 // R_RISCV_PCREL_LO12_I
@@ -83,9 +88,14 @@ func (img *Image) ELFRISCVObject() ([]byte, error) {
 	// Build relocations.  Each SB reference is an AUIPC + second-instruction
 	// pair carrying a single relocation kind; the ELF writer expands it into
 	// the R_RISCV_PCREL_HI20 + R_RISCV_PCREL_LO12_I/S pair the psABI expects.
-	// The HI20 carries the symbol addend; the LO12 addend is zero, matching
-	// cmd/link's own ELF conversion (the LO12 resolves against the HI20's
-	// AUIPC location).
+	// The HI20 carries the symbol and its addend.  The LO12's symbol must
+	// denote the AUIPC site the HI20 relocates (psABI §8.4.9: the pair is
+	// resolved against the label of the AUIPC, not the target symbol;
+	// cmd/link generates one local text symbol per AUIPC for exactly this,
+	// cmd/link/internal/riscv64/asm.go).  The .text section symbol with the
+	// AUIPC's section-relative offset as addend gives S + A = the AUIPC
+	// address, which is that label.
+	const secSymText = 1 // syms[1], the .text section symbol
 	type elfRela struct {
 		off    uint64
 		typ    uint32
@@ -99,21 +109,20 @@ func (img *Image) ELFRISCVObject() ([]byte, error) {
 			if !ok {
 				return nil, fmt.Errorf("relocation references unknown symbol %q", r.Name)
 			}
+			auipc := int64(fn.Offset + r.Off)
 			switch r.Kind {
 			case RelRISCVPCRELIType:
 				relas = append(relas,
 					elfRela{off: uint64(fn.Offset + r.Off), typ: rRISCVPCRELHI20, sym: idx, addend: r.Addend},
-					elfRela{off: uint64(fn.Offset + r.Off + 4), typ: rRISCVPCRELLO12I, sym: idx, addend: 0},
+					elfRela{off: uint64(fn.Offset + r.Off + 4), typ: rRISCVPCRELLO12I, sym: secSymText, addend: auipc},
 				)
 			case RelRISCVPCRELSType:
 				relas = append(relas,
 					elfRela{off: uint64(fn.Offset + r.Off), typ: rRISCVPCRELHI20, sym: idx, addend: r.Addend},
-					elfRela{off: uint64(fn.Offset + r.Off + 4), typ: rRISCVPCRELLO12S, sym: idx, addend: 0},
+					elfRela{off: uint64(fn.Offset + r.Off + 4), typ: rRISCVPCRELLO12S, sym: secSymText, addend: auipc},
 				)
 			case RelRISCVJal:
 				relas = append(relas, elfRela{off: uint64(fn.Offset + r.Off), typ: rRISCVJAL, sym: idx, addend: r.Addend})
-			case RelPCRelAbs:
-				relas = append(relas, elfRela{off: uint64(fn.Offset + r.Off), typ: rRISCV32, sym: idx, addend: r.Addend})
 			default:
 				return nil, fmt.Errorf("relocation kind %v unsupported in ELF emission", r.Kind)
 			}
@@ -129,6 +138,9 @@ func (img *Image) ELFRISCVObject() ([]byte, error) {
 	for _, n := range []string{".text", ".data", ".symtab", ".strtab", ".rela.text", ".shstrtab"} {
 		stSections.add(n)
 	}
+	for _, n := range dwarfSectionNames {
+		stSections.add(n)
+	}
 
 	hasRela := len(relas) > 0
 	nSections := 6
@@ -188,6 +200,32 @@ func (img *Image) ELFRISCVObject() ([]byte, error) {
 	shstrOff := len(out)
 	out = append(out, stSections.bytes()...)
 
+	dwAlign := func(n int) {
+		for len(out)%n != 0 {
+			out = append(out, 0)
+		}
+	}
+	dw := appendDWARFSections(&out, img, dwarfSourceName(img), symIdx, dwAlign, cfiRISCV64)
+	dwarfStart := 0 // section index of .debug_abbrev, set when DWARF is present
+	if dw != nil {
+		// Five DWARF sections: .debug_abbrev, .debug_info, .debug_line,
+		// .debug_line_str and .debug_frame (the CIE is unconditional, so
+		// the frame section is always present), plus the relocation
+		// sections below when they carry entries.
+		dwarfStart = nSections
+		nSections += 5
+		appendDWARFRelas(&out, dw, rRISCVAbs64, dwAlign)
+		if dw.infoRelaCount > 0 {
+			nSections++
+		}
+		if dw.lineRelaCount > 0 {
+			nSections++
+		}
+		if dw.frameRelaCount > 0 {
+			nSections++
+		}
+	}
+
 	align(8)
 	shoff := len(out)
 
@@ -214,6 +252,39 @@ func (img *Image) ELFRISCVObject() ([]byte, error) {
 		putSh(".rela.text", shtRela, 0, relaOff, 24*len(relas), secSymtab, secText, 8, 24)
 	}
 	putSh(".shstrtab", shtStrtab, 0, shstrOff, len(stSections.bytes()), 0, 0, 1, 0)
+	// DWARF section headers; their indices follow the write order.
+	if dw != nil {
+		// secIdx is a running section index: each putSh below emits the
+		// next header, and the sh_info of a .rela section names the index
+		// of the section it relocates.
+		secIdx := dwarfStart
+		putSh(".debug_abbrev", shtProgbits, 0, dw.abbrevOff, dw.abbrevSize, 0, 0, 1, 0)
+		secIdx++
+		putSh(".debug_info", shtProgbits, 0, dw.infoOff, dw.infoSize, 0, 0, 1, 0)
+		secInfoIdx := secIdx
+		secIdx++
+		if dw.infoRelaCount > 0 {
+			putSh(".rela.debug_info", shtRela, 0, dw.infoRelaOff, 24*dw.infoRelaCount, secSymtab, secInfoIdx, 8, 24)
+			secIdx++
+		}
+		putSh(".debug_line", shtProgbits, 0, dw.lineOff, dw.lineSize, 0, 0, 1, 0)
+		secLineIdx := secIdx
+		secIdx++
+		if dw.lineRelaCount > 0 {
+			putSh(".rela.debug_line", shtRela, 0, dw.lineRelaOff, 24*dw.lineRelaCount, secSymtab, secLineIdx, 8, 24)
+			secIdx++
+		}
+		putSh(".debug_line_str", shtProgbits, 0, dw.lineStrOff, dw.lineStrSize, 0, 0, 1, 0)
+		secIdx++
+		if dw.frameSize > 0 {
+			putSh(".debug_frame", shtProgbits, 0, dw.frameOff, dw.frameSize, 0, 0, 8, 0)
+			secFrameIdx := secIdx
+			secIdx++
+			if dw.frameRelaCount > 0 {
+				putSh(".rela.debug_frame", shtRela, 0, dw.frameRelaOff, 24*dw.frameRelaCount, secSymtab, secFrameIdx, 8, 24)
+			}
+		}
+	}
 
 	// ELF header.
 	hdr := out[:64]
@@ -224,7 +295,7 @@ func (img *Image) ELFRISCVObject() ([]byte, error) {
 	le.PutUint64(hdr[24:], 0)
 	le.PutUint64(hdr[32:], 0)
 	le.PutUint64(hdr[40:], uint64(shoff))
-	le.PutUint32(hdr[48:], 0)
+	le.PutUint32(hdr[48:], efRISCVFloatAbiDouble)
 	le.PutUint16(hdr[52:], 64)
 	le.PutUint16(hdr[54:], 0)
 	le.PutUint16(hdr[56:], 0)

asm/encodable.go

@@ -0,0 +1,125 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: BSD-3-Clause
+
+package asm
+
+import "strings"
+
+// Encodable reports whether the amd64 encoder knows how to encode the
+// mnemonic.  It mirrors the dispatch in (*enc).encode: the fixed-name
+// instructions, conditional jumps, the CMOV/SET condition families, the
+// VEX/EVEX/opmask/gather/scatter vector paths, the legacy SSE tables and the
+// explicit scalar cases.  A mnemonic that parses (is in the architecture
+// table) but is not encodable would otherwise surface only at assembly time,
+// deep inside a build; the linter uses this predicate to flag it at edit
+// time.
+func Encodable(mnemonic string) bool {
+	upper := strings.ToUpper(mnemonic)
+
+	// Fixed-name instructions (no size suffix).
+	switch upper {
+	case "RET", "NOP", "CALL", "JMP",
+		"POPFQ", "PUSHFQ", "INT", "LDMXCSR", "STMXCSR", "CMPSD", "SHA256RNDS2":
+		return true
+	}
+	if _, ok := noOperandTable[upper]; ok {
+		return true
+	}
+	if _, ok := condCode(upper); ok {
+		return true
+	}
+
+	// VEX/EVEX and friends: the trailing B/W/L/Q/D is part of the mnemonic.
+	base, _, err := parseEvexSuffix(upper)
+	if err != nil {
+		return false
+	}
+	if isVex(base) || isEvex(base) || isKOp(base) || isGather(base) || isScatter(base) ||
+		base == "KMOVW" || base == "KMOVQ" || base == "KMOVB" || base == "KMOVD" {
+		return true
+	}
+
+	// CMOV carries size then condition (CMOVLGT); SET carries the condition
+	// alone (SETNE).  The size letter is checked exactly as encodeCmov does,
+	// so a spelling like CMOVBGT is not reported encodable when Encode
+	// would reject it.
+	if rest, ok := strings.CutPrefix(upper, "CMOV"); ok && len(rest) >= 2 {
+		switch rest[0] {
+		case 'W', 'L', 'Q':
+			if _, ok := jccMap[rest[1:]]; ok {
+				return true
+			}
+		}
+	}
+	if rest, ok := strings.CutPrefix(upper, "SET"); ok {
+		if _, ok := jccMap[rest]; ok {
+			return true
+		}
+	}
+
+	// Legacy SSE shuffles and packed binaries dispatch on the full name; so
+	// do the imm8-controlled instructions, the lane extracts and inserts and
+	// the packed integer shifts (their trailing width letters belong to the
+	// mnemonic).
+	if _, ok := sseShufTable[upper]; ok {
+		return true
+	}
+	if _, ok := sseBinTable[upper]; ok {
+		return true
+	}
+	if _, ok := sseImm3Table[upper]; ok {
+		return true
+	}
+	if _, ok := sseExtractTable[upper]; ok {
+		return true
+	}
+	if _, ok := sseInsertTable[upper]; ok {
+		return true
+	}
+	if _, ok := sseShiftImm[upper]; ok {
+		return true
+	}
+
+	// The size-suffix split: retry the tables and the scalar switch on the
+	// base.
+	base2, size := splitSize(upper)
+	if size == 0 {
+		size = 8
+	}
+	_ = size
+	if base2 != upper {
+		if _, ok := sseBinTable[base2]; ok {
+			return true
+		}
+	}
+	switch base2 {
+	case "MOV", "MOVD",
+		"ADD", "SUB", "AND", "OR", "XOR", "CMP", "ADC", "SBB",
+		"TEST",
+		"LEA",
+		"INC", "DEC", "NEG", "NOT", "MUL", "DIV", "IDIV",
+		"SHL", "SHR", "SAR", "SAL", "ROL", "ROR", "RCL", "RCR",
+		"BT", "BTS", "BTR", "BTC",
+		"XCHG", "CMPXCHG", "XADD", "CRC32", "ADCX", "ADOX",
+		"MOVS", "STOS",
+		"IMUL", "IMUL3",
+		"PUSH", "POP",
+		"BSF", "BSR", "LZCNT", "TZCNT", "POPCNT",
+		"BSWAP",
+		"PREFETCHNTA", "PREFETCHT0", "PREFETCHT1", "PREFETCHT2",
+		"MOVBLZX", "MOVBQZX", "MOVWLZX", "MOVWQZX", "MOVWLSX", "MOVLQSX",
+		"MOVBWZX", "MOVBWSX", "MOVBLSX", "MOVBQSX", "MOVWQSX", "MOVLQZX",
+		"CVTSL2SD", "CVTSQ2SD",
+		"CVTSD2S", "CVTTSD2S", "CVTSS2S", "CVTTSS2S",
+		"FMOVD",
+		"MOVOU", "MOVO", "MOVOA", "MOVUPS", "MOVAPS", "MOVUPD", "MOVAPD", "MOVSD", "MOVSS":
+		return true
+	}
+	// Full-name dispatches the size split would eat (a trailing width
+	// letter that is part of the mnemonic).
+	switch upper {
+	case "PMOVMSKB":
+		return true
+	}
+	return false
+}

asm/encode.go

@@ -40,14 +40,59 @@ func (e *enc) encode(mnem string, ops []Operand) error {
 		return e.encodeRet()
 	case upper == "NOP":
 		return e.emit(&instr{opcode: []byte{0x90}, modrm: -1, sib: -1})
-	case upper == "CALL":
-		return e.encodeJmpRel(ops, []byte{0xE8})
-	case upper == "JMP":
-		return e.encodeJmpRel(ops, []byte{0xE9})
+	case upper == "CALL" || upper == "JMP":
+		// Through a register or memory: FF /2 (CALL) or FF /4 (JMP).
+		// Anything else is a rel32 against a label resolved by the assembler.
+		if len(ops) == 1 {
+			switch ops[0].(type) {
+			case Reg, Mem:
+				return e.encodeIndirectBranch(upper, ops)
+			}
+		}
+		opcode := []byte{0xE8}
+		if upper == "JMP" {
+			opcode = []byte{0xE9}
+		}
+		return e.encodeJmpRel(ops, opcode)
 	}
 	if cc, ok := condCode(upper); ok {
 		return e.encodeJcc(cc, ops)
 	}
+	// No-operand system and string-control instructions (CPUID, RDTSC,
+	// SYSCALL, the fences, UNDEF, …).
+	if op, ok := noOperandTable[upper]; ok {
+		if len(ops) != 0 {
+			return fmt.Errorf("%s takes no operands, got %d", upper, len(ops))
+		}
+		return e.emit(&instr{opcode: op, modrm: -1, sib: -1})
+	}
+	// POPFQ/PUSHFQ are exact names: the bare POPF/PUSHF and the L spellings
+	// are rejected by go tool asm in 64-bit mode, so they stay unsupported.
+	switch upper {
+	case "POPFQ":
+		if len(ops) != 0 {
+			return fmt.Errorf("POPFQ takes no operands, got %d", len(ops))
+		}
+		return e.emit(&instr{opcode: []byte{0x9D}, modrm: -1, sib: -1})
+	case "PUSHFQ":
+		if len(ops) != 0 {
+			return fmt.Errorf("PUSHFQ takes no operands, got %d", len(ops))
+		}
+		return e.emit(&instr{opcode: []byte{0x9C}, modrm: -1, sib: -1})
+	case "INT":
+		return e.encodeInt(ops)
+	case "LDMXCSR":
+		return e.encodeMxcsr(2, ops)
+	case "STMXCSR":
+		return e.encodeMxcsr(3, ops)
+	// CMPSD is the scalar double compare, whose predicate immediate comes
+	// LAST in Plan 9 order (src, dst, $imm).
+	case "CMPSD":
+		return e.encodeCmpsd(ops)
+	// SHA256RNDS2 carries the round constant in a literal X0 first operand.
+	case "SHA256RNDS2":
+		return e.encodeSha256rnds2(ops)
+	}
 
 	// VEX (AVX/AVX2) and EVEX (AVX-512) instructions: the trailing
 	// B/W/L/Q/D is part of the mnemonic, not a size suffix, so dispatch
@@ -57,7 +102,8 @@ func (e *enc) encode(mnem string, ops []Operand) error {
 	if err != nil {
 		return err
 	}
-	if isVex(base) || isEvex(base) || isKOp(base) || isGather(base) || isScatter(base) || base == "KMOVW" || base == "KMOVQ" {
+	if isVex(base) || isEvex(base) || isKOp(base) || isGather(base) || isScatter(base) ||
+		base == "KMOVW" || base == "KMOVQ" || base == "KMOVB" || base == "KMOVD" {
 		return e.encodeVec(base, ops, sfx)
 	}
 	if sfx.any() {
@@ -76,37 +122,125 @@ func (e *enc) encode(mnem string, ops []Operand) error {
 	if size == 0 {
 		size = 8 // default operand size in 64-bit mode (e.g. PUSHQ)
 	}
+	// Legacy SSE imm8 shuffles whose names end in W/H (PSHUFLW,
+	// PSHUFHW) must dispatch BEFORE the size-suffix split, and the
+	// others ride along.
+	if m, ok := sseShufTable[upper]; ok {
+		return e.encodeSSEShuf(m, ops)
+	}
+	// Legacy SSE packed binaries dispatch on the full name: the packed
+	// integer mnemonics carry real width suffixes (PADDB/PCMPGTW/...),
+	// which the size split must not eat.
+	if m, ok := sseBinTable[upper]; ok {
+		return e.encodeSSEBin(m, ops)
+	}
+	if m, ok := sseBinTable[base]; ok {
+		return e.encodeSSEBin(m, ops)
+	}
+	// The imm8-controlled legacy instructions, the lane extracts and inserts
+	// and the packed integer shifts all dispatch on the full name: a trailing
+	// width letter here belongs to the mnemonic, not to the size split.
+	if m, ok := sseImm3Table[upper]; ok {
+		return e.encodeSSEImm3(m, ops)
+	}
+	if m, ok := sseExtractTable[upper]; ok {
+		return e.encodeSSEExtract(m, ops)
+	}
+	if m, ok := sseInsertTable[upper]; ok {
+		return e.encodeSSEInsert(m, ops)
+	}
+	if _, ok := sseShiftImm[upper]; ok {
+		return e.encodeSSEShift(upper, ops)
+	}
+	// PMOVMSKB ends in a width letter the size split would eat, so it
+	// dispatches on the full name like the packed binaries above.
+	if upper == "PMOVMSKB" {
+		return e.encodePmovmskb(upper, ops)
+	}
 	switch base {
 	case "MOV":
 		return e.encodeMov(ops, size)
-	case "ADD", "SUB", "AND", "OR", "XOR", "CMP":
+	// MOVD is the Go assembler's alias of MOVQ: the same byte forms, 64-bit
+	// REX.W and all.
+	case "MOVD":
+		return e.encodeMov(ops, 8)
+	case "ADD", "SUB", "AND", "OR", "XOR", "CMP", "ADC", "SBB":
 		return e.encodeALU(aluOp[base], ops, size)
 	case "TEST":
 		return e.encodeTest(ops, size)
 	case "LEA":
 		return e.encodeLea(ops, size)
-	case "INC", "DEC", "NEG", "NOT":
+	case "INC", "DEC", "NEG", "NOT", "MUL", "DIV", "IDIV":
 		return e.encodeUnary(unaryOp[base], ops, size)
-	case "SHL", "SHR", "SAR":
+	case "SHL", "SHR", "SAR", "SAL", "ROL", "ROR", "RCL", "RCR":
 		return e.encodeShift(shiftOp[base], ops, size)
+	case "BT", "BTS", "BTR", "BTC":
+		return e.encodeBitTest(base, ops, size)
+	case "XCHG":
+		return e.encodeExchange(ops, size)
+	case "CMPXCHG":
+		return e.encodeRegRegOp(0xB0, 0xB1, base, ops, size)
+	case "XADD":
+		return e.encodeRegRegOp(0xC0, 0xC1, base, ops, size)
+	case "CRC32":
+		return e.encodeCrc32(ops, size)
+	case "ADCX":
+		return e.encodeCarryExt(0x66, ops, size)
+	case "ADOX":
+		return e.encodeCarryExt(0xF3, ops, size)
+	case "MOVS", "STOS":
+		return e.encodeStringOp(base, ops, size)
 	case "IMUL", "IMUL3":
 		return e.encodeImul(ops, size)
 	case "PUSH":
-		return e.encodePushPop(ops, true)
+		return e.encodePushPop(ops, size, true)
 	case "POP":
-		return e.encodePushPop(ops, false)
-	case "LZCNT", "TZCNT":
+		return e.encodePushPop(ops, size, false)
+	case "BSF", "BSR", "LZCNT", "TZCNT", "POPCNT":
 		return e.encodeCount(base, ops, size)
-	case "MOVBLZX", "MOVBQZX", "MOVWLZX", "MOVWQZX", "MOVWLSX", "MOVLQSX":
+	case "BSWAP":
+		return e.encodeBswap(ops, size)
+	case "PREFETCHNTA", "PREFETCHT0", "PREFETCHT1", "PREFETCHT2":
+		return e.encodePrefetch(base, ops)
+	case "MOVBLZX", "MOVBQZX", "MOVWLZX", "MOVWQZX", "MOVWLSX", "MOVLQSX",
+		"MOVBWZX", "MOVBWSX", "MOVBLSX", "MOVBQSX", "MOVWQSX", "MOVLQZX":
 		return e.encodeMovExtend(base, ops)
 	case "CVTSL2SD", "CVTSQ2SD":
 		return e.encodeCvtsi2sd(base == "CVTSQ2SD", ops)
-	case "MOVOU", "MOVO", "MOVUPS", "MOVAPS", "MOVUPD", "MOVAPD", "MOVSD", "MOVSS":
+	case "CVTSD2S", "CVTTSD2S", "CVTSS2S", "CVTTSS2S":
+		return e.encodeCvtInt(base, ops, size)
+	case "FMOVD":
+		return e.encodeFmov(ops)
+	case "MOVOU", "MOVO", "MOVOA", "MOVUPS", "MOVAPS", "MOVUPD", "MOVAPD", "MOVSD", "MOVSS":
 		return e.encodeSSEMove(sseMoveTable[base], ops)
 	}
 	return fmt.Errorf("unsupported instruction %q", mnem)
 }
 
+// encodePrefetch emits the 0F 18 /r prefetch hints: the reg field selects
+// the locality (NTA=0, T0=1, T1=2, T2=3) and the single operand is memory.
+func (e *enc) encodePrefetch(base string, ops []Operand) error {
+	if len(ops) != 1 {
+		return fmt.Errorf("%s expects one memory operand", base)
+	}
+	m, ok := ops[0].(Mem)
+	if !ok {
+		return fmt.Errorf("%s requires a memory operand", base)
+	}
+	i := newInstr(0, []byte{0x0F, 0x18})
+	if err := setMem(i, prefetchVariant[base], m); err != nil {
+		return err
+	}
+	return e.emit(i)
+}
+
+var prefetchVariant = map[string]int{
+	"PREFETCHNTA": 0,
+	"PREFETCHT0":  1,
+	"PREFETCHT1":  2,
+	"PREFETCHT2":  3,
+}
+
 // splitSize separates a trailing B/W/L/Q size suffix from the mnemonic.
 func splitSize(upper string) (base string, size int) {
 	if upper == "" {
@@ -136,7 +270,7 @@ func (e *enc) encodeVec(upper string, ops []Operand, sfx evexSuffix) error {
 	if ss, ok := scatterTable[upper]; ok {
 		return e.encodeScatter(upper, ss, ops, sfx)
 	}
-	if upper == "KMOVW" || upper == "KMOVQ" {
+	if upper == "KMOVW" || upper == "KMOVQ" || upper == "KMOVB" || upper == "KMOVD" {
 		if sfx.any() {
 			return fmt.Errorf("%s takes no EVEX suffixes", upper)
 		}
@@ -241,7 +375,7 @@ func setRM(i *instr, reg Reg, rm Operand, opSize int) error {
 }
 
 // setRMDigit fills in the ModR/M for an instruction whose reg field is an
-// opcode /digit extension (0–7), which carries none of the register REX rules.
+// opcode /digit extension (0-7), which carries none of the register REX rules.
 func setRMDigit(i *instr, digit int, rm Operand, opSize int) error {
 	return setRMReg(i, digit, false, false, rm, opSize)
 }
@@ -292,11 +426,24 @@ func setMem(i *instr, regField int, m Mem) error {
 // a memory operand.  It is shared by the REX (scalar) and VEX (vector) paths.
 func memComponents(regField int, m Mem) (modrm, sib int, disp []byte, xBit, bBit int, err error) {
 	sib = -1
+	// A displacement wider than int32 fits no encoding form; truncating it
+	// would address a different location, and go tool asm reports "offset
+	// too large" for the same operand.
+	if m.Disp < -(1<<31) || m.Disp > (1<<31)-1 {
+		return 0, -1, nil, 0, 0, fmt.Errorf("displacement %d does not fit in 32 bits", m.Disp)
+	}
 	// RIP-relative: neither base nor index.
 	if !m.HasBase && !m.HasIndex {
 		return regField<<3 | 0x05, -1, le32(m.Disp), 0, 0, nil // mod=00, rm=101
 	}
 
+	// The SIB scale field only encodes 1/2/4/8; the Go assembler rejects
+	// anything else ("bad scale: 16"), so a silent fallback to scale 1 here
+	// would mis-assemble the operand instead of reporting it.
+	if m.HasIndex && m.Scale != 1 && m.Scale != 2 && m.Scale != 4 && m.Scale != 8 {
+		return 0, -1, nil, 0, 0, fmt.Errorf("bad scale: %d", m.Scale)
+	}
+
 	needSIB := m.HasIndex || (m.HasBase && m.Base.idx&7 == 4)
 
 	var mod int
@@ -369,7 +516,7 @@ func le16(v int64) []byte {
 func le64(v int64) []byte {
 	u := uint64(v)
 	b := make([]byte, 8)
-	for i := 0; i < 8; i++ {
+	for i := range 8 {
 		b[i] = byte(u >> (8 * i))
 	}
 	return b

asm/encode_test.go

@@ -4,6 +4,7 @@
 package asm
 
 import (
+	"fmt"
 	"strings"
 	"testing"
 
@@ -57,8 +58,11 @@ func TestMov(t *testing.T) {
 	checkSyntax(t, "mov qword ptr [rbx], rax", "MOVQ", AX, Ptr(BX, 0, 8))
 	checkSyntax(t, "mov rbx, qword ptr [rax+0x10]", "MOVQ", Ptr(AX, 0x10, 8), BX)
 	checkSyntax(t, "mov rbx, qword ptr [rsi+4*rbx]", "MOVQ", Idx(SI, BX, 4, 0, 8), BX)
-	checkSyntax(t, "mov rax, 0x5", "MOVQ", Imm(5), AX)
-	checkSyntax(t, "mov r8, 0x5", "MOVQ", Imm(5), Reg{idx: 8, size: 8})
+	// A small positive immediate compresses to the 32-bit zero-extending
+	// form (matching go tool asm), so the disassembler renders the 32-bit
+	// register name even for MOVQ.
+	checkSyntax(t, "mov eax, 0x5", "MOVQ", Imm(5), AX)
+	checkSyntax(t, "mov r8d, 0x5", "MOVQ", Imm(5), Reg{idx: 8, size: 8})
 	checkSyntax(t, "mov qword ptr [rax], 0x5", "MOVQ", Imm(5), Ptr(AX, 0, 8))
 	checkSyntax(t, "mov r12, r13", "MOVQ", Reg{idx: 13, size: 8}, Reg{idx: 12, size: 8})
 }
@@ -74,13 +78,63 @@ func TestALU(t *testing.T) {
 	checkSyntax(t, "cmp rsi, r10", "CMPQ", SI, Reg{idx: 10, size: 8})
 	checkSyntax(t, "add rbx, qword ptr [rax]", "ADDQ", Ptr(AX, 0, 8), BX)
 	checkSyntax(t, "add qword ptr [rax], rbx", "ADDQ", BX, Ptr(AX, 0, 8))
-	checkSyntax(t, "cmp rbx, -0x20", "CMPQ", Imm(-32), BX)
+	// The Go assembler rejects the immediate-first CMP spelling outright,
+	// so Encode errors instead of silently emitting the swapped form.
+	if _, err := Encode("CMPQ", Imm(-32), BX); err == nil {
+		t.Errorf("Encode(CMPQ imm-first) should error, got success")
+	}
 	// The Go assembler's own spelling: immediate second.
 	checkSyntax(t, "cmp ecx, 0x1f", "CMPL", CX, Imm(31))
 	checkSyntax(t, "cmp ecx, -0x80000000", "CMPL", CX, Imm(-2147483648))
 	checkSyntax(t, "cmp r9, -0x80000000", "CMPQ", Reg{idx: 9, size: 8}, Imm(-2147483648))
 }
 
+// TestScalarXmmRegMoves pins the Go-assembler byte forms of scalar
+// MOVQ/MOVL between GPRs and XMM registers (66 REX.W 0F 6E/0F 7E) and the
+// memory forms (F3 0F 7E load, 66 0F D6 store), all byte-for-byte.
+func TestScalarXmmRegMoves(t *testing.T) {
+	cases := []struct {
+		name string
+		mnem string
+		ops  []Operand
+		want string
+	}{
+		{"MOVQ AX,X1", "MOVQ", []Operand{AX, vreg(t, "X1")}, "66480f6ec8"},
+		{"MOVQ DX,X2", "MOVQ", []Operand{DX, vreg(t, "X2")}, "66480f6ed2"},
+		{"MOVQ X1,AX", "MOVQ", []Operand{vreg(t, "X1"), AX}, "66480f7ec8"},
+		{"MOVQ X0,DX", "MOVQ", []Operand{vreg(t, "X0"), DX}, "66480f7ec2"},
+		{"MOVL AX,X1", "MOVL", []Operand{AX, vreg(t, "X1")}, "660f6ec8"},
+		{"MOVL X1,AX", "MOVL", []Operand{vreg(t, "X1"), AX}, "660f7ec8"},
+		{"MOVQ (SI),X1", "MOVQ", []Operand{Ptr(SI, 0, 8), vreg(t, "X1")}, "f30f7e0e"},
+		{"MOVQ X3,(DI)", "MOVQ", []Operand{vreg(t, "X3"), Ptr(DI, 0, 8)}, "660fd61f"},
+	}
+	for _, c := range cases {
+		code, err := Encode(c.mnem, c.ops...)
+		if err != nil {
+			t.Errorf("%s: %v", c.name, err)
+			continue
+		}
+		if got := fmt.Sprintf("%x", code); got != c.want {
+			t.Errorf("%s: got %s, want %s", c.name, got, c.want)
+		}
+	}
+}
+
+// TestBadScale pins the go-tool-asm parity of rejecting SIB scales the
+// hardware cannot encode.
+func TestBadScale(t *testing.T) {
+	for _, sc := range []int{3, 5, 16, 32} {
+		if _, err := Encode("LEAQ", Idx(SI, BX, sc, 0, 8), AX); err == nil {
+			t.Errorf("LEAQ scale %d: expected error, got success", sc)
+		}
+	}
+	for _, sc := range []int{1, 2, 4, 8} {
+		if _, err := Encode("LEAQ", Idx(SI, BX, sc, 0, 8), AX); err != nil {
+			t.Errorf("LEAQ scale %d: %v", sc, err)
+		}
+	}
+}
+
 func TestLea(t *testing.T) {
 	checkSyntax(t, "lea r9, ptr [rsi+4*rbx]", "LEAQ", Idx(SI, BX, 4, 0, 8), Reg{idx: 9, size: 8})
 	checkSyntax(t, "lea rax, ptr [rbx+0x8]", "LEAQ", Ptr(BX, 0x8, 8), AX)
@@ -95,6 +149,45 @@ func TestPushPop(t *testing.T) {
 	checkSyntax(t, "push rbx", "PUSHQ", BX)
 	checkSyntax(t, "pop r12", "POPQ", Reg{idx: 12, size: 8})
 	checkSyntax(t, "push 0x5", "PUSHQ", Imm(5))
+	// The W spelling carries the 0x66 operand-size prefix, byte for byte
+	// with go tool asm; the L and B spellings are illegal in 64-bit mode
+	// there and rejected here rather than silently widened.
+	cases := []struct {
+		name string
+		mnem string
+		ops  []Operand
+		want string
+	}{
+		{"PUSHW AX", "PUSHW", []Operand{AX}, "6650"},
+		{"POPW AX", "POPW", []Operand{AX}, "6658"},
+		{"PUSHW $5", "PUSHW", []Operand{Imm(5)}, "666a05"},
+		{"PUSHW (AX)", "PUSHW", []Operand{Ptr(AX, 0, 2)}, "66ff30"},
+		{"PUSHQ AX", "PUSHQ", []Operand{AX}, "50"},
+	}
+	for _, c := range cases {
+		code, err := Encode(c.mnem, c.ops...)
+		if err != nil {
+			t.Errorf("%s: %v", c.name, err)
+			continue
+		}
+		if got := fmt.Sprintf("%x", code); got != c.want {
+			t.Errorf("%s: bytes %s, want %s", c.name, got, c.want)
+		}
+	}
+	for _, c := range []struct {
+		name string
+		mnem string
+		ops  []Operand
+	}{
+		{"PUSHL AX", "PUSHL", []Operand{AX}},
+		{"PUSHL R8", "PUSHL", []Operand{Reg{idx: 8, size: 8}}},
+		{"POPL BX", "POPL", []Operand{BX}},
+		{"PUSHB AX", "PUSHB", []Operand{AX}},
+	} {
+		if _, err := Encode(c.mnem, c.ops...); err == nil {
+			t.Errorf("%s: expected an error, got none", c.name)
+		}
+	}
 }
 
 func TestUnary(t *testing.T) {
@@ -127,6 +220,39 @@ func TestControl(t *testing.T) {
 	checkOp(t, x86asm.JBE, "JLS", Imm(0))
 }
 
+// TestIndirectControlFlow pins the indirect JMP/CALL forms: FF /4 for JMP and
+// FF /2 for CALL through a register or memory.  A REX appears only for the
+// extended registers, never REX.W: the branch operand size is fixed at 64
+// bits in long mode.
+func TestIndirectControlFlow(t *testing.T) {
+	cases := []struct {
+		name string
+		mnem string
+		ops  []Operand
+		want string
+	}{
+		{"JMP AX", "JMP", []Operand{AX}, "ffe0"},
+		{"CALL AX", "CALL", []Operand{AX}, "ffd0"},
+		{"JMP (BX)", "JMP", []Operand{Ptr(BX, 0, 8)}, "ff23"},
+		{"CALL (BX)", "CALL", []Operand{Ptr(BX, 0, 8)}, "ff13"},
+		{"JMP 8(BX)", "JMP", []Operand{Ptr(BX, 8, 8)}, "ff6308"},
+		{"CALL -16(BX)", "CALL", []Operand{Ptr(BX, -16, 8)}, "ff53f0"},
+		{"JMP R8", "JMP", []Operand{Reg{idx: 8, size: 2}}, "41ffe0"},
+		{"CALL R9", "CALL", []Operand{Reg{idx: 9, size: 2}}, "41ffd1"},
+		{"JMP R15", "JMP", []Operand{Reg{idx: 15, size: 2}}, "41ffe7"},
+	}
+	for _, c := range cases {
+		code, err := Encode(c.mnem, c.ops...)
+		if err != nil {
+			t.Errorf("%s: %v", c.name, err)
+			continue
+		}
+		if got := fmt.Sprintf("%x", code); got != c.want {
+			t.Errorf("%s: got %s, want %s", c.name, got, c.want)
+		}
+	}
+}
+
 // TestSSEMoveGroundTruth checks the legacy (non-VEX) SSE moves byte for byte
 // against the Go assembler.  wantOp is the decoder's name, which differs from
 // the Plan 9 spelling for the octa moves (MOVOU = MOVDQU, MOVO = MOVDQA).
@@ -176,7 +302,7 @@ func TestSSEMoveGroundTruth(t *testing.T) {
 // TestGoFlacScalarTail encodes the scalar tail of an analyze kernel to confirm
 // the encoder handles a realistic instruction sequence.
 func TestGoFlacScalarTail(t *testing.T) {
-	// MOVQ swin_base+0(FP), SI — modelled as MOVQ disp(reg), reg.
+	// MOVQ swin_base+0(FP), SI; modelled as MOVQ disp(reg), reg.
 	checkSyntax(t, "mov rsi, qword ptr [rax+0x10]", "MOVQ", Ptr(AX, 0x10, 8), SI)
 	checkSyntax(t, "lea r9, ptr [rsi+4*rbx]", "LEAQ", Idx(SI, BX, 4, 0, 8), Reg{idx: 9, size: 8})
 	checkSyntax(t, "and r10, -0x8", "ANDQ", Imm(-8), Reg{idx: 10, size: 8})
@@ -203,6 +329,21 @@ func TestScalarGroundTruth(t *testing.T) {
 		{"LZCNTQ R8,R9", "LZCNTQ", []Operand{r8, r9}, "f34d0fbdc8", "LZCNT"},
 		{"LZCNTW AX,CX", "LZCNTW", []Operand{AX, CX}, "66f30fbdc8", "LZCNT"},
 		{"TZCNTL AX,CX", "TZCNTL", []Operand{AX, CX}, "f30fbcc8", "TZCNT"},
+		// Bit scan: BSF/BSR are the unprefixed forms of TZCNT/LZCNT's map.
+		{"BSFL AX,CX", "BSFL", []Operand{AX, CX}, "0fbcc8", "BSF"},
+		{"BSFQ R8,R9", "BSFQ", []Operand{r8, r9}, "4d0fbcc8", "BSF"},
+		{"BSFW AX,CX", "BSFW", []Operand{AX, CX}, "660fbcc8", "BSF"},
+		{"BSRL AX,CX", "BSRL", []Operand{AX, CX}, "0fbdc8", "BSR"},
+		{"BSRQ AX,CX", "BSRQ", []Operand{AX, CX}, "480fbdc8", "BSR"},
+		{"POPCNTL AX,CX", "POPCNTL", []Operand{AX, CX}, "f30fb8c8", "POPCNT"},
+		{"POPCNTQ R8,R9", "POPCNTQ", []Operand{r8, r9}, "f34d0fb8c8", "POPCNT"},
+		// A 64-bit immediate that fits a signed int32 is compressed exactly
+		// as the Go assembler does: positive via B8+rd without REX.W
+		// (zero-extended), negative via REX.W C7 /0 (sign-extended).
+		{"MOVQ $4,BX", "MOVQ", []Operand{Imm(4), BX}, "bb04000000", "MOV"},
+		{"MOVQ $4,R8", "MOVQ", []Operand{Imm(4), r8}, "41b804000000", "MOV"},
+		{"MOVQ $-1,BX", "MOVQ", []Operand{Imm(-1), BX}, "48c7c3ffffffff", "MOV"},
+		{"MOVQ big,BX", "MOVQ", []Operand{Imm(0x1122334455667788), BX}, "48bb8877665544332211", "MOV"},
 		{"CMOVLGT CX,AX", "CMOVLGT", []Operand{CX, AX}, "0f4fc1", "CMOVG"},
 		{"CMOVLEQ CX,AX", "CMOVLEQ", []Operand{CX, AX}, "0f44c1", "CMOVE"},
 		{"CMOVQGT R9,R8", "CMOVQGT", []Operand{r9, r8}, "4d0f4fc1", "CMOVG"},
@@ -216,6 +357,18 @@ func TestScalarGroundTruth(t *testing.T) {
 		{"MOVBQZX AL,R8", "MOVBQZX", []Operand{AL, r8}, "4c0fb6c0", "MOVZX"},
 		{"MOVWLZX AX,CX", "MOVWLZX", []Operand{AX, CX}, "0fb7c8", "MOVZX"},
 		{"MOVWQZX AX,R8", "MOVWQZX", []Operand{AX, r8}, "4c0fb7c0", "MOVZX"},
+		// The width pairs the toolchain accepts and GOROOT uses; bytes
+		// pinned from go tool asm (see testdata/verify/widen_amd64.s).
+		{"MOVBWZX (BX),R11W", "MOVBWZX", []Operand{Ptr(BX, 0, 1), Reg{idx: 11, size: 2}}, "66440fb61b", "MOVZX"},
+		{"MOVBWSX (BX),R11W", "MOVBWSX", []Operand{Ptr(BX, 0, 1), Reg{idx: 11, size: 2}}, "66440fbe1b", "MOVSX"},
+		{"MOVBLSX (BX),AX", "MOVBLSX", []Operand{Ptr(BX, 0, 1), AX}, "0fbe03", "MOVSX"},
+		{"MOVBQSX (BX),R8", "MOVBQSX", []Operand{Ptr(BX, 0, 1), r8}, "4c0fbe03", "MOVSX"},
+		{"MOVWQSX (BX),R9", "MOVWQSX", []Operand{Ptr(BX, 0, 2), r9}, "4c0fbf0b", "MOVSX"},
+		// A long to quad zero-extend is a plain 32-bit move.
+		{"MOVLQZX (BX),DX", "MOVLQZX", []Operand{Ptr(BX, 0, 4), DX}, "8b13", "MOV"},
+		{"MOVLQZX AX,DX", "MOVLQZX", []Operand{AX, DX}, "8bd0", "MOV"},
+		{"PMOVMSKB X1,AX", "PMOVMSKB", []Operand{vreg(t, "X1"), AX}, "660fd7c1", "PMOVMSKB"},
+		{"PMOVMSKB X11,CX", "PMOVMSKB", []Operand{vreg(t, "X11"), CX}, "66410fd7cb", "PMOVMSKB"},
 		{"CVTSL2SD R8,X13", "CVTSL2SD", []Operand{r8, vreg(t, "X13")}, "f2450f2ae8", "CVTSI2SD"},
 		{"CVTSL2SD AX,X0", "CVTSL2SD", []Operand{AX, vreg(t, "X0")}, "f20f2ac0", "CVTSI2SD"},
 		{"CVTSQ2SD R8,X13", "CVTSQ2SD", []Operand{r8, vreg(t, "X13")}, "f24d0f2ae8", "CVTSI2SD"},
@@ -294,3 +447,425 @@ func TestScalarErrors(t *testing.T) {
 		}
 	}
 }
+
+// TestImmediateOutOfRange pins the go-tool-asm parity of the immediate and
+// displacement spans: a scalar immediate must fit a signed or unsigned 32-bit
+// word (only MOVQ reg, $imm takes the full int64), a scalar shift count must
+// be an unsigned byte, and a displacement must fit int32.  Every rejected
+// shape here is rejected by `go tool asm` too; every accepted one encodes the
+// same bytes.
+func TestImmediateOutOfRange(t *testing.T) {
+	cases := []struct {
+		name string
+		mnem string
+		ops  []Operand
+	}{
+		{"SHLQ count 300", "SHLQ", []Operand{Imm(300), AX}},
+		{"SHLQ count -1", "SHLQ", []Operand{Imm(-1), AX}},
+		{"SHLW count 256", "SHLW", []Operand{Imm(256), DX}},
+		{"SHLB count 300", "SHLB", []Operand{Imm(300), BL}},
+		{"MOVL imm32+", "MOVL", []Operand{Imm(4294967296), AX}},
+		{"MOVL imm32-", "MOVL", []Operand{Imm(-2147483649), AX}},
+		{"MOVW imm32+", "MOVW", []Operand{Imm(4294967296), AX}},
+		{"MOVB imm32+", "MOVB", []Operand{Imm(4294967296), AL}},
+		{"ADDB imm32+", "ADDB", []Operand{Imm(4294967296), AL}},
+		{"ADDL imm32+", "ADDL", []Operand{Imm(4294967296), AX}},
+		{"ADDQ imm32+", "ADDQ", []Operand{Imm(8589934592), AX}},
+		{"CMPQ imm32+", "CMPQ", []Operand{AX, Imm(4294967296)}},
+		{"CMPQ imm32-", "CMPQ", []Operand{AX, Imm(-2147483649)}},
+		{"TESTL imm32+", "TESTL", []Operand{Imm(4294967296), AX}},
+		{"IMUL3L imm32+", "IMUL3L", []Operand{Imm(4294967296), CX, DX}},
+		{"PUSHQ imm32+", "PUSHQ", []Operand{Imm(4294967296)}},
+		{"MOVQ mem imm32+", "MOVQ", []Operand{Imm(4294967296), Ptr(AX, 0, 8)}},
+		{"disp32+", "MOVQ", []Operand{Ptr(AX, 4294967296, 8), BX}},
+		{"disp32+ max", "MOVQ", []Operand{Ptr(AX, 2147483648, 8), BX}},
+		{"disp32-", "MOVQ", []Operand{Ptr(AX, -2147483649, 8), BX}},
+		{"VEX disp32+", "VMOVDQU", []Operand{Ptr(AX, 4294967296, 32), vreg(t, "Y1")}},
+		{"EVEX disp32+", "VMOVDQU32", []Operand{Ptr(AX, 4294967296, 64), vreg(t, "Z1")}},
+	}
+	for _, c := range cases {
+		if _, err := Encode(c.mnem, c.ops...); err == nil {
+			t.Errorf("%s: expected an error, got none", c.name)
+		}
+	}
+}
+
+// TestImmediateTruncation pins the toolchain-matching truncations inside the
+// accepted 32-bit span: the narrower fields take the low bits silently, byte
+// for byte with `go tool asm` (which rejects none of these).
+func TestImmediateTruncation(t *testing.T) {
+	cases := []struct {
+		name string
+		mnem string
+		ops  []Operand
+		want string
+	}{
+		{"ADDB $256,BL", "ADDB", []Operand{Imm(256), BL}, "80c300"},
+		{"ADDB $1000,BL", "ADDB", []Operand{Imm(1000), BL}, "80c3e8"},
+		{"MOVB $256,AL", "MOVB", []Operand{Imm(256), AL}, "b000"},
+		{"MOVB $-129,AL", "MOVB", []Operand{Imm(-129), AL}, "b07f"},
+		{"MOVW $65536,AX", "MOVW", []Operand{Imm(65536), AX}, "66b80000"},
+		{"MOVW $65535,AX", "MOVW", []Operand{Imm(65535), AX}, "66b8ffff"},
+		{"MOVW $-32769,AX", "MOVW", []Operand{Imm(-32769), AX}, "66b8ff7f"},
+		{"MOVL $4294967295,AX", "MOVL", []Operand{Imm(4294967295), AX}, "b8ffffffff"},
+		{"ADDQ $4294967295,AX", "ADDQ", []Operand{Imm(4294967295), AX}, "4805ffffffff"},
+		{"CMPB BL,$255", "CMPB", []Operand{BL, Imm(255)}, "80fbff"},
+		{"CMPQ AX,$4294967295", "CMPQ", []Operand{AX, Imm(4294967295)}, "483dffffffff"},
+		{"MOVQ $4294967295,0(AX)", "MOVQ", []Operand{Imm(4294967295), Ptr(AX, 0, 8)}, "48c700ffffffff"},
+		{"SHLQ $255,AX", "SHLQ", []Operand{Imm(255), AX}, "48c1e0ff"},
+		{"SHLQ $0,AX", "SHLQ", []Operand{Imm(0), AX}, "48c1e000"},
+		// The one form beyond the 32-bit span: the imm64 MOVQ register move.
+		{"MOVQ $4294967296,AX", "MOVQ", []Operand{Imm(4294967296), AX}, "48b80000000001000000"},
+		{"MOVQ disp32 max", "MOVQ", []Operand{Ptr(AX, 2147483647, 8), BX}, "488b98ffffff7f"},
+	}
+	for _, c := range cases {
+		code, err := Encode(c.mnem, c.ops...)
+		if err != nil {
+			t.Errorf("%s: %v", c.name, err)
+			continue
+		}
+		if got := fmt.Sprintf("%x", code); got != c.want {
+			t.Errorf("%s: bytes %s, want %s", c.name, got, c.want)
+		}
+	}
+}
+
+// TestEncodableCmovSize pins the linter contract for CMOVcc: Encodable must
+// reject the spellings Encode rejects, so a mnemonic like CMOVBGT (no size
+// letter) is not reported as encodable.
+func TestEncodableCmovSize(t *testing.T) {
+	for _, m := range []string{"CMOVBGT", "CMOVXEQ", "CMOVB", "CMOV", "CMOVWXX"} {
+		if Encodable(m) {
+			t.Errorf("Encodable(%q) = true, want false", m)
+		}
+	}
+	for _, m := range []string{"CMOVLGT", "CMOVQGT", "CMOVWLS", "CMOVLEQ"} {
+		if !Encodable(m) {
+			t.Errorf("Encodable(%q) = false, want true", m)
+		}
+	}
+}
+
+// TestCarryShiftMulGroundTruth pins the carry-flag ALU family (ADC/SBB with
+// their accumulator immediate forms), the rotate family, MUL/DIV/IDIV and the
+// bit-test family byte for byte against go tool asm (see
+// testdata/verify/scalar_amd64.s).
+func TestCarryShiftMulGroundTruth(t *testing.T) {
+	cases := []struct {
+		name string
+		mnem string
+		ops  []Operand
+		want string
+	}{
+		{"ADCQ AX,BX", "ADCQ", []Operand{AX, BX}, "4811c3"},
+		{"ADCL AX,BX", "ADCL", []Operand{AX, BX}, "11c3"},
+		{"ADCB AL,BL", "ADCB", []Operand{AL, BL}, "10c3"},
+		{"ADCW AX,BX", "ADCW", []Operand{AX, BX}, "6611c3"},
+		{"SBBQ AX,BX", "SBBQ", []Operand{AX, BX}, "4819c3"},
+		{"ADCQ $5,BX", "ADCQ", []Operand{Imm(5), BX}, "4883d305"},
+		{"ADCQ $300,BX", "ADCQ", []Operand{Imm(300), BX}, "4881d32c010000"},
+		{"ADCQ $300,AX", "ADCQ", []Operand{Imm(300), AX}, "48152c010000"},
+		{"ADCB $5,AL", "ADCB", []Operand{Imm(5), AL}, "1405"},
+		{"SBBQ $300,AX", "SBBQ", []Operand{Imm(300), AX}, "481d2c010000"},
+		{"ADCQ AX,(BX)", "ADCQ", []Operand{AX, Ptr(BX, 0, 8)}, "481103"},
+		{"ROLQ $3,AX", "ROLQ", []Operand{Imm(3), AX}, "48c1c003"},
+		{"ROLL CX,BX", "ROLL", []Operand{CL, BX}, "d3c3"},
+		{"RORQ CL,AX", "RORQ", []Operand{CL, AX}, "48d3c8"},
+		{"RCRQ $1,BX", "RCRQ", []Operand{Imm(1), BX}, "48d1db"},
+		{"RCLQ $3,AX", "RCLQ", []Operand{Imm(3), AX}, "48c1d003"},
+		{"RORB CL,BL", "RORB", []Operand{CL, BL}, "d2cb"},
+		{"SALQ $2,AX", "SALQ", []Operand{Imm(2), AX}, "48c1e002"},
+		{"ROLW $1,AX", "ROLW", []Operand{Imm(1), AX}, "66d1c0"},
+		{"MULQ CX", "MULQ", []Operand{CX}, "48f7e1"},
+		{"MULL CX", "MULL", []Operand{CX}, "f7e1"},
+		{"MULB CL", "MULB", []Operand{CL}, "f6e1"},
+		{"DIVL CX", "DIVL", []Operand{CX}, "f7f1"},
+		{"IDIVQ CX", "IDIVQ", []Operand{CX}, "48f7f9"},
+		{"MULW CX", "MULW", []Operand{CX}, "66f7e1"},
+		{"BTQ AX,DX", "BTQ", []Operand{AX, DX}, "480fa3c2"},
+		{"BTL AX,DX", "BTL", []Operand{AX, DX}, "0fa3c2"},
+		{"BTW AX,DX", "BTW", []Operand{AX, DX}, "660fa3c2"},
+		{"BTQ $3,BX", "BTQ", []Operand{Imm(3), BX}, "480fbae303"},
+		{"BTQ $3,(AX)", "BTQ", []Operand{Imm(3), Ptr(AX, 0, 8)}, "480fba2003"},
+		{"BTSQ $5,BX", "BTSQ", []Operand{Imm(5), BX}, "480fbaeb05"},
+		{"BTCQ AX,BX", "BTCQ", []Operand{AX, BX}, "480fbbc3"},
+		{"BTRQ $7,BX", "BTRQ", []Operand{Imm(7), BX}, "480fbaf307"},
+	}
+	for _, c := range cases {
+		code, err := Encode(c.mnem, c.ops...)
+		if err != nil {
+			t.Errorf("%s: Encode: %v", c.name, err)
+			continue
+		}
+		if got := fmt.Sprintf("%x", code); got != c.want {
+			t.Errorf("%s = %s, want %s", c.name, got, c.want)
+		}
+	}
+	// The bit-test immediate is an unsigned bit index with the negative
+	// spelling accepted, the shuffle convention: BTQ $300 must be rejected.
+	if _, err := Encode("BTQ", Imm(300), AX); err == nil {
+		t.Errorf("BTQ $300: expected an error, got none")
+	}
+}
+
+// TestAtomicSystemGroundTruth pins the exchange/compare-exchange/accumulate
+// family, the string primitives, the flag and system instructions, the MXCSR
+// pair, the scalar float-to-int conversions and the x87 FMOVD byte for byte
+// against go tool asm (see testdata/verify/atomics_amd64.s and
+// testdata/verify/system_amd64.s).
+func TestAtomicSystemGroundTruth(t *testing.T) {
+	r8 := Reg{idx: 8, size: 8}
+	cases := []struct {
+		name string
+		mnem string
+		ops  []Operand
+		want string
+	}{
+		{"XCHGQ AX,BX", "XCHGQ", []Operand{AX, BX}, "4893"},
+		{"XCHGQ BX,AX", "XCHGQ", []Operand{BX, AX}, "4893"},
+		{"XCHGL AX,BX", "XCHGL", []Operand{AX, BX}, "93"},
+		{"XCHGB AL,BL", "XCHGB", []Operand{AL, BL}, "86c3"},
+		{"XCHGW AX,BX", "XCHGW", []Operand{AX, BX}, "6693"},
+		{"XCHGQ R8,R9", "XCHGQ", []Operand{r8, Reg{idx: 9, size: 8}}, "4d87c1"},
+		{"XCHGQ BX,(AX)", "XCHGQ", []Operand{BX, Ptr(AX, 0, 8)}, "488718"},
+		{"XCHGQ (AX),BX", "XCHGQ", []Operand{Ptr(AX, 0, 8), BX}, "488718"},
+		{"XCHGQ AX,(BX)", "XCHGQ", []Operand{AX, Ptr(BX, 0, 8)}, "488703"},
+		{"CMPXCHGL AX,BX", "CMPXCHGL", []Operand{AX, BX}, "0fb1c3"},
+		{"CMPXCHGQ AX,(BX)", "CMPXCHGQ", []Operand{AX, Ptr(BX, 0, 8)}, "480fb103"},
+		{"CMPXCHGB AL,(BX)", "CMPXCHGB", []Operand{AL, Ptr(BX, 0, 1)}, "0fb003"},
+		{"CMPXCHGW AX,BX", "CMPXCHGW", []Operand{AX, BX}, "660fb1c3"},
+		{"XADDL AX,BX", "XADDL", []Operand{AX, BX}, "0fc1c3"},
+		{"XADDQ AX,(BX)", "XADDQ", []Operand{AX, Ptr(BX, 0, 8)}, "480fc103"},
+		{"XADDB AL,(BX)", "XADDB", []Operand{AL, Ptr(BX, 0, 1)}, "0fc003"},
+		{"XADDW AX,BX", "XADDW", []Operand{AX, BX}, "660fc1c3"},
+		{"ADCXL AX,CX", "ADCXL", []Operand{AX, CX}, "660f38f6c8"},
+		{"ADCXQ AX,CX", "ADCXQ", []Operand{AX, CX}, "66480f38f6c8"},
+		{"ADOXL AX,CX", "ADOXL", []Operand{AX, CX}, "f30f38f6c8"},
+		{"ADOXQ AX,CX", "ADOXQ", []Operand{AX, CX}, "f3480f38f6c8"},
+		{"CRC32B AX,CX", "CRC32B", []Operand{AX, CX}, "f20f38f0c8"},
+		{"CRC32W AX,CX", "CRC32W", []Operand{AX, CX}, "66f20f38f1c8"},
+		{"CRC32L AX,CX", "CRC32L", []Operand{AX, CX}, "f20f38f1c8"},
+		{"CRC32Q AX,CX", "CRC32Q", []Operand{AX, CX}, "f2480f38f1c8"},
+		{"CRC32L (AX),CX", "CRC32L", []Operand{Ptr(AX, 0, 4), CX}, "f20f38f108"},
+		{"MOVSQ", "MOVSQ", []Operand{}, "48a5"},
+		{"MOVSL", "MOVSL", []Operand{}, "a5"},
+		{"MOVSB", "MOVSB", []Operand{}, "a4"},
+		{"MOVSW", "MOVSW", []Operand{}, "66a5"},
+		{"STOSB", "STOSB", []Operand{}, "aa"},
+		{"STOSQ", "STOSQ", []Operand{}, "48ab"},
+		{"STOSL", "STOSL", []Operand{}, "ab"},
+		{"STOSW", "STOSW", []Operand{}, "66ab"},
+		{"CLD", "CLD", []Operand{}, "fc"},
+		{"STD", "STD", []Operand{}, "fd"},
+		{"POPFQ", "POPFQ", []Operand{}, "9d"},
+		{"PUSHFQ", "PUSHFQ", []Operand{}, "9c"},
+		{"CPUID", "CPUID", []Operand{}, "0fa2"},
+		{"RDTSC", "RDTSC", []Operand{}, "0f31"},
+		{"RDTSCP", "RDTSCP", []Operand{}, "0f01f9"},
+		{"SYSCALL", "SYSCALL", []Operand{}, "0f05"},
+		{"XGETBV", "XGETBV", []Operand{}, "0f01d0"},
+		{"PAUSE", "PAUSE", []Operand{}, "f390"},
+		{"LFENCE", "LFENCE", []Operand{}, "0faee8"},
+		{"MFENCE", "MFENCE", []Operand{}, "0faef0"},
+		{"SFENCE", "SFENCE", []Operand{}, "0faef8"},
+		{"UNDEF", "UNDEF", []Operand{}, "0f0b"},
+		{"INT $3", "INT", []Operand{Imm(3)}, "cd03"},
+		{"LDMXCSR (AX)", "LDMXCSR", []Operand{Ptr(AX, 0, 4)}, "0fae10"},
+		{"STMXCSR (AX)", "STMXCSR", []Operand{Ptr(AX, 0, 4)}, "0fae18"},
+		{"CVTSD2SL X0,AX", "CVTSD2SL", []Operand{vreg(t, "X0"), AX}, "f20f2dc0"},
+		{"CVTTSD2SQ X0,AX", "CVTTSD2SQ", []Operand{vreg(t, "X0"), AX}, "f2480f2cc0"},
+		{"CVTTSD2SL X0,AX", "CVTTSD2SL", []Operand{vreg(t, "X0"), AX}, "f20f2cc0"},
+		{"CVTSS2SQ X0,AX", "CVTSS2SQ", []Operand{vreg(t, "X0"), AX}, "f3480f2dc0"},
+		{"FMOVD (AX),F0", "FMOVD", []Operand{Ptr(AX, 0, 8), vreg(t, "F0")}, "dd00"},
+		{"FMOVD F0,(AX)", "FMOVD", []Operand{vreg(t, "F0"), Ptr(AX, 0, 8)}, "dd10"},
+		{"FMOVD F0,F1", "FMOVD", []Operand{vreg(t, "F0"), vreg(t, "F1")}, "ddd1"},
+		{"MOVD AX,X0", "MOVD", []Operand{AX, vreg(t, "X0")}, "66480f6ec0"},
+		{"MOVD X0,AX", "MOVD", []Operand{vreg(t, "X0"), AX}, "66480f7ec0"},
+		{"MOVD X0,X1", "MOVD", []Operand{vreg(t, "X0"), vreg(t, "X1")}, "f30f7ec8"},
+		{"MOVD (AX),X0", "MOVD", []Operand{Ptr(AX, 0, 8), vreg(t, "X0")}, "f30f7e00"},
+		{"MOVD X0,(AX)", "MOVD", []Operand{vreg(t, "X0"), Ptr(AX, 0, 8)}, "660fd600"},
+	}
+	for _, c := range cases {
+		code, err := Encode(c.mnem, c.ops...)
+		if err != nil {
+			t.Errorf("%s: Encode: %v", c.name, err)
+			continue
+		}
+		if got := fmt.Sprintf("%x", code); got != c.want {
+			t.Errorf("%s = %s, want %s", c.name, got, c.want)
+		}
+	}
+	// LDMXCSR/STMXCSR take a memory operand only.
+	if _, err := Encode("LDMXCSR", AX); err == nil {
+		t.Errorf("LDMXCSR AX: expected an error, got none")
+	}
+}
+
+// TestSSEGapsGroundTruth pins the legacy SSE gap families: the scalar
+// compare and square root, the Plan 9 packed spellings, the imm8-controlled
+// shuffles, the lane extracts and inserts, the packed integer shifts and the
+// AES/SHA round instructions, byte for byte against go tool asm (see
+// testdata/verify/crypto_amd64.s and testdata/verify/sse_amd64.s).
+func TestSSEGapsGroundTruth(t *testing.T) {
+	cases := []struct {
+		name string
+		mnem string
+		ops  []Operand
+		want string
+	}{
+		{"ANDNPD X0,X1", "ANDNPD", []Operand{vreg(t, "X0"), vreg(t, "X1")}, "660f55c8"},
+		{"ANDNPS X0,X1", "ANDNPS", []Operand{vreg(t, "X0"), vreg(t, "X1")}, "0f55c8"},
+		{"COMISD X0,X1", "COMISD", []Operand{vreg(t, "X0"), vreg(t, "X1")}, "660f2fc8"},
+		{"SQRTSD X0,X1", "SQRTSD", []Operand{vreg(t, "X0"), vreg(t, "X1")}, "f20f51c8"},
+		{"PSHUFL $3,X0,X1", "PSHUFL", []Operand{Imm(3), vreg(t, "X0"), vreg(t, "X1")}, "660f70c803"},
+		{"PALIGNR $2,X0,X1", "PALIGNR", []Operand{Imm(2), vreg(t, "X0"), vreg(t, "X1")}, "660f3a0fc802"},
+		{"PBLENDW $3,X0,X1", "PBLENDW", []Operand{Imm(3), vreg(t, "X0"), vreg(t, "X1")}, "660f3a0ec803"},
+		{"PCMPESTRI $1,X0,X1", "PCMPESTRI", []Operand{Imm(1), vreg(t, "X0"), vreg(t, "X1")}, "660f3a61c801"},
+		{"PCLMULQDQ $0,X0,X1", "PCLMULQDQ", []Operand{Imm(0), vreg(t, "X0"), vreg(t, "X1")}, "660f3a44c800"},
+		{"PCLMULQDQ $0,(AX),X1", "PCLMULQDQ", []Operand{Imm(0), Ptr(AX, 0, 16), vreg(t, "X1")}, "660f3a440800"},
+		{"PEXTRB $1,X0,AX", "PEXTRB", []Operand{Imm(1), vreg(t, "X0"), AX}, "660f3a14c001"},
+		{"PEXTRD $1,X0,AX", "PEXTRD", []Operand{Imm(1), vreg(t, "X0"), AX}, "660f3a16c001"},
+		{"PEXTRQ $1,X0,AX", "PEXTRQ", []Operand{Imm(1), vreg(t, "X0"), AX}, "66480f3a16c001"},
+		{"PEXTRW $1,X0,AX", "PEXTRW", []Operand{Imm(1), vreg(t, "X0"), AX}, "660fc5c001"},
+		{"PEXTRW $1,X0,(AX)", "PEXTRW", []Operand{Imm(1), vreg(t, "X0"), Ptr(AX, 0, 2)}, "660f3a150001"},
+		{"PINSRB $1,AX,X0", "PINSRB", []Operand{Imm(1), AX, vreg(t, "X0")}, "660f3a20c001"},
+		{"PINSRD $1,AX,X0", "PINSRD", []Operand{Imm(1), AX, vreg(t, "X0")}, "660f3a22c001"},
+		{"PINSRQ $1,AX,X0", "PINSRQ", []Operand{Imm(1), AX, vreg(t, "X0")}, "66480f3a22c001"},
+		{"PINSRW $1,AX,X0", "PINSRW", []Operand{Imm(1), AX, vreg(t, "X0")}, "660fc4c001"},
+		{"PINSRW $1,(AX),X0", "PINSRW", []Operand{Imm(1), Ptr(AX, 0, 2), vreg(t, "X0")}, "660fc40001"},
+		{"PSLLL $2,X0", "PSLLL", []Operand{Imm(2), vreg(t, "X0")}, "660f72f002"},
+		{"PSRAL $2,X0", "PSRAL", []Operand{Imm(2), vreg(t, "X0")}, "660f72e002"},
+		{"PSRLL $2,X0", "PSRLL", []Operand{Imm(2), vreg(t, "X0")}, "660f72d002"},
+		{"PSRLQ $2,X0", "PSRLQ", []Operand{Imm(2), vreg(t, "X0")}, "660f73d002"},
+		{"PSLLQ $2,X0", "PSLLQ", []Operand{Imm(2), vreg(t, "X0")}, "660f73f002"},
+		{"PSLLW $2,X0", "PSLLW", []Operand{Imm(2), vreg(t, "X0")}, "660f71f002"},
+		{"PSRLW $2,X0", "PSRLW", []Operand{Imm(2), vreg(t, "X0")}, "660f71d002"},
+		{"PSRAW $2,X0", "PSRAW", []Operand{Imm(2), vreg(t, "X0")}, "660f71e002"},
+		{"PSLLDQ $2,X0", "PSLLDQ", []Operand{Imm(2), vreg(t, "X0")}, "660f73f802"},
+		{"PSRLDQ $2,X0", "PSRLDQ", []Operand{Imm(2), vreg(t, "X0")}, "660f73d802"},
+		{"PSLLL X0,X1", "PSLLL", []Operand{vreg(t, "X0"), vreg(t, "X1")}, "660ff2c8"},
+		{"PSRLQ X0,X1", "PSRLQ", []Operand{vreg(t, "X0"), vreg(t, "X1")}, "660fd3c8"},
+		{"PSLLL (AX),X1", "PSLLL", []Operand{Ptr(AX, 0, 16), vreg(t, "X1")}, "660ff208"},
+		{"PSUBL X0,X1", "PSUBL", []Operand{vreg(t, "X0"), vreg(t, "X1")}, "660ffac8"},
+		{"PADDL X0,X1", "PADDL", []Operand{vreg(t, "X0"), vreg(t, "X1")}, "660ffec8"},
+		{"PCMPEQL X0,X1", "PCMPEQL", []Operand{vreg(t, "X0"), vreg(t, "X1")}, "660f76c8"},
+		{"PUNPCKLBW X0,X1", "PUNPCKLBW", []Operand{vreg(t, "X0"), vreg(t, "X1")}, "660f60c8"},
+		{"MOVOA X0,X1", "MOVOA", []Operand{vreg(t, "X0"), vreg(t, "X1")}, "660f6fc8"},
+		{"MOVOA (AX),X1", "MOVOA", []Operand{Ptr(AX, 0, 16), vreg(t, "X1")}, "660f6f08"},
+		{"MOVOA X0,(AX)", "MOVOA", []Operand{vreg(t, "X0"), Ptr(AX, 0, 16)}, "660f7f00"},
+		{"AESIMC X0,X1", "AESIMC", []Operand{vreg(t, "X0"), vreg(t, "X1")}, "660f38dbc8"},
+		{"AESIMC (AX),X1", "AESIMC", []Operand{Ptr(AX, 0, 16), vreg(t, "X1")}, "660f38db08"},
+		{"AESENC X0,X1", "AESENC", []Operand{vreg(t, "X0"), vreg(t, "X1")}, "660f38dcc8"},
+		{"AESENCLAST X0,X1", "AESENCLAST", []Operand{vreg(t, "X0"), vreg(t, "X1")}, "660f38ddc8"},
+		{"AESDEC X0,X1", "AESDEC", []Operand{vreg(t, "X0"), vreg(t, "X1")}, "660f38dec8"},
+		{"AESDECLAST X0,X1", "AESDECLAST", []Operand{vreg(t, "X0"), vreg(t, "X1")}, "660f38dfc8"},
+		{"AESKEYGENASSIST $0,X0,X1", "AESKEYGENASSIST", []Operand{Imm(0), vreg(t, "X0"), vreg(t, "X1")}, "660f3adfc800"},
+		{"SHA1MSG1 X0,X1", "SHA1MSG1", []Operand{vreg(t, "X0"), vreg(t, "X1")}, "0f38c9c8"},
+		{"SHA1MSG2 X0,X1", "SHA1MSG2", []Operand{vreg(t, "X0"), vreg(t, "X1")}, "0f38cac8"},
+		{"SHA1NEXTE X0,X1", "SHA1NEXTE", []Operand{vreg(t, "X0"), vreg(t, "X1")}, "0f38c8c8"},
+		{"SHA1RNDS4 $0,X0,X1", "SHA1RNDS4", []Operand{Imm(0), vreg(t, "X0"), vreg(t, "X1")}, "0f3accc800"},
+		{"SHA256MSG1 X0,X1", "SHA256MSG1", []Operand{vreg(t, "X0"), vreg(t, "X1")}, "0f38ccc8"},
+		{"SHA256MSG2 X0,X1", "SHA256MSG2", []Operand{vreg(t, "X0"), vreg(t, "X1")}, "0f38cdc8"},
+		{"SHA256RNDS2 X0,X1,X2", "SHA256RNDS2", []Operand{vreg(t, "X0"), vreg(t, "X1"), vreg(t, "X2")}, "0f38cbd1"},
+	}
+	for _, c := range cases {
+		code, err := Encode(c.mnem, c.ops...)
+		if err != nil {
+			t.Errorf("%s: Encode: %v", c.name, err)
+			continue
+		}
+		if got := fmt.Sprintf("%x", code); got != c.want {
+			t.Errorf("%s = %s, want %s", c.name, got, c.want)
+		}
+	}
+	// SHA256RNDS2's first operand must be the literal X0.
+	if _, err := Encode("SHA256RNDS2", vreg(t, "X1"), vreg(t, "X2"), vreg(t, "X3")); err == nil {
+		t.Errorf("SHA256RNDS2 X1,...: expected an error, got none")
+	}
+	// PSLLDQ has no variable-count form.
+	if _, err := Encode("PSLLDQ", vreg(t, "X0"), vreg(t, "X1")); err == nil {
+		t.Errorf("PSLLDQ X0,X1: expected an error, got none")
+	}
+}
+
+// TestSSEBinGroundTruth checks the legacy packed/scalar binary family
+// byte for byte (no prefix / 66 / F2 / F3 variants).
+func TestSSEBinGroundTruth(t *testing.T) {
+	cases := []struct {
+		name string
+		mnem string
+		ops  []Operand
+		want string
+	}{
+		{"MULPS X0,X1", "MULPS", []Operand{vreg(t, "X0"), vreg(t, "X1")}, "0f59c8"},
+		{"MULPS (DI),X1", "MULPS", []Operand{Ptr(DI, 0, 16), vreg(t, "X1")}, "0f590f"},
+		{"ADDPD X1,X2", "ADDPD", []Operand{vreg(t, "X1"), vreg(t, "X2")}, "660f58d1"},
+		{"XORPS X0,X0", "XORPS", []Operand{vreg(t, "X0"), vreg(t, "X0")}, "0f57c0"},
+		{"UNPCKLPS X0,X0", "UNPCKLPS", []Operand{vreg(t, "X0"), vreg(t, "X0")}, "0f14c0"},
+		{"MULSD X1,X2", "MULSD", []Operand{vreg(t, "X1"), vreg(t, "X2")}, "f20f59d1"},
+		{"ADDSS (DI),X0", "ADDSS", []Operand{Ptr(DI, 0, 4), vreg(t, "X0")}, "f30f5807"},
+	}
+	for _, c := range cases {
+		code, err := Encode(c.mnem, c.ops...)
+		if err != nil {
+			t.Errorf("%s: %v", c.name, err)
+			continue
+		}
+		if got := fmt.Sprintf("%x", code); got != c.want {
+			t.Errorf("%s = %s, want %s", c.name, got, c.want)
+		}
+	}
+}
+
+// TestSSEShuffleGroundTruth checks the imm8 shuffle family: immediate
+// first in Plan 9 order, encoded last on the wire.
+func TestSSEShuffleGroundTruth(t *testing.T) {
+	cases := []struct {
+		name string
+		mnem string
+		ops  []Operand
+		want string
+	}{
+		{"SHUFPS $0,X0,X0", "SHUFPS", []Operand{Imm(0), vreg(t, "X0"), vreg(t, "X0")}, "0fc6c000"},
+		{"SHUFPS $27,X1,X2", "SHUFPS", []Operand{Imm(27), vreg(t, "X1"), vreg(t, "X2")}, "0fc6d11b"},
+		{"PSHUFD $0,X0,X0", "PSHUFD", []Operand{Imm(0), vreg(t, "X0"), vreg(t, "X0")}, "660f70c000"},
+		{"PSHUFLW $3,(DI),X1", "PSHUFLW", []Operand{Imm(3), Ptr(DI, 0, 8), vreg(t, "X1")}, "f20f700f03"},
+		{"PSHUFHW $2,X1,X2", "PSHUFHW", []Operand{Imm(2), vreg(t, "X1"), vreg(t, "X2")}, "f30f70d102"},
+	}
+	for _, c := range cases {
+		code, err := Encode(c.mnem, c.ops...)
+		if err != nil {
+			t.Errorf("%s: %v", c.name, err)
+			continue
+		}
+		if got := fmt.Sprintf("%x", code); got != c.want {
+			t.Errorf("%s = %s, want %s", c.name, got, c.want)
+		}
+	}
+}
+
+// TestMOVQXMMGroundTruth pins the SSE2 packed-quadword move encodings:
+// loads and register moves on F3 0F 7E, stores on 66 0F D6; the forms
+// the GPR-move fallback silently corrupted.
+func TestMOVQXMMGroundTruth(t *testing.T) {
+	cases := []struct {
+		name string
+		mnem string
+		ops  []Operand
+		want string
+	}{
+		{"MOVQ (DI),X0", "MOVQ", []Operand{Ptr(DI, 0, 8), vreg(t, "X0")}, "f30f7e07"},
+		{"MOVQ X1,X2", "MOVQ", []Operand{vreg(t, "X1"), vreg(t, "X2")}, "f30f7ed1"},
+		{"MOVQ X0,(DI)", "MOVQ", []Operand{vreg(t, "X0"), Ptr(DI, 0, 8)}, "660fd607"},
+	}
+	for _, c := range cases {
+		code, err := Encode(c.mnem, c.ops...)
+		if err != nil {
+			t.Errorf("%s: %v", c.name, err)
+			continue
+		}
+		if got := fmt.Sprintf("%x", code); got != c.want {
+			t.Errorf("%s = %s, want %s", c.name, got, c.want)
+		}
+	}
+}

asm/evex.go

@@ -9,10 +9,10 @@ import (
 )
 
 // This file implements EVEX (AVX-512) instruction encoding: the four-byte
-// EVEX prefix with 5-bit vector register fields (Z0–Z31, X/Y 16–31), the
+// EVEX prefix with 5-bit vector register fields (Z0-Z31, X/Y 16-31), the
 // compressed disp8×N displacement, and the operand shapes the go-flac
 // AVX-512 kernels use plus the common floating-point and conversion set.
-// Masking follows the Go assembler's spelling: an explicit K1–K7 operand
+// Masking follows the Go assembler's spelling: an explicit K1-K7 operand
 // anywhere among the operands (merging) plus a ".Z" mnemonic suffix for
 // zeroing.  K-register operands (mask destinations, KMOVW, KTESTW) are
 // supported too.
@@ -36,7 +36,7 @@ type evexSpec struct {
 // are taken from the Go assembler's opcode tables, which are authoritative
 // for byte-for-byte agreement.
 var evexTable = map[string]evexSpec{
-	// EVEX.128/256/512.66.0F — integer arithmetic / logic, NDS form.
+	// EVEX.128/256/512.66.0F, integer arithmetic / logic, NDS form.
 	"VPADDD":      {1, 0xFE, 0, 1, -1, vexNDS3, [3]int{16, 32, 64}},
 	"VPADDQ":      {1, 0xD4, 1, 1, -1, vexNDS3, [3]int{16, 32, 64}},
 	"VPSUBD":      {1, 0xFA, 0, 1, -1, vexNDS3, [3]int{16, 32, 64}},
@@ -48,25 +48,25 @@ var evexTable = map[string]evexSpec{
 	"VPCMPEQD":    {1, 0x76, 0, 1, -1, vexNDS3, [3]int{16, 32, 64}},
 	"VFMADD231PD": {2, 0xB8, 1, 1, -1, vexNDS3, [3]int{16, 32, 64}},
 
-	// EVEX.128/256/512.66.0F.W1 — packed double arithmetic.
+	// EVEX.128/256/512.66.0F.W1, packed double arithmetic.
 	"VADDPD": {1, 0x58, 1, 1, -1, vexNDS3, [3]int{16, 32, 64}},
 	"VMULPD": {1, 0x59, 1, 1, -1, vexNDS3, [3]int{16, 32, 64}},
 	"VSUBPD": {1, 0x5C, 1, 1, -1, vexNDS3, [3]int{16, 32, 64}},
 	"VDIVPD": {1, 0x5E, 1, 1, -1, vexNDS3, [3]int{16, 32, 64}},
 	"VMINPD": {1, 0x5D, 1, 1, -1, vexNDS3, [3]int{16, 32, 64}},
 	"VMAXPD": {1, 0x5F, 1, 1, -1, vexNDS3, [3]int{16, 32, 64}},
-	// EVEX.128/256/512.0F.W0 — packed single arithmetic.
+	// EVEX.128/256/512.0F.W0, packed single arithmetic.
 	"VADDPS": {1, 0x58, 0, 0, -1, vexNDS3, [3]int{16, 32, 64}},
 	"VMULPS": {1, 0x59, 0, 0, -1, vexNDS3, [3]int{16, 32, 64}},
 	"VSUBPS": {1, 0x5C, 0, 0, -1, vexNDS3, [3]int{16, 32, 64}},
 	"VDIVPS": {1, 0x5E, 0, 0, -1, vexNDS3, [3]int{16, 32, 64}},
 	"VMINPS": {1, 0x5D, 0, 0, -1, vexNDS3, [3]int{16, 32, 64}},
 	"VMAXPS": {1, 0x5F, 0, 0, -1, vexNDS3, [3]int{16, 32, 64}},
-	// EVEX.128/256/512.66.0F.W1 — packed double unpack.
+	// EVEX.128/256/512.66.0F.W1, packed double unpack.
 	"VUNPCKLPD": {1, 0x14, 1, 1, -1, vexNDS3, [3]int{16, 32, 64}},
 	"VUNPCKHPD": {1, 0x15, 1, 1, -1, vexNDS3, [3]int{16, 32, 64}},
 
-	// EVEX.128.F2.0F.W1 — scalar double arithmetic (the packed opcodes with
+	// EVEX.128.F2.0F.W1, scalar double arithmetic (the packed opcodes with
 	// an F2 pp; the EVEX forms exist for masked and zeroing use).  The
 	// memory operand is a single double, so disp8×N = 8.
 	"VADDSD": {1, 0x58, 1, 3, -1, vexNDS3, [3]int{8, 8, 8}},
@@ -76,7 +76,7 @@ var evexTable = map[string]evexSpec{
 	"VMINSD": {1, 0x5D, 1, 3, -1, vexNDS3, [3]int{8, 8, 8}},
 	"VMAXSD": {1, 0x5F, 1, 3, -1, vexNDS3, [3]int{8, 8, 8}},
 
-	// EVEX.128.F3.0F.W0 — scalar single arithmetic (disp8×N = 4).
+	// EVEX.128.F3.0F.W0, scalar single arithmetic (disp8×N = 4).
 	"VADDSS": {1, 0x58, 0, 2, -1, vexNDS3, [3]int{4, 4, 4}},
 	"VSUBSS": {1, 0x5C, 0, 2, -1, vexNDS3, [3]int{4, 4, 4}},
 	"VMULSS": {1, 0x59, 0, 2, -1, vexNDS3, [3]int{4, 4, 4}},
@@ -84,38 +84,38 @@ var evexTable = map[string]evexSpec{
 	"VMINSS": {1, 0x5D, 0, 2, -1, vexNDS3, [3]int{4, 4, 4}},
 	"VMAXSS": {1, 0x5F, 0, 2, -1, vexNDS3, [3]int{4, 4, 4}},
 
-	// EVEX.512.66.0F3A — align (NDS + imm8).
+	// EVEX.512.66.0F3A, align (NDS + imm8).
 	"VALIGND": {3, 0x03, 0, 1, -1, vexNDS3Imm, [3]int{16, 32, 64}},
 
-	// EVEX.128/256/512.66.0F — immediate shift (VPSRAD /4).
+	// EVEX.128/256/512.66.0F, immediate shift (VPSRAD /4).
 	"VPSRAD": {1, 0x72, 0, 1, 4, vexShiftImm, [3]int{16, 32, 64}},
-	// EVEX.128/256/512.66.0F.W1 — variable shift with an XMM count (VPSRAQ;
+	// EVEX.128/256/512.66.0F.W1, variable shift with an XMM count (VPSRAQ;
 	// the W bit distinguishes it from VPSRAD's E2 form).
 	"VPSRAQ": {1, 0xE2, 1, 1, -1, vexNDS3, [3]int{16, 32, 64}},
 
-	// EVEX.128/256/512.F3.0F.W1 — signed qword to packed double (reg=dst,
+	// EVEX.128/256/512.F3.0F.W1, signed qword to packed double (reg=dst,
 	// rm=src, no vvvv).
 	"VCVTQQ2PD": {1, 0xE6, 1, 2, -1, vexRM, [3]int{16, 32, 64}},
-	// EVEX.128/256/512.F2.0F.W1 — duplicate the low double (reg=dst,
+	// EVEX.128/256/512.F2.0F.W1, duplicate the low double (reg=dst,
 	// rm=src, no vvvv): a 128-bit destination reads a single double from
 	// memory (disp8×8), the wider ones read the full operand.
 	"VMOVDDUP": {1, 0x12, 1, 3, -1, vexRM, [3]int{8, 32, 64}},
-	// EVEX.128/256/512.0F.W0 — signed dword to packed single (reg=dst,
-	// rm=src, no vvvv, no mandatory prefix — as in the VEX form).
+	// EVEX.128/256/512.0F.W0, signed dword to packed single (reg=dst,
+	// rm=src, no vvvv, no mandatory prefix, as in the VEX form).
 	"VCVTDQ2PS": {1, 0x5B, 0, 0, -1, vexRM, [3]int{16, 32, 64}},
-	// EVEX.128/256/512.0F.W0 — packed single to packed double: the
+	// EVEX.128/256/512.0F.W0, packed single to packed double: the
 	// destination is twice the source width and sets the length; disp8×N
 	// follows the narrow memory source.  No F3 prefix: the Go assembler
 	// emits this instruction with pp = 00 (Intel's maps would call that
-	// undefined) and gasm reproduces the Go assembler's bytes — its machine
+	// undefined) and gasm reproduces the Go assembler's bytes, its machine
 	// code is the oracle, not the manual.
 	"VCVTPS2PD": {1, 0x5A, 0, 0, -1, vexRM, [3]int{8, 16, 32}},
-	// EVEX.128/256/512.F3.0F.W0 — signed dword to packed double (the EVEX
+	// EVEX.128/256/512.F3.0F.W0, signed dword to packed double (the EVEX
 	// form of the VEX instruction; the destination sets the length, disp8×N
 	// follows the narrow memory source).
 	"VCVTDQ2PD": {1, 0xE6, 0, 2, -1, vexRM, [3]int{8, 16, 32}},
 	// EVEX packed double → dword conversions: the source is the wide
-	// operand and the mnemonic fixes the length — the bare names are
+	// operand and the mnemonic fixes the length, the bare names are
 	// 512-bit only (ZMM source, XMM destination), the X/Y spellings are
 	// EVEX-128/256.  Exactly one slot of n is valid; it names the vector
 	// length (and the disp8×N multiplier) a register or memory source
@@ -127,7 +127,7 @@ var evexTable = map[string]evexSpec{
 	"VCVTTPD2DQX": {1, 0xE6, 1, 1, -1, vexRMSrcLen, [3]int{16, 0, 0}},
 	"VCVTTPD2DQY": {1, 0xE6, 1, 1, -1, vexRMSrcLen, [3]int{0, 32, 0}},
 
-	// EVEX.66.0F3A — ternary logic and lane shuffles (NDS + imm8).
+	// EVEX.66.0F3A, ternary logic and lane shuffles (NDS + imm8).
 	"VPTERNLOGD": {3, 0x25, 0, 1, -1, vexNDS3Imm, [3]int{16, 32, 64}},
 	"VPTERNLOGQ": {3, 0x25, 1, 1, -1, vexNDS3Imm, [3]int{16, 32, 64}},
 	"VSHUFI32X4": {3, 0x43, 0, 1, -1, vexNDS3Imm, [3]int{16, 32, 64}},
@@ -136,11 +136,11 @@ var evexTable = map[string]evexSpec{
 	"VSHUFF64X2": {3, 0x23, 1, 1, -1, vexNDS3Imm, [3]int{16, 32, 64}},
 	"VPALIGNR":   {3, 0x0F, 0, 1, -1, vexNDS3Imm, [3]int{16, 32, 64}},
 
-	// EVEX.66.0F — the EVEX forms of the VEX two-source shuffle.
+	// EVEX.66.0F, the EVEX forms of the VEX two-source shuffle.
 	"VSHUFPD": {1, 0xC6, 1, 1, -1, vexNDS3Imm, [3]int{16, 32, 64}},
 	"VSHUFPS": {1, 0xC6, 0, 1, -1, vexNDS3Imm, [3]int{16, 32, 64}},
 
-	// EVEX.66.0F3A — lane insert ($imm, xsrc, zsrc1, zdst).
+	// EVEX.66.0F3A, lane insert ($imm, xsrc, zsrc1, zdst).
 	"VINSERTF32X4": {3, 0x18, 0, 1, -1, vexNDS3Imm, [3]int{0, 16, 32}},
 	"VINSERTF32X8": {3, 0x1A, 0, 1, -1, vexNDS3Imm, [3]int{0, 0, 32}},
 	"VINSERTF64X2": {3, 0x18, 1, 1, -1, vexNDS3Imm, [3]int{0, 16, 32}},
@@ -150,7 +150,7 @@ var evexTable = map[string]evexSpec{
 	"VINSERTI64X2": {3, 0x38, 1, 1, -1, vexNDS3Imm, [3]int{0, 16, 32}},
 	"VINSERTI64X4": {3, 0x3A, 1, 1, -1, vexNDS3Imm, [3]int{0, 0, 32}},
 
-	// EVEX.66.0F3A — lane extract (reg=source, rm=XMM/YMM destination,
+	// EVEX.66.0F3A, lane extract (reg=source, rm=XMM/YMM destination,
 	// imm8).
 	"VEXTRACTF32X4": {3, 0x19, 0, 1, -1, vexExtract, [3]int{0, 16, 16}},
 	"VEXTRACTF32X8": {3, 0x1B, 0, 1, -1, vexExtract, [3]int{0, 0, 32}},
@@ -159,23 +159,45 @@ var evexTable = map[string]evexSpec{
 	"VEXTRACTI32X8": {3, 0x3B, 0, 1, -1, vexExtract, [3]int{0, 0, 32}},
 	"VEXTRACTI64X2": {3, 0x39, 1, 1, -1, vexExtract, [3]int{0, 16, 16}},
 
-	// EVEX.66.0F — compare with an opmask destination ($imm, src2, src1,
+	// EVEX.66.0F, compare with an opmask destination ($imm, src2, src1,
 	// kdst): NDS3Imm with the K register in the reg field.
 	"VCMPPD": {1, 0xC2, 1, 1, -1, vexNDS3Imm, [3]int{16, 32, 64}},
 	"VCMPPS": {1, 0xC2, 0, 0, -1, vexNDS3Imm, [3]int{16, 32, 64}},
 	"VCMPSD": {1, 0xC2, 1, 3, -1, vexNDS3Imm, [3]int{8, 8, 8}},
 	"VCMPSS": {1, 0xC2, 0, 2, -1, vexNDS3Imm, [3]int{4, 4, 4}},
 
-	// EVEX.66.0F38 — permutes (NDS form).
-	"VPERMB":    {2, 0x8D, 0, 1, -1, vexNDS3, [3]int{16, 32, 64}},
-	"VPERMW":    {2, 0x8D, 1, 1, -1, vexNDS3, [3]int{16, 32, 64}},
-	"VPERMI2D":  {2, 0x76, 0, 1, -1, vexNDS3, [3]int{16, 32, 64}},
-	"VPERMI2Q":  {2, 0x76, 1, 1, -1, vexNDS3, [3]int{16, 32, 64}},
+	// EVEX.66.0F3A, integer compares with an opmask destination, the same
+	// NDS3Imm-with-k-reg shape as the floating-point compares; W selects the
+	// operand width (byte/word vs dword/qword), the opcode the signedness.
+	// The memory form takes a full vector, so disp8×N is 16/32/64.
+	"VPCMPB":  {3, 0x3F, 0, 1, -1, vexNDS3Imm, [3]int{16, 32, 64}},
+	"VPCMPUB": {3, 0x3E, 0, 1, -1, vexNDS3Imm, [3]int{16, 32, 64}},
+	"VPCMPW":  {3, 0x3F, 1, 1, -1, vexNDS3Imm, [3]int{16, 32, 64}},
+	"VPCMPUW": {3, 0x3E, 1, 1, -1, vexNDS3Imm, [3]int{16, 32, 64}},
+	"VPCMPD":  {3, 0x1F, 0, 1, -1, vexNDS3Imm, [3]int{16, 32, 64}},
+	"VPCMPUD": {3, 0x1E, 0, 1, -1, vexNDS3Imm, [3]int{16, 32, 64}},
+	"VPCMPQ":  {3, 0x1F, 1, 1, -1, vexNDS3Imm, [3]int{16, 32, 64}},
+	"VPCMPUQ": {3, 0x1E, 1, 1, -1, vexNDS3Imm, [3]int{16, 32, 64}},
+
+	// EVEX.66.0F38, permutes (NDS form).
+	"VPERMB":   {2, 0x8D, 0, 1, -1, vexNDS3, [3]int{16, 32, 64}},
+	"VPERMW":   {2, 0x8D, 1, 1, -1, vexNDS3, [3]int{16, 32, 64}},
+	"VPERMI2B": {2, 0x75, 0, 1, -1, vexNDS3, [3]int{16, 32, 64}},
+	"VPERMI2D": {2, 0x76, 0, 1, -1, vexNDS3, [3]int{16, 32, 64}},
+	"VPERMI2Q": {2, 0x76, 1, 1, -1, vexNDS3, [3]int{16, 32, 64}},
+	// EVEX.66.0F38, population count (reg=dst, rm=src; W selects byte/word
+	// against dword/qword).
+	"VPOPCNTB": {2, 0x54, 0, 1, -1, vexRM, [3]int{16, 32, 64}},
+	"VPOPCNTD": {2, 0x55, 0, 1, -1, vexRM, [3]int{16, 32, 64}},
+	"VPOPCNTQ": {2, 0x55, 1, 1, -1, vexRM, [3]int{16, 32, 64}},
+	// EVEX.66.0F.W1, the qword spelling of the packed OR (VPORQ has no VEX
+	// form in the Go assembler: it always encodes through EVEX).
+	"VPORQ":     {1, 0xEB, 1, 1, -1, vexNDS3, [3]int{16, 32, 64}},
 	"VPERMT2D":  {2, 0x7E, 0, 1, -1, vexNDS3, [3]int{16, 32, 64}},
 	"VPERMT2Q":  {2, 0x7E, 1, 1, -1, vexNDS3, [3]int{16, 32, 64}},
 	"VPERMT2PD": {2, 0x7F, 1, 1, -1, vexNDS3, [3]int{16, 32, 64}},
 
-	// EVEX.66.0F — the wider integer set (NDS form).
+	// EVEX.66.0F, the wider integer set (NDS form).
 	"VPMADDWD":   {1, 0xF5, 0, 1, -1, vexNDS3, [3]int{16, 32, 64}},
 	"VPMULHUW":   {1, 0xE4, 0, 1, -1, vexNDS3, [3]int{16, 32, 64}},
 	"VPMADDUBSW": {2, 0x04, 0, 1, -1, vexNDS3, [3]int{16, 32, 64}},
@@ -186,34 +208,34 @@ var evexTable = map[string]evexSpec{
 	"VPACKSSDW":  {1, 0x6B, 0, 1, -1, vexNDS3, [3]int{16, 32, 64}},
 	"VPACKUSDW":  {2, 0x2B, 0, 1, -1, vexNDS3, [3]int{16, 32, 64}},
 
-	// EVEX.66.0F38 — absolute values and replicating moves (reg=dst,
+	// EVEX.66.0F38, absolute values and replicating moves (reg=dst,
 	// rm=src).
 	"VPABSB": {2, 0x1C, 0, 1, -1, vexRM, [3]int{16, 32, 64}},
 	"VPABSW": {2, 0x1D, 0, 1, -1, vexRM, [3]int{16, 32, 64}},
 	"VPABSD": {2, 0x1E, 0, 1, -1, vexRM, [3]int{16, 32, 64}},
 	"VPABSQ": {2, 0x1F, 1, 1, -1, vexRM, [3]int{16, 32, 64}},
-	// EVEX.F3.0F — replicate even/odd singles.
+	// EVEX.F3.0F, replicate even/odd singles.
 	"VMOVSLDUP": {1, 0x12, 0, 2, -1, vexRM, [3]int{16, 32, 64}},
 	"VMOVSHDUP": {1, 0x16, 0, 2, -1, vexRM, [3]int{16, 32, 64}},
-	// EVEX.66.0F38 — sign/zero-extending moves; the memory source is the
+	// EVEX.66.0F38, sign/zero-extending moves; the memory source is the
 	// narrow half (here byte to word).
 	"VPMOVSXBW": {2, 0x20, 0, 1, -1, vexRM, [3]int{8, 16, 32}},
 	"VPMOVZXBW": {2, 0x30, 0, 1, -1, vexRM, [3]int{8, 16, 32}},
-	// EVEX.66.0F — packed single conversions (reg=dst, rm=src).
+	// EVEX.66.0F, packed single conversions (reg=dst, rm=src).
 	"VCVTPS2DQ":  {1, 0x5B, 0, 1, -1, vexRM, [3]int{16, 32, 64}},
 	"VCVTTPS2DQ": {1, 0x5B, 0, 2, -1, vexRM, [3]int{16, 32, 64}},
-	// EVEX.66.0F38 — broadcast a single/double to all lanes (reg=dst,
+	// EVEX.66.0F38, broadcast a single/double to all lanes (reg=dst,
 	// rm=scalar memory; disp8×N is the element size).
 	"VBROADCASTSS": {2, 0x18, 0, 1, -1, vexRM, [3]int{4, 4, 4}},
 	"VBROADCASTSD": {2, 0x19, 1, 1, -1, vexRM, [3]int{0, 8, 8}},
 
-	// EVEX.66.0F38 — expand loads (rm → vector register destination).
+	// EVEX.66.0F38, expand loads (rm → vector register destination).
 	"VEXPANDPD": {2, 0x88, 1, 1, -1, vexRM, [3]int{8, 8, 8}},
 	"VEXPANDPS": {2, 0x88, 0, 1, -1, vexRM, [3]int{4, 4, 4}},
 	"VPEXPANDD": {2, 0x89, 0, 1, -1, vexRM, [3]int{4, 4, 4}},
 	"VPEXPANDQ": {2, 0x89, 1, 1, -1, vexRM, [3]int{8, 8, 8}},
 
-	// EVEX.66.0F38 — compress stores (vector register source → rm), and the
+	// EVEX.66.0F38, compress stores (vector register source → rm), and the
 	// remaining narrowing stores.
 	"VCOMPRESSPD": {2, 0x8A, 1, 1, -1, vexRMRev, [3]int{8, 8, 8}},
 	"VCOMPRESSPS": {2, 0x8A, 0, 1, -1, vexRMRev, [3]int{4, 4, 4}},
@@ -222,7 +244,7 @@ var evexTable = map[string]evexSpec{
 	"VPMOVWB":     {2, 0x30, 0, 2, -1, vexRMRev, [3]int{8, 16, 32}},
 	"VPMOVQB":     {2, 0x32, 0, 2, -1, vexRMRev, [3]int{2, 4, 8}},
 
-	// EVEX.66.0F — rotates (immediate form: /0 right, /1 left).
+	// EVEX.66.0F, rotates (immediate form: /0 right, /1 left).
 	"VPRORD": {1, 0x72, 0, 1, 0, vexShiftImm, [3]int{16, 32, 64}},
 	"VPRORQ": {1, 0x72, 1, 1, 0, vexShiftImm, [3]int{16, 32, 64}},
 	"VPROLD": {1, 0x72, 0, 1, 1, vexShiftImm, [3]int{16, 32, 64}},
@@ -235,14 +257,14 @@ var evexTable = map[string]evexSpec{
 	"VPSRLQ": {1, 0x73, 1, 1, 2, vexShiftImm, [3]int{16, 32, 64}},
 	"VPSLLQ": {1, 0x73, 1, 1, 6, vexShiftImm, [3]int{16, 32, 64}},
 
-	// EVEX.66.0F38 — floating-point helpers, packed (reg=dst, rm=src).
+	// EVEX.66.0F38, floating-point helpers, packed (reg=dst, rm=src).
 	"VRCP14PD":   {2, 0x4C, 1, 1, -1, vexRM, [3]int{16, 32, 64}},
 	"VRCP14PS":   {2, 0x4C, 0, 1, -1, vexRM, [3]int{16, 32, 64}},
 	"VRSQRT14PD": {2, 0x4E, 1, 1, -1, vexRM, [3]int{16, 32, 64}},
 	"VRSQRT14PS": {2, 0x4E, 0, 1, -1, vexRM, [3]int{16, 32, 64}},
 	"VGETEXPPD":  {2, 0x42, 1, 1, -1, vexRM, [3]int{16, 32, 64}},
 	"VGETEXPPS":  {2, 0x42, 0, 1, -1, vexRM, [3]int{16, 32, 64}},
-	// EVEX.66.0F38 — floating-point helpers, scalar (NDS form: src2 is
+	// EVEX.66.0F38, floating-point helpers, scalar (NDS form: src2 is
 	// rm, src1 is vvvv, the XMM destination is reg).  Like the scalar 0F3A
 	// forms, these take the 66 prefix; W selects double/single.
 	"VRCP14SD":   {2, 0x4D, 1, 1, -1, vexNDS3, [3]int{8, 8, 8}},
@@ -251,13 +273,13 @@ var evexTable = map[string]evexSpec{
 	"VRSQRT14SS": {2, 0x4F, 0, 1, -1, vexNDS3, [3]int{4, 4, 4}},
 	"VGETEXPSD":  {2, 0x43, 1, 1, -1, vexNDS3, [3]int{8, 8, 8}},
 	"VGETEXPSS":  {2, 0x43, 0, 1, -1, vexNDS3, [3]int{4, 4, 4}},
-	// EVEX.66.0F38 — scale by a power of two (NDS form).
+	// EVEX.66.0F38, scale by a power of two (NDS form).
 	"VSCALEFPD": {2, 0x2C, 1, 1, -1, vexNDS3, [3]int{16, 32, 64}},
 	"VSCALEFPS": {2, 0x2C, 0, 1, -1, vexNDS3, [3]int{16, 32, 64}},
 	"VSCALEFSD": {2, 0x2D, 1, 1, -1, vexNDS3, [3]int{8, 8, 8}},
 	"VSCALEFSS": {2, 0x2D, 0, 1, -1, vexNDS3, [3]int{4, 4, 4}},
 
-	// EVEX.66.0F3A — packed round/getmant/reduce ($imm, src, dst: reg=dst,
+	// EVEX.66.0F3A, packed round/getmant/reduce ($imm, src, dst: reg=dst,
 	// rm=src, imm8).
 	"VRNDSCALEPD": {3, 0x09, 1, 1, -1, vexImmRM, [3]int{16, 32, 64}},
 	"VRNDSCALEPS": {3, 0x08, 0, 1, -1, vexImmRM, [3]int{16, 32, 64}},
@@ -265,7 +287,7 @@ var evexTable = map[string]evexSpec{
 	"VGETMANTPS":  {3, 0x26, 0, 1, -1, vexImmRM, [3]int{16, 32, 64}},
 	"VREDUCEPD":   {3, 0x56, 1, 1, -1, vexImmRM, [3]int{16, 32, 64}},
 	"VREDUCEPS":   {3, 0x56, 0, 1, -1, vexImmRM, [3]int{16, 32, 64}},
-	// EVEX.66.0F3A — scalar round/getmant/reduce and fixup/range (NDS +
+	// EVEX.66.0F3A, scalar round/getmant/reduce and fixup/range (NDS +
 	// imm8: $imm, src2, src1, dst).  The scalar 0F3A forms all take the 66
 	// prefix; W selects double/single.
 	"VRNDSCALESD": {3, 0x0B, 1, 1, -1, vexNDS3Imm, [3]int{8, 8, 8}},
@@ -283,7 +305,7 @@ var evexTable = map[string]evexSpec{
 	"VRANGESD":    {3, 0x51, 1, 1, -1, vexNDS3Imm, [3]int{8, 8, 8}},
 	"VRANGESS":    {3, 0x51, 0, 1, -1, vexNDS3Imm, [3]int{4, 4, 4}},
 
-	// EVEX.66.0F3A — floating-point class test ($imm, src, kdst): the
+	// EVEX.66.0F3A, floating-point class test ($imm, src, kdst): the
 	// reg field carries the opmask destination.  The packed forms carry an
 	// explicit length in the mnemonic (X/Y/Z).
 	"VFPCLASSPDX": {3, 0x66, 1, 1, -1, vexImmRM, [3]int{16, 0, 0}},
@@ -295,7 +317,7 @@ var evexTable = map[string]evexSpec{
 	"VFPCLASSSD":  {3, 0x67, 1, 1, -1, vexImmRM, [3]int{8, 0, 0}},
 	"VFPCLASSSS":  {3, 0x67, 0, 1, -1, vexImmRM, [3]int{4, 0, 0}},
 
-	// EVEX — the remaining conversions.  VCVTQQ2PS narrows (the 512-bit
+	// EVEX, the remaining conversions.  VCVTQQ2PS narrows (the 512-bit
 	// source sets the length); the rest follow the destination.
 	"VCVTQQ2PS":  {1, 0x5B, 1, 0, -1, vexRMSrcLen, [3]int{0, 0, 64}},
 	"VCVTPD2QQ":  {1, 0x7B, 1, 1, -1, vexRM, [3]int{16, 32, 64}},
@@ -303,13 +325,13 @@ var evexTable = map[string]evexSpec{
 	"VCVTPS2QQ":  {1, 0x7B, 0, 1, -1, vexRM, [3]int{8, 16, 32}},
 	"VCVTUDQ2PD": {1, 0x7A, 0, 2, -1, vexRM, [3]int{8, 16, 32}},
 	"VCVTUDQ2PS": {1, 0x7A, 0, 0, -1, vexRM, [3]int{8, 16, 32}},
-	// EVEX.66.0F38 — half-precision convert (half-width source).
+	// EVEX.66.0F38, half-precision convert (half-width source).
 	"VCVTPH2PS": {2, 0x13, 0, 1, -1, vexRM, [3]int{8, 16, 32}},
-	// EVEX.66.0F3A — half-precision convert back ($imm, src, dst: reg=src,
-	// rm=dst, imm8 — the extract layout).
+	// EVEX.66.0F3A, half-precision convert back ($imm, src, dst: reg=src,
+	// rm=dst, imm8, the extract layout).
 	"VCVTPS2PH": {3, 0x1D, 0, 1, -1, vexExtract, [3]int{8, 16, 32}},
 
-	// EVEX — unsigned and truncating conversions.  The PD sources are the
+	// EVEX, unsigned and truncating conversions.  The PD sources are the
 	// wide operand (the bare names are 512-bit only, the X/Y spellings fix
 	// the length); the PS/UQQ destinations are wide and follow the
 	// destination.
@@ -336,7 +358,7 @@ var evexTable = map[string]evexSpec{
 	"VCVTQQ2PSX":   {1, 0x5B, 1, 0, -1, vexRMSrcLen, [3]int{16, 0, 0}},
 	"VCVTQQ2PSY":   {1, 0x5B, 1, 0, -1, vexRMSrcLen, [3]int{0, 32, 0}},
 
-	// EVEX.66.0F38 — the remaining sign/zero-extending moves (narrow
+	// EVEX.66.0F38, the remaining sign/zero-extending moves (narrow
 	// source; disp8×N follows its size).
 	"VPMOVSXBD": {2, 0x21, 0, 1, -1, vexRM, [3]int{4, 8, 16}},
 	"VPMOVSXBQ": {2, 0x22, 0, 1, -1, vexRM, [3]int{2, 4, 8}},
@@ -348,7 +370,7 @@ var evexTable = map[string]evexSpec{
 	"VPMOVZXWQ": {2, 0x34, 0, 1, -1, vexRM, [3]int{4, 8, 16}},
 	"VPMOVZXDQ": {2, 0x35, 0, 1, -1, vexRM, [3]int{8, 16, 32}},
 
-	// EVEX.F3.0F38 — the remaining narrowing stores (vector source in reg,
+	// EVEX.F3.0F38, the remaining narrowing stores (vector source in reg,
 	// narrow destination in r/m): signed, unsigned and the D/Q truncations.
 	"VPMOVSDB":  {2, 0x21, 0, 2, -1, vexRMRev, [3]int{4, 8, 16}},
 	"VPMOVSQB":  {2, 0x22, 0, 2, -1, vexRMRev, [3]int{2, 4, 8}},
@@ -365,7 +387,7 @@ var evexTable = map[string]evexSpec{
 	"VPMOVDB":   {2, 0x31, 0, 2, -1, vexRMRev, [3]int{4, 8, 16}},
 	"VPMOVQW":   {2, 0x34, 0, 2, -1, vexRMRev, [3]int{4, 8, 16}},
 
-	// EVEX.F3.0F38 — mask/vector conversions: M2* moves an opmask register
+	// EVEX.F3.0F38, mask/vector conversions: M2* moves an opmask register
 	// into a vector (rm = K source, reg = vector destination), *2M does the
 	// reverse (reg = K destination, rm = vector source, the length follows
 	// the vector).
@@ -378,7 +400,7 @@ var evexTable = map[string]evexSpec{
 	"VPMOVD2M": {2, 0x39, 0, 2, -1, vexRM, [3]int{16, 32, 64}},
 	"VPMOVQ2M": {2, 0x39, 1, 2, -1, vexRM, [3]int{16, 32, 64}},
 
-	// EVEX — scalar conversions between vector and general-purpose
+	// EVEX, scalar conversions between vector and general-purpose
 	// registers.  Vector to GPR (two operands: vec/mem source, GPR
 	// destination, vvvv unused): the signed and truncated pair, and the
 	// unsigned forms (EVEX only).
@@ -408,22 +430,22 @@ var evexTable = map[string]evexSpec{
 	"VCVTUSI2SDQ": {1, 0x7B, 1, 3, -1, vexNDS3, [3]int{8, 8, 8}},
 	"VCVTUSI2SSL": {1, 0x7B, 0, 2, -1, vexNDS3, [3]int{4, 4, 4}},
 	"VCVTUSI2SSQ": {1, 0x7B, 1, 2, -1, vexNDS3, [3]int{8, 8, 8}},
-	// EVEX.128/256/512.66.0F38.W0 — sign-extend dwords to qwords; the memory
+	// EVEX.128/256/512.66.0F38.W0, sign-extend dwords to qwords; the memory
 	// operand is the narrow source, so disp8×N follows its size (8/16/32 for
 	// the xmm/ymm/zmm destination lengths).
 	"VPMOVSXDQ": {2, 0x25, 0, 1, -1, vexRM, [3]int{8, 16, 32}},
 
-	// EVEX.512.66.0F3A.W1 — lane extract (reg=ZMM source, rm=YMM/memory
+	// EVEX.512.66.0F3A.W1, lane extract (reg=ZMM source, rm=YMM/memory
 	// destination, imm8).
 	"VEXTRACTI64X4": {3, 0x3B, 1, 1, -1, vexExtract, [3]int{0, 0, 32}},
 	"VEXTRACTF64X4": {3, 0x1B, 1, 1, -1, vexExtract, [3]int{0, 0, 32}},
 
-	// EVEX.66.0F38 — more integer NDS forms (W distinguishes D/Q).
+	// EVEX.66.0F38, more integer NDS forms (W distinguishes D/Q).
 	"VPMULLD": {2, 0x40, 0, 1, -1, vexNDS3, [3]int{16, 32, 64}},
 	"VPMULLQ": {2, 0x40, 1, 1, -1, vexNDS3, [3]int{16, 32, 64}},
 	"VPERMD":  {2, 0x36, 0, 1, -1, vexNDS3, [3]int{0, 32, 64}},
 
-	// EVEX.128/256/512 — the wider integer set (AVX-512 F/BW): byte/word
+	// EVEX.128/256/512, the wider integer set (AVX-512 F/BW): byte/word
 	// arithmetic, the bitwise ops with D/Q suffixes, min/max, averages and
 	// variable shifts.  All NDS form; W distinguishes element size.
 	"VPADDB":  {1, 0xFC, 0, 1, -1, vexNDS3, [3]int{16, 32, 64}},
@@ -461,21 +483,21 @@ var evexTable = map[string]evexSpec{
 	"VPSRAVQ": {2, 0x46, 1, 1, -1, vexNDS3, [3]int{16, 32, 64}},
 
 	// EVEX forms of instructions that also exist in VEX (selected when a ZMM
-	// or K register, or indices 16–31, demand EVEX).
+	// or K register, or indices 16-31, demand EVEX).
 	"VPSHUFD": {1, 0x70, 0, 1, -1, vexImmRM, [3]int{16, 32, 64}},
 	"VPSHUFB": {2, 0x00, 0, 1, -1, vexNDS3, [3]int{16, 32, 64}},
 
-	// EVEX.66.0F — immediate shift (VPSLLD /6).
+	// EVEX.66.0F, immediate shift (VPSLLD /6).
 	"VPSLLD": {1, 0x72, 0, 1, 6, vexShiftImm, [3]int{16, 32, 64}},
 
-	// EVEX.F3.0F38.W0 — narrowing stores: reg = wide source, rm = narrow
+	// EVEX.F3.0F38.W0, narrowing stores: reg = wide source, rm = narrow
 	// destination (VPMOVDW dword→word, VPMOVQD qword→dword).
 	"VPMOVDW": {2, 0x33, 0, 2, -1, vexRMRev, [3]int{8, 16, 32}},
 	"VPMOVQD": {2, 0x35, 0, 2, -1, vexRMRev, [3]int{8, 16, 32}},
 }
 
 // evexBcastSpec describes an EVEX broadcast (VPBROADCASTD/Q): the opcode
-// depends on the source kind — a GPR source uses opReg, a memory source uses
+// depends on the source kind, a GPR source uses opReg, a memory source uses
 // opMem with a disp8×N of n.
 type evexBcastSpec struct {
 	mapSel int
@@ -486,50 +508,53 @@ type evexBcastSpec struct {
 }
 
 var evexBcastTable = map[string]evexBcastSpec{
-	// EVEX.128/256/512.66.0F38 — broadcast a dword/qword to all lanes.
+	// EVEX.128/256/512.66.0F38, broadcast a dword/qword to all lanes.
 	"VPBROADCASTD": {2, 0x7C, 0x58, 0, 4},
 	"VPBROADCASTQ": {2, 0x7C, 0x59, 1, 8},
-	// EVEX.128/256/512.66.0F38 — broadcast a byte/word (GPR or memory
+	// EVEX.128/256/512.66.0F38, broadcast a byte/word (GPR or memory
 	// source) to all lanes.
 	"VPBROADCASTB": {2, 0x7A, 0x78, 0, 1},
 	"VPBROADCASTW": {2, 0x7B, 0x79, 0, 2},
 }
 
 // evexMoveSpec describes an EVEX move (load and store opcodes, like the VEX
-// move table).
+// move table).  vecOK and xmmOnly mirror the VEX twin's operand rules: a
+// scalar move (vecOK false, xmmOnly true) takes XMM↔memory operands only.
 type evexMoveSpec struct {
-	mapSel int
-	pp     int
-	load   byte // r/m → vector
-	store  byte // vector → r/m
-	w      int
-	n      [3]int
+	mapSel  int
+	pp      int
+	load    byte // r/m → vector
+	store   byte // vector → r/m
+	w       int
+	n       [3]int
+	vecOK   bool // the non-memory operand may be a vector register
+	xmmOnly bool // wider than XMM registers are rejected
 }
 
 // evexMoveTable maps an upper-case EVEX move mnemonic to its encoding.
 var evexMoveTable = map[string]evexMoveSpec{
-	// EVEX.128/256/512.F3.0F.W0 — unaligned integer move.
-	"VMOVDQU32": {1, 2, 0x6F, 0x7F, 0, [3]int{16, 32, 64}},
-	// EVEX.128/256/512.F3.0F.W1 — unaligned qword move.
-	"VMOVDQU64": {1, 2, 0x6F, 0x7F, 1, [3]int{16, 32, 64}},
-	// EVEX.128/256/512.F2.0F.W0 — unaligned byte move (byte/word moves use the
+	// EVEX.128/256/512.F3.0F.W0, unaligned integer move.
+	"VMOVDQU32": {1, 2, 0x6F, 0x7F, 0, [3]int{16, 32, 64}, true, false},
+	// EVEX.128/256/512.F3.0F.W1, unaligned qword move.
+	"VMOVDQU64": {1, 2, 0x6F, 0x7F, 1, [3]int{16, 32, 64}, true, false},
+	// EVEX.128/256/512.F2.0F.W0, unaligned byte move (byte/word moves use the
 	// F2 prefix, dword/qword moves F3; the element size only changes the tuple
 	// semantics).
-	"VMOVDQU8": {1, 3, 0x6F, 0x7F, 0, [3]int{16, 32, 64}},
-	// EVEX.128/256/512.F2.0F.W1 — unaligned word move (shares the qword
+	"VMOVDQU8": {1, 3, 0x6F, 0x7F, 0, [3]int{16, 32, 64}, true, false},
+	// EVEX.128/256/512.F2.0F.W1, unaligned word move (shares the qword
 	// encoding).
-	"VMOVDQU16": {1, 3, 0x6F, 0x7F, 1, [3]int{16, 32, 64}},
-	// EVEX.128/256/512.66.0F.W1 — unaligned packed double move.
-	"VMOVUPD": {1, 1, 0x10, 0x11, 1, [3]int{16, 32, 64}},
-	// EVEX.128/256/512 — aligned packed moves.
-	"VMOVAPS": {1, 0, 0x28, 0x29, 0, [3]int{16, 32, 64}},
-	"VMOVAPD": {1, 1, 0x28, 0x29, 1, [3]int{16, 32, 64}},
-	// EVEX.128/256/512.66.0F — aligned integer moves.
-	"VMOVDQA32": {1, 1, 0x6F, 0x7F, 0, [3]int{16, 32, 64}},
-	"VMOVDQA64": {1, 1, 0x6F, 0x7F, 1, [3]int{16, 32, 64}},
-	// EVEX.128.F3.0F.W0 — scalar single move, memory operands (the
+	"VMOVDQU16": {1, 3, 0x6F, 0x7F, 1, [3]int{16, 32, 64}, true, false},
+	// EVEX.128/256/512.66.0F.W1, unaligned packed double move.
+	"VMOVUPD": {1, 1, 0x10, 0x11, 1, [3]int{16, 32, 64}, true, false},
+	// EVEX.128/256/512, aligned packed moves.
+	"VMOVAPS": {1, 0, 0x28, 0x29, 0, [3]int{16, 32, 64}, true, false},
+	"VMOVAPD": {1, 1, 0x28, 0x29, 1, [3]int{16, 32, 64}, true, false},
+	// EVEX.128/256/512.66.0F, aligned integer moves.
+	"VMOVDQA32": {1, 1, 0x6F, 0x7F, 0, [3]int{16, 32, 64}, true, false},
+	"VMOVDQA64": {1, 1, 0x6F, 0x7F, 1, [3]int{16, 32, 64}, true, false},
+	// EVEX.128.F3.0F.W0, scalar single move, memory operands (the
 	// three-operand register form is not supported).
-	"VMOVSS": {1, 2, 0x10, 0x11, 0, [3]int{4, 4, 4}},
+	"VMOVSS": {1, 2, 0x10, 0x11, 0, [3]int{4, 4, 4}, false, true},
 }
 
 // isEvex reports whether the mnemonic has an EVEX encoding we handle.
@@ -546,7 +571,7 @@ func isEvex(mnemUpper string) bool {
 
 // evexRequired reports whether the operands force the EVEX encoding of a
 // mnemonic that also has a VEX form: ZMM and K registers do, and so do
-// register indices 16–31, which only EVEX can represent (X16–Y31 exist
+// register indices 16-31, which only EVEX can represent (X16-Y31 exist
 // solely under AVX-512).
 func evexRequired(upper string, ops []Operand) bool {
 	_, inVex := vexTable[upper]
@@ -565,7 +590,7 @@ func evexRequired(upper string, ops []Operand) bool {
 // evexSuffix carries the EVEX mnemonic suffixes the Go assembler accepts:
 // zeroing (.Z), a rounding mode (.RN_SAE, .RD_SAE, .RU_SAE, .RZ_SAE),
 // suppress-all-exceptions (.SAE) and memory broadcast (.BCST).  Masking is
-// not a suffix — Go writes it as an explicit K operand.
+// not a suffix, Go writes it as an explicit K operand.
 type evexSuffix struct {
 	zeroing  bool
 	sae      bool
@@ -590,12 +615,12 @@ func (s evexSuffix) evexOnly() bool {
 // broadcast together with rounding/SAE.
 func parseEvexSuffix(mnem string) (string, evexSuffix, error) {
 	sfx := evexSuffix{rounding: -1}
-	i := strings.IndexByte(mnem, '.')
-	if i < 0 {
+	before, after, ok := strings.Cut(mnem, ".")
+	if !ok {
 		return mnem, sfx, nil
 	}
-	base := mnem[:i]
-	parts := strings.Split(mnem[i+1:], ".")
+	base := before
+	parts := strings.Split(after, ".")
 	seen := map[string]bool{}
 	for j, p := range parts {
 		if seen[p] {
@@ -605,7 +630,7 @@ func parseEvexSuffix(mnem string) (string, evexSuffix, error) {
 		switch p {
 		case "Z":
 			if j != len(parts)-1 {
-				return "", sfx, fmt.Errorf("the .Z suffix must come last in %q", mnem[i+1:])
+				return "", sfx, fmt.Errorf("the .Z suffix must come last in %q", after)
 			}
 			sfx.zeroing = true
 		case "SAE":
@@ -625,7 +650,7 @@ func parseEvexSuffix(mnem string) (string, evexSuffix, error) {
 		}
 	}
 	if sfx.bcst && (sfx.sae || sfx.rounding >= 0) {
-		return "", sfx, fmt.Errorf("cannot combine .BCST with rounding or SAE in %q", mnem[i+1:])
+		return "", sfx, fmt.Errorf("cannot combine .BCST with rounding or SAE in %q", after)
 	}
 	return base, sfx, nil
 }
@@ -655,7 +680,7 @@ var evexRound = map[string]bool{
 }
 
 // evexBcstN maps an instruction accepting .BCST to the broadcast element
-// size — the disp8×N multiplier for its memory operand.
+// size, the disp8×N multiplier for its memory operand.
 var evexBcstN = map[string]int{
 	"VADDPD": 8, "VSUBPD": 8, "VMULPD": 8, "VDIVPD": 8,
 	"VMINPD": 8, "VMAXPD": 8,
@@ -676,7 +701,7 @@ var evexBcstN = map[string]int{
 	"VCVTTPD2QQ": 8, "VCVTTPS2QQ": 4, "VCVTUQQ2PD": 8, "VCVTUQQ2PS": 8,
 }
 
-// splitMask extracts an explicit mask register (K1–K7) from the operand list,
+// splitMask extracts an explicit mask register (K1-K7) from the operand list,
 // returning the remaining operands and the mask index.  K0 is not a usable
 // mask (aaa = 0 means "no mask"), matching the assembler.
 func splitMask(ops []Operand) ([]Operand, int, error) {
@@ -688,7 +713,7 @@ func splitMask(ops []Operand) ([]Operand, int, error) {
 				return nil, 0, fmt.Errorf("at most one mask register operand")
 			}
 			if r.idx == 0 {
-				return nil, 0, fmt.Errorf("K0 is not a usable mask register")
+				return nil, 0, fmt.Errorf("k0 is not a usable mask register")
 			}
 			mask = r.idx
 			continue
@@ -699,7 +724,7 @@ func splitMask(ops []Operand) ([]Operand, int, error) {
 }
 
 // encodeEvex encodes an EVEX instruction with operands in Plan 9 order.  The
-// mask, when present, is an explicit K1–K7 operand anywhere among the
+// mask, when present, is an explicit K1-K7 operand anywhere among the
 // operands; the mnemonic suffix carries zeroing, rounding/SAE and
 // broadcast.
 func (e *enc) encodeEvex(mnemUpper string, ops []Operand, sfx evexSuffix) error {
@@ -1009,6 +1034,12 @@ func (e *enc) encodeEvexMove(mnem string, ms evexMoveSpec, ops []Operand, mask i
 	var rm Operand
 	switch {
 	case srcIsVec && dstIsVec:
+		// A store-form reg-reg move, the layout the Go assembler uses; a
+		// scalar move has no two-register form at all (the register form
+		// takes three operands), matching the VEX twin's vecOK rule.
+		if !ms.vecOK {
+			return fmt.Errorf("%s does not take two vector registers", mnem)
+		}
 		reg, rm = srcReg, dst
 	case srcIsVec:
 		if !memOperand(dst) {
@@ -1024,12 +1055,18 @@ func (e *enc) encodeEvexMove(mnem string, ms evexMoveSpec, ops []Operand, mask i
 	default:
 		return fmt.Errorf("%s needs a vector register operand", mnem)
 	}
+	// The scalar move is 128-bit only, so the register the length follows
+	// must be an XMM (the VEX twin's xmmOnly rule; EVEX also reaches ZMM,
+	// hence the inequality rather than a YMM test).
+	if ms.xmmOnly && reg.size != 16 {
+		return fmt.Errorf("%s operates on XMM registers only", mnem)
+	}
 	spec := evexSpec{mapSel: ms.mapSel, opcode: op, w: ms.w, pp: ms.pp, opdigit: -1, n: ms.n}
 	return e.emitEvexFields(spec, reg.vecLenBit(), reg.idx, -1, rm, mask, sfx)
 }
 
 // encodeEvexRMSrcLen encodes a length-narrowing conversion: OP src, dst with
-// the destination always XMM and the length fixed by the mnemonic — the
+// the destination always XMM and the length fixed by the mnemonic, the
 // single valid slot of spec.n names the vector length (and the disp8×N
 // multiplier) a register or memory source encodes.
 func (e *enc) encodeEvexRMSrcLen(spec evexSpec, ops []Operand, mask int, sfx evexSuffix) error {
@@ -1048,7 +1085,7 @@ func (e *enc) encodeEvexRMSrcLen(spec evexSpec, ops []Operand, mask int, sfx eve
 	return e.emitEvexFields(spec, ll, dstReg.idx, -1, src, mask, sfx)
 }
 
-// soleLen returns the vector-length index of the single valid slot of n —
+// soleLen returns the vector-length index of the single valid slot of n
 // the length a length-fixed mnemonic (the EVEX conversion spellings) encodes
 // regardless of its operands.
 func soleLen(n [3]int) (int, error) {
@@ -1118,8 +1155,8 @@ func (e *enc) encodeEvexBcast(bs evexBcastSpec, ops []Operand, mask int, sfx eve
 
 // emitEvexFields emits the EVEX prefix, opcode, ModR/M, SIB and displacement
 // (disp8×N compressed) for the given precomputed fields.  regIdx is the
-// unextended reg-field register index, or a /digit (0–7); vvvvIdx is the
-// vvvv register index, or -1 when unused.  mask (K1–K7, 0 = unmasked) and
+// unextended reg-field register index, or a /digit (0-7); vvvvIdx is the
+// vvvv register index, or -1 when unused.  mask (K1-K7, 0 = unmasked) and
 // zeroing fill the aaa and z bits of the P2 byte.
 func (e *enc) emitEvexFields(spec evexSpec, ll, regIdx, vvvvIdx int, rm Operand, mask int, sfx evexSuffix) error {
 	if ll > 2 {
@@ -1158,9 +1195,6 @@ func (e *enc) emitEvexFields(spec evexSpec, ll, regIdx, vvvvIdx int, rm Operand,
 		if r.idx&16 != 0 {
 			xBar = 0
 		}
-		if r.idx&16 != 0 {
-			xBar = 0
-		}
 	case Mem:
 		var err error
 		modrm, sib, disp, xBar, bBar, err = memComponentsEvex(regIdx&7, r, spec.n[ll])
@@ -1190,7 +1224,7 @@ func (e *enc) emitEvexFields(spec evexSpec, ll, regIdx, vvvvIdx int, rm Operand,
 	// The b bit and the L'L field carry the rounding/SAE/broadcast mode:
 	// a rounding mode replaces L'L with the rc value, plain SAE and
 	// broadcast keep the vector length.
-	b, ll := 0, ll
+	b := 0
 	switch {
 	case sfx.rounding >= 0:
 		b, ll = 1, sfx.rounding
@@ -1219,6 +1253,11 @@ func (e *enc) emitEvexFields(spec evexSpec, ll, regIdx, vvvvIdx int, rm Operand,
 func memComponentsEvex(regField int, m Mem, n int) (modrm, sib int, disp []byte, xBar, bBar int, err error) {
 	sib = -1
 	xBar, bBar = 1, 1 // inverted bits: 1 = no extension
+	// The disp32 fallback bounds the displacement by int32, and the
+	// compressed disp8 form reaches at most ±127×64, well inside it.
+	if m.Disp < -(1<<31) || m.Disp > (1<<31)-1 {
+		return 0, -1, nil, 0, 0, fmt.Errorf("displacement %d does not fit in 32 bits", m.Disp)
+	}
 	if !m.HasBase && !m.HasIndex {
 		return regField<<3 | 0x05, -1, le32(m.Disp), 1, 1, nil // RIP-relative
 	}
@@ -1311,7 +1350,7 @@ func isScatter(upper string) bool {
 }
 
 // vsibLen validates a VSIB memory operand (the index must be a vector
-// register) and returns it with the vector length the index selects — the
+// register) and returns it with the vector length the index selects, the
 // EVEX L'L field follows the index register, not the data register.
 func vsibLen(op Operand, what string) (Mem, int, error) {
 	m, ok := op.(Mem)
@@ -1370,7 +1409,7 @@ func (e *enc) encodeGather(upper string, gs gatherSpec, ops []Operand, sfx evexS
 	return e.emitVexFields(spec, dst.vecLenBit(), dst.idx&7, rBit, 15-maskReg.idx, vsib)
 }
 
-// encodeScatter encodes a scatter (EVEX only): OP src, K, vsib — reg = src,
+// encodeScatter encodes a scatter (EVEX only): OP src, K, vsib, reg = src,
 // rm = the VSIB memory operand, the K mask in aaa and L following the VSIB
 // index.
 func (e *enc) encodeScatter(upper string, ss gatherSpec, ops []Operand, sfx evexSuffix) error {
@@ -1398,25 +1437,27 @@ func (e *enc) encodeScatter(upper string, ss gatherSpec, ops []Operand, sfx evex
 
 // evexKOperand lists the instructions whose K register is a genuine operand
 // (the source or destination of a mask/vector conversion) rather than a
-// mask modifier — the M2 and 2M conversions.  They take no masking.
+// mask modifier, the M2 and 2M conversions.  They take no masking.
 var evexKOperand = map[string]bool{
 	"VPMOVM2B": true, "VPMOVM2W": true, "VPMOVM2D": true, "VPMOVM2Q": true,
 	"VPMOVB2M": true, "VPMOVW2M": true, "VPMOVD2M": true, "VPMOVQ2M": true,
 }
 
 // kmovSpec describes a KMOV width: the opcode depends on the operand
-// direction — kk (k/mem → K is 90, k → k uses the same), kmem (K → mem),
-// gprk (GPR/mem → K), kgpr (K → GPR) — and the GPR forms carry a mandatory
-// prefix and W for the wider widths.
+// direction, kk (k → k), kmem (k → mem), gprk (GPR/mem → k) and kgpr
+// (k → GPR).  Each direction group carries its own mandatory prefix and W:
+// the k-destination/source forms share one pair, the GPR forms another.
 type kmovSpec struct {
 	kk, kmem, gprk, kgpr byte
-	gprPP                int
-	w                    int
+	kPP, kW              int // prefix and VEX.W for the k forms
+	gprPP, gprW          int // prefix and VEX.W for the GPR forms
 }
 
 var kmovTable = map[string]kmovSpec{
-	"KMOVW": {0x90, 0x91, 0x92, 0x93, 0, 0},
-	"KMOVQ": {0x90, 0x91, 0x92, 0x93, 3, 1},
+	"KMOVW": {0x90, 0x91, 0x92, 0x93, 0, 0, 0, 0},
+	"KMOVB": {0x90, 0x91, 0x92, 0x93, 1, 0, 1, 0},
+	"KMOVD": {0x90, 0x91, 0x92, 0x93, 1, 1, 3, 0},
+	"KMOVQ": {0x90, 0x91, 0x92, 0x93, 0, 1, 3, 1},
 }
 
 // encodeKmov encodes a KMOV width, selecting the opcode by direction.
@@ -1430,14 +1471,14 @@ func (e *enc) encodeKmov(upper string, ops []Operand) error {
 	dstReg, dstIsReg := dst.(Reg)
 	srcK := srcIsReg && srcReg.mask
 	dstK := dstIsReg && dstReg.mask
-	spec := vexSpec{mapSel: 1, w: ks.w, pp: 0, opdigit: -1}
 	switch {
 	case srcK && dstK:
-		spec.opcode = ks.kk // k ← k: reg = dst, rm = src
+		// k ← k: reg = dst, rm = src.
+		spec := vexSpec{mapSel: 1, opcode: ks.kk, w: ks.kW, pp: ks.kPP, opdigit: -1}
 		return e.emitVexFields(spec, 0, dstReg.idx&7, 0, 15, src)
 	case srcK && dstIsReg:
-		spec.opcode = ks.kgpr // GPR ← k: reg = dst, rm = src
-		spec.pp = ks.gprPP
+		// GPR ← k: reg = dst, rm = src.
+		spec := vexSpec{mapSel: 1, opcode: ks.kgpr, w: ks.gprW, pp: ks.gprPP, opdigit: -1}
 		rBit := 0
 		if dstReg.idx >= 8 {
 			rBit = 1
@@ -1447,11 +1488,17 @@ func (e *enc) encodeKmov(upper string, ops []Operand) error {
 		if _, ok := dst.(Mem); !ok {
 			return fmt.Errorf("%s: invalid destination operand", upper)
 		}
-		spec.opcode = ks.kmem // mem ← k: reg = src, rm = dst
+		// mem ← k: reg = src, rm = dst.
+		spec := vexSpec{mapSel: 1, opcode: ks.kmem, w: ks.kW, pp: ks.kPP, opdigit: -1}
 		return e.emitVexFields(spec, 0, srcReg.idx&7, 0, 15, dst)
 	case dstK:
-		spec.opcode = ks.gprk // k ← GPR/mem: reg = dst, rm = src
-		spec.pp = ks.gprPP
+		// k ← GPR: reg = dst, rm = src.  A memory source shares the k ← k
+		// opcode and prefix group (the ykmovb layout the Go assembler uses).
+		opcode, w, pp := ks.gprk, ks.gprW, ks.gprPP
+		if memOperand(src) {
+			opcode, w, pp = ks.kk, ks.kW, ks.kPP
+		}
+		spec := vexSpec{mapSel: 1, opcode: opcode, w: w, pp: pp, opdigit: -1}
 		return e.emitVexFields(spec, 0, dstReg.idx&7, 0, 15, src)
 	}
 	return fmt.Errorf("%s requires a K register operand", upper)
@@ -1471,24 +1518,60 @@ type kOpSpec struct {
 
 var kOpsTable = map[string]kOpSpec{
 	// k ← k OP k: reg = dst, vvvv = src1, rm = src2 (three opmask
-	// registers).
+	// registers).  Byte/word widths share W0 and differ by the 66 prefix;
+	// dword/qword share the W bit selection the Go assembler emits.
 	"KANDB":    {1, 0x41, 0, 1, 1, vexNDS3},
 	"KANDW":    {1, 0x41, 0, 0, 1, vexNDS3},
+	"KANDD":    {1, 0x41, 1, 1, 1, vexNDS3},
 	"KANDQ":    {1, 0x41, 1, 0, 1, vexNDS3},
+	"KANDNB":   {1, 0x42, 0, 1, 1, vexNDS3},
+	"KANDNW":   {1, 0x42, 0, 0, 1, vexNDS3},
+	"KANDND":   {1, 0x42, 1, 1, 1, vexNDS3},
+	"KANDNQ":   {1, 0x42, 1, 0, 1, vexNDS3},
 	"KORB":     {1, 0x45, 0, 1, 1, vexNDS3},
+	"KORW":     {1, 0x45, 0, 0, 1, vexNDS3},
 	"KORD":     {1, 0x45, 1, 1, 1, vexNDS3},
+	"KORQ":     {1, 0x45, 1, 0, 1, vexNDS3},
+	"KXNORB":   {1, 0x46, 0, 1, 1, vexNDS3},
 	"KXNORW":   {1, 0x46, 0, 0, 1, vexNDS3},
+	"KXNORD":   {1, 0x46, 1, 1, 1, vexNDS3},
 	"KXNORQ":   {1, 0x46, 1, 0, 1, vexNDS3},
+	"KXORB":    {1, 0x47, 0, 1, 1, vexNDS3},
+	"KXORW":    {1, 0x47, 0, 0, 1, vexNDS3},
+	"KXORD":    {1, 0x47, 1, 1, 1, vexNDS3},
+	"KXORQ":    {1, 0x47, 1, 0, 1, vexNDS3},
 	"KUNPCKBW": {1, 0x4B, 0, 1, 1, vexNDS3},
 	"KUNPCKDQ": {1, 0x4B, 1, 0, 1, vexNDS3},
 	"KADDB":    {1, 0x4A, 0, 1, 1, vexNDS3},
 	"KADDW":    {1, 0x4A, 0, 0, 1, vexNDS3},
+	"KADDD":    {1, 0x4A, 1, 1, 1, vexNDS3},
 	"KADDQ":    {1, 0x4A, 1, 0, 1, vexNDS3},
-	// k ← OP k (KNOT) and flags ← k OP k (KORTEST): reg = dst, rm = src.
+	// k ← OP k (KNOT), k ← k AND~ k (KTEST-style RM) and flags ← k OP k
+	// (KORTEST): reg = dst, rm = src.
 	"KNOTB":    {1, 0x44, 0, 1, 0, vexRM},
+	"KNOTW":    {1, 0x44, 0, 0, 0, vexRM},
+	"KNOTD":    {1, 0x44, 1, 1, 0, vexRM},
+	"KNOTQ":    {1, 0x44, 1, 0, 0, vexRM},
+	"KORTESTB": {1, 0x98, 0, 1, 0, vexRM},
+	"KORTESTW": {1, 0x98, 0, 0, 0, vexRM},
 	"KORTESTD": {1, 0x98, 1, 1, 0, vexRM},
-	// OP $imm, src, dst: reg = dst, rm = src, imm8.
+	"KORTESTQ": {1, 0x98, 1, 0, 0, vexRM},
+	"KTESTB":   {1, 0x99, 0, 1, 0, vexRM},
+	"KTESTW":   {1, 0x99, 0, 0, 0, vexRM},
+	"KTESTD":   {1, 0x99, 1, 1, 0, vexRM},
+	"KTESTQ":   {1, 0x99, 1, 0, 0, vexRM},
+	// OP $imm, src, dst: reg = dst, rm = src, imm8.  The opcodes split by
+	// direction (0x32/0x33 left, 0x30/0x31 right) and within each by
+	// element half (0x32 byte/word, 0x33 dword/qword); W picks byte/dword
+	// (W0) against word/qword (W1).
+	"KSHIFTLB": {3, 0x32, 0, 1, 0, vexImmRM},
 	"KSHIFTLW": {3, 0x32, 1, 1, 0, vexImmRM},
+	"KSHIFTLD": {3, 0x33, 0, 1, 0, vexImmRM},
+	"KSHIFTLQ": {3, 0x33, 1, 1, 0, vexImmRM},
+	"KSHIFTRB": {3, 0x30, 0, 1, 0, vexImmRM},
+	"KSHIFTRW": {3, 0x30, 1, 1, 0, vexImmRM},
+	"KSHIFTRD": {3, 0x31, 0, 1, 0, vexImmRM},
+	"KSHIFTRQ": {3, 0x31, 1, 1, 0, vexImmRM},
 }
 
 // isKOp reports whether the mnemonic is an opmask-register instruction.

asm/evex_test.go

@@ -16,7 +16,7 @@ import (
 // kernels use: NDS arithmetic, immediate and variable shifts, shuffles with
 // an immediate, lane extracts, narrowing stores, broadcasts from a GPR or
 // memory, mask destinations, mask moves, disp8×N compression and the 5-bit
-// register fields (X/Y 16–31, Z 0–31).
+// register fields (X/Y 16-31, Z 0-31).
 func TestEvexGroundTruth(t *testing.T) {
 	cases := []struct {
 		name string
@@ -38,6 +38,15 @@ func TestEvexGroundTruth(t *testing.T) {
 		{"VADDPD Z11,Z10,Z10", "VADDPD", []Operand{vreg(t, "Z11"), vreg(t, "Z10"), vreg(t, "Z10")}, "6251ad4858d3"},
 		{"VMULPD Z13,Z12,Z12", "VMULPD", []Operand{vreg(t, "Z13"), vreg(t, "Z12"), vreg(t, "Z12")}, "62519d4859e5"},
 		{"VFMADD231PD Z14,Z12,Z10", "VFMADD231PD", []Operand{vreg(t, "Z14"), vreg(t, "Z12"), vreg(t, "Z10")}, "62529d48b8d6"},
+		// The qword OR spelling always encodes through EVEX.
+		{"VPORQ Y0,Y1,Y2", "VPORQ", []Operand{vreg(t, "Y0"), vreg(t, "Y1"), vreg(t, "Y2")}, "62f1f528ebd0"},
+		{"VPORQ X0,X1,X2", "VPORQ", []Operand{vreg(t, "X0"), vreg(t, "X1"), vreg(t, "X2")}, "62f1f508ebd0"},
+		// Byte permute and population count.
+		{"VPERMI2B X0,X1,X2", "VPERMI2B", []Operand{vreg(t, "X0"), vreg(t, "X1"), vreg(t, "X2")}, "62f2750875d0"},
+		{"VPOPCNTB X0,X1", "VPOPCNTB", []Operand{vreg(t, "X0"), vreg(t, "X1")}, "62f27d0854c8"},
+		{"VPOPCNTD X0,X1", "VPOPCNTD", []Operand{vreg(t, "X0"), vreg(t, "X1")}, "62f27d0855c8"},
+		{"VPOPCNTD Y0,Y1", "VPOPCNTD", []Operand{vreg(t, "Y0"), vreg(t, "Y1")}, "62f27d2855c8"},
+		{"VPOPCNTQ X0,X1", "VPOPCNTQ", []Operand{vreg(t, "X0"), vreg(t, "X1")}, "62f2fd0855c8"},
 		// Align (NDS + imm8).
 		{"VALIGND $12,Z12,Z0,Z1", "VALIGND", []Operand{Imm(12), vreg(t, "Z12"), vreg(t, "Z0"), vreg(t, "Z1")}, "62d37d4803cc0c"},
 		{"VALIGND $15,Z9,Z0,Z1", "VALIGND", []Operand{Imm(15), vreg(t, "Z9"), vreg(t, "Z0"), vreg(t, "Z1")}, "62d37d4803c90f"},
@@ -52,13 +61,23 @@ func TestEvexGroundTruth(t *testing.T) {
 		{"KMOVW K1,CX", "KMOVW", []Operand{vreg(t, "K1"), CX}, "c5f893c9"},
 		{"KMOVW K1,R12", "KMOVW", []Operand{vreg(t, "K1"), vreg(t, "R12")}, "c57893e1"},
 		{"KTESTW K1,K1", "KTESTW", []Operand{vreg(t, "K1"), vreg(t, "K1")}, "c5f899c9"},
+		{"KMOVB K1,K2", "KMOVB", []Operand{vreg(t, "K1"), vreg(t, "K2")}, "c5f990d1"},
+		{"KMOVB AX,K1", "KMOVB", []Operand{AX, vreg(t, "K1")}, "c5f992c8"},
+		{"KMOVB K1,AX", "KMOVB", []Operand{vreg(t, "K1"), AX}, "c5f993c1"},
+		{"KMOVB K1,(AX)", "KMOVB", []Operand{vreg(t, "K1"), Ptr(AX, 0, 1)}, "c5f99108"},
+		{"KMOVD K1,K2", "KMOVD", []Operand{vreg(t, "K1"), vreg(t, "K2")}, "c4e1f990d1"},
+		{"KMOVD AX,K1", "KMOVD", []Operand{AX, vreg(t, "K1")}, "c5fb92c8"},
+		{"KMOVD K1,AX", "KMOVD", []Operand{vreg(t, "K1"), AX}, "c5fb93c1"},
+		{"KMOVD K1,(AX)", "KMOVD", []Operand{vreg(t, "K1"), Ptr(AX, 0, 4)}, "c4e1f99108"},
+		{"KMOVB (AX),K1", "KMOVB", []Operand{Ptr(AX, 0, 1), vreg(t, "K1")}, "c5f99008"},
+		{"KMOVQ (AX),K1", "KMOVQ", []Operand{Ptr(AX, 0, 8), vreg(t, "K1")}, "c4e1f89008"},
 		// Moves, incl. disp8×N (64 for a 512-bit operand).
 		{"VMOVDQU32 (SI)(R15*4),Z3", "VMOVDQU32", []Operand{Idx(SI, vreg(t, "R15"), 4, 0, 64), vreg(t, "Z3")}, "62b17e486f1cbe"},
 		{"VMOVDQU32 4(SI)(AX*1),Z4", "VMOVDQU32", []Operand{Idx(SI, AX, 1, 4, 64), vreg(t, "Z4")}, "62f17e486fa40604000000"},
 		{"VMOVDQU32 16(SI)(R15*4),Z4", "VMOVDQU32", []Operand{Idx(SI, vreg(t, "R15"), 4, 16, 64), vreg(t, "Z4")}, "62b17e486fa4be10000000"},
 		{"VMOVDQU32 Z0,4(SI)(AX*1)", "VMOVDQU32", []Operand{vreg(t, "Z0"), Idx(SI, AX, 1, 4, 64)}, "62f17e487f840604000000"},
 		{"VMOVDQU32 Z3,(DI)(R15*4)", "VMOVDQU32", []Operand{vreg(t, "Z3"), Idx(DI, vreg(t, "R15"), 4, 0, 64)}, "62b17e487f1cbf"},
-		// VMOVDQU64 — the W1 qword variant.
+		// VMOVDQU64; the W1 qword variant.
 		{"VMOVDQU64 (SI)(R15*4),Z3", "VMOVDQU64", []Operand{Idx(SI, vreg(t, "R15"), 4, 0, 64), vreg(t, "Z3")}, "62b1fe486f1cbe"},
 		{"VMOVDQU64 Z0,4(SI)(AX*1)", "VMOVDQU64", []Operand{vreg(t, "Z0"), Idx(SI, AX, 1, 4, 64)}, "62f1fe487f840604000000"},
 		{"VMOVDQU64 Z1,Z2", "VMOVDQU64", []Operand{vreg(t, "Z1"), vreg(t, "Z2")}, "62f1fe487fca"},
@@ -77,7 +96,7 @@ func TestEvexGroundTruth(t *testing.T) {
 		{"VPSHUFB Z1,Z2,Z3", "VPSHUFB", []Operand{vreg(t, "Z1"), vreg(t, "Z2"), vreg(t, "Z3")}, "62f26d4800d9"},
 		{"VMOVDQU8 Z1,Z2", "VMOVDQU8", []Operand{vreg(t, "Z1"), vreg(t, "Z2")}, "62f17f487fca"},
 		{"VMOVDQU16 Z1,Z2", "VMOVDQU16", []Operand{vreg(t, "Z1"), vreg(t, "Z2")}, "62f1ff487fca"},
-		// Indices 16–31: rm[4] rides in X̄ for register operands.
+		// Indices 16-31: rm[4] rides in X̄ for register operands.
 		{"VPSHUFD $1,X16,X17", "VPSHUFD", []Operand{Imm(1), vreg(t, "X16"), vreg(t, "X17")}, "62a17d0870c801"},
 		{"VMOVUPD (DI),Z14", "VMOVUPD", []Operand{Ptr(DI, 0, 64), vreg(t, "Z14")}, "6271fd481037"},
 		{"VMOVUPD 64(DI),Z14", "VMOVUPD", []Operand{Ptr(DI, 64, 64), vreg(t, "Z14")}, "6271fd48107701"},
@@ -96,7 +115,7 @@ func TestEvexGroundTruth(t *testing.T) {
 		{"VPBROADCASTD 4(SI),Z10", "VPBROADCASTD", []Operand{Ptr(SI, 4, 4), vreg(t, "Z10")}, "62727d48585601"},
 		{"VPBROADCASTQ R8,X31", "VPBROADCASTQ", []Operand{vreg(t, "R8"), vreg(t, "X31")}, "6242fd087cf8"},
 		{"VPBROADCASTQ AX,Z9", "VPBROADCASTQ", []Operand{AX, vreg(t, "Z9")}, "6272fd487cc8"},
-		// Register indices 16–31 exist only in EVEX encodings.
+		// Register indices 16-31 exist only in EVEX encodings.
 		{"VPBROADCASTD AX,Y30", "VPBROADCASTD", []Operand{AX, vreg(t, "Y30")}, "62627d287cf0"},
 		// Packed double arithmetic / unpack (EVEX forms carry W=1).
 		{"VSUBPD Z1,Z2,Z3", "VSUBPD", []Operand{vreg(t, "Z1"), vreg(t, "Z2"), vreg(t, "Z3")}, "62f1ed485cd9"},
@@ -107,7 +126,7 @@ func TestEvexGroundTruth(t *testing.T) {
 		{"VUNPCKHPD Z1,Z2,Z3", "VUNPCKHPD", []Operand{vreg(t, "Z1"), vreg(t, "Z2"), vreg(t, "Z3")}, "62f1ed4815d9"},
 		{"VSUBPD 64(AX),Z1,Z2", "VSUBPD", []Operand{Ptr(AX, 64, 64), vreg(t, "Z1"), vreg(t, "Z2")}, "62f1f5485c5001"},
 		{"VSUBPD Z17,Z18,Z19", "VSUBPD", []Operand{vreg(t, "Z17"), vreg(t, "Z18"), vreg(t, "Z19")}, "62a1ed405cd9"},
-		// VMOVDDUP — duplicate the low double; disp8×N = 64 at 512 bits, and
+		// VMOVDDUP; duplicate the low double; disp8×N = 64 at 512 bits, and
 		// X16/X17 force EVEX (the mod=11 rm[4] extension rides in X̄).
 		{"VMOVDDUP Z1,Z2", "VMOVDDUP", []Operand{vreg(t, "Z1"), vreg(t, "Z2")}, "62f1ff4812d1"},
 		{"VMOVDDUP 64(AX),Z1", "VMOVDDUP", []Operand{Ptr(AX, 64, 64), vreg(t, "Z1")}, "62f1ff48124801"},
@@ -150,7 +169,7 @@ func TestEvexGroundTruth(t *testing.T) {
 	}
 }
 
-// TestEvexMasking checks the AVX-512 mask operand (K1–K7, placed freely among
+// TestEvexMasking checks the AVX-512 mask operand (K1-K7, placed freely among
 // the operands) and the .Z zeroing suffix, byte for byte against the Go
 // assembler.
 func TestEvexMasking(t *testing.T) {
@@ -241,11 +260,11 @@ func TestEvexMasking(t *testing.T) {
 	}
 }
 
-// TestEvexExtendedGroundTruth covers the wider EVEX/AVX-512 set — ternary
+// TestEvexExtendedGroundTruth covers the wider EVEX/AVX-512 set; ternary
 // logic, lane shuffles/inserts/extracts, compares with a K destination,
 // permutes, the wider integer families, expand/compress, broadcasts,
 // rotates and word shifts, the opmask instructions, the EVEX suffixes
-// (rounding/SAE/broadcast) and the aligned/scalar moves — byte for byte
+// (rounding/SAE/broadcast) and the aligned/scalar moves; byte for byte
 // against the Go assembler.
 func TestEvexExtendedGroundTruth(t *testing.T) {
 	mem64 := func(base Reg) Operand { return Ptr(base, 0, 64) }
@@ -275,7 +294,7 @@ func TestEvexExtendedGroundTruth(t *testing.T) {
 		{"VMULPD.RZ_SAE.Z", "VMULPD.RZ_SAE.Z", []Operand{vreg(t, "Z1"), vreg(t, "Z2"), vreg(t, "K1"), vreg(t, "Z3")}, "62f1edf959d9"},
 		{"VMAXPD.SAE", "VMAXPD.SAE", []Operand{vreg(t, "Z1"), vreg(t, "Z2"), vreg(t, "Z3")}, "62f1ed585fd9"},
 		{"VADDPD.BCST", "VADDPD.BCST", []Operand{mem64(AX), vreg(t, "Z1"), vreg(t, "Z2")}, "62f1f5585810"},
-		// Packed single arithmetic (same opcodes, no mandatory prefix) —
+		// Packed single arithmetic (same opcodes, no mandatory prefix);
 		// ZMM, YMM and XMM widths, rounding and broadcast.
 		{"VADDPS", "VADDPS", []Operand{vreg(t, "Z1"), vreg(t, "Z2"), vreg(t, "Z3")}, "62f16c4858d9"},
 		{"VMULPS", "VMULPS", []Operand{vreg(t, "Y1"), vreg(t, "Y2"), vreg(t, "Y3")}, "c5ec59d9"},
@@ -319,6 +338,43 @@ func TestEvexExtendedGroundTruth(t *testing.T) {
 		{"KORTESTD", "KORTESTD", []Operand{vreg(t, "K1"), vreg(t, "K2")}, "c4e1f998d1"},
 		{"KMOVQ k,k", "KMOVQ", []Operand{vreg(t, "K1"), vreg(t, "K2")}, "c4e1f890d1"},
 		{"KMOVQ gpr,k", "KMOVQ", []Operand{BX, vreg(t, "K1")}, "c4e1fb92cb"},
+		// Completed opmask families (ANDN, NOT, OR/XOR word+qword, TEST,
+		// word-width shifts; byte-exact against go tool asm).
+		{"KANDNW", "KANDNW", []Operand{vreg(t, "K1"), vreg(t, "K2"), vreg(t, "K3")}, "c5ec42d9"},
+		{"KANDNB", "KANDNB", []Operand{vreg(t, "K4"), vreg(t, "K5"), vreg(t, "K6")}, "c5d542f4"},
+		{"KANDND", "KANDND", []Operand{vreg(t, "K1"), vreg(t, "K2"), vreg(t, "K3")}, "c4e1ed42d9"},
+		{"KANDNQ", "KANDNQ", []Operand{vreg(t, "K4"), vreg(t, "K5"), vreg(t, "K6")}, "c4e1d442f4"},
+		{"KANDD", "KANDD", []Operand{vreg(t, "K1"), vreg(t, "K2"), vreg(t, "K3")}, "c4e1ed41d9"},
+		{"KADDD", "KADDD", []Operand{vreg(t, "K4"), vreg(t, "K5"), vreg(t, "K6")}, "c4e1d54af4"},
+		{"KNOTW", "KNOTW", []Operand{vreg(t, "K1"), vreg(t, "K2")}, "c5f844d1"},
+		{"KNOTD", "KNOTD", []Operand{vreg(t, "K3"), vreg(t, "K4")}, "c4e1f944e3"},
+		{"KNOTQ", "KNOTQ", []Operand{vreg(t, "K5"), vreg(t, "K6")}, "c4e1f844f5"},
+		{"KORW", "KORW", []Operand{vreg(t, "K1"), vreg(t, "K2"), vreg(t, "K3")}, "c5ec45d9"},
+		{"KORQ", "KORQ", []Operand{vreg(t, "K4"), vreg(t, "K5"), vreg(t, "K6")}, "c4e1d445f4"},
+		{"KXNORB", "KXNORB", []Operand{vreg(t, "K1"), vreg(t, "K2"), vreg(t, "K3")}, "c5ed46d9"},
+		{"KXORW", "KXORW", []Operand{vreg(t, "K1"), vreg(t, "K2"), vreg(t, "K3")}, "c5ec47d9"},
+		{"KXORQ", "KXORQ", []Operand{vreg(t, "K4"), vreg(t, "K5"), vreg(t, "K6")}, "c4e1d447f4"},
+		{"KORTESTW", "KORTESTW", []Operand{vreg(t, "K1"), vreg(t, "K2")}, "c5f898d1"},
+		{"KORTESTB", "KORTESTB", []Operand{vreg(t, "K3"), vreg(t, "K4")}, "c5f998e3"},
+		{"KORTESTQ", "KORTESTQ", []Operand{vreg(t, "K5"), vreg(t, "K6")}, "c4e1f898f5"},
+		{"KTESTW", "KTESTW", []Operand{vreg(t, "K1"), vreg(t, "K2")}, "c5f899d1"},
+		{"KTESTD", "KTESTD", []Operand{vreg(t, "K3"), vreg(t, "K4")}, "c4e1f999e3"},
+		{"KSHIFTLB", "KSHIFTLB", []Operand{Imm(1), vreg(t, "K1"), vreg(t, "K2")}, "c4e37932d101"},
+		{"KSHIFTLD", "KSHIFTLD", []Operand{Imm(2), vreg(t, "K3"), vreg(t, "K4")}, "c4e37933e302"},
+		{"KSHIFTLQ", "KSHIFTLQ", []Operand{Imm(3), vreg(t, "K5"), vreg(t, "K6")}, "c4e3f933f503"},
+		{"KSHIFTRB", "KSHIFTRB", []Operand{Imm(4), vreg(t, "K1"), vreg(t, "K2")}, "c4e37930d104"},
+		{"KSHIFTRW", "KSHIFTRW", []Operand{Imm(5), vreg(t, "K3"), vreg(t, "K4")}, "c4e3f930e305"},
+		{"KSHIFTRQ", "KSHIFTRQ", []Operand{Imm(6), vreg(t, "K5"), vreg(t, "K6")}, "c4e3f931f506"},
+		// Integer compares with an opmask destination (0F3A map, the
+		// go-bzip2 partition kernel's classify instructions).
+		{"VPCMPUB", "VPCMPUB", []Operand{Imm(1), vreg(t, "X1"), vreg(t, "X0"), vreg(t, "K1")}, "62f37d083ec901"},
+		{"VPCMPB", "VPCMPB", []Operand{Imm(2), vreg(t, "Y2"), vreg(t, "Y3"), vreg(t, "K2")}, "62f365283fd202"},
+		{"VPCMPUW", "VPCMPUW", []Operand{Imm(5), vreg(t, "Z1"), vreg(t, "Z2"), vreg(t, "K3")}, "62f3ed483ed905"},
+		{"VPCMPW", "VPCMPW", []Operand{Imm(6), vreg(t, "X3"), vreg(t, "X4"), vreg(t, "K4")}, "62f3dd083fe306"},
+		{"VPCMPD", "VPCMPD", []Operand{Imm(0), vreg(t, "Y1"), vreg(t, "Y2"), vreg(t, "K1")}, "62f36d281fc900"},
+		{"VPCMPUD", "VPCMPUD", []Operand{Imm(1), vreg(t, "Z2"), vreg(t, "Z3"), vreg(t, "K2")}, "62f365481ed201"},
+		{"VPCMPQ", "VPCMPQ", []Operand{Imm(2), vreg(t, "X1"), vreg(t, "X2"), vreg(t, "K3")}, "62f3ed081fd902"},
+		{"VPCMPUQ", "VPCMPUQ", []Operand{Imm(3), vreg(t, "Y3"), vreg(t, "Y4"), vreg(t, "K4")}, "62f3dd281ee303"},
 		// Lane extract / insert.
 		{"VEXTRACTF32X4", "VEXTRACTF32X4", []Operand{Imm(1), vreg(t, "Y1"), vreg(t, "X2")}, "62f37d2819ca01"},
 		{"VEXTRACTI64X2", "VEXTRACTI64X2", []Operand{Imm(1), vreg(t, "Y1"), vreg(t, "X2")}, "62f3fd2839ca01"},
@@ -362,8 +418,8 @@ func TestEvexExtendedGroundTruth(t *testing.T) {
 }
 
 // TestEvexHelperGroundTruth covers the floating-point helper and conversion
-// tail of the EVEX set — reciprocals, rsqrt, getexp/getmant, scalef,
-// rndscale, reduce, fixupimm, range, fpclass, the remaining conversions —
+// tail of the EVEX set; reciprocals, rsqrt, getexp/getmant, scalef,
+// rndscale, reduce, fixupimm, range, fpclass, the remaining conversions;
 // plus gather/scatter with VSIB addressing, byte for byte against the Go
 // assembler.
 func TestEvexHelperGroundTruth(t *testing.T) {
@@ -465,9 +521,9 @@ func TestEvexHelperGroundTruth(t *testing.T) {
 }
 
 // TestEvexGprGroundTruth covers the scalar conversions between vector and
-// general-purpose registers — the signed and truncated VCVT{,T}S{D,S}2SI
+// general-purpose registers; the signed and truncated VCVT{,T}S{D,S}2SI
 // forms (VEX and EVEX), the unsigned EVEX-only forms, and the GPR-to-vector
-// VCVTSI2*/VCVTUSI2* forms with the preserved vector source in vvvv — byte
+// VCVTSI2*/VCVTUSI2* forms with the preserved vector source in vvvv; byte
 // for byte against the Go assembler, including memory sources and extended
 // GPRs.
 func TestEvexGprGroundTruth(t *testing.T) {
@@ -638,6 +694,15 @@ func TestEvexErrors(t *testing.T) {
 		{"align arity", "VALIGND", []Operand{Imm(1), vreg(t, "Z0"), vreg(t, "Z1")}},
 		// VEX-only mnemonics reject registers only EVEX can encode.
 		{"VMOVMSKPS X16", "VMOVMSKPS", []Operand{vreg(t, "X16"), AX}},
+		// The scalar EVEX move matches its VEX twin and the Go assembler:
+		// XMM↔memory only, never reg-reg and never a wider register (the
+		// toolchain rejects every one of these shapes).
+		{"VMOVSS X1,X2", "VMOVSS", []Operand{vreg(t, "X1"), vreg(t, "X2")}},
+		{"VMOVSS X16,X2", "VMOVSS", []Operand{vreg(t, "X16"), vreg(t, "X2")}},
+		{"VMOVSS Y1,(AX)", "VMOVSS", []Operand{vreg(t, "Y1"), Ptr(AX, 0, 4)}},
+		{"VMOVSS Z1,Z2", "VMOVSS", []Operand{vreg(t, "Z1"), vreg(t, "Z2")}},
+		{"VMOVSS Z1,(AX)", "VMOVSS", []Operand{vreg(t, "Z1"), Ptr(AX, 0, 4)}},
+		{"VMOVSS (AX),Z2", "VMOVSS", []Operand{Ptr(AX, 0, 4), vreg(t, "Z2")}},
 	}
 	for _, c := range cases {
 		if _, err := Encode(c.mnem, c.ops...); err == nil {

asm/goobj.go

@@ -14,8 +14,8 @@ import (
 	"sync"
 )
 
-// This file emits GOOBJ — the Go toolchain's object format, which cmd/link
-// consumes directly — so gasm-assembled functions drop into a go build
+// This file emits GOOBJ, the Go toolchain's object format, which cmd/link
+// consumes directly, so gasm-assembled functions drop into a go build
 // without the Go assembler.  The layout follows cmd/internal/goobj: a
 // toolchain preamble ("go object ...\n!\n"), the go120ld header with its
 // block offsets, a string table, symbol definitions, the relocation /
@@ -33,7 +33,10 @@ import (
 // methods supply the toolchain preamble, the MinLC (pc-value delta unit)
 // and the relocation-type mapping for code relocations.
 
-// GOOBJ block indices (cmd/internal/goobj).
+// GOOBJ block indices (cmd/internal/goobj).  These MUST match the real
+// archive layout: the emitter writes the header offsets per index and the
+// reader (groundtruth, goobj_resolve) parses real Go archives with them.
+// blkAutolib is unused by the emitter but still defines index 0.
 const (
 	blkAutolib = iota
 	blkPkgIdx
@@ -65,11 +68,12 @@ const (
 	kindSDWARFLINES = 20
 )
 
-// Symbol flags (cmd/internal/goobj).
+// Symbol flags (cmd/internal/goobj).  The linkname flag is set only for
+// //go:linkname symbols (and main.main); ordinary assembly symbols carry
+// none, matching cmd/asm's output.
 const (
 	symFlagDupok   = 0x01
 	symFlagNoSplit = 0x10
-	symFlag2Link   = 0x10 // asm objects flag every named symbol as linkname
 	symABIStatic   = 0xffff
 )
 
@@ -91,10 +95,12 @@ const (
 )
 
 // Relocation types (cmd/internal/objabi).
-// R_PCREL and R_ADDR are stable across Go versions.
+// R_ADDR, R_CALL, R_PCREL and R_TLS_LE are stable across Go versions.
 const (
-	relocPCRel = 14 // R_PCREL
 	relocAddr  = 1  // R_ADDR
+	relocCall  = 7  // R_CALL
+	relocPCRel = 14 // R_PCREL
+	relocTLSLE = 15 // R_TLS_LE
 )
 
 // relocDWTXTADDRU4 returns the R_DWTXTADDR_U4 relocation type for the
@@ -137,10 +143,30 @@ func isGo127OrLater() bool {
 
 // Special package indices for symbol references.
 const (
-	pkgIdxNone = 0x7fffffff
-	pkgIdxSelf = 0x7ffffffb
+	pkgIdxNone    = 0x7fffffff
+	pkgIdxSelf    = 0x7ffffffb
+	pkgIdxBuiltin = 0x7ffffffc
 )
 
+// goobjBuiltinMorestackNoctxt is the index of runtime.morestack_noctxt in
+// cmd/internal/goobj/builtinlist.go of the toolchain the object targets
+// (246 since Go 1.25; the list is append-only).
+const goobjBuiltinMorestackNoctxt = 246
+
+// goobjBuiltinMorestack is the builtin reference the toolchain emits for the
+// stack-guard call.
+var goobjBuiltinMorestack = "runtime\u00b7morestack_noctxt"
+
+// isCallReloc reports whether k is one of the per-arch call relocations a
+// direct branch to a TEXT symbol carries.
+func isCallReloc(k RelocKind) bool {
+	switch k {
+	case RelCall, RelRISCVJal, RelArm64Branch, RelLoong64Branch:
+		return true
+	}
+	return false
+}
+
 const goobjMagic = "\x00go120ld"
 
 // goSym is one symbol definition under construction.
@@ -175,14 +201,24 @@ type dwarfRelocSet struct {
 // does with its -p flag).  srcPath names the source file recorded in the
 // object's file table and line tables.  The toolchain's object preamble is
 // captured from the installed go tool asm, so the output links with the
-// toolchain it was produced on — exactly like a real assembly object.
+// toolchain it was produced on, exactly like a real assembly object.
 func (img *Image) GOObject(pkgPath, srcPath string) ([]byte, error) {
 	pre, err := toolchainObjectPreamble()
 	if err != nil {
 		return nil, err
 	}
-	// amd64: MinLC 1, R_PCREL for the code relocations.
-	return img.emitGOObject(pkgPath, srcPath, pre, 1, func(Reloc) (uint16, uint8) { return relocPCRel, 4 })
+	// amd64: MinLC 1, R_PCREL for displacements, R_CALL for calls and
+	// R_TLS_LE for the stack-guard TLS load.
+	return img.emitGOObject(pkgPath, srcPath, pre, 1, func(r Reloc) (uint16, uint8) {
+		switch r.Kind {
+		case RelCall:
+			return relocCall, 4
+		case RelTLSLE:
+			return relocTLSLE, 4
+		default:
+			return relocPCRel, 4
+		}
+	})
 }
 
 // emitGOObject assembles the GOOBJ payload for any architecture.  pre is
@@ -195,7 +231,7 @@ func (img *Image) emitGOObject(pkgPath, srcPath string, pre []byte, minLC int, r
 		return nil, fmt.Errorf("GOOBJ emission requires a package path (-p)")
 	}
 
-	// The non-package definitions first — the DWARF symbols reference the
+	// The non-package definitions first, the DWARF symbols reference the
 	// functions by these indices: per function the four pc-value tables
 	// and the function itself, as cmd/asm lays them out.
 	type npSym struct {
@@ -244,7 +280,7 @@ func (img *Image) emitGOObject(pkgPath, srcPath string, pre []byte, minLC int, r
 			// their relocations cover whole AUIPC/pcalau12i pairs, so
 			// zeroing r.Off would erase the opcode/register bits the linker
 			// preserves when it patches only the immediate.
-			if r.Kind != RelPCRel32 {
+			if r.Kind != RelPCRel32 && r.Kind != RelCall {
 				continue
 			}
 			if r.Off >= 0 && r.Off+4 <= len(code) {
@@ -252,7 +288,7 @@ func (img *Image) emitGOObject(pkgPath, srcPath string, pre []byte, minLC int, r
 			}
 		}
 		nps = append(nps, npSym{
-			sym:  goSym{name: name, abi: abi, typ: kindSTEXT, flag: flag, flag2: symFlag2Link, size: uint32(fn.Size)},
+			sym:  goSym{name: name, abi: abi, typ: kindSTEXT, flag: flag, size: uint32(fn.Size)},
 			data: code,
 		})
 	}
@@ -282,7 +318,7 @@ func (img *Image) emitGOObject(pkgPath, srcPath string, pre []byte, minLC int, r
 			abi = symABIStatic
 		}
 		defIdx[d.Name] = len(defs)
-		defs = append(defs, goSym{name: name, abi: abi, typ: typ, flag: flag, flag2: symFlag2Link, size: uint32(d.Size)})
+		defs = append(defs, goSym{name: name, abi: abi, typ: typ, flag: flag, size: uint32(d.Size)})
 		defData = append(defData, img.Data[d.Offset:d.Offset+d.Size])
 	}
 	fnFiIdx := make([]int, len(img.Funcs))
@@ -317,6 +353,13 @@ func (img *Image) emitGOObject(pkgPath, srcPath string, pre []byte, minLC int, r
 		)
 	}
 
+	// Index the non-package TEXT definitions by short name for the internal
+	// call references.
+	textNpIdx := map[string]int{}
+	for i, fn := range img.Funcs {
+		textNpIdx[fn.Name] = fnNpIdx[i]
+	}
+
 	// Resolve external symbol references (cross-package).  Build the
 	// package index table and determine each external symbol's SymIdx
 	// by reading the target package's export data.
@@ -324,10 +367,20 @@ func (img *Image) emitGOObject(pkgPath, srcPath string, pre []byte, minLC int, r
 	var extPkgIdx map[string]int
 	var extSymIdx map[string]int
 	if len(img.Externals) > 0 {
-		var err error
-		extPkgTable, extPkgIdx, extSymIdx, err = resolveExternalSymbols(img.Externals)
-		if err != nil {
-			return nil, fmt.Errorf("GOOBJ emission: resolving external symbols: %w", err)
+		// The morestack call is a builtin reference, not a resolved external.
+		var need []string
+		for _, n := range img.Externals {
+			if n == goobjBuiltinMorestack {
+				continue
+			}
+			need = append(need, n)
+		}
+		if len(need) > 0 {
+			var err error
+			extPkgTable, extPkgIdx, extSymIdx, err = resolveExternalSymbols(need)
+			if err != nil {
+				return nil, fmt.Errorf("GOOBJ emission: resolving external symbols: %w", err)
+			}
 		}
 	}
 
@@ -339,6 +392,31 @@ func (img *Image) emitGOObject(pkgPath, srcPath string, pre []byte, minLC int, r
 		si := len(defs) + fnNpIdx[i]
 		for _, r := range fn.Relocs {
 			typ, size := relocField(r)
+			if r.Kind == RelTLSLE {
+				// The TLS load has no symbol: {0, 0} is the nil ref.
+				var rec [23]byte
+				binary.LittleEndian.PutUint32(rec[0:], uint32(int32(r.Off)))
+				rec[4] = size
+				binary.LittleEndian.PutUint16(rec[5:], typ)
+				binary.LittleEndian.PutUint64(rec[7:], uint64(r.Addend))
+				binary.LittleEndian.PutUint32(rec[15:], 0)
+				binary.LittleEndian.PutUint32(rec[19:], 0)
+				symRelocs[si] = append(symRelocs[si], rec[:]...)
+				continue
+			}
+			if r.External && r.Name == goobjBuiltinMorestack {
+				// The stack-guard morestack call uses the toolchain's
+				// builtin reference.
+				var rec [23]byte
+				binary.LittleEndian.PutUint32(rec[0:], uint32(int32(r.Off)))
+				rec[4] = size
+				binary.LittleEndian.PutUint16(rec[5:], typ)
+				binary.LittleEndian.PutUint64(rec[7:], uint64(r.Addend))
+				binary.LittleEndian.PutUint32(rec[15:], pkgIdxBuiltin)
+				binary.LittleEndian.PutUint32(rec[19:], goobjBuiltinMorestackNoctxt)
+				symRelocs[si] = append(symRelocs[si], rec[:]...)
+				continue
+			}
 			if r.External {
 				// Split package-qualified name: "runtime·morestack" → runtime, morestack.
 				pkg, name := splitQualified(r.Name)
@@ -363,16 +441,24 @@ func (img *Image) emitGOObject(pkgPath, srcPath string, pre []byte, minLC int, r
 				symRelocs[si] = append(symRelocs[si], rec[:]...)
 				continue
 			}
+			pkg := uint32(pkgIdxSelf)
 			di, ok := defIdx[r.Name]
 			if !ok {
-				return nil, fmt.Errorf("GOOBJ emission: reference to unknown symbol %q", r.Name)
+				// A call to a TEXT function of the same file references the
+				// non-package definition table.
+				ni, isText := textNpIdx[r.Name]
+				if !isText || !isCallReloc(r.Kind) {
+					return nil, fmt.Errorf("GOOBJ emission: reference to unknown symbol %q", r.Name)
+				}
+				pkg = pkgIdxNone
+				di = ni
 			}
 			var rec [23]byte
 			binary.LittleEndian.PutUint32(rec[0:], uint32(int32(r.Off)))
 			rec[4] = size // field width
 			binary.LittleEndian.PutUint16(rec[5:], typ)
 			binary.LittleEndian.PutUint64(rec[7:], uint64(r.Addend))
-			binary.LittleEndian.PutUint32(rec[15:], pkgIdxSelf)
+			binary.LittleEndian.PutUint32(rec[15:], pkg)
 			binary.LittleEndian.PutUint32(rec[19:], uint32(di))
 			symRelocs[si] = append(symRelocs[si], rec[:]...)
 		}
@@ -417,7 +503,7 @@ func (img *Image) emitGOObject(pkgPath, srcPath string, pre []byte, minLC int, r
 	// The string table.  Absolute offsets: it starts right after the
 	// 96-byte header (magic, fingerprint, flags, the 19 block offsets).
 	const headerSize = 8 + 8 + 4 + 4*(blkEnd+1)
-	strTab := []byte{}
+	var strTab []byte
 	strOff := map[string]uint32{}
 	addStr := func(s string) {
 		if _, ok := strOff[s]; ok {
@@ -464,7 +550,7 @@ func (img *Image) emitGOObject(pkgPath, srcPath string, pre []byte, minLC int, r
 	auxIdxBlk := make([]byte, 0, 4*(nsyms+1))
 	dataIdxBlk := make([]byte, 0, 4*(nsyms+1))
 	var nr, na, nd uint32
-	for si := 0; si < nsyms; si++ {
+	for si := range nsyms {
 		relocIdxBlk = binary.LittleEndian.AppendUint32(relocIdxBlk, nr)
 		auxIdxBlk = binary.LittleEndian.AppendUint32(auxIdxBlk, na)
 		dataIdxBlk = binary.LittleEndian.AppendUint32(dataIdxBlk, nd)
@@ -505,7 +591,7 @@ func (img *Image) emitGOObject(pkgPath, srcPath string, pre []byte, minLC int, r
 	// The fingerprint stays zero, as cmd/asm leaves it.
 	binary.LittleEndian.PutUint32(payload[16:], 4) // ObjFlagFromAssembly
 	off := uint32(headerSize + len(strTab))
-	for i := 0; i < blkEnd; i++ {
+	for i := range blkEnd {
 		binary.LittleEndian.PutUint32(payload[20+4*i:], off)
 		off += uint32(len(blocks[i]))
 	}

asm/goobj_dwarf.go

@@ -139,10 +139,7 @@ func dwSelectOpcode(deltaPC uint64, deltaLC int64) int64 {
 		return int64(dwOpcodeBase) + (deltaLC - dwLineBase) + dwLineRange*int64(deltaPC)
 	default:
 		if deltaPC <= uint64(dwPCRange) {
-			op := int64(dwOpcodeBase) + (dwLineRange - 1) + dwLineRange*int64(deltaPC)
-			if op > 255 {
-				op = 255
-			}
+			op := min(int64(dwOpcodeBase)+(dwLineRange-1)+dwLineRange*int64(deltaPC), 255)
 			return op
 		}
 		switch deltaPC - uint64(dwPCRange) {

asm/goobj_resolve.go

@@ -12,24 +12,6 @@ import (
 	"strings"
 )
 
-// readGOOBJSymbols reads the GOOBJ symbol definitions from a compiled Go
-// package's export file.  The file is an ar archive containing a __.PKGDEF
-// member whose payload is the "go object ...\n!\n" preamble followed by the
-// GOOBJ data.  The function returns the symbol names in definition order
-// (the order they appear in blkSymdef), which matches the SymIdx the linker
-// expects for cross-package references.
-func readGOOBJSymbols(exportPath string) ([]string, error) {
-	data, err := os.ReadFile(exportPath)
-	if err != nil {
-		return nil, err
-	}
-	goobj, err := extractGOOBJ(data)
-	if err != nil {
-		return nil, fmt.Errorf("%s: %w", exportPath, err)
-	}
-	return goobj.symbols(), nil
-}
-
 // exportPath returns the export file path for a given import path by running
 // "go list -export".  The result is cached so repeated calls for the same
 // package are fast.
@@ -58,8 +40,11 @@ func exportPath(importPath string) (string, error) {
 //
 // refs maps package import paths to the symbol names referenced from that
 // package.  The returned pkgIdx maps each import path to its position in
-// the blkPkgIdx table (0-based), and symIdx gives each symbol's index within
-// its package.
+// the blkPkgIdx table, which reserves index 0 for the dummy invalid
+// package (cmd/internal/obj/sym.go: "0 is invalid index"; the loader's
+// reader loop starts at 1), so package i sits at block index i+1 and its
+// relocations carry i+1.  symIdx gives each symbol's index within its
+// package.
 func resolveExternalGOOBJ(refs map[string][]string) (pkgIdx map[string]int, symIdx map[string]int, err error) {
 	pkgIdx = make(map[string]int, len(refs))
 	symIdx = make(map[string]int)
@@ -68,7 +53,9 @@ func resolveExternalGOOBJ(refs map[string][]string) (pkgIdx map[string]int, symI
 	packages := sortedPkgRefs(refs)
 
 	for i, pkg := range packages {
-		pkgIdx[pkg.path] = i
+		// Block index 0 is the dummy invalid package; the first real
+		// package starts at 1.
+		pkgIdx[pkg.path] = i + 1
 		exp, err := exportPath(pkg.path)
 		if err != nil {
 			return nil, nil, err
@@ -102,7 +89,7 @@ func sortedPkgRefs(refs map[string][]string) []pkgRef {
 	for pkg, syms := range refs {
 		pkgs = append(pkgs, pkgRef{pkg, syms})
 	}
-	// Simple insertion sort — the list is tiny (usually 1–3 packages).
+	// Simple insertion sort, the list is tiny (usually 1-3 packages).
 	for i := 1; i < len(pkgs); i++ {
 		for j := i; j > 0 && pkgs[j-1].path > pkgs[j].path; j-- {
 			pkgs[j-1], pkgs[j] = pkgs[j], pkgs[j-1]
@@ -163,40 +150,65 @@ func parseArDecimal(b []byte) int {
 }
 
 // goobjFile is a parsed GOOBJ file: the string table and the symbol-definition
-// block.
+// blocks.  The hashed blocks are kept raw: their symbols carry no names, only
+// the loader needs their counts.
 type goobjFile struct {
-	strTab []byte // string table, at headerSize + n
-	symdef []byte // blkSymdef raw block
-	npdef  []byte // blkNonpkgdef raw block
+	strTab   []byte // string table, at headerSize + n
+	symdef   []byte // blkSymdef raw block
+	hashed64 []byte // blkHashed64def raw block
+	hashed   []byte // blkHasheddef raw block
+	npdef    []byte // blkNonpkgdef raw block
 }
 
-// symbols returns all symbol names in definition order by scanning the
-// symdef and nonpkgdef blocks and resolving each name through the string
-// table.  Package definitions (blkSymdef) use fully-qualified names like
-// "runtime.morestack"; non-package definitions (blkNonpkgdef) use bare
-// names like "morestack".  This combined list matches the index the
-// linker expects for cross-package references.
+// loaderIndexBase returns the index the first nonpkgdef symbol occupies in the
+// loader's per-object symbol array.  cmd/link lays the definition blocks out as
+// symdef, hashed64def, hasheddef, nonpkgdef, nonpkgref (loader.go: preloadSyms
+// fills r.syms in exactly that order, and resolve() indexes PkgIdxNone and
+// cross-package SymIdx into it), so a symbol found in blkNonpkgdef carries the
+// three leading blocks' symbol counts as its base.
+func (f *goobjFile) loaderIndexBase() int {
+	return len(f.symdef)/recSymSize + len(f.hashed64)/recSymSize + len(f.hashed)/recSymSize
+}
+
+// symbols returns the names of the symdef and nonpkgdef blocks in
+// definition order.  Package definitions (blkSymdef) use fully-qualified
+// names like "runtime.morestack"; non-package definitions (blkNonpkgdef)
+// use bare names like "morestack".  For lookups by index prefer
+// findSymbol: it adds the hashed blocks' count the loader's array
+// interleaves between the two.
 func (f *goobjFile) symbols() []string {
 	return append(f.defNames(), f.npdefNames()...)
 }
 
-// findSymbol returns the index of a symbol within the combined symbol list,
-// or -1 if not found.  It first tries the fully-qualified name (pkg.name),
-// then the bare name.
+// findSymbol returns the index of a symbol within the loader's per-object
+// symbol array, or -1 if not found.  It first tries the fully-qualified
+// name (pkg.name), then the bare name (assembly objects store dotless
+// names, e.g. runtime's "gogo", for symbols other packages reach through
+// a linkname).
 func (f *goobjFile) findSymbol(pkg, name string) int {
+	base := f.loaderIndexBase()
 	qualified := pkg + "." + name
-	syms := f.symbols()
-	for i, s := range syms {
+	for i, s := range f.defNames() {
 		if s == qualified {
 			return i
 		}
 	}
-	// Try bare name (for non-package definitions).
-	for i, s := range syms {
+	for i, s := range f.npdefNames() {
+		if s == qualified {
+			return base + i
+		}
+	}
+	// Try bare name (for dotless assembly definitions).
+	for i, s := range f.defNames() {
 		if s == name {
 			return i
 		}
 	}
+	for i, s := range f.npdefNames() {
+		if s == name {
+			return base + i
+		}
+	}
 	return -1
 }
 
@@ -210,18 +222,22 @@ func (f *goobjFile) npdefNames() []string {
 	return f.readSymNames(f.npdef)
 }
 
+// recSymSize is the size of one Sym record in the definition blocks
+// (goobj.SymSize: stringRefSize + 2 + 1 + 1 + 1 + 4 + 4).
+const recSymSize = 21
+
 // readSymNames reads symbol names from a symdef/nonpkgdef block.  Each record
 // is 21 bytes: nameLen (u32), nameOff (u32), abi (u16), typ, flag, flag2,
 // size (u32), align (u32).  nameOff is an absolute offset into the string
 // table.
 func (f *goobjFile) readSymNames(block []byte) []string {
-	const recSize = 21
+	const recSize = recSymSize
 	if len(block) < recSize {
 		return nil
 	}
 	n := len(block) / recSize
 	names := make([]string, 0, n)
-	for i := 0; i < n; i++ {
+	for i := range n {
 		rec := block[i*recSize : (i+1)*recSize]
 		nameLen := binary.LittleEndian.Uint32(rec[0:4])
 		nameOff := binary.LittleEndian.Uint32(rec[4:8])
@@ -265,16 +281,18 @@ func parseGOOBJ(data []byte) (*goobjFile, error) {
 	//   [16:20] flags
 	//   [20:96] 19 × uint32 offsets
 	var offs [blkEnd + 1]uint32
-	for i := 0; i <= blkEnd; i++ {
+	for i := range blkEnd + 1 {
 		offs[i] = binary.LittleEndian.Uint32(payload[20+4*i:])
 	}
 	// The string table lives at headerSize.
 	strTabStart := uint32(goobjHeaderSize)
 
 	f := &goobjFile{
-		strTab: payload[strTabStart:offs[0]],
-		symdef: blockSlice(payload, offs, blkSymdef, blkSymdef+1),
-		npdef:  blockSlice(payload, offs, blkNonpkgdef, blkNonpkgdef+1),
+		strTab:   payload[strTabStart:offs[0]],
+		symdef:   blockSlice(payload, offs, blkSymdef, blkSymdef+1),
+		hashed64: blockSlice(payload, offs, blkHashed64def, blkHashed64def+1),
+		hashed:   blockSlice(payload, offs, blkHasheddef, blkHasheddef+1),
+		npdef:    blockSlice(payload, offs, blkNonpkgdef, blkNonpkgdef+1),
 	}
 	return f, nil
 }
@@ -324,25 +342,29 @@ func resolveExternalSymbols(externals []string) (pkgTable []string, pkgIdxMap ma
 		return nil, nil, nil, err
 	}
 
-	// Build the package table in pkgIdx order.
+	// Build the package table in pkgIdx order.  The indices are 1-based
+	// (0 is the dummy invalid package, written by the emitter itself), so
+	// the table without the dummy is indexed one below.
 	pkgTable = make([]string, len(pkgIdx1))
 	for pkg, idx := range pkgIdx1 {
-		pkgTable[idx] = pkg
+		pkgTable[idx-1] = pkg
 	}
 
 	return pkgTable, pkgIdx1, symIdx1, nil
 }
 
 // splitQualified splits a qualified Go symbol name (pkgpath·name) into its
-// package path and local name.  The separator is the middle dot (U+00B7).
-// If no separator is found, the symbol is assumed to be in the current
-// package (empty pkg).
+// package path and local name.  The separator is the middle dot (U+00B7),
+// whose UTF-8 encoding is two bytes, so the search must be string-based:
+// IndexByte would match only the second byte and leave the lead byte on
+// the package path.  If no separator is found, the symbol is assumed to be
+// in the current package (empty pkg).
 func splitQualified(full string) (pkg, name string) {
-	if idx := strings.IndexByte(full, '\u00b7'); idx >= 0 {
-		return full[:idx], full[idx+len("\u00b7"):]
+	if before, after, ok := strings.Cut(full, "\u00b7"); ok {
+		return before, after
 	}
-	if idx := strings.IndexByte(full, '.'); idx >= 0 {
-		return full[:idx], full[idx+1:]
+	if before, after, ok := strings.Cut(full, "."); ok {
+		return before, after
 	}
 	return "", full
 }

asm/goobj_resolve_test.go

@@ -56,8 +56,12 @@ func TestResolveExternalSymbols(t *testing.T) {
 	if err != nil {
 		t.Fatalf("resolveExternalGOOBJ: %v", err)
 	}
-	if len(pkgIdx) != 1 || pkgIdx["runtime"] != 0 {
-		t.Errorf("pkgIdx = %v, want runtime→0", pkgIdx)
+	if len(pkgIdx) != 1 || pkgIdx["runtime"] != 1 {
+		// Index 0 is the dummy invalid package in the blkPkgIdx table;
+		// the loader's reader loop starts at 1 (cmd/link/internal/
+		// loader/loader.go: "PkgIdx 0 is a dummy invalid package"), so
+		// the first real package must carry index 1.
+		t.Errorf("pkgIdx = %v, want runtime→1", pkgIdx)
 	}
 	if _, ok := symIdx["runtime·g0"]; !ok {
 		t.Errorf("symIdx missing runtime·g0, got %v", symIdx)

asm/goobj_test.go

@@ -117,7 +117,9 @@ DATA mask<>+8(SB)/8, $0x800f0e0d0c0b0a09
 	if len(defs) != 7 {
 		t.Fatalf("symdefs = %d, want 7", len(defs))
 	}
-	if defs[0].name != "mask" || defs[0].abi != 0xffff || defs[0].typ != kindSRODATA || defs[0].size != 16 || defs[0].flag2 != symFlag2Link {
+	// The linkname flag stays clear: the toolchain sets it only for
+	// //go:linkname symbols, and an ordinary static GLOBL is not one.
+	if defs[0].name != "mask" || defs[0].abi != 0xffff || defs[0].typ != kindSRODATA || defs[0].size != 16 || defs[0].flag2 != 0 {
 		t.Errorf("mask symbol = %+v", defs[0])
 	}
 	if defs[1].name != "" || defs[1].typ != kindSDATA || defs[1].size != 28 {
@@ -158,8 +160,8 @@ DATA mask<>+8(SB)/8, $0x800f0e0d0c0b0a09
 		t.Errorf("funcinfo bytes %x", fi)
 	}
 
-	// The pc-value tables of addq (non-package indices 0–3, so global
-	// indices 7–10): pcsp a flat zero over the whole function, pcinline a
+	// The pc-value tables of addq (non-package indices 0-3, so global
+	// indices 7-10): pcsp a flat zero over the whole function, pcinline a
 	// flat -1, both with the pc delta in MinLC (1) units.
 	pcsp := data[le.Uint32(didx[4*7:]):]
 	if got := pcsp[:3]; !bytes.Equal(got, []byte{0x02, 19, 0x00}) {
@@ -294,7 +296,7 @@ TEXT ·framed(SB), NOSPLIT, $8-0
 	}
 	for i := range wantPCs {
 		if pcs[i] != wantPCs[i] || vals[i] != wantVals[i] {
-			t.Errorf("pcsp[%d] = (%d,%d), want (%d,%d) — all: %v %v", i, pcs[i], vals[i], wantPCs[i], wantVals[i], pcs, vals)
+			t.Errorf("pcsp[%d] = (%d,%d), want (%d,%d); all: %v %v", i, pcs[i], vals[i], wantPCs[i], wantVals[i], pcs, vals)
 		}
 	}
 	// The last two steps unwind the epilogue to zero.
@@ -333,7 +335,7 @@ TEXT ·useext(SB), NOSPLIT, $0-8
 
 // TestGOObjectLinkAndRun is the end-to-end check: assemble the test
 // functions to a GOOBJ, swap it into a go build in place of the toolchain's
-// assembly object, link, and run — the output must match the baseline
+// assembly object, link, and run; the output must match the baseline
 // binary the Go assembler produced.  Skipped when no Go toolchain is
 // available.
 func TestGOObjectLinkAndRun(t *testing.T) {
@@ -393,7 +395,7 @@ func main() {
 	}
 	var work string
 	var asmObj, pkgArch, linkLine string
-	for _, line := range strings.Split(string(buildLog), "\n") {
+	for line := range strings.SplitSeq(string(buildLog), "\n") {
 		switch {
 		case strings.HasPrefix(line, "WORK="):
 			work = strings.TrimPrefix(line, "WORK=")
@@ -461,7 +463,7 @@ func main() {
 	newArch := filepath.Join(dir, "pkg.a")
 	args := []string{"tool", "pack", "c", newArch}
 	seen := map[string]bool{}
-	for _, m := range strings.Fields(string(listOut)) {
+	for m := range strings.FieldsSeq(string(listOut)) {
 		if seen[m] {
 			continue
 		}
@@ -511,3 +513,188 @@ func fieldAfter(line, flag string) string {
 	}
 	return ""
 }
+
+// TestGOObjectExternalPackageLink is the cross-package end-to-end check: a
+// GOOBJ whose code references a real external package symbol (runtime's
+// morestack, a plain reference rather than the builtin noctxt form) must
+// carry a package index that points past the blkPkgIdx table's dummy entry
+// 0, and the object must link against the real runtime.  Pre-fix, the
+// relocations carried block index 0, which the loader never fills, so the
+// reference resolved against whatever object was loaded first and the link
+// failed.  The binary is not run: morestack returns to the call site's
+// stack check, which a hand-written caller has none of.
+func TestGOObjectExternalPackageLink(t *testing.T) {
+	goBin, err := exec.LookPath("go")
+	if err != nil {
+		t.Skip("no Go toolchain available")
+	}
+	dir := t.TempDir()
+
+	const asmSrc = `
+#include "textflag.h"
+
+TEXT ·fn(SB), NOSPLIT, $0-0
+	CALL ·helper(SB)
+	RET
+
+TEXT ·helper(SB), NOSPLIT, $0-0
+	RET
+`
+	const mainSrc = `package main
+
+func fn()
+func helper()
+
+func main() {
+	fn()
+	helper()
+}
+`
+	if err := os.WriteFile(filepath.Join(dir, "main_amd64.s"), []byte(asmSrc), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "main.go"), []byte(mainSrc), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "go.mod"), []byte("module extlink\n\ngo 1.27\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	// Capture the build the toolchain performs and re-run only its link
+	// step with our object swapped into the package archive, mirroring
+	// TestGOObjectLinkAndRun.
+	build := exec.Command(goBin, "build", "-x", "-work", "-o", filepath.Join(dir, "prog"), ".")
+	build.Dir = dir
+	buildLog, err := build.CombinedOutput()
+	if err != nil {
+		t.Fatalf("baseline build: %v\n%s", err, buildLog)
+	}
+	var work, linkLine, asmObj, pkgArch string
+	for line := range strings.SplitSeq(string(buildLog), "\n") {
+		switch {
+		case strings.HasPrefix(line, "WORK="):
+			work = strings.TrimPrefix(line, "WORK=")
+		case strings.Contains(line, "/asm ") && strings.Contains(line, "main_amd64.s") && !strings.Contains(line, "-gensymabis"):
+			asmObj = fieldAfter(line, "-o")
+		case strings.Contains(line, "pack r") && strings.Contains(line, "_pkg_.a"):
+			pkgArch = strings.TrimSpace(strings.SplitN(line, "pack r", 2)[1])
+			pkgArch = strings.Fields(strings.SplitN(pkgArch, "#", 2)[0])[0]
+		case strings.Contains(line, "/link ") && strings.Contains(line, "-importcfg"):
+			linkLine = line
+		}
+	}
+	if work == "" || asmObj == "" || pkgArch == "" || linkLine == "" {
+		t.Skipf("could not parse build log (work=%q asmObj=%q)", work, asmObj)
+	}
+	defer os.RemoveAll(work)
+	asmObj = strings.ReplaceAll(asmObj, "$WORK", work)
+	pkgArch = strings.ReplaceAll(pkgArch, "$WORK", work)
+
+	// Assemble the source with gasm, then retarget fn's internal call at
+	// a real external package symbol: the reloc's qualified name drives
+	// the export-data resolution the way a source-level runtime·sym(SB)
+	// reference would.
+	f, errs := parser.Parse("main_amd64.s", asmSrc)
+	if len(errs) > 0 {
+		t.Fatalf("parse: %v", errs)
+	}
+	img, err := AssembleFile(f)
+	if err != nil {
+		t.Fatalf("AssembleFile: %v", err)
+	}
+	fn := &img.Funcs[0]
+	for i := range fn.Relocs {
+		fn.Relocs[i].Name = "runtime\u00b7morestack"
+		fn.Relocs[i].External = true
+	}
+	img.Externals = []string{"runtime\u00b7morestack"}
+	obj, err := img.GOObject("main", "main_amd64.s")
+	if err != nil {
+		t.Fatalf("GOObject: %v", err)
+	}
+
+	// Structural check: the blkPkgIdx block reserves entry 0 for the
+	// dummy invalid package and places runtime at entry 1, and fn's call
+	// relocation carries PkgIdx 1.
+	v := openGoobj(t, obj)
+	pkgBlk := v.blk(blkPkgIdx)
+	if len(pkgBlk) != 2*8 {
+		t.Fatalf("blkPkgIdx = %d bytes, want two entries", len(pkgBlk))
+	}
+	le := binary.LittleEndian
+	strEntry := func(i int) string {
+		e := pkgBlk[i*8 : (i+1)*8]
+		return v.str(le.Uint32(e[4:]), le.Uint32(e[0:]))
+	}
+	if s := strEntry(0); s != "" {
+		t.Errorf("blkPkgIdx[0] = %q, want the dummy empty package", s)
+	}
+	if s := strEntry(1); s != "runtime" {
+		t.Errorf("blkPkgIdx[1] = %q, want runtime", s)
+	}
+	relocs := v.blk(blkReloc)
+	// fn is the last non-package symbol (two functions, four pc tables
+	// each); its one reloc is the final record.
+	fnRec := relocs[len(relocs)-23:]
+	if pIdx := le.Uint32(fnRec[15:]); pIdx != 1 {
+		t.Errorf("external reloc PkgIdx = %d, want 1 (runtime)", pIdx)
+	}
+
+	// Swap the object into the package archive and link with cmd/link;
+	// the link line consumes the archive, not the loose object file.
+	membersDir := filepath.Join(dir, "members")
+	if err := os.MkdirAll(membersDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	extract := exec.Command(goBin, "tool", "pack", "x", pkgArch)
+	extract.Dir = membersDir
+	if out, err := extract.CombinedOutput(); err != nil {
+		t.Fatalf("pack x: %v\n%s", err, out)
+	}
+	member := filepath.Join(membersDir, filepath.Base(asmObj))
+	if err := os.Chmod(member, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(member, obj, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	listCmd := exec.Command(goBin, "tool", "pack", "t", pkgArch)
+	listOut, err := listCmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("pack t: %v\n%s", err, listOut)
+	}
+	newArch := filepath.Join(dir, "pkg.a")
+	args := []string{"tool", "pack", "c", newArch}
+	seen := map[string]bool{}
+	for m := range strings.FieldsSeq(string(listOut)) {
+		if seen[m] {
+			continue
+		}
+		seen[m] = true
+		if err := os.Chmod(filepath.Join(membersDir, m), 0o644); err != nil {
+			t.Fatal(err)
+		}
+		args = append(args, filepath.Join(membersDir, m))
+	}
+	pack := exec.Command(goBin, args...)
+	pack.Dir = membersDir
+	if out, err := pack.CombinedOutput(); err != nil {
+		t.Fatalf("pack c: %v\n%s", err, out)
+	}
+	linkLine = strings.ReplaceAll(linkLine, "$WORK", work)
+	linkLine = strings.ReplaceAll(linkLine, pkgArch, newArch)
+	linkLine = strings.ReplaceAll(linkLine, filepath.Join(work, "b001", "exe", "a.out"), filepath.Join(dir, "prog2"))
+	linkCmd := exec.Command("sh", "-c", "cd "+dir+" && "+linkLine)
+	if out, err := linkCmd.CombinedOutput(); err != nil {
+		t.Fatalf("re-link with gasm object: %v\n%s", err, out)
+	}
+
+	// The call must have resolved to the real runtime symbol.
+	dump, err := exec.Command(goBin, "tool", "objdump", "-s", "main.fn", filepath.Join(dir, "prog2")).CombinedOutput()
+	if err != nil {
+		t.Fatalf("objdump main.fn: %v\n%s", err, dump)
+	}
+	if !bytes.Contains(dump, []byte("runtime.morestack")) {
+		t.Errorf("main.fn does not call runtime.morestack:\n%s", dump)
+	}
+}

asm/goobjarm64.go

@@ -13,25 +13,54 @@ import (
 )
 
 // GOObjectAARCH64 emits a GOOBJ object file for AArch64.  The layout is
-// the shared one in goobj.go — the toolchain preamble, the go120ld header
+// the shared one in goobj.go, the toolchain preamble, the go120ld header
 // with its block offsets, the string table, the symbol definitions and the
-// reloc/aux/data index arrays — with the arm64 preamble, the MinLC of 4
-// for the pc-value deltas, and R_ADDRARM64 relocation types for the
-// ADRP+ADD/LDR/STR address pairs.
+// reloc/aux/data index arrays, with the arm64 preamble, the MinLC of 4
+// for the pc-value deltas, and the arm64 relocation types for the ADRP
+// pairs and BL calls.
+//
+// The toolchain records one relocation per ADRP pair: a single R_ADDRARM64
+// or R_ARM64_PCREL_LDST64 of Siz 8 at the ADRP word, from which the linker
+// patches both instructions of the pair (cmd/internal/obj/arm64/asm7.go,
+// the ADRP cases: one AddRel with Off at the pair's pc and Siz 8).  gasm's
+// assembler records the ADRP+ADD form as two word relocs, so the second
+// word's twin is dropped here before emission.
 func (img *Image) GOObjectAARCH64(pkgPath, srcPath string) ([]byte, error) {
 	pre, err := toolchainObjectPreambleAARCH64()
 	if err != nil {
 		return nil, err
 	}
-	return img.emitGOObject(pkgPath, srcPath, pre, 4, func(r Reloc) (uint16, uint8) {
-		return relocArm64Addr, 4
+	coalesced := *img
+	coalesced.Funcs = append([]FuncLayout(nil), img.Funcs...)
+	for i := range coalesced.Funcs {
+		rs := coalesced.Funcs[i].Relocs
+		var keep []Reloc
+		for j := 0; j < len(rs); j++ {
+			keep = append(keep, rs[j])
+			if rs[j].Kind == RelArm64Addr && j+1 < len(rs) &&
+				rs[j+1].Kind == RelArm64Addr && rs[j+1].Off == rs[j].Off+4 {
+				j++ // the ADD word's twin: the Siz-8 pair reloc covers it
+			}
+		}
+		coalesced.Funcs[i].Relocs = keep
+	}
+	return coalesced.emitGOObject(pkgPath, srcPath, pre, 4, func(r Reloc) (uint16, uint8) {
+		switch r.Kind {
+		case RelArm64Branch:
+			return relocArm64Branch, 4
+		case RelArm64LDST64:
+			return relocArm64LDST64, 8
+		default:
+			return relocArm64Addr, 8
+		}
 	})
 }
 
-// arm64 relocation types (cmd/internal/objabi).  R_ADDRARM64 resolves an
-// ADRP+ADD/LDR/STR pair to a symbol's address.
+// arm64 relocation types (cmd/internal/objabi).
 const (
-	relocArm64Addr = 9 // R_ADDRARM64
+	relocArm64Addr   = 3  // R_ADDRARM64, ADRP+ADD pair
+	relocArm64Branch = 9  // R_CALLARM64, BL instruction
+	relocArm64LDST64 = 40 // R_ARM64_PCREL_LDST64, ADRP+LDR/STR pair
 )
 
 // toolchainObjectPreambleAARCH64 returns the "go object ...\n!\n" header

asm/goobjloong64.go

@@ -13,9 +13,9 @@ import (
 )
 
 // GOObjectLOONG64 emits a GOOBJ object file for LoongArch.  The layout is
-// the shared one in goobj.go — the toolchain preamble, the go120ld header
+// the shared one in goobj.go, the toolchain preamble, the go120ld header
 // with its block offsets, the string table, the symbol definitions and the
-// reloc/aux/data index arrays — with the loong64 preamble, the MinLC of 4
+// reloc/aux/data index arrays, with the loong64 preamble, the MinLC of 4
 // for the pc-value deltas, and R_LOONG64_ADDR_HI/LO relocation types for
 // the pcalau12i+addi.d address pairs.
 func (img *Image) GOObjectLOONG64(pkgPath, srcPath string) ([]byte, error) {
@@ -25,11 +25,16 @@ func (img *Image) GOObjectLOONG64(pkgPath, srcPath string) ([]byte, error) {
 	}
 	return img.emitGOObject(pkgPath, srcPath, pre, 4, func(r Reloc) (uint16, uint8) {
 		// A pcalau12i+addi.d pair: the high part carries
-		// R_LOONG64_ADDR_HI, the low part R_LOONG64_ADDR_LO.
-		if r.Kind == RelLoong64AddrLo {
+		// R_LOONG64_ADDR_HI, the low part R_LOONG64_ADDR_LO; the guard's
+		// morestack call carries R_CALLLOONG64.
+		switch {
+		case r.Kind == RelLoong64AddrLo:
 			return relocLoong64AddrLo, 4
+		case r.Kind == RelLoong64Branch:
+			return relocCallLoong64, 4
+		default:
+			return relocLoong64AddrHi, 4
 		}
-		return relocLoong64AddrHi, 4
 	})
 }
 
@@ -39,6 +44,7 @@ func (img *Image) GOObjectLOONG64(pkgPath, srcPath string) ([]byte, error) {
 const (
 	relocLoong64AddrHi = 77 // R_LOONG64_ADDR_HI
 	relocLoong64AddrLo = 78 // R_LOONG64_ADDR_LO
+	relocCallLoong64   = 84 // R_CALLLOONG64
 )
 
 // toolchainObjectPreambleLOONG64 returns the "go object ...\n!\n" header

asm/goobjriscv.go

@@ -13,9 +13,9 @@ import (
 )
 
 // GOObjectRISCV emits a GOOBJ object file for RISC-V.  The layout is the
-// shared one in goobj.go — the toolchain preamble, the go120ld header with
+// shared one in goobj.go, the toolchain preamble, the go120ld header with
 // its block offsets, the string table, the symbol definitions and the
-// reloc/aux/data index arrays — with the RISC-V preamble, the MinLC of 2 for
+// reloc/aux/data index arrays, with the RISC-V preamble, the MinLC of 2 for
 // the pc-value deltas, and the single R_RISCV_PCREL_ITYPE/STYPE relocation
 // per AUIPC pair, matching `go tool asm`'s model (each pair is one 8-byte
 // relocation, not the ELF HI20/LO12 pair).

asm/guard_test.go

@@ -0,0 +1,329 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: BSD-3-Clause
+
+package asm
+
+import (
+	"bytes"
+	"encoding/hex"
+	"strings"
+	"testing"
+
+	"sourcedock.dev/petrbalvin/gasm-devkit/ast"
+	"sourcedock.dev/petrbalvin/gasm-devkit/parser"
+)
+
+// The expected bytes are pinned from `go tool asm` output (Go 1.27, amd64,
+// verified with go tool objdump): the stack-split guard classes, the morestack
+// block and the auto-NOSPLIT leaf behaviour.
+func TestStackGuardBytes(t *testing.T) {
+	for _, tt := range []struct {
+		name string
+		src  string
+		want string
+	}{
+		{"leafsmall", "TEXT \u00b7leafsmall(SB), $16-0\n\tRET\n",
+			"554889e54883ec104883c4105dc3"},
+		{"leafmed", "TEXT \u00b7leafmed(SB), $256-0\n\tRET\n",
+			"644c8b3425000000004c8da42478ffffff4d3b66107614554889e54881ec000100004881c4000100005dc3e800000000ebce"},
+		{"leafbig", "TEXT \u00b7leafbig(SB), $8192-0\n\tRET\n",
+			"644c8b3425000000004989e44981ec881f0000721a4d3b66107614554889e54881ec002000004881c4002000005dc3e800000000ebca"},
+		// Class 2 with a body long enough that the underflow JB relaxes to
+		// rel32: its displacement must span the real 6-byte JB, else the
+		// branch lands 4 bytes past the morestack block, inside the CALL
+		// displacement field.
+		{"leafbiglong", "TEXT \u00b7leafbiglong(SB), $8192-0\n" + strings.Repeat("\tMOVQ AX, BX\n", 40) + "\tRET\n",
+			"644c8b3425000000004989e44981ec881f00000f82960000004d3b66100f868c000000554889e54881ec00200000" + strings.Repeat("4889c3", 40) + "4881c4002000005dc3e800000000e947ffffff"},
+		{"callsmall", "TEXT \u00b7callsmall(SB), $16-0\n\tCALL \u00b7other(SB)\n\tRET\nTEXT \u00b7other(SB), NOSPLIT, $0\n\tRET\n",
+			"644c8b342500000000493b66107613554889e54883ec10e8000000004883c4105dc3e800000000ebd7"},
+		{"nosplit", "TEXT \u00b7nosplit(SB), NOSPLIT, $16-0\n\tRET\n",
+			"554889e54883ec104883c4105dc3"},
+	} {
+		f, errs := parser.Parse("g_amd64.s", tt.src)
+		if len(errs) > 0 {
+			t.Fatalf("%s: parse: %v", tt.name, errs)
+		}
+		img, err := AssembleFile(f)
+		if err != nil {
+			t.Fatalf("%s: assemble: %v", tt.name, err)
+		}
+		fn := img.Funcs[0]
+		// The toolchain's object leaves every relocation field zero for the
+		// linker, while the gasm image resolves file-internal references, so
+		// the comparison masks the patch sites the way verify's ground truth
+		// does.
+		code := append([]byte(nil), img.Code[fn.Offset:fn.Offset+fn.Size]...)
+		for _, r := range fn.Relocs {
+			for j := r.Off; j < r.Off+4 && j < len(code); j++ {
+				code[j] = 0
+			}
+		}
+		got := hex.EncodeToString(code)
+		if got != tt.want {
+			t.Errorf("%s:\n  got  %s\n  want %s", tt.name, got, tt.want)
+		}
+	}
+}
+
+// TestStackGuardRelocs checks the guard's patch sites: the TLS slot and the
+// morestack call.
+func TestStackGuardRelocs(t *testing.T) {
+	f, errs := parser.Parse("g_amd64.s", "TEXT \u00b7f(SB), $256-0\n\tRET\n")
+	if len(errs) > 0 {
+		t.Fatalf("parse: %v", errs)
+	}
+	img, err := AssembleFile(f)
+	if err != nil {
+		t.Fatalf("assemble: %v", err)
+	}
+	relocs := img.Funcs[0].Relocs
+	if len(relocs) != 2 {
+		t.Fatalf("relocs = %d, want 2", len(relocs))
+	}
+	tls, call := relocs[0], relocs[1]
+	if tls.Kind != RelTLSLE || tls.Off != 5 || tls.Name != "" || tls.External {
+		t.Errorf("tls reloc = %+v, want RelTLSLE at 5 with no symbol", tls)
+	}
+	if call.Kind != RelCall || call.Name != "runtime\u00b7morestack_noctxt" || !call.External {
+		t.Errorf("call reloc = %+v, want RelCall to runtime.morestack_noctxt", call)
+	}
+}
+
+// TestStackGuardGOObj emissions succeed with the guard's TLS and builtin
+// references in play.
+func TestStackGuardGOObj(t *testing.T) {
+	f, errs := parser.Parse("g_amd64.s", "TEXT \u00b7f(SB), $256-0\n\tCALL \u00b7helper(SB)\n\tRET\nTEXT \u00b7helper(SB), NOSPLIT, $0\n\tRET\n")
+	if len(errs) > 0 {
+		t.Fatalf("parse: %v", errs)
+	}
+	img, err := AssembleFile(f)
+	if err != nil {
+		t.Fatalf("assemble: %v", err)
+	}
+	obj, err := img.GOObject("testpkg", "g_amd64.s")
+	if err != nil {
+		t.Fatalf("GOObject: %v", err)
+	}
+	if !bytes.Contains(obj, []byte("go120ld")) {
+		t.Fatal("object lacks the GOOBJ magic")
+	}
+}
+
+// The arm64 stack-split guard, pinned from `go tool asm` (Go 1.27, arm64):
+// the guard classes, the auto-NOSPLIT leaf behaviour and the morestack
+// block.  Relocation fields are masked: the toolchain's object leaves them
+// zero for the linker, the gasm image resolves file-internal references.
+func TestStackGuardBytesARM64(t *testing.T) {
+	for _, tt := range []struct {
+		name string
+		src  string
+		want string
+	}{
+		{"leafsmall", "TEXT \u00b7leafsmall(SB), $16-0\n\tRET\n",
+			"fe0f1ef8fd831ff8fd2300d1fd630091ff830091c0035fd6"},
+		{"leafmed", "TEXT \u00b7leafmed(SB), $256-0\n\tRET\n",
+			"900b40f9f14302d13f0210eb09010054f44304d19dfa3fa99f020091fd2300d1fd230491ff430491c0035fd6e3031eaa00000000f3ffff17"},
+		{"leafbig", "TEXT \u00b7leafbig(SB), $8192-0\n\tRET\n",
+			"900b40f91bf283d2f1633beba30100543f0210eb690100541b0284d2f4633bcb9dfa3fa99f020091fd2300d11b0184d2fd633b8b1b0284d2ff633b8bc0035fd6e3031eaa00000000eeffff17"},
+		{"callsmall", "TEXT \u00b7callsmall(SB), $16-0\n\tCALL \u00b7other(SB)\n\tRET\nTEXT \u00b7other(SB), NOSPLIT, $0\n\tRET\n",
+			"900b40f9ff6330eb09010054fe0f1ef8fd831ff8fd2300d100000000fd835ff8fe0742f8c0035fd6e3031eaa00000000f4ffff17"},
+		{"nosplit", "TEXT \u00b7nosplit(SB), NOSPLIT, $16-0\n\tRET\n",
+			"fe0f1ef8fd831ff8fd2300d1fd630091ff830091c0035fd6"},
+	} {
+		f, errs := parser.Parse("g_arm64.s", tt.src)
+		if len(errs) > 0 {
+			t.Fatalf("%s: parse: %v", tt.name, errs)
+		}
+		img, err := AssembleFileARM64(f)
+		if err != nil {
+			t.Fatalf("%s: assemble: %v", tt.name, err)
+		}
+		fn := img.Funcs[0]
+		code := append([]byte(nil), img.Code[fn.Offset:fn.Offset+fn.Size]...)
+		for _, r := range fn.Relocs {
+			for j := r.Off; j < r.Off+4 && j < len(code); j++ {
+				code[j] = 0
+			}
+		}
+		got := hex.EncodeToString(code)
+		if got != tt.want {
+			t.Errorf("%s:\n  got  %s\n  want %s", tt.name, got, tt.want)
+		}
+	}
+}
+
+// TestStackGuardBranchTargetsARM64 checks the class-2 guard's branch
+// positions for a frame whose guard constant needs two MOV words: the
+// displacements must be computed from byte offsets (8+4*ml and 16+4*ml), so
+// both branches land on the morestack block rather than inside the body.
+// The frame size makes the toolchain switch its own prologue decomposition,
+// so the assertion is on the branch targets, not pinned bytes.
+func TestStackGuardBranchTargetsARM64(t *testing.T) {
+	f, errs := parser.Parse("g_arm64.s", "TEXT \u00b7f(SB), $65664-0\n\tCALL \u00b7other(SB)\n\tRET\nTEXT \u00b7other(SB), NOSPLIT, $0\n\tRET\n")
+	if len(errs) > 0 {
+		t.Fatalf("parse: %v", errs)
+	}
+	img, err := AssembleFileARM64(f)
+	if err != nil {
+		t.Fatalf("assemble: %v", err)
+	}
+	fn := img.Funcs[0]
+	code := img.Code[fn.Offset : fn.Offset+fn.Size]
+	if len(code)%4 != 0 {
+		t.Fatalf("function size %d is not a word multiple", len(code))
+	}
+	// autosize = 65680, so the guard materialises 65552 = MOVZ+MOVK: ml = 2
+	// and the branches sit at bytes 16 and 24 of the guard prefix.
+	const morestackBlock = 12 // MOVD R30, R3; BL; B back
+	blockStart := len(code) - morestackBlock
+	check := func(name string, off int) {
+		t.Helper()
+		w := leWord(code[off:])
+		imm19 := int32(w>>5) & 0x7FFFF
+		if imm19&(1<<18) != 0 {
+			imm19 -= 1 << 19
+		}
+		if target := off + int(imm19)*4; target != blockStart {
+			t.Errorf("%s at byte %d targets byte %d, want the morestack block at %d", name, off, target, blockStart)
+		}
+	}
+	check("B.LO", 16)
+	check("B.LS", 24)
+}
+
+// The riscv64 stack-split guard, pinned from `go tool asm` (Go 1.27,
+// riscv64): the morestack call sits between the guard and the body, and the
+// guard branches forward over it.  Relocation fields are masked.
+func TestStackGuardBytesRISCV64(t *testing.T) {
+	for _, tt := range []struct {
+		name string
+		src  string
+		want string
+	}{
+		{"leafsmall", "TEXT \u00b7leafsmall(SB), $16-0\n\tRET\n",
+			"03b30d0163662300000000006ff05fff233411fe211106e08260610167800000"},
+		{"leafmed", "TEXT \u00b7leafmed(SB), $256-0\n\tRET\n",
+			"03b30d01930381f763667300000000006ff01fff233c11ee130181ef06e082601301811067800000"},
+		{"leafbig", "TEXT \u00b7leafbig(SB), $8192-0\n\tRET\n",
+			"03b30d0189639b8383f863697100f97f9b8f8f07b303f10163667300000000006ff01ffef97f8a9f23bc1ffef97fe13f7e9106e08260896fa12f7e9167800000"},
+		{"frameless", "TEXT \u00b7frameless(SB), $0-0\n\tCALL \u00b7other(SB)\n\tRET\nTEXT \u00b7other(SB), NOSPLIT, $0\n\tRET\n",
+			"03b30d0163662300000000006ff05fff233c11fe611106e0000000008260210167800000"},
+		{"nosplit", "TEXT \u00b7nosplit(SB), NOSPLIT, $16-0\n\tRET\n",
+			"233411fe211106e08260610167800000"},
+	} {
+		f, errs := parser.Parse("g_riscv64.s", tt.src)
+		if len(errs) > 0 {
+			t.Fatalf("%s: parse: %v", tt.name, errs)
+		}
+		img, err := AssembleFileRISCV(f)
+		if err != nil {
+			t.Fatalf("%s: assemble: %v", tt.name, err)
+		}
+		fn := img.Funcs[0]
+		code := append([]byte(nil), img.Code[fn.Offset:fn.Offset+fn.Size]...)
+		for _, r := range fn.Relocs {
+			for j := r.Off; j < r.Off+4 && j < len(code); j++ {
+				code[j] = 0
+			}
+		}
+		got := hex.EncodeToString(code)
+		if got != tt.want {
+			t.Errorf("%s:\n  got  %s\n  want %s", tt.name, got, tt.want)
+		}
+	}
+}
+
+// The loong64 stack-split guard, pinned from `go tool asm` (Go 1.27,
+// loong64): every guard class (including the medium class with the
+// materialised constant and the big class with the ORI-less constants), the
+// auto-NOSPLIT leaf behaviour, the large-frame R30 prologue/epilogue forms
+// and the morestack block.  Relocation fields are masked.
+func TestStackGuardBytesLOONG64(t *testing.T) {
+	for _, tt := range []struct {
+		name string
+		src  string
+		want string
+	}{
+		{"leafsmall", "TEXT \u00b7leafsmall(SB), $16-0\n\tRET\n",
+			"61a0ff2963a0ff026100c0296360c0022000004c"},
+		{"leafmed", "TEXT \u00b7leafmed(SB), $256-0\n\tRET\n",
+			"d442c02878e0fd0294e21200801a004061e0fb2963e0fb026100c0296320c4022000004c3f00150000000000ffd7ff53"},
+		{"nosplit", "TEXT \u00b7nosplit(SB), NOSPLIT, $16-0\n\tRET\n",
+			"61a0ff2963a0ff026100c0296360c0022000004c"},
+		// The LR store leaves the 12-bit store-offset range while the SP
+		// adjust immediate still fits, and the epilogue adjusts through a
+		// single ORI.
+		{"fit2048", "TEXT \u00b7fit2048(SB), $2040-0\n\tRET\n",
+			"d442c0287800e20294e21200802600401e000014de8f1000c103e0296300e0026100c0291e00a00363f810002000004c3f00150000000000ffcbff53"},
+		// Medium class at the materialisation boundary (off = 2048 still
+		// immediate, 2049+ goes through R30).
+		{"med2048off", "TEXT \u00b7med2048off(SB), $2168-0\n\tRET\n",
+			"d442c0287800e00294e21200802e0040feffff15de8f1000c103de29feffff15de039e0363f810006100c0291e00a20363f810002000004c3f00150000000000ffc3ff53"},
+		{"medmat", "TEXT \u00b7medmat(SB), $2176-0\n\tRET\n",
+			"d442c028feffff15dee39f0378f8100094e21200802e0040feffff15de8f1000c1e3dd29feffff15dee39d0363f810006100c0291e20a20363f810002000004c3f00150000000000ffbbff53"},
+		// Big class with the rounding-split store and the floor-split adjust.
+		{"leafbig", "TEXT \u00b7leafbig(SB), $8192-0\n\tRET\n",
+			"d442c0283e000014de23be0378f8120000470044deffff15dee3810378f8100094e2120080320040deffff15de8f1000c1e3ff29beffff15dee3bf0363f810006100c0295e000014de23800363f810002000004c3f00150000000000ffa7ff53"},
+		// Zero low 12 bits drop the ORI from the store, the adjust and the
+		// epilogue materialisation.
+		{"bigzero", "TEXT \u00b7bigzero(SB), $4088-0\n\tRET\n",
+			"d442c028feffff15de03820378f8100094e21200802a0040feffff15de8f1000c103c029feffff1563f810006100c0293e00001463f810002000004c3f00150000000000ffbfff53"},
+		// Big class whose first constant has a zero high part: a single ORI.
+		{"big3976", "TEXT \u00b7big3976(SB), $4096-0\n\tRET\n",
+			"d442c0281e20be0378f8120000470044feffff15dee3810378f8100094e2120080320040feffff15de8f1000c1e3ff29deffff15dee3bf0363f810006100c0293e000014de23800363f810002000004c3f00150000000000ffabff53"},
+		// Big class at a multiple of 4096: both guard constants lose their
+		// ORI word.
+		{"giantlo0", "TEXT \u00b7giantlo0(SB), $4216-0\n\tRET\n",
+			"d442c0283e00001478f8120000430044feffff1578f8100094e2120080320040feffff15de8f1000c103fe29deffff15de03be0363f810006100c0293e000014de03820363f810002000004c3f00150000000000ffafff53"},
+		// Non-leaf big frame: the body call plus the LR restore epilogue.
+		{"callbig", "TEXT \u00b7callbig(SB), $8192-0\n\tCALL \u00b7other(SB)\n\tRET\nTEXT \u00b7other(SB), NOSPLIT, $0\n\tRET\n",
+			"d442c0283e000014de23be0378f81200004f0044deffff15dee3810378f8100094e21200803a0040deffff15de8f1000c1e3ff29beffff15dee3bf0363f810006100c029000000006100c0285e000014de23800363f810002000004c3f00150000000000ff9fff53"},
+	} {
+		f, errs := parser.Parse("g_loong64.s", tt.src)
+		if len(errs) > 0 {
+			t.Fatalf("%s: parse: %v", tt.name, errs)
+		}
+		img, err := AssembleFileLOONG64(f)
+		if err != nil {
+			t.Fatalf("%s: assemble: %v", tt.name, err)
+		}
+		fn := img.Funcs[0]
+		code := append([]byte(nil), img.Code[fn.Offset:fn.Offset+fn.Size]...)
+		for _, r := range fn.Relocs {
+			for j := r.Off; j < r.Off+4 && j < len(code); j++ {
+				code[j] = 0
+			}
+		}
+		got := hex.EncodeToString(code)
+		if got != tt.want {
+			t.Errorf("%s:\n  got  %s\n  want %s", tt.name, got, tt.want)
+		}
+	}
+}
+
+// TestStackGuardGOObjInternalCall checks that GOOBJ emission succeeds when a
+// guarded function calls a TEXT symbol of the same file, for every arch's
+// call relocation kind.
+func TestStackGuardGOObjInternalCall(t *testing.T) {
+	for _, tt := range []struct {
+		src      string
+		assemble func(*ast.File) (*Image, error)
+	}{
+		{"g_amd64.s", AssembleFile},
+		{"g_arm64.s", AssembleFileARM64},
+		{"g_riscv64.s", AssembleFileRISCV},
+		{"g_loong64.s", AssembleFileLOONG64},
+	} {
+		f, errs := parser.Parse(tt.src, "TEXT \u00b7callsmall(SB), $16-0\n\tCALL \u00b7other(SB)\n\tRET\nTEXT \u00b7other(SB), NOSPLIT, $0\n\tRET\n")
+		if len(errs) > 0 {
+			t.Fatalf("%s: parse: %v", tt.src, errs)
+		}
+		img, err := tt.assemble(f)
+		if err != nil {
+			t.Fatalf("%s: assemble: %v", tt.src, err)
+		}
+		if _, err := img.GOObject("testpkg", tt.src); err != nil {
+			t.Errorf("%s: GOObject: %v", tt.src, err)
+		}
+	}
+}

asm/integration_test.go

@@ -19,8 +19,8 @@ import (
 	"sourcedock.dev/petrbalvin/gasm-devkit/parser"
 )
 
-// TestAssembleGoFlacAVX2Kernel assembles the whole production AVX2 kernel —
-// all functions plus the file-local mask24 constant — and checks that every
+// TestAssembleGoFlacAVX2Kernel assembles the whole production AVX2 kernel;
+// all functions plus the file-local mask24 constant; and checks that every
 // static-symbol load resolves to the right bytes in the image.
 func TestAssembleGoFlacAVX2Kernel(t *testing.T) {
 	path := "../../go-libraries/go-flac/avx2_amd64.s"
@@ -81,7 +81,7 @@ func TestAssembleGoFlacAVX2Kernel(t *testing.T) {
 }
 
 // TestAssembleGoFlacAVX512Kernel assembles the whole production AVX-512
-// kernel — all functions plus the file-global idx16 constant — and checks
+// kernel, all functions plus the file-global idx16 constant, and checks
 // that the static-symbol load resolves to the right bytes in the image.
 func TestAssembleGoFlacAVX512Kernel(t *testing.T) {
 	path := "../../go-libraries/go-flac/avx512_amd64.s"

asm/l64_goobj_test.go

@@ -94,9 +94,9 @@ DATA ·table<>+0(SB)/8, $0x1122334455667788
 	}
 
 	// The debug_line program: LNE_set_address (the R_ADDR relocation
-	// carries the function address), then one row per line change — the
+	// carries the function address), then one row per line change; the
 	// TEXT is on line 4 (a leading blank line precedes the include), the
-	// instructions on lines 5–9 — an advance to the 20-byte end and an
+	// instructions on lines 5-9; an advance to the 20-byte end and an
 	// end-of-sequence.
 	linesOff := le.Uint32(dataIdx[4*2:])
 	lines := dataBlk[linesOff : linesOff+21]
@@ -214,7 +214,7 @@ func main() {
 		t.Fatalf("baseline build: %v\n%s", err, buildLog)
 	}
 	var pkgArch, work, linkLine, asmObj string
-	for _, line := range strings.Split(string(buildLog), "\n") {
+	for line := range strings.SplitSeq(string(buildLog), "\n") {
 		switch {
 		case strings.HasPrefix(line, "WORK="):
 			work = strings.TrimPrefix(line, "WORK=")
@@ -278,7 +278,7 @@ func main() {
 	newArch := filepath.Join(dir, "pkg.a")
 	args := []string{"tool", "pack", "c", newArch}
 	seen := map[string]bool{}
-	for _, m := range strings.Fields(string(listOut)) {
+	for m := range strings.FieldsSeq(string(listOut)) {
 		if seen[m] {
 			continue
 		}

asm/link.go

@@ -6,6 +6,7 @@ package asm
 import (
 	"fmt"
 	"sort"
+	"strconv"
 
 	"sourcedock.dev/petrbalvin/gasm-devkit/ast"
 )
@@ -15,7 +16,7 @@ import (
 // file-local static symbols are encoded RIP-relative and resolved within the
 // image, so the raw bytes are self-consistent and executable at any base
 // address; references to external symbols are recorded as relocations
-// (Funcs[i].Relocs, Externals) and left unresolved — the object-file
+// (Funcs[i].Relocs, Externals) and left unresolved, the object-file
 // emitters turn them into linker relocations.
 type Image struct {
 	Code      []byte         // concatenated function bodies
@@ -24,6 +25,10 @@ type Image struct {
 	Symbols   map[string]int // static symbol → byte offset within the image
 	DataSyms  []DataSymbol   // GLOBL symbols, in layout order
 	Externals []string       // referenced but undefined symbols, sorted
+	// SourcePath is the assembled file's path, recorded in the DWARF
+	// sections in place of a placeholder name.  Empty when the image was
+	// not built from a named file.
+	SourcePath string
 }
 
 // FuncLayout describes one assembled function within an Image.
@@ -80,26 +85,34 @@ func (fl *FuncLayout) LineAt(offset int) int {
 	return 0
 }
 
-// Reloc is one static-symbol reference within a function body: the disp32
-// field at Off (function-relative) must reach the symbol plus Addend,
-// measured from After, the address just past the instruction.  An External
-// relocation names a symbol no GLOBL in the file defines; the object-file
-// emitters carry it into the output's relocation table.
-// RelocKind discriminates the type of relocation needed.
+// RelocKind discriminates the relocation a static-symbol reference needs;
+// the encoders record one per SB reference, and the object-file emitters map
+// it to their format's relocation type.
 type RelocKind int
 
 const (
 	RelPCRel32         RelocKind = iota // 32-bit PC-relative (amd64)
+	RelCall                             // R_CALL: CALL to a function symbol (amd64)
+	RelTLSLE                            // R_TLS_LE: local-exec TLS load, no symbol (amd64 guard)
 	RelRISCVPCRELIType                  // R_RISCV_PCREL_ITYPE (AUIPC + I-type pair)
 	RelRISCVPCRELSType                  // R_RISCV_PCREL_STYPE (AUIPC + S-type pair)
 	RelRISCVJal                         // R_RISCV_JAL (J-type call)
-	RelPCRelAbs                         // 32-bit absolute (R_RISCV_32)
 	RelLoong64AddrHi                    // R_LOONG64_ADDR_HI (pcalau12i)
 	RelLoong64AddrLo                    // R_LOONG64_ADDR_LO (addi.d/ld/st)
-	RelArm64Addr                        // R_ADDRARM64 (ADRP + ADD/LDR/STR pair)
+	RelArm64Addr                        // R_ADDRARM64 (ADRP + ADD pair)
+	RelArm64Branch                      // R_CALLARM64 (BL instruction)
+	RelArm64LDST64                      // R_ARM64_PCREL_LDST64 (ADRP + 64-bit LDR/STR pair)
+	RelLoong64Branch                    // R_CALLLOONG64 (BL instruction)
 )
 
 type Reloc struct {
+	// Off is the function-relative offset of the field the linker patches
+	// and After the address just past the instruction, the base the
+	// assembler measures PC-relative displacements from.  Name plus
+	// Addend select the target: the symbol plus the byte offset.  An
+	// External relocation names a symbol no GLOBL in the file defines;
+	// the object-file emitters carry it into the output's relocation
+	// table.
 	Off      int
 	After    int
 	Name     string
@@ -131,7 +144,7 @@ func (img *Image) Bytes() []byte {
 // reference to a file-local static symbol becomes a RIP-relative load whose
 // displacement is resolved against that layout; a reference to a symbol no
 // GLOBL defines is recorded as an external relocation (Externals) with its
-// displacement left zero — the object-file emitters resolve it at link
+// displacement left zero, the object-file emitters resolve it at link
 // time, while the raw image (Bytes) cannot represent it.
 func AssembleFile(f *ast.File) (*Image, error) {
 	dataSyms, err := collectData(f)
@@ -144,7 +157,8 @@ func AssembleFile(f *ast.File) (*Image, error) {
 	}
 	link := &linkInfo{symbols: known, allowExternal: true}
 
-	img := &Image{Symbols: map[string]int{}}
+	img := &Image{Symbols: map[string]int{}, SourcePath: f.Path}
+	textOff := map[string]int{}
 	type asmFunc struct {
 		name    string
 		patches []sbPatch
@@ -182,6 +196,7 @@ func AssembleFile(f *ast.File) (*Image, error) {
 		for _, s := range steps {
 			fl.Spadj = append(fl.Spadj, SpadjStep{PC: s.pc, Value: s.value})
 		}
+		textOff[t.Name.Name] = len(img.Code)
 		img.Funcs = append(img.Funcs, fl)
 		img.Code = append(img.Code, code...)
 		funcs = append(funcs, asmFunc{name: t.Name.Name, patches: patches})
@@ -214,13 +229,27 @@ func AssembleFile(f *ast.File) (*Image, error) {
 		base := img.Funcs[i].Offset
 		code := img.Code[base : base+img.Funcs[i].Size]
 		for _, p := range fn.patches {
-			reloc := Reloc{Off: p.off, After: p.after, Name: p.name, Addend: p.addend}
+			reloc := Reloc{Off: p.off, After: p.after, Name: p.name, Addend: p.addend, Kind: p.kind}
+			if p.kind == RelTLSLE {
+				// The TLS slot has no symbol: the linker fills the offset
+				// from the runtime's TLS layout.
+				img.Funcs[i].Relocs = append(img.Funcs[i].Relocs, reloc)
+				continue
+			}
 			if imgOff, ok := img.Symbols[p.name]; ok {
 				rel := int64(imgOff) + p.addend - int64(base+p.after)
 				if rel < -1<<31 || rel >= 1<<31 {
 					return nil, fmt.Errorf("%s: displacement to %q out of rel32 range", fn.name, p.name)
 				}
 				copy(code[p.off:p.off+4], le32(rel))
+			} else if imgOff, ok := textOff[p.name]; ok {
+				// A CALL to a TEXT function of the same file: resolve the
+				// displacement against the function's layout position.
+				rel := int64(imgOff) + p.addend - int64(base+p.after)
+				if rel < -1<<31 || rel >= 1<<31 {
+					return nil, fmt.Errorf("%s: displacement to %q out of rel32 range", fn.name, p.name)
+				}
+				copy(code[p.off:p.off+4], le32(rel))
 			} else {
 				reloc.External = true
 				externals[p.name] = true
@@ -245,7 +274,7 @@ func AssembleFileRISCV(f *ast.File) (*Image, error) {
 		return nil, err
 	}
 
-	img := &Image{Symbols: map[string]int{}}
+	img := &Image{Symbols: map[string]int{}, SourcePath: f.Path}
 	for _, d := range f.Decls {
 		t, ok := d.(*ast.Text)
 		if !ok {
@@ -302,6 +331,7 @@ func AssembleFileRISCV(f *ast.File) (*Image, error) {
 		})
 	}
 
+	markExternals(img, dataSyms)
 	return img, nil
 }
 
@@ -316,7 +346,7 @@ func AssembleFileLOONG64(f *ast.File) (*Image, error) {
 		return nil, err
 	}
 
-	img := &Image{Symbols: map[string]int{}}
+	img := &Image{Symbols: map[string]int{}, SourcePath: f.Path}
 	for _, d := range f.Decls {
 		t, ok := d.(*ast.Text)
 		if !ok {
@@ -373,9 +403,38 @@ func AssembleFileLOONG64(f *ast.File) (*Image, error) {
 		})
 	}
 
+	markExternals(img, dataSyms)
 	return img, nil
 }
 
+// markExternals identifies relocations that reference symbols not defined in
+// the file (neither a GLOBL/DATA symbol nor a TEXT function) and records them
+// as external.  The non-amd64 architectures emit relocations for every SB
+// reference; this post-processing step distinguishes file-local from external.
+func markExternals(img *Image, dataSyms []dataSym) {
+	known := make(map[string]bool, len(dataSyms)+len(img.Funcs))
+	for _, d := range dataSyms {
+		known[d.name] = true
+	}
+	for _, fn := range img.Funcs {
+		known[fn.Name] = true
+	}
+	externals := map[string]bool{}
+	for i := range img.Funcs {
+		for j := range img.Funcs[i].Relocs {
+			r := &img.Funcs[i].Relocs[j]
+			if !known[r.Name] {
+				r.External = true
+				externals[r.Name] = true
+			}
+		}
+	}
+	for name := range externals {
+		img.Externals = append(img.Externals, name)
+	}
+	sort.Strings(img.Externals)
+}
+
 // dataSym is one GLOBL symbol and its DATA initialiser.
 type dataSym struct {
 	name   string
@@ -388,78 +447,90 @@ type dataSym struct {
 }
 
 // collectData gathers the file's static symbols (GLOBL) and their initial
-// contents (DATA) into byte buffers, in declaration order.
+// contents (DATA) into byte buffers.  Two passes: the Plan 9 convention puts
+// every DATA line before its symbol's GLOBL, so the symbols are registered
+// before the initialisers are applied.
 func collectData(f *ast.File) ([]dataSym, error) {
 	index := map[string]int{}
 	var syms []dataSym
 	for _, d := range f.Decls {
-		switch dd := d.(type) {
-		case *ast.Globl:
-			if dd.Name == nil || dd.Name.Pseudo != "SB" {
-				continue
-			}
-			name := dd.Name.Name
-			if _, dup := index[name]; dup {
-				return nil, fmt.Errorf("duplicate GLOBL %q", name)
-			}
-			size := 0
-			if dd.Size != nil && dd.Size.Imm.HasVal {
-				size = int(dd.Size.Imm.Val)
-			}
-			index[name] = len(syms)
-			ds := dataSym{
-				name:   name,
-				pkg:    dd.Name.Pkg,
-				buf:    make([]byte, size),
-				size:   size,
-				static: dd.Name.Static,
-			}
-			for _, f := range dd.Flags {
-				switch f {
-				case "RODATA":
-					ds.rodata = true
-				case "DUPOK":
-					ds.dupok = true
-				case "1":
-					ds.dupok = true
-				case "8":
-					ds.rodata = true
-				case "9":
-					ds.dupok = true
-					ds.rodata = true
+		gd, ok := d.(*ast.Globl)
+		if !ok {
+			continue
+		}
+		if gd.Name == nil || gd.Name.Pseudo != "SB" {
+			continue
+		}
+		name := gd.Name.Name
+		if _, dup := index[name]; dup {
+			return nil, fmt.Errorf("duplicate GLOBL %q", name)
+		}
+		size := 0
+		if gd.Size != nil && gd.Size.Imm.HasVal {
+			size = int(gd.Size.Imm.Val)
+		}
+		index[name] = len(syms)
+		ds := dataSym{
+			name:   name,
+			pkg:    gd.Name.Pkg,
+			buf:    make([]byte, size),
+			size:   size,
+			static: gd.Name.Static,
+		}
+		for _, f := range gd.Flags {
+			switch f {
+			case "RODATA":
+				ds.rodata = true
+			case "DUPOK":
+				ds.dupok = true
+			default:
+				// Legacy numeric flag constants (runtime/textflag.h):
+				// DUPOK is 2, RODATA is 8; combinations arrive as one
+				// number (e.g. 10 = RODATA|DUPOK).
+				if n, err := strconv.Atoi(f); err == nil {
+					if n&2 != 0 {
+						ds.dupok = true
+					}
+					if n&8 != 0 {
+						ds.rodata = true
+					}
 				}
 			}
-			syms = append(syms, ds)
-
-		case *ast.Data:
-			if dd.Name == nil || dd.Name.Pseudo != "SB" {
-				continue
-			}
-			i, ok := index[dd.Name.Name]
-			if !ok {
-				return nil, fmt.Errorf("DATA %q: no matching GLOBL", dd.Name.Name)
-			}
-			if dd.Value == nil || !dd.Value.Imm.HasVal {
-				return nil, fmt.Errorf("DATA %q: value must be an integer immediate", dd.Name.Name)
-			}
-			w := dd.Width
-			switch w {
-			case 1, 2, 4, 8:
-			default:
-				return nil, fmt.Errorf("DATA %q: invalid width %d (want 1, 2, 4 or 8)", dd.Name.Name, w)
-			}
-			off := dd.Name.Offset
-			buf := syms[i].buf
-			if off < 0 || off+int64(w) > int64(len(buf)) {
-				return nil, fmt.Errorf("DATA %q+%d/%d exceeds GLOBL size %d", dd.Name.Name, off, w, len(buf))
-			}
-			v := dd.Value.Imm.Val
-			if dd.Value.Imm.Neg {
-				v = -v
-			}
-			for j := 0; j < w; j++ {
-				buf[off+int64(j)] = byte(v >> (8 * j))
-			}
+		}
+		syms = append(syms, ds)
+	}
+	for _, d := range f.Decls {
+		dd, ok := d.(*ast.Data)
+		if !ok {
+			continue
+		}
+		if dd.Name == nil || dd.Name.Pseudo != "SB" {
+			continue
+		}
+		i, ok := index[dd.Name.Name]
+		if !ok {
+			return nil, fmt.Errorf("DATA %q: no matching GLOBL", dd.Name.Name)
+		}
+		if dd.Value == nil || !dd.Value.Imm.HasVal {
+			return nil, fmt.Errorf("DATA %q: value must be an integer immediate", dd.Name.Name)
+		}
+		w := dd.Width
+		switch w {
+		case 1, 2, 4, 8:
+		default:
+			return nil, fmt.Errorf("DATA %q: invalid width %d (want 1, 2, 4 or 8)", dd.Name.Name, w)
+		}
+		off := dd.Name.Offset
+		buf := syms[i].buf
+		if off < 0 || off+int64(w) > int64(len(buf)) {
+			return nil, fmt.Errorf("DATA %q+%d/%d exceeds GLOBL size %d", dd.Name.Name, off, w, len(buf))
+		}
+		v := dd.Value.Imm.Val
+		if dd.Value.Imm.Neg {
+			v = -v
+		}
+		for j := range w {
+			buf[off+int64(j)] = byte(v >> (8 * j))
 		}
 	}
 	return syms, nil

asm/link_test.go

@@ -10,8 +10,8 @@ import (
 	"sourcedock.dev/petrbalvin/gasm-devkit/parser"
 )
 
-// TestAssembleFileStaticData checks the whole-image layout — code, padding
-// and the data section — and that the RIP-relative displacements of static
+// TestAssembleFileStaticData checks the whole-image layout; code, padding
+// and the data section; and that the RIP-relative displacements of static
 // symbol loads resolve to the right bytes.
 func TestAssembleFileStaticData(t *testing.T) {
 	f, errs := parser.Parse("d_amd64.s", `
@@ -128,3 +128,41 @@ DATA x<>+0(SB)/4, $1
 		t.Errorf("single-function SB: error %v, want a file-level-assembly error", err)
 	}
 }
+
+// TestCollectDataNumericFlags pins the numeric GLOBL flag constants from
+// runtime/textflag.h: DUPOK is 2, RODATA is 8, and combinations arrive as
+// one number (9 = NOPROF|RODATA, 10 = RODATA|DUPOK).
+func TestCollectDataNumericFlags(t *testing.T) {
+	tests := []struct {
+		flags  string
+		rodata bool
+		dupok  bool
+	}{
+		{"2", false, true},
+		{"8", true, false},
+		{"9", true, false}, // NOPROF|RODATA, not DUPOK
+		{"10", true, true}, // RODATA|DUPOK
+		{"RODATA", true, false},
+		{"DUPOK", false, true},
+		{"RODATA|DUPOK", true, true},
+	}
+	for _, tt := range tests {
+		src := "TEXT \u00b7f(SB), NOSPLIT, $0\n\tRET\nGLOBL sym(SB), " + tt.flags + ", $8\n"
+		f, errs := parser.Parse("f_amd64.s", src)
+		if len(errs) > 0 {
+			t.Fatalf("parse %q: %v", tt.flags, errs)
+		}
+		img, err := AssembleFile(f)
+		if err != nil {
+			t.Fatalf("assemble %q: %v", tt.flags, err)
+		}
+		if len(img.DataSyms) != 1 {
+			t.Fatalf("%q: data syms = %d, want 1", tt.flags, len(img.DataSyms))
+		}
+		d := img.DataSyms[0]
+		if d.Rodata != tt.rodata || d.Dupok != tt.dupok {
+			t.Errorf("flags %q: rodata=%v dupok=%v, want rodata=%v dupok=%v",
+				tt.flags, d.Rodata, d.Dupok, tt.rodata, tt.dupok)
+		}
+	}
+}

asm/loong64_encode.go

@@ -9,7 +9,7 @@ package asm
 // an opcode constant, and the format selects the bit layout.  The opcode
 // constants and formats are transcribed from the Go toolchain's own loong64
 // backend (cmd/internal/obj/loong64), so the emitted bytes match `go tool asm`
-// exactly — the ground-truth oracle for the verify suite.
+// exactly, the ground-truth oracle for the verify suite.
 //
 // All LoongArch instructions are 32 bits, little-endian.  The formats used
 // here (per the LoongArch Volume I specification):
@@ -30,9 +30,14 @@ package asm
 // of the immediate and register fields), mirroring the toolchain's OP_*
 // helpers, so each l64* function only ORs its fields in.
 
+import (
+	"maps"
+	"strings"
+)
+
 // loong64RegNum returns the 5-bit register number for a LoongArch register
-// name: R0–R31 (integer), F0–F31 (floating point), FCC0–FCC7 (condition
-// flags), FCSR0–FCSR31 (control/status) and the ABI aliases the runtime's
+// name: R0-R31 (integer), F0-F31 (floating point), FCC0-FCC7 (condition
+// flags), FCSR0-FCSR31 (control/status) and the ABI aliases the runtime's
 // assembly uses.  Returns -1 for an unrecognised name.
 func loong64RegNum(name string) int {
 	switch name {
@@ -101,12 +106,17 @@ func loong64RegNum(name string) int {
 	case "R31", "S8":
 		return 31
 	}
-	// F0–F31, FCC0–FCC7, FCSR0–FCSR31.
+	// F0-F31, FCC0-FCC7, FCSR0-FCSR31.  The LSX/LASX vector banks (V0-V31,
+	// X0-X31) are deliberately NOT accepted here: they are a separate
+	// register class, and the toolchain rejects V/X names wherever an
+	// integer or FP register is expected (GOARCH=loong64 go tool asm reports
+	// "unrecognized instruction" for `BEQZ X0`).  Vector operands are
+	// resolved only through loong64VecRegNum.
 	if len(name) >= 4 && name[:4] == "FCSR" {
-		return loong64RegSpecial(name[4:], "FCSR", 31)
+		return loong64RegSpecial(name[4:], 31)
 	}
 	if len(name) >= 3 && name[:3] == "FCC" {
-		return loong64RegSpecial(name[3:], "FCC", 7)
+		return loong64RegSpecial(name[3:], 7)
 	}
 	if len(name) < 2 {
 		return -1
@@ -129,7 +139,7 @@ func loong64RegNum(name string) int {
 }
 
 // loong64RegSpecial parses a numbered FCC/FCSR register.
-func loong64RegSpecial(digits, prefix string, max int) int {
+func loong64RegSpecial(digits string, max int) int {
 	if digits == "" {
 		return -1
 	}
@@ -146,6 +156,19 @@ func loong64RegSpecial(digits, prefix string, max int) int {
 	return -1
 }
 
+// loong64VecRegNum resolves an LSX/LASX vector register name (V0-V31 or
+// X0-X31) to its 5-bit number, or -1.  The vector banks are a register class
+// of their own: the toolchain accepts them only in the vector operands of the
+// LSX/LASX instructions (GOARCH=loong64 go tool asm assembles `VADDV V0, V1,
+// V2` and `XVADDV X0, X1, X2`, and rejects `VADDV R4, R5, R6`), so the V/X
+// spellings never reach the integer/FP resolver.
+func loong64VecRegNum(name string) int {
+	if len(name) < 2 || (name[0] != 'V' && name[0] != 'X') {
+		return -1
+	}
+	return loong64RegSpecial(name[1:], 31)
+}
+
 // ---- format helpers ----
 
 // l64rrr encodes a 3R instruction: op | rk<<10 | rj<<5 | rd.
@@ -197,7 +220,9 @@ func l64rrrr(op uint32, r1, r2, r3, r4 int) uint32 {
 }
 
 // l64irir encodes a BSTRINS/BSTRPICK instruction: op | msb<<16 | rj<<5 | lsb<<10 | rd.
-// The msb/lsb fields are 6 bits wide (0–63) and are validated by the caller.
+// The msb/lsb fields are 6 bits wide and are inserted unmasked: the caller
+// must have validated them (0..31 for the .w forms, 0..63 for the .d forms,
+// lsb <= msb), the same rule the toolchain enforces as "illegal bit number".
 func l64irir(op uint32, msb, rj, lsb, rd int) uint32 {
 	return op | uint32(msb)<<16 | uint32(rj&0x1f)<<5 | uint32(lsb)<<10 | uint32(rd&0x1f)
 }
@@ -243,7 +268,7 @@ const (
 	l64Firr14                   // 2RI14 (ldptr/stptr)
 	l64Firr16                   // 2RI16 (addu16i.d)
 	l64Fir20                    // 2RI20 (lu12i.w, lu32i.d, pcalau12i, pcaddu12i)
-	l64Frrrr                    // 4R (fmadd/fmsub/fnmadd/fnmsub)
+	l64Frrrr                    // 4R (fmadd/fmsub/fnmadd/fnmsub, fsel)
 	l64Firir                    // bstrins/bstrpick
 	l64Firrr                    // alsl
 	l64Fi15                     // syscall/break/dbar
@@ -251,6 +276,8 @@ const (
 	l64Frdtime                  // rdtime (rd at bits [9:5], rj at bits [4:0])
 	l64Fshift                   // 2RI12 with a 5/6-bit shift immediate
 	l64Fpreld                   // preld (2RI12 + 5-bit hint)
+	l64Fvvv                     // 3R vector (LSX/LASX): op | vk<<10 | vj<<5 | vd
+	l64Fvcf                     // vector-to-condition: op | subop<<10 | vj<<5 | fcc
 )
 
 // l64Enc is one instruction's encoding: its bit layout (format) and the
@@ -273,12 +300,70 @@ type l64DualEnc struct {
 var l64DualTable = map[string]l64DualEnc{}
 
 // l64InstrTable maps LoongArch mnemonics (as the Go assembler spells them)
-// to their encoding.  SIMD (LSX/LASX: V*/XV*) instructions are not covered
-// yet; the base integer, memory and floating-point ISA is complete.
+// to their encoding.
 var l64InstrTable = map[string]l64Enc{}
 
+// l64Vec3Enc pairs a vector opcode with its register bank: false = LSX
+// (V0-V31), true = LASX (X0-X31).  The toolchain accepts one bank per
+// spelling: GOARCH=loong64 go tool asm assembles `VADDV V1, V2, V3` and
+// `XVADDV X1, X2, X3`, and rejects the crossed spellings.
+type l64Vec3Enc struct {
+	op   uint32
+	lasx bool
+}
+
+// l64VecImmEnc carries the immediate-form encoding of a vector mnemonic:
+// the opcode, the bank, the accepted immediate range, the bias the toolchain
+// adds (vsrai.b encodes imm+8) and the mask of the encoded field (vseqi.b
+// keeps a 5-bit two's-complement value, vseqi.d a 7-bit one).
+type l64VecImmEnc struct {
+	op       uint32
+	lasx     bool
+	min, max int
+	bias     int
+	mask     int
+}
+
+// l64VecBank marks the LSX/LASX mnemonics and records which register bank
+// each accepts; presence in the map routes the mnemonic through the vector
+// dispatcher rather than the integer/FP formats.
+var l64VecBank = map[string]bool{}
+
+// l64VecImmInfo mirrors l64VecImmTable for the dispatcher.
+var l64VecImmInfo = map[string]l64VecImmEnc{}
+
+// l64Vec2R marks the two-operand vector mnemonics (INSTR vj, vd, such as
+// vpcnt.v).
+var l64Vec2R = map[string]bool{}
+
+// l64VmovqOps holds the VMOVQ/XVMOVQ opcode constants (pre-shifted to bit
+// 15), read off `go tool objdump` of GOARCH=loong64 `go tool asm` kernels.
+type l64VmovqEnc struct {
+	ld, st, ldx, stx           uint32 // plain and indexed load/store
+	replB, replH, replW, replD uint32 // vldrepl: load and replicate element
+	pickS, pickU               uint32 // vpickve2gr.{,u} element extract
+	ins                        uint32 // vinsgr2vr element insert
+	dup                        uint32 // vreplgr2vr duplicate (width in [11:10])
+	move                       uint32 // vori.b/xvori.b $0 register move
+}
+
+var l64VmovqTable = map[bool]l64VmovqEnc{
+	false: { // VMOVQ, the LSX (V) bank
+		ld: 0x5800 << 15, st: 0x5880 << 15, ldx: 0x7080 << 15, stx: 0x7088 << 15,
+		replB: 0x6100 << 15, replH: 0x6080 << 15, replW: 0x6040 << 15, replD: 0x6020 << 15,
+		pickS: 0xE5DF << 15, pickU: 0xE5E7 << 15,
+		ins: 0xE5D7 << 15, dup: 0xE53E << 15, move: 0xE65A << 15,
+	},
+	true: { // XVMOVQ, the LASX (X) bank
+		ld: 0x5900 << 15, st: 0x5980 << 15, ldx: 0x7090 << 15, stx: 0x7098 << 15,
+		replB: 0x6500 << 15, replH: 0x6480 << 15, replW: 0x6440 << 15, replD: 0x6420 << 15,
+		pickS: 0xEDDF << 15, pickU: 0xEDE7 << 15,
+		ins: 0xEDD7 << 15, dup: 0xED3E << 15, move: 0xEE5A << 15,
+	},
+}
+
 func init() {
-	// 3R — integer.
+	// 3R, integer.
 	rrr := map[string]uint32{
 		"ADD": 0x20 << 15, "ADDW": 0x20 << 15, "ADDV": 0x21 << 15, "ADDVU": 0x21 << 15,
 		"SUB": 0x22 << 15, "SUBW": 0x22 << 15, "SUBV": 0x23 << 15, "SUBVU": 0x23 << 15,
@@ -298,7 +383,7 @@ func init() {
 		"CRCWBW": 0x48 << 15, "CRCWHW": 0x49 << 15, "CRCWWW": 0x4a << 15, "CRCWVW": 0x4b << 15,
 		"CRCCWBW": 0x4c << 15, "CRCCWHW": 0x4d << 15, "CRCCWWW": 0x4e << 15, "CRCCWVW": 0x4f << 15,
 	}
-	// 3R — floating point.
+	// 3R, floating point.
 	rrr["MULF"] = 0x209 << 15
 	rrr["MULD"] = 0x20a << 15
 	rrr["DIVF"] = 0x20d << 15
@@ -356,6 +441,10 @@ func init() {
 		"FTINTRZVF": 0x46a9 << 10, "FTINTRZVD": 0x46aa << 10,
 		"FTINTRNEWF": 0x46b1 << 10, "FTINTRNEWD": 0x46b2 << 10,
 		"FTINTRNEVF": 0x46b9 << 10, "FTINTRNEVD": 0x46ba << 10,
+		// LSX: convert a 64-bit integer lane to a double float.  The operand
+		// bank is the FP registers (the toolchain spells it `FFINTDV F0, F1`),
+		// so the entry stays on the 2R integer/FP format.
+		"FFINTDV": 0x474a << 10,
 	}
 	for m, op := range rr {
 		l64InstrTable[m] = l64Enc{format: l64Frr, op: op}
@@ -368,7 +457,7 @@ func init() {
 	// The dual-form arithmetic mnemonics (register 3R + immediate 2RI12),
 	// selected by the operand kind; the shift mnemonics pair the 3R form
 	// with a 5/6-bit shift immediate.
-	for m, e := range map[string]l64DualEnc{
+	maps.Copy(l64DualTable, map[string]l64DualEnc{
 		"ADD":   {rrr: 0x20 << 15, imm: 0x00a << 22},
 		"ADDW":  {rrr: 0x20 << 15, imm: 0x00a << 22},
 		"ADDV":  {rrr: 0x21 << 15, imm: 0x00b << 22},
@@ -386,16 +475,14 @@ func init() {
 		"SRLV":  {rrr: 0x32 << 15, imm: 0x0045 << 16, shift: true},
 		"SRAV":  {rrr: 0x33 << 15, imm: 0x0049 << 16, shift: true},
 		"ROTRV": {rrr: 0x37 << 15, imm: 0x004d << 16, shift: true},
-	} {
-		l64DualTable[m] = e
-	}
+	})
 
-	// 2RI12 — pure immediate arithmetic (LU52ID has no register form).
+	// 2RI12, pure immediate arithmetic (LU52ID has no register form).
 	l64InstrTable["LU52ID"] = l64Enc{format: l64Firr, op: 0x00c << 22}
 	// ADDV16 (addu16i.d): 2RI16 with the immediate shifted right by 16.
 	l64InstrTable["ADDV16"] = l64Enc{format: l64Firr16, op: 0x4 << 26}
 
-	// 2RI14 — LL/SC are aliased by the Go assembler to the pointer loads and
+	// 2RI14, LL/SC are aliased by the Go assembler to the pointer loads and
 	// stores (ldptr/stptr), with the offset scaled by 4.
 	l64InstrTable["MOVWP"] = l64Enc{format: l64Firr14, op: 0x25 << 24} // stptr.w
 	l64InstrTable["MOVVP"] = l64Enc{format: l64Firr14, op: 0x27 << 24} // stptr.d
@@ -414,18 +501,20 @@ func init() {
 	// LUI is the Plan 9 spelling of lu12i.w.
 	l64InstrTable["LUI"] = l64Enc{format: l64Fir20, op: 0x0a << 25}
 
-	// 4R — fused multiply-add.
+	// 4R, fused multiply-add, and FSEL (fsel.d: the first operand is a FCC
+	// condition flag, the layout matches the 4R shape).
 	rrrr := map[string]uint32{
 		"FMADDF": 0x81 << 20, "FMADDD": 0x82 << 20,
 		"FMSUBF": 0x85 << 20, "FMSUBD": 0x86 << 20,
 		"FNMADDF": 0x89 << 20, "FNMADDD": 0x8a << 20,
 		"FNMSUBF": 0x8d << 20, "FNMSUBD": 0x8e << 20,
+		"FSEL": 0x340 << 18,
 	}
 	for m, op := range rrrr {
 		l64InstrTable[m] = l64Enc{format: l64Frrrr, op: op}
 	}
 
-	// IRIR — bit-field insert/extract.
+	// IRIR, bit-field insert/extract.
 	irir := map[string]uint32{
 		"BSTRINSW":  0x3<<21 | 0x0<<15,
 		"BSTRINSV":  0x2 << 22,
@@ -436,7 +525,7 @@ func init() {
 		l64InstrTable[m] = l64Enc{format: l64Firir, op: op}
 	}
 
-	// 3RI2 — ALSL.
+	// 3RI2, ALSL.
 	irrr := map[string]uint32{
 		"ALSLW": 0x2 << 17, "ALSLWU": 0x3 << 17, "ALSLV": 0x16 << 17,
 	}
@@ -452,7 +541,11 @@ func init() {
 	// PRELD.
 	l64InstrTable["PRELD"] = l64Enc{format: l64Fpreld, op: 0x0ab << 22}
 
-	// Atomics — 3R with the AM field order (rk=value, rj=address, rd=result).
+	// Atomics, 3R with the AM field order (rk=value, rj=address, rd=result).
+	// The toolchain's form is three operands, `AMADDW rk, (rj), rd`
+	// (cmd/asm/internal/asm/testdata/loong64enc1.s and
+	// internal/runtime/atomic/atomic_loong64.s); the two-register spelling
+	// is rejected by the oracle.
 	am := map[string]uint32{
 		"AMSWAPB": 0x070B8 << 15, "AMSWAPH": 0x070B9 << 15,
 		"AMSWAPW": 0x070C0 << 15, "AMSWAPV": 0x070C1 << 15,
@@ -470,14 +563,88 @@ func init() {
 		"AMSWAPDBW": 0x070D2 << 15, "AMSWAPDBV": 0x070D3 << 15,
 		"AMCASDBB": 0x070B4 << 15, "AMCASDBH": 0x070B5 << 15,
 		"AMCASDBW": 0x070B6 << 15, "AMCASDBV": 0x070B7 << 15,
+		// The _dbar (acquire/release) add, and, or variants: opcodes read off
+		// `go tool objdump` of `AMADDDBW R14, (R13), R12` and friends.
+		"AMADDDBW": 0x070D4 << 15, "AMADDDBV": 0x070D5 << 15,
+		"AMANDDBW": 0x070D6 << 15, "AMANDDBV": 0x070D7 << 15,
+		"AMORDBW": 0x070D8 << 15, "AMORDBV": 0x070D9 << 15,
 	}
 	for m, op := range am {
 		l64InstrTable[m] = l64Enc{format: l64Fam, op: op}
 	}
+
+	// ---- LSX/LASX (V*/XV*) ----
+	// Every opcode below was read off `go tool objdump` of a GOARCH=loong64
+	// `go tool asm` kernel (the toolchain's own loong64enc1.s cross-checks
+	// most of them), not assumed from the LoongArch manual.
+
+	// Three vector registers: INSTR vk, vj, vd (or INSTR vk, vd with
+	// vj = vd).  l64Vec3Enc.lasx selects the register bank the toolchain
+	// accepts: LSX spellings take V0-V31, LASX spellings X0-X31.
+	vec3 := map[string]l64Vec3Enc{
+		"VADDW": {0xE016 << 15, false}, "VADDV": {0xE017 << 15, false},
+		"VANDV": {0xE24C << 15, false}, "VXORV": {0xE24E << 15, false},
+		"VSEQB": {0xE000 << 15, false}, "VSEQV": {0xE003 << 15, false},
+		"VSRAB": {0xE1D8 << 15, false}, "VROTRW": {0xE1DE << 15, false},
+		"XVADDV": {0xE817 << 15, true},
+		"XVANDV": {0xEA4C << 15, true}, "XVXORV": {0xEA4E << 15, true},
+		"XVSEQB": {0xE800 << 15, true}, "XVSEQV": {0xE803 << 15, true},
+	}
+	for m, e := range vec3 {
+		l64InstrTable[m] = l64Enc{format: l64Fvvv, op: e.op}
+		l64VecBank[m] = e.lasx
+	}
+
+	// Immediate forms: INSTR $imm, vj, vd (or INSTR $imm, vd).  The immediate
+	// range, bias and field mask are the ones the toolchain encodes: vandi.b
+	// stores the raw 8-bit constant, vsrai.b stores imm+8 (byte-lane bias),
+	// vseqi.b and vseqi.d store 5-bit and 7-bit two's-complement values.
+	// The mnemonics that also have a register form (VSEQB, VSEQV, VSRAB,
+	// VROTRW) keep their three-register entry in l64InstrTable; the
+	// dispatcher picks the immediate opcode from l64VecImmInfo by operand
+	// kind, so the immediate entries must not overwrite the table.
+	vecImm := map[string]l64VecImmEnc{
+		"VANDB":  {0xE7A0 << 15, false, 0, 255, 0, 0xFF},
+		"XVANDB": {0xEFA0 << 15, true, 0, 255, 0, 0xFF},
+		"VSEQB":  {0xE500 << 15, false, -16, 15, 0, 0x1F},
+		"XVSEQB": {0xE900 << 15, true, -16, 15, 0, 0x1F},
+		"VSEQV":  {0xE503 << 15, false, -64, 63, 0, 0x7F},
+		"XVSEQV": {0xE903 << 15, true, -64, 63, 0, 0x7F},
+		"VSRAB":  {0xE668 << 15, false, 0, 7, 8, 0x1F},
+		"VROTRW": {0xE541 << 15, false, 0, 31, 0, 0x1F},
+	}
+	for m, e := range vecImm {
+		l64VecImmInfo[m] = e
+		l64VecBank[m] = e.lasx
+	}
+
+	// Vector-to-condition flag: INSTR vj, FCCn (vsetnez.v, vsetanyeqz.*,
+	// vsetallnez.*): the sub-op rides in the rk field.
+	vecCf := map[string]uint32{
+		"VSETNEV": 0xE539<<15 | 7<<10, "XVSETNEV": 0xED39<<15 | 7<<10,
+		"VSETANYEQB": 0xE539<<15 | 8<<10, "XVSETANYEQB": 0xED39<<15 | 8<<10,
+		"VSETANYEQV": 0xE539<<15 | 11<<10, "XVSETANYEQV": 0xED39<<15 | 11<<10,
+		"VSETALLNEV": 0xE539<<15 | 15<<10, "XVSETALLNEV": 0xED39<<15 | 15<<10,
+	}
+	for m, op := range vecCf {
+		l64InstrTable[m] = l64Enc{format: l64Fvcf, op: op}
+		l64VecBank[m] = strings.HasPrefix(m, "XV")
+	}
+
+	// Lane popcount: INSTR vj, vd (the 2R layout with the opcode extending
+	// over the unused vk field).
+	vec2r := map[string]l64Vec3Enc{
+		"VPCNTV": {0x1CA70B << 10, false}, "XVPCNTV": {0x1DA70B << 10, true},
+	}
+	for m, e := range vec2r {
+		l64InstrTable[m] = l64Enc{format: l64Frr, op: e.op}
+		l64VecBank[m] = e.lasx
+		l64Vec2R[m] = true
+	}
 }
 
 // l64FpMovTable maps (mnemonic, from-class, to-class) to the 2R opcode of the
-// register move between the integer and floating-point register banks — the
+// register move between the integer and floating-point register banks, the
 // MOVW/MOVV specials the Go assembler accepts.
 var l64FpMovTable = map[string]uint32{
 	"MOVV.R.F":    0x452a << 10, // movgr2fr.d

asm/loong64_encode_test.go

@@ -263,6 +263,20 @@ func TestLOONG64_regNames(t *testing.T) {
 			t.Errorf("loong64RegNum(%q) = %d, want %d", name, got, want)
 		}
 	}
+	// The X/V spellings name the LSX/LASX vector banks, a register class of
+	// their own: the oracle (GOARCH=loong64 go tool asm) rejects `BEQZ X0`
+	// with "unrecognized instruction" while assembling `VADDV V0, V1, V2`
+	// and `XVADDV X0, X1, X2`, so loong64RegNum stays strict and the vector
+	// operands resolve through loong64VecRegNum only.
+	vecCases := map[string]int{
+		"V0": 0, "V31": 31, "X0": 0, "X31": 31,
+		"R4": -1, "F0": -1, "FCC0": -1, "V32": -1, "X32": -1, "V": -1, "X": -1,
+	}
+	for name, want := range vecCases {
+		if got := loong64VecRegNum(name); got != want {
+			t.Errorf("loong64VecRegNum(%q) = %d, want %d", name, got, want)
+		}
+	}
 }
 
 func TestLOONG64_bytesEqualGroundTruth(t *testing.T) {
@@ -291,3 +305,287 @@ done:
 		t.Errorf("code = % x\nwant % x", code, want)
 	}
 }
+
+// TestLOONG64IndirectBranch pins the indirect branch encodings: JMP (Rj) and
+// JAL (Rj) lower to jirl, and the raw JIRL spelling encodes the written
+// offset (the Go loong64 assembler deletes raw JIRL instructions entirely,
+// so this form is a gasm-only superset with faithful semantics).
+func TestLOONG64IndirectBranch(t *testing.T) {
+	fn := firstTextLOONG64(t, `#include "textflag.h"
+TEXT ·f(SB), NOSPLIT, $0-0
+	JMP (R4)
+	JIRL R0, R4, 8
+	RET
+`)
+	code := assembleLOONG64Helper(t, fn)
+	wantWords(t, code,
+		0x4C000080, // jirl r0, r4, 0
+		0x4C002080, // jirl r0, r4, 8
+		0x4C000020, // jirl r0, r1, 0 (RET)
+	)
+
+	// JAL (R5) links, so the toolchain gives the function its autosize-8
+	// prologue and epilogue around the call and the closing RET.
+	fn = firstTextLOONG64(t, `#include "textflag.h"
+TEXT ·f(SB), NOSPLIT, $0-0
+	JAL (R5)
+	RET
+`)
+	code = assembleLOONG64Helper(t, fn)
+	wantWords(t, code,
+		0x29FFE061, // st.d r1, -8(r3) (prologue saves RA below the new SP)
+		0x02FFE063, // addi.d r3, r3, -8 (prologue opens the frame)
+		0x29C00061, // st.d r1, 0(r3) (prologue saves RA at SP)
+		0x4C0000A1, // jirl r1, r5, 0
+		0x28C00061, // ld.d r1, 0(r3) (epilogue restores RA)
+		0x02C02063, // addi.d r3, r3, 8
+		0x4C000020, // jirl r0, r1, 0 (RET)
+	)
+}
+
+// TestLOONG64_vector pins the LSX/LASX slice against words read off
+// GOARCH=loong64 go tool asm (cross-checked against the toolchain's own
+// loong64enc1.s): the three-register forms, the immediate forms with their
+// biases, the vector-to-condition forms, lane popcount, the FP conversion,
+// FSEL and the VMOVQ move family.
+func TestLOONG64_vector(t *testing.T) {
+	t.Run("three-register and immediate forms", func(t *testing.T) {
+		fn := firstTextLOONG64(t, `#include "textflag.h"
+TEXT ·v(SB), NOSPLIT, $0
+	VADDV V1, V2, V3
+	VADDW V1, V2, V3
+	VADDV V2, V1
+	VANDV V1, V2
+	VXORV V1, V2, V3
+	VSEQB V1, V2, V3
+	VSEQV V1, V2, V3
+	VSRAB V1, V2, V3
+	VROTRW V1, V2, V3
+	VANDB $0, V2, V3
+	VANDB $255, V2
+	VSEQB $3, V2, V3
+	VSEQV $15, V2, V3
+	VSEQV $-15, V2, V3
+	VSRAB $7, V1, V2
+	VROTRW $16, V1, V2
+	VPCNTV V1, V2
+	XVADDV X1, X2, X3
+	XVXORV X1, X2, X3
+	XVSEQB X1, X2, X3
+	XVPCNTV X1, X2
+	RET
+`)
+		code := assembleLOONG64Helper(t, fn)
+		wantWords(t, code,
+			0x700B8443, // vadd.v v3, v2, v1
+			0x700B0443, // vadd.w
+			0x700B8821, // vadd.v v1, v1, v2 (two-operand form)
+			0x71260442, // vand.v v2, v2, v1
+			0x71270443, // vxor.v
+			0x70000443, // vseq.b
+			0x70018443, // vseq.d
+			0x70EC0443, // vsra.b
+			0x70EF0443, // vrotr.w
+			0x73D00043, // vandi.b v3, v2, 0
+			0x73D3FC42, // vandi.b v2, v2, 255 (two-operand form)
+			0x72800C43, // vseqi.b v3, v2, 3
+			0x7281BC43, // vseqi.d v3, v2, 15
+			0x7281C443, // vseqi.d v3, v2, -15 (7-bit two's complement)
+			0x73343C22, // vsrai.b v2, v1, 7 (encoded as 7+8)
+			0x72A0C022, // vrotri.w v2, v1, 16
+			0x729C2C22, // vpcnt.d v2, v1
+			0x740B8443, // xvadd.d x3, x2, x1
+			0x75270443, // xvxor.d
+			0x74000443, // xvseq.b
+			0x769C2C22, // xvpcnt.d x2, x1
+			0x4C000020,
+		)
+	})
+
+	t.Run("vector-to-condition", func(t *testing.T) {
+		fn := firstTextLOONG64(t, `#include "textflag.h"
+TEXT ·v(SB), NOSPLIT, $0
+	VSETNEV V1, FCC0
+	VSETANYEQB V1, FCC0
+	VSETANYEQV V2, FCC0
+	VSETALLNEV V0, FCC0
+	XVSETNEV X1, FCC0
+	XVSETALLNEV X1, FCC0
+	RET
+`)
+		code := assembleLOONG64Helper(t, fn)
+		wantWords(t, code,
+			0x729C9C20, // vsetnez.d fcc0, v1
+			0x729CA020, // vsetanyeqz.b
+			0x729CAC40, // vsetanyeqz.d
+			0x729CBC00, // vsetallnez.d
+			0x769C9C20, // xvsetnez.d
+			0x769CBC20, // xvsetallnez.d
+			0x4C000020,
+		)
+	})
+
+	t.Run("FP convert and FSEL", func(t *testing.T) {
+		fn := firstTextLOONG64(t, `#include "textflag.h"
+TEXT ·v(SB), NOSPLIT, $0
+	FFINTDV F0, F1
+	FSEL FCC0, F3, F4, F3
+	FSEL FCC1, F1, F2
+	RET
+`)
+		code := assembleLOONG64Helper(t, fn)
+		wantWords(t, code,
+			0x011D2801, // ffint.d.v f1, f0
+			0x0D000C83, // fsel f3, f4, f3, fcc0
+			0x0D008442, // fsel f2, f2, f1, fcc1
+			0x4C000020,
+		)
+	})
+
+	t.Run("VMOVQ move family", func(t *testing.T) {
+		fn := firstTextLOONG64(t, `#include "textflag.h"
+TEXT ·v(SB), NOSPLIT, $0
+	VMOVQ V1, V9
+	VMOVQ (R4), V2
+	VMOVQ 16(R4), V2
+	VMOVQ V0, (R4)
+	VMOVQ V0, 32(R4)
+	VMOVQ (R4)(R7), V3
+	VMOVQ V3, (R4)(R7)
+	VMOVQ R6, V0.B16
+	VMOVQ R6, V12.W4
+	VMOVQ (R4), V4.W4
+	XVMOVQ X3, X7
+	XVMOVQ (R4), X2
+	XVMOVQ X0, (R4)
+	XVMOVQ (R4)(R7), X4
+	XVMOVQ X0, (R4)(R7)
+	XVMOVQ R6, X0.B32
+	RET
+`)
+		code := assembleLOONG64Helper(t, fn)
+		wantWords(t, code,
+			0x732D0029, // vori.b v9, v1, 0 (register move)
+			0x2C000082, // vld v2, r4, 0
+			0x2C004082, // vld v2, r4, 16
+			0x2C400080, // vst v0, r4, 0
+			0x2C408080, // vst v0, r4, 32
+			0x38401C83, // vldx v3, r4, r7
+			0x38441C83, // vstx v3, r4, r7
+			0x729F00C0, // vreplgr2vr.b v0, r6
+			0x729F08CC, // vreplgr2vr.w v12, r6
+			0x30200084, // vldrepl.w v4, r4, 0
+			0x772D0067, // xvori.b x7, x3, 0
+			0x2C800082, // xvld x2, r4, 0
+			0x2CC00080, // xvst x0, r4, 0
+			0x38481C84, // xvldx x4, r4, r7
+			0x384C1C80, // xvstx x0, r4, r7
+			0x769F00C0, // xvreplgr2vr.b x0, r6
+			0x4C000020,
+		)
+	})
+
+	t.Run("element extract and insert", func(t *testing.T) {
+		fn := firstTextLOONG64(t, `#include "textflag.h"
+TEXT ·v(SB), NOSPLIT, $0
+	VMOVQ V0.V[0], R10
+	VMOVQ V6.V[1], R8
+	VMOVQ R9, V1.V[0]
+	XVMOVQ X0.V[0], R10
+	XVMOVQ X5.W[7], R7
+	XVMOVQ R4, X7.V[3]
+	RET
+`)
+		code := assembleLOONG64Helper(t, fn)
+		wantWords(t, code,
+			0x72EFF00A, // vpickve2gr.d r10, v0, 0
+			0x72EFF4C8, // vpickve2gr.d r8, v6, 1
+			0x72EBF121, // vinsgr2vr.d v1, r9, 0
+			0x76EFE00A, // xvpickve2gr.d r10, x0, 0
+			0x76EFDCA7, // xvpickve2gr.w r7, x5, 7
+			0x76EBEC87, // xvinsgr2vr.d x7, r4, 3
+			0x4C000020,
+		)
+	})
+}
+
+// TestLOONG64_vectorErrors pins the register-class and range diagnostics of
+// the vector slice; each shape is rejected by the oracle as well
+// (GOARCH=loong64 go tool asm).
+func TestLOONG64_vectorErrors(t *testing.T) {
+	cases := []string{
+		// Integer registers in vector positions.
+		`TEXT ·e(SB), NOSPLIT, $0
+	VADDV R4, R5, R6
+	RET
+`,
+		// Crossed banks: LSX spellings take V, LASX spellings X.
+		`TEXT ·e(SB), NOSPLIT, $0
+	VADDV X1, X2, X3
+	RET
+`,
+		`TEXT ·e(SB), NOSPLIT, $0
+	XVADDV V1, V2, V3
+	RET
+`,
+		// The LASX bank has no .b/.h element forms.
+		`TEXT ·e(SB), NOSPLIT, $0
+	XVMOVQ R4, X2.B[0]
+	RET
+`,
+		// Immediate ranges.
+		`TEXT ·e(SB), NOSPLIT, $0
+	VANDB $256, V2
+	RET
+`,
+		`TEXT ·e(SB), NOSPLIT, $0
+	VSEQB $16, V2, V3
+	RET
+`,
+		`TEXT ·e(SB), NOSPLIT, $0
+	VROTRW $32, V1, V2
+	RET
+`,
+		// VSET* wants an FCC flag, not a vector register.
+		`TEXT ·e(SB), NOSPLIT, $0
+	VSETNEV V1, V2
+	RET
+`,
+	}
+	for i, src := range cases {
+		fn := firstTextLOONG64(t, src)
+		if _, _, _, _, _, err := assembleLOONG64(fn); err == nil {
+			t.Errorf("case %d: expected an error, got none", i)
+		}
+	}
+}
+
+// TestLOONG64_dbarAtomics pins the _dbar (acquire/release) AMO variants.
+// The oracle words come from GOARCH=loong64 go tool objdump of kernels
+// assembled with go tool asm, and match the toolchain's loong64enc1.s.
+func TestLOONG64_dbarAtomics(t *testing.T) {
+	fn := firstTextLOONG64(t, `#include "textflag.h"
+TEXT ·atoms(SB), NOSPLIT, $0
+	AMADDDBW R14, (R13), R12
+	AMADDDBV R14, (R13), R12
+	AMANDDBW R5, (R4), R6
+	AMANDDBV R5, (R4), R6
+	AMORDBW R5, (R4), R0
+	AMORDBV R5, (R4), R6
+	AMSWAPDBW R5, (R4), R6
+	AMCASDBV R6, (R4), R5
+	RET
+`)
+	code := assembleLOONG64Helper(t, fn)
+	wantWords(t, code,
+		0x386A39AC, // amadd_db.w r12, r13, r14
+		0x386AB9AC, // amadd_db.d
+		0x386B1486, // amand_db.w r6, r4, r5
+		0x386B9486, // amand_db.d
+		0x386C1480, // amor_db.w r0, r4, r5
+		0x386C9486, // amor_db.d
+		0x38691486, // amswap_db.w
+		0x385B9885, // amcas_db.w
+		0x4C000020,
+	)
+}

asm/loong64_frame.go

@@ -20,14 +20,20 @@ import (
 // (the toolchain aligns frames with `if autosize&4 != 0 { autosize += 4 }`).
 // A leaf function (no calls) with a zero frame gets no prologue at all.
 //
-// Prologue (autosize > 0), byte-identical to the toolchain:
+// Prologue (autosize > 0, small), byte-identical to the toolchain:
 //
 //	MOVV R1, -autosize(R3)   // save LR below the new SP (traceback-safe)
 //	ADDV $-autosize, R3      // open the frame
 //	MOVV R1, 0(R3)           // save LR again at SP (signal-safety)
 //
+// Large frames (autosize past the 12-bit offset or immediate ranges) expand
+// the store and the adjust through REGTMP (R30) exactly as the toolchain's
+// assembler does: the store via the rounding LU12IW split, the adjust via
+// the floor LU12IW/ORI split.
+//
 // Epilogue: MOVV 0(R3), R1; ADDV $autosize, R3 (non-leaf only for the LR
-// restore); the RET's jirl r0, r1, 0 follows.
+// restore; the adjust materialised when the immediate does not fit); the
+// RET's jirl r0, r1, 0 follows.
 
 // loong64FrameInfo holds the frame layout derived from a TEXT directive.
 type loong64FrameInfo struct {
@@ -36,6 +42,11 @@ type loong64FrameInfo struct {
 	args     int  // the declared -argsize
 	noSplit  bool // the NOSPLIT flag
 	leaf     bool // no call instructions in the body
+
+	// Stack-split guard state: like amd64 and arm64, a leaf function with a
+	// small autosize is auto-marked NOSPLIT by the toolchain.
+	needSplit  bool
+	splitClass int // 0: <=StackSmall, 1: <=StackBig, 2: >StackBig
 }
 
 // loong64ComputeFrame derives the frame layout for a TEXT function.
@@ -59,9 +70,157 @@ func loong64ComputeFrame(t *ast.Text) loong64FrameInfo {
 		// A zero-frame non-leaf function still opens an 8-byte frame for LR.
 		fi.autosize = 8
 	}
+	switch {
+	case fi.noSplit:
+	case fi.autosize < stackSmall && fi.leaf:
+		// Auto-NOSPLIT, as the toolchain's leaf mark concludes.
+	default:
+		fi.needSplit = true
+		switch {
+		case fi.autosize <= stackSmall:
+			fi.splitClass = 0
+		case fi.autosize <= stackBig:
+			fi.splitClass = 1
+		default:
+			fi.splitClass = 2
+		}
+	}
 	return fi
 }
 
+// loong64GuardLen returns the byte length of the stack-split guard prefix
+// (zero when the function needs no guard).  The big class materialises two
+// constants through R30; each materialisation shrinks by one word when the
+// constant's low 12 bits are zero.
+func loong64GuardLen(fi loong64FrameInfo) int {
+	if !fi.needSplit {
+		return 0
+	}
+	off := int64(fi.autosize - stackSmall)
+	switch fi.splitClass {
+	case 0:
+		return 12
+	case 1:
+		if off <= 2048 {
+			return 16 // ADDV $-off fits the signed 12-bit immediate
+		}
+		return 24 // MOVV + LU12IW + ORI + ADDV + SGTU + BEQ
+	default:
+		// MOVV + [mat] + SGTU + BNE + [mat] + ADDV + SGTU + BEQ
+		return (6 + loong64MatLen(off) + loong64MatLen(-off)) * 4
+	}
+}
+
+// loong64MatLen reports the word count of materialising v in R30: a value
+// with a zero high part needs only the ORI (the toolchain's MOVW $v, R30),
+// one with a zero low part only the LU12IW.
+func loong64MatLen(v int64) int {
+	if v>>12 == 0 || v&0xFFF == 0 {
+		return 1
+	}
+	return 2
+}
+
+// loong64MatWords appends the words that materialise v in R30, splitting it
+// as v>>12 plus the zero-extended low 12 bits.
+func loong64MatWords(ws []uint32, v int64) []uint32 {
+	hi := v >> 12
+	lo := v & 0xFFF
+	if hi == 0 {
+		return append(ws, l64irr(l64OriOp, int(v), 0, 30))
+	}
+	ws = append(ws, l64ir(l64Lu12iwOp, int(hi), 30))
+	if lo != 0 {
+		ws = append(ws, l64irr(l64OriOp, int(lo), 30, 30))
+	}
+	return ws
+}
+
+// The LU12IW and ORI opcode bases (2RI20 and 2RI12 formats); the ORI reads
+// and writes rd itself.
+const (
+	l64Lu12iwOp = 0x0a << 25
+	l64OriOp    = 0x0e << 22
+)
+
+// loong64Imm12 reports whether v fits a signed 12-bit immediate.
+func loong64Imm12(v int64) bool { return v >= -2048 && v <= 2047 }
+
+// loong64GuardBytes emits the stack-split guard prefix.  blockStart is the
+// function-relative address of the morestack call at the end of the function;
+// branch displacements are in instructions and are computed from each
+// branch's own position.
+func loong64GuardBytes(fi loong64FrameInfo, blockStart int) []byte {
+	// MOVV 16(g), R20 (g.stackguard0), g = R22.
+	ws := []uint32{l64irr(l64loadStoreTable["MOVV"].ld, 16, 22, 20)}
+	off := int64(fi.autosize - stackSmall)
+	// beq appends BEQ R20, blockStart from the branch's own position.
+	beq := func() {
+		ws = append(ws, loong64Beqz(20, int32((blockStart-len(ws)*4)>>2)))
+	}
+	switch fi.splitClass {
+	case 0:
+		// SGTU SP, R20, R20; BEQ R20, more
+		ws = append(ws, l64rrr(l64DualTable["SGTU"].rrr, 3, 20, 20))
+		beq()
+	case 1:
+		ws = append(ws, loong64MediumWords(off)...)
+		ws = append(ws, l64rrr(l64DualTable["SGTU"].rrr, 24, 20, 20))
+		beq()
+	default:
+		// SGTU $off, SP, R24 catches the SP underflow a huge frame would
+		// cause; BNE jumps to morestack in that case.
+		ws = append(ws, loong64MatWords(nil, off)...)
+		ws = append(ws, l64rrr(l64DualTable["SGTU"].rrr, 30, 3, 24))
+		ws = append(ws, loong64Bnez(24, int32((blockStart-len(ws)*4)>>2)))
+		ws = append(ws, loong64MatWords(nil, -off)...)
+		ws = append(ws, l64rrr(l64DualTable["ADDV"].rrr, 30, 3, 24))
+		ws = append(ws, l64rrr(l64DualTable["SGTU"].rrr, 24, 20, 20))
+		beq()
+	}
+	return l64WordsLE(ws...)
+}
+
+// loong64MediumWords emits the medium-class stack check for offset off: the
+// ADDV immediate when it fits, otherwise the same sequence with the constant
+// materialised in R30.
+func loong64MediumWords(off int64) []uint32 {
+	if off <= 2048 {
+		return []uint32{l64irr(l64DualTable["ADDV"].imm, int(-off), 3, 24)}
+	}
+	ws := loong64MatWords(nil, -off)
+	return append(ws, l64rrr(l64DualTable["ADDV"].rrr, 30, 3, 24))
+}
+
+// loong64Beqz/loong64Bnez build the 21-bit conditional branches against R0
+// that the toolchain emits for its guard compares.
+func loong64Beqz(rj int, dispInstr int32) uint32 {
+	return l64ir21(l64branch21Table["BEQZ"], int(dispInstr), rj)
+}
+
+func loong64Bnez(rj int, dispInstr int32) uint32 {
+	return l64ir21(l64branch21Table["BNEZ"], int(dispInstr), rj)
+}
+
+// loong64MoreStackBlock emits the trailing block: MOVV R1, R31 (save LR, the
+// toolchain's OR R1, R0, R31 expansion), BL runtime.morestack_noctxt, B back
+// to the function entry.
+func loong64MoreStackBlock(blockStart int) ([]byte, Reloc) {
+	ws := []uint32{
+		l64rrr(l64DualTable["OR"].rrr, 0, 1, 31), // MOVV R1, R31 (OR R1, R0, R31)
+		l64bbl(l64jumpTable["BL"], 0),            // BL, patched by the linker
+	}
+	disp := (-(blockStart + 8)) >> 2
+	ws = append(ws, l64bbl(l64jumpTable["B"], int(disp)))
+	reloc := Reloc{
+		Off:   blockStart + 4,
+		After: blockStart + 8,
+		Name:  "runtime\u00b7morestack_noctxt",
+		Kind:  RelLoong64Branch,
+	}
+	return l64WordsLE(ws...), reloc
+}
+
 // loong64IsLeaf reports whether a function contains no call instructions
 // (JAL/BL/CALL), matching the toolchain's LEAF mark, which drives the frame
 // and the epilogue shape.
@@ -79,17 +238,37 @@ func loong64IsLeaf(t *ast.Text) bool {
 	return true
 }
 
-// loong64Prologue returns the prologue bytes for a loong64 function.
+// loong64Prologue returns the prologue bytes for a loong64 function.  When
+// the LR store offset leaves the toolchain's 12-bit store range ([-2046,
+// 2045], BIG_12 = 2046) or the SP adjust immediate its 12-bit immediate
+// range, each switches to the R30 materialisation the assembler expands it
+// to: the store uses the rounding %hi/%lo split (LU12IW of (v+2048)>>12,
+// REGTMP += SP, store at the raw offset), the adjust the floor split
+// (LU12IW, ORI when the low part is non-zero, REGTMP += SP).
 func loong64Prologue(fi loong64FrameInfo) []byte {
 	if fi.autosize == 0 {
 		return nil
 	}
 	addiD := l64DualTable["ADDV"].imm
-	return l64WordsLE(
-		l64irr(l64loadStoreTable["MOVV"].st, -fi.autosize, 3, 1), // MOVV R1, -autosize(R3)
-		l64irr(addiD, -fi.autosize, 3, 3),                        // ADDV $-autosize, R3
-		l64irr(l64loadStoreTable["MOVV"].st, 0, 3, 1),            // MOVV R1, 0(R3)
-	)
+	var ws []uint32
+	storeBase := 3
+	if fi.autosize > 2046 {
+		// The store goes through REGTMP: LU12IW of the rounding split,
+		// REGTMP += SP, then the store at REGTMP with the truncated offset.
+		v := -int64(fi.autosize)
+		ws = append(ws, l64ir(l64Lu12iwOp, int((v+2048)>>12), 30))
+		ws = append(ws, l64rrr(l64DualTable["ADDV"].rrr, 3, 30, 30))
+		storeBase = 30
+	}
+	ws = append(ws, l64irr(l64loadStoreTable["MOVV"].st, -fi.autosize, storeBase, 1)) // MOVV R1, -autosize(base)
+	if loong64Imm12(-int64(fi.autosize)) {
+		ws = append(ws, l64irr(addiD, -fi.autosize, 3, 3)) // ADDV $-autosize, R3
+	} else {
+		ws = append(ws, loong64MatWords(nil, -int64(fi.autosize))...)
+		ws = append(ws, l64rrr(l64DualTable["ADDV"].rrr, 30, 3, 3))
+	}
+	ws = append(ws, l64irr(l64loadStoreTable["MOVV"].st, 0, 3, 1)) // MOVV R1, 0(R3)
+	return l64WordsLE(ws...)
 }
 
 // loong64Return returns the bytes for a RET: the epilogue (restore LR and
@@ -98,17 +277,49 @@ func loong64Return(fi loong64FrameInfo) []byte {
 	var ws []uint32
 	if fi.autosize != 0 {
 		if !fi.leaf {
-			// MOVV 0(R3), R1 — restore the link register.
+			// MOVV 0(R3), R1, restore the link register.
 			ws = append(ws, l64irr(l64loadStoreTable["MOVV"].ld, 0, 3, 1))
 		}
-		// ADDV $autosize, R3 — close the frame.
-		ws = append(ws, l64irr(l64DualTable["ADDV"].imm, fi.autosize, 3, 3))
+		// ADDV $autosize, R3, close the frame (materialised when the
+		// immediate does not fit).
+		if loong64Imm12(int64(fi.autosize)) {
+			ws = append(ws, l64irr(l64DualTable["ADDV"].imm, fi.autosize, 3, 3))
+		} else {
+			ws = append(ws, loong64MatWords(nil, int64(fi.autosize))...)
+			ws = append(ws, l64rrr(l64DualTable["ADDV"].rrr, 30, 3, 3))
+		}
 	}
-	// jirl r0, r1, 0 — return.
+	// jirl r0, r1, 0, return.
 	ws = append(ws, l64irr16(l64branchTable["JIRL"], 0, 1, 0))
 	return l64WordsLE(ws...)
 }
 
+// loong64StoreWords reports the prologue word count of the LR store, and
+// loong64AdjustWords the word count of an SP adjust of v: the immediate
+// forms when they fit, otherwise the R30 materialisation sequences.
+func loong64StoreWords(autosize int) int {
+	if autosize > 2046 {
+		return 3
+	}
+	return 1
+}
+
+func loong64AdjustWords(v int64) int {
+	if loong64Imm12(v) {
+		return 1
+	}
+	return loong64MatLen(v) + 1
+}
+
+// loong64EpilogueWords reports the epilogue word count the RET expands to.
+func loong64EpilogueWords(fi loong64FrameInfo) int {
+	n := loong64AdjustWords(int64(fi.autosize))
+	if !fi.leaf {
+		n++
+	}
+	return n
+}
+
 // loong64ResolvePseudo translates a pseudo-register memory reference into a
 // hardware base register and offset.  x+N(FP) → (N + autosize + 8)(SP);
 // x-N(SP) → (autosize - N)(SP).  Returns base = -1 for an unresolvable

asm/loong64_more_test.go

@@ -232,7 +232,10 @@ DATA ·table+0(SB)/8, $42
 }
 
 // TestLOONG64_errors checks the encoder's error paths: undefined labels,
-// invalid register operands and operand-count mismatches.
+// invalid register operands and operand-count mismatches.  The X0 and
+// AMADDW cases follow the oracle: GOARCH=loong64 go tool asm rejects
+// `BEQZ X0` (the X bank is not an integer register) and the two-register
+// `AMADDW R4, R5` (the AM* family is strictly `val, (addr), result`).
 func TestLOONG64_errors(t *testing.T) {
 	cases := []string{
 		`TEXT ·e(SB), NOSPLIT, $0
@@ -280,7 +283,7 @@ done:
 // TestLOONG64_pcsp checks the stack-adjustment table of a framed function:
 // the prologue raises the SP delta by autosize (in effect from the third
 // instruction) and the RET's epilogue restores it to zero, with the pc deltas
-// in MinLC (4) units — byte-identical to `go tool asm`.
+// in MinLC (4) units; byte-identical to `go tool asm`.
 func TestLOONG64_pcsp(t *testing.T) {
 	cases := []struct {
 		name string
@@ -347,21 +350,94 @@ TEXT ·sb(SB), NOSPLIT, $0
 	}
 }
 
-// TestLOONG64_movImmToFp checks the immediate-to-FP move forms.
+// TestLOONG64_movImmToFp checks the immediate-to-FP move: MOVW $c, Fd is the
+// only spelling the toolchain accepts, expanding to ori (or addi.w for the
+// negative span) into R30 plus movgr2fr.w.  The pinned words are the
+// toolchain's own bytes; the other widths and out-of-range constants are
+// illegal combinations there and are diagnosed here.
 func TestLOONG64_movImmToFp(t *testing.T) {
 	fn := firstTextLOONG64(t, `#include "textflag.h"
 TEXT ·fpmov(SB), NOSPLIT, $0
-	MOVV $0x1, F0
+	MOVW $0x1, F0
 	MOVW $0x2, F4
+	MOVW $-1, F4
 	RET
 `)
 	code := assembleLOONG64Helper(t, fn)
 	want := []byte{
-		0x00, 0x04, 0x80, 0x03, // ori f0, r0, 1
-		0x04, 0x08, 0x80, 0x03, // ori f4, r0, 2
+		0x1e, 0x04, 0x80, 0x03, // ori r30, r0, 1
+		0xc0, 0xa7, 0x14, 0x01, // movgr2fr.w f0, r30
+		0x1e, 0x08, 0x80, 0x03, // ori r30, r0, 2
+		0xc4, 0xa7, 0x14, 0x01, // movgr2fr.w f4, r30
+		0x1e, 0xfc, 0xbf, 0x02, // addi.w r30, r0, -1
+		0xc4, 0xa7, 0x14, 0x01, // movgr2fr.w f4, r30
 		0x20, 0x00, 0x00, 0x4c, // jirl r0, r1, 0
 	}
 	if !bytes.Equal(code, want) {
 		t.Errorf("code = % x\nwant % x", code, want)
 	}
 }
+
+// TestLOONG64_movImmToFpErrors checks the immediate-to-FP diagnostics: the
+// widths the toolchain rejects as illegal combinations, and constants beyond
+// the 12-bit ori/addi.w span (the toolchain never materialises a wider
+// constant on this path).
+func TestLOONG64_movImmToFpErrors(t *testing.T) {
+	cases := []string{
+		"MOVV $1, F0",
+		"MOVF $2, F4",
+		"MOVD $2, F4",
+		"MOVW $100000, F1",
+		"MOVW $-2049, F1",
+		"MOVW $4096, F1",
+	}
+	for _, src := range cases {
+		fn := firstTextLOONG64(t, "#include \"textflag.h\"\nTEXT ·e(SB), NOSPLIT, $0\n\t"+src+"\n\tRET\n")
+		if _, _, _, _, _, err := assembleLOONG64(fn); err == nil {
+			t.Errorf("%s: expected an error, got none", src)
+		}
+	}
+}
+
+// TestLOONG64_branch16Unsigned pins the unsigned two-operand branches: with
+// one register BLTU/BGEU keep the register-register form against R0 (never
+// taken), the toolchain's encoding, where a beqz would test the wrong
+// condition; the three-operand forms are unchanged.
+func TestLOONG64_branch16Unsigned(t *testing.T) {
+	fn := firstTextLOONG64(t, `#include "textflag.h"
+TEXT ·u(SB), NOSPLIT, $0
+	BLTU R4, done
+	BGEU R5, done
+	BLTU R6, R7, done
+	BGEU R8, R9, done
+done:
+	RET
+`)
+	code := assembleLOONG64Helper(t, fn)
+	wantWords(t, code,
+		0x68001080, // bltu r4, r0, +4
+		0x6C000CA0, // bgeu r5, r0, +3
+		0x680008C7, // bltu r6, r7, +2
+		0x6C000509, // bgeu r8, r9, +1
+		0x4C000020, // jirl r0, r1, 0
+	)
+}
+
+// TestLOONG64_bitFieldRange checks the BSTRINS/BSTRPICK bit-number
+// validation, mirroring the toolchain's "illegal bit number" rule: 0..31 for
+// the .w forms, 0..63 for the .d forms, and lsb <= msb.
+func TestLOONG64_bitFieldRange(t *testing.T) {
+	cases := []string{
+		"BSTRINSW $32, R4, $0, R5",
+		"BSTRPICKW $31, R4, $32, R5",
+		"BSTRINSV $64, R4, $0, R5",
+		"BSTRPICKV $3, R4, $4, R5",
+		"BSTRINSW $-1, R4, $0, R5",
+	}
+	for _, src := range cases {
+		fn := firstTextLOONG64(t, "#include \"textflag.h\"\nTEXT ·e(SB), NOSPLIT, $0\n\t"+src+"\n\tRET\n")
+		if _, _, _, _, _, err := assembleLOONG64(fn); err == nil {
+			t.Errorf("%s: expected an error, got none", src)
+		}
+	}
+}

asm/loong64_reloc_test.go

@@ -0,0 +1,42 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: BSD-3-Clause
+
+package asm
+
+import (
+	"testing"
+
+	"sourcedock.dev/petrbalvin/gasm-devkit/parser"
+)
+
+// TestLOONG64RelocOffsetsIncludePrologue pins the function-relative
+// relocation offsets of a framed loong64 function: the offsets used to
+// exclude the prologue, so every relocation landed on a prologue
+// instruction in the GOOBJ/ELF output.
+func TestLOONG64RelocOffsetsIncludePrologue(t *testing.T) {
+	f, errs := parser.Parse("k_loong64.s", "TEXT \u00b7f(SB), $16-0\n"+
+		"\tMOVV $gdata(SB), R4\n"+
+		"\tRET\n"+
+		"GLOBL gdata(SB), $8\n")
+	if len(errs) > 0 {
+		t.Fatalf("parse: %v", errs)
+	}
+	img, err := AssembleFileLOONG64(f)
+	if err != nil {
+		t.Fatalf("assemble: %v", err)
+	}
+	fn := img.Funcs[0]
+
+	// Layout: 12-byte prologue (autosize 32), pcalau12i+addi.d (12, 16),
+	// epilogue with RET.
+	if len(fn.Relocs) != 2 {
+		t.Fatalf("relocs = %d, want 2", len(fn.Relocs))
+	}
+	hi, lo := fn.Relocs[0], fn.Relocs[1]
+	if hi.Kind != RelLoong64AddrHi || hi.Off != 12 || hi.After != 12 {
+		t.Errorf("hi reloc = {off %d after %d kind %d}, want {off 12 after 12 kind RelLoong64AddrHi}", hi.Off, hi.After, hi.Kind)
+	}
+	if lo.Kind != RelLoong64AddrLo || lo.Off != 16 || lo.After != 16 {
+		t.Errorf("lo reloc = {off %d after %d kind %d}, want {off 16 after 16 kind RelLoong64AddrLo}", lo.Off, lo.After, lo.Kind)
+	}
+}

asm/operand.go

@@ -37,11 +37,6 @@ func Idx(base, index Reg, scale int, disp int64, size int) Mem {
 	return Mem{Base: base, Index: index, Scale: scale, Disp: disp, Size: size, HasBase: true, HasIndex: true}
 }
 
-// Rip builds a RIP-relative memory operand (RIP)+disp.
-func Rip(disp int64, size int) Mem {
-	return Mem{Disp: disp, Size: size}
-}
-
 // sbMem is a memory operand that references a static (SB) symbol.  It encodes
 // as a RIP-relative reference with a placeholder displacement; the encoder
 // records a patch site so the file-level layout can fill in the true rel32

asm/reg.go

@@ -7,36 +7,39 @@
 // by round-tripping through golang.org/x/arch's decoder in the tests.
 package asm
 
+import "maps"
+
 import "strings"
 
 // Reg is an x86-64 register.  In Plan 9 assembly the classic names (AX, BX, …)
-// are size-agnostic — the instruction suffix (MOVQ vs MOVL) fixes the width —
+// are size-agnostic, the instruction suffix (MOVQ vs MOVL) fixes the width
 // so the encoder keys off the register's index and lets the mnemonic supply the
 // size.  The high flag marks the legacy high-byte registers AH/CH/DH/BH, which
-// occupy indices 4–7 yet take no REX prefix, unlike SPL/BPL/SIL/DIL that share
+// occupy indices 4-7 yet take no REX prefix, unlike SPL/BPL/SIL/DIL that share
 // those indices but require one.  The mask flag marks the AVX-512 opmask
-// registers K0–K7.
+// registers K0-K7, the fp flag the x87 stack registers F0-F7.
 type Reg struct {
 	idx  int
 	size int  // informational width implied by the name; the mnemonic decides
 	high bool // AH/CH/DH/BH
-	mask bool // K0–K7 opmask register
+	mask bool // K0-K7 opmask register
+	fp   bool // F0-F7 x87 stack register
 }
 
-// Index returns the register number (0–15 for GPRs, 0–31 for vectors).
+// Index returns the register number (0-15 for GPRs, 0-31 for vectors).
 func (r Reg) Index() int { return r.idx }
 
 // Size returns the width in bytes implied by the register's name.
 func (r Reg) Size() int { return r.size }
 
-// IsMask reports whether r is an AVX-512 opmask register (K0–K7).
+// IsMask reports whether r is an AVX-512 opmask register (K0-K7).
 func (r Reg) IsMask() bool { return r.mask }
 
 func (r Reg) isOperand() {}
 
 // needsREX reports whether this register forces a REX prefix at the given
-// operand size: the extended registers R8–R15 always do, and at byte size the
-// low registers SPL/BPL/SIL/DIL (indices 4–7, not high) do as well.
+// operand size: the extended registers R8-R15 always do, and at byte size the
+// low registers SPL/BPL/SIL/DIL (indices 4-7, not high) do as well.
 func (r Reg) needsREX(opSize int) bool {
 	if r.idx >= 8 {
 		return true
@@ -63,28 +66,28 @@ var (
 	CX = Reg{idx: 1, size: 2}
 	DX = Reg{idx: 2, size: 2}
 	BX = Reg{idx: 3, size: 2}
-	SP = Reg{idx: 4, size: 2}
-	BP = Reg{idx: 5, size: 2}
+	_  = Reg{idx: 4, size: 2}
+	_  = Reg{idx: 5, size: 2}
 	SI = Reg{idx: 6, size: 2}
 	DI = Reg{idx: 7, size: 2}
 
-	EAX = Reg{idx: 0, size: 4}
-	ECX = Reg{idx: 1, size: 4}
-	EDX = Reg{idx: 2, size: 4}
-	EBX = Reg{idx: 3, size: 4}
-	ESP = Reg{idx: 4, size: 4}
-	EBP = Reg{idx: 5, size: 4}
-	ESI = Reg{idx: 6, size: 4}
-	EDI = Reg{idx: 7, size: 4}
+	_ = Reg{idx: 0, size: 4}
+	_ = Reg{idx: 1, size: 4}
+	_ = Reg{idx: 2, size: 4}
+	_ = Reg{idx: 3, size: 4}
+	_ = Reg{idx: 4, size: 4}
+	_ = Reg{idx: 5, size: 4}
+	_ = Reg{idx: 6, size: 4}
+	_ = Reg{idx: 7, size: 4}
 
-	RAX = Reg{idx: 0, size: 8}
-	RCX = Reg{idx: 1, size: 8}
-	RDX = Reg{idx: 2, size: 8}
-	RBX = Reg{idx: 3, size: 8}
-	RSP = Reg{idx: 4, size: 8}
-	RBP = Reg{idx: 5, size: 8}
-	RSI = Reg{idx: 6, size: 8}
-	RDI = Reg{idx: 7, size: 8}
+	_ = Reg{idx: 0, size: 8}
+	_ = Reg{idx: 1, size: 8}
+	_ = Reg{idx: 2, size: 8}
+	_ = Reg{idx: 3, size: 8}
+	_ = Reg{idx: 4, size: 8}
+	_ = Reg{idx: 5, size: 8}
+	_ = Reg{idx: 6, size: 8}
+	_ = Reg{idx: 7, size: 8}
 )
 
 // regByName maps an assembly register name (case-insensitive) to a Reg.
@@ -121,19 +124,17 @@ func buildRegByName() map[string]Reg {
 	}
 
 	// 8-bit: AL..BH, SPL..DIL, R8B..R15B.
-	for n, r := range map[string]Reg{
+	maps.Copy(m, map[string]Reg{
 		"AL": AL, "CL": CL, "DL": DL, "BL": BL,
 		"AH": AH, "CH": CH, "DH": DH, "BH": BH,
 		"SPL": SPL, "BPL": BPL, "SIL": SIL, "DIL": DIL,
-	} {
-		m[n] = r
-	}
+	})
 	for i := 8; i <= 15; i++ {
 		m["R"+itoa(i)+"B"] = Reg{idx: i, size: 1}
 	}
 
 	// Vector: X0..X31 (128-bit, size 16), Y0..Y31 (256-bit, size 32),
-	// Z0..Z31 (512-bit, size 64).  Indices 16–31 are only encodable in EVEX
+	// Z0..Z31 (512-bit, size 64).  Indices 16-31 are only encodable in EVEX
 	// (AVX-512) instructions; the encoder validates that through its tables.
 	for i := 0; i <= 31; i++ {
 		m["X"+itoa(i)] = Reg{idx: i, size: 16}
@@ -144,6 +145,10 @@ func buildRegByName() map[string]Reg {
 	for i := 0; i <= 7; i++ {
 		m["K"+itoa(i)] = Reg{idx: i, size: 8, mask: true}
 	}
+	// x87 stack: F0..F7.
+	for i := 0; i <= 7; i++ {
+		m["F"+itoa(i)] = Reg{idx: i, size: 8, fp: true}
+	}
 	return m
 }
 

asm/riscv_encode.go

@@ -65,7 +65,7 @@ func riscvRegNum(name string) int {
 		return 25
 	case "X26", "S10":
 		return 26
-	case "X27", "S11":
+	case "X27", "S11", "g":
 		return 27
 	case "X28", "T3":
 		return 28
@@ -141,10 +141,36 @@ func riscvRegNum(name string) int {
 	case "F31", "FT11":
 		return 31
 	default:
+		// Vector registers V0-V31 (the "V" extension).  They share the
+		// register numbering with the integer file: a bare number 0-31.
+		if len(name) >= 2 && name[0] == 'V' {
+			if n, ok := parseRegDigits(name[1:], 31); ok {
+				return n
+			}
+		}
 		return -1
 	}
 }
 
+// parseRegDigits parses a decimal register suffix and reports whether it is
+// within [0, max].
+func parseRegDigits(digits string, max int) (int, bool) {
+	if digits == "" {
+		return 0, false
+	}
+	n := 0
+	for i := 0; i < len(digits); i++ {
+		if digits[i] < '0' || digits[i] > '9' {
+			return 0, false
+		}
+		n = n*10 + int(digits[i]-'0')
+		if n > max {
+			return 0, false
+		}
+	}
+	return n, true
+}
+
 // RISC-V instruction encoding parameters.
 type riscvEnc struct {
 	opcode uint32 // bits [6:0]
@@ -154,7 +180,7 @@ type riscvEnc struct {
 
 // riscvInstrTable maps RISC-V mnemonics to their encoding.
 var riscvInstrTable = map[string]riscvEnc{
-	// RV64I — R-type arithmetic/logic.
+	// RV64I, R-type arithmetic/logic.
 	"ADD":  {0x33, 0x0, 0x00},
 	"SUB":  {0x33, 0x0, 0x20},
 	"SLL":  {0x33, 0x1, 0x00},
@@ -165,20 +191,20 @@ var riscvInstrTable = map[string]riscvEnc{
 	"SRA":  {0x33, 0x5, 0x20},
 	"OR":   {0x33, 0x6, 0x00},
 	"AND":  {0x33, 0x7, 0x00},
-	// RV64I — 32-bit variants (W suffix).
+	// RV64I, 32-bit variants (W suffix).
 	"ADDW": {0x3B, 0x0, 0x00},
 	"SUBW": {0x3B, 0x0, 0x20},
 	"SLLW": {0x3B, 0x1, 0x00},
 	"SRLW": {0x3B, 0x5, 0x00},
 	"SRAW": {0x3B, 0x5, 0x20},
-	// RV64I — I-type shift-immediate (shamt in rs2 field).
+	// RV64I, I-type shift-immediate (shamt in rs2 field).
 	"SLLI":  {0x13, 0x1, 0x00},
 	"SRLI":  {0x13, 0x5, 0x00},
 	"SRAI":  {0x13, 0x5, 0x20},
 	"SLLIW": {0x1B, 0x1, 0x00},
 	"SRLIW": {0x1B, 0x5, 0x00},
 	"SRAIW": {0x1B, 0x5, 0x20},
-	// RV64M — multiply/divide.
+	// RV64M, multiply/divide.
 	"MUL":    {0x33, 0x0, 0x01},
 	"MULH":   {0x33, 0x1, 0x01},
 	"MULHSU": {0x33, 0x2, 0x01},
@@ -187,13 +213,13 @@ var riscvInstrTable = map[string]riscvEnc{
 	"DIVU":   {0x33, 0x5, 0x01},
 	"REM":    {0x33, 0x6, 0x01},
 	"REMU":   {0x33, 0x7, 0x01},
-	// RV64M — 32-bit variants.
+	// RV64M, 32-bit variants.
 	"MULW":  {0x3B, 0x0, 0x01},
 	"DIVW":  {0x3B, 0x4, 0x01},
 	"DIVUW": {0x3B, 0x5, 0x01},
 	"REMW":  {0x3B, 0x6, 0x01},
 	"REMUW": {0x3B, 0x7, 0x01},
-	// RV64I — I-type arithmetic.
+	// RV64I, I-type arithmetic.
 	"ADDI":  {0x13, 0x0, 0x00},
 	"ADDIW": {0x1B, 0x0, 0x00},
 	"SLTI":  {0x13, 0x2, 0x00},
@@ -228,31 +254,34 @@ var riscvInstrTable = map[string]riscvEnc{
 	"ECALL":  {0x73, 0x0, 0x00},
 	"EBREAK": {0x73, 0x0, 0x00},
 	"FENCE":  {0x0F, 0x0, 0x00},
-	// JALR — indirect jump/call (I-type).
+	// JALR, indirect jump/call (I-type).
 	"JALR": {0x67, 0x0, 0x00},
 
-	// RV64A — atomics (AMO opcode 0x2F).
-	// funct3: 0x2 = word, 0x3 = doubleword. funct5 in bits [31:27].
-	"AMOSWAPW": {0x2F, 0x2, 0x01 << 2},
-	"AMOSWAPD": {0x2F, 0x3, 0x01 << 2},
-	"AMOADDW":  {0x2F, 0x2, 0x00 << 2},
-	"AMOADDD":  {0x2F, 0x3, 0x00 << 2},
-	"AMOANDW":  {0x2F, 0x2, 0x0C << 2},
-	"AMOANDD":  {0x2F, 0x3, 0x0C << 2},
-	"AMOORW":   {0x2F, 0x2, 0x06 << 2},
-	"AMOORD":   {0x2F, 0x3, 0x06 << 2},
-	"AMOXORW":  {0x2F, 0x2, 0x04 << 2},
-	"AMOXORD":  {0x2F, 0x3, 0x04 << 2},
-	"AMOMAXW":  {0x2F, 0x2, 0x14 << 2},
-	"AMOMAXD":  {0x2F, 0x3, 0x14 << 2},
-	"AMOMINW":  {0x2F, 0x2, 0x10 << 2},
-	"AMOMIND":  {0x2F, 0x3, 0x10 << 2},
-	"AMOMAXUW": {0x2F, 0x2, 0x1C << 2},
-	"AMOMAXUD": {0x2F, 0x3, 0x1C << 2},
-	"AMOMINUW": {0x2F, 0x2, 0x18 << 2},
-	"AMOMINUD": {0x2F, 0x3, 0x18 << 2},
+	// RV64A, atomics (AMO opcode 0x2F).
+	// funct3: 0x2 = word, 0x3 = doubleword.  The stored funct7 is the full
+	// 7-bit field: funct5 in the upper five bits and the aq/rl ordering bits in
+	// the lower two, exactly as the toolchain writes them: every AMO sets both
+	// aq and rl (funct7 |= 3).
+	"AMOSWAPW": {0x2F, 0x2, 0x01<<2 | 0x3},
+	"AMOSWAPD": {0x2F, 0x3, 0x01<<2 | 0x3},
+	"AMOADDW":  {0x2F, 0x2, 0x00<<2 | 0x3},
+	"AMOADDD":  {0x2F, 0x3, 0x00<<2 | 0x3},
+	"AMOANDW":  {0x2F, 0x2, 0x0C<<2 | 0x3},
+	"AMOANDD":  {0x2F, 0x3, 0x0C<<2 | 0x3},
+	"AMOORW":   {0x2F, 0x2, 0x08<<2 | 0x3},
+	"AMOORD":   {0x2F, 0x3, 0x08<<2 | 0x3},
+	"AMOXORW":  {0x2F, 0x2, 0x04<<2 | 0x3},
+	"AMOXORD":  {0x2F, 0x3, 0x04<<2 | 0x3},
+	"AMOMAXW":  {0x2F, 0x2, 0x14<<2 | 0x3},
+	"AMOMAXD":  {0x2F, 0x3, 0x14<<2 | 0x3},
+	"AMOMINW":  {0x2F, 0x2, 0x10<<2 | 0x3},
+	"AMOMIND":  {0x2F, 0x3, 0x10<<2 | 0x3},
+	"AMOMAXUW": {0x2F, 0x2, 0x1C<<2 | 0x3},
+	"AMOMAXUD": {0x2F, 0x3, 0x1C<<2 | 0x3},
+	"AMOMINUW": {0x2F, 0x2, 0x18<<2 | 0x3},
+	"AMOMINUD": {0x2F, 0x3, 0x18<<2 | 0x3},
 
-	// RV64F/D — floating-point arithmetic.
+	// RV64F/D, floating-point arithmetic.
 	"FADDS":  {0x53, 0x0, 0x00},
 	"FSUBS":  {0x53, 0x0, 0x04},
 	"FMULS":  {0x53, 0x0, 0x08},
@@ -273,14 +302,18 @@ var riscvInstrTable = map[string]riscvEnc{
 	"FMAXS": {0x53, 0x1, 0x14},
 	"FMIND": {0x53, 0x0, 0x15},
 	"FMAXD": {0x53, 0x1, 0x15},
+	// FP sign injection (double): rs2 carries the sign source.
+	"FSGNJD": {0x53, 0x0, 0x11},
 
-	// RV64A — load-reserved / store-conditional (funct5 0x02 / 0x03).
-	"LRW": {0x2F, 0x2, 0x02 << 2},
-	"LRD": {0x2F, 0x3, 0x02 << 2},
-	"SCW": {0x2F, 0x2, 0x03 << 2},
-	"SCD": {0x2F, 0x3, 0x03 << 2},
+	// RV64A, load-reserved / store-conditional (funct5 0x02 / 0x03).
+	// The toolchain gives LR acquire ordering (aq = 1) and SC release
+	// ordering (rl = 1).
+	"LRW": {0x2F, 0x2, 0x02<<2 | 0x2},
+	"LRD": {0x2F, 0x3, 0x02<<2 | 0x2},
+	"SCW": {0x2F, 0x2, 0x03<<2 | 0x1},
+	"SCD": {0x2F, 0x3, 0x03<<2 | 0x1},
 
-	// FP compare — result in integer register (funct7 0x50/0x51).
+	// FP compare, result in integer register (funct7 0x50/0x51).
 	"FEQS": {0x53, 0x2, 0x50},
 	"FLTS": {0x53, 0x1, 0x50},
 	"FLES": {0x53, 0x0, 0x50},
@@ -296,11 +329,11 @@ func riscvRType(enc riscvEnc, rd, rs1, rs2 int) uint32 {
 }
 
 // riscvAMOType encodes an atomic (AMO) instruction.
-// Layout: funct5 | aq | rl | rs2 | rs1 | funct3 | rd | opcode.
-// The funct5 is stored in the upper bits of enc.funct7 (shifted left by 2).
+// Layout: funct7 | rs2 | rs1 | funct3 | rd | opcode, where funct7 carries the
+// funct5 in its upper five bits and the aq/rl ordering bits in the lower two
+// (the table stores the full field, so the word needs no reassembly).
 func riscvAMOType(enc riscvEnc, rd, rs1, rs2 int) uint32 {
-	funct5 := enc.funct7 >> 2 // extract funct5 from the stored value
-	return (funct5 << 27) | (uint32(rs2) << 20) | (uint32(rs1) << 15) |
+	return (enc.funct7 << 25) | (uint32(rs2) << 20) | (uint32(rs1) << 15) |
 		(enc.funct3 << 12) | (uint32(rd) << 7) | enc.opcode
 }
 
@@ -328,6 +361,8 @@ var riscvCvtTable = map[string]riscvCvtEnc{
 	"FCVTSWU": {0x68, 0x1, 0x53}, // uint32 → float32
 	"FCVTSL":  {0x68, 0x2, 0x53}, // int64 → float32
 	"FCVTSLU": {0x68, 0x3, 0x53}, // uint64 → float32
+	"FCLASSS": {0x70, 0x0, 0x53}, // classify float32 → GPR mask
+	"FCLASSD": {0x70, 0x0, 0x53}, // classify float64 → GPR mask
 	"FCVTDW":  {0x69, 0x0, 0x53}, // int32 → float64
 	"FCVTDWU": {0x69, 0x1, 0x53}, // uint32 → float64
 	"FCVTDL":  {0x69, 0x2, 0x53}, // int64 → float64
@@ -371,7 +406,7 @@ var riscvFmaTable = map[string]riscvFmaEnc{
 // riscvFmaType encodes an R4-type fused multiply-add instruction.
 func riscvFmaType(enc riscvFmaEnc, rd, rs1, rs2, rs3 int) uint32 {
 	return (uint32(rs3) << 27) | (enc.fmt << 25) | (uint32(rs2) << 20) |
-		(uint32(rs1) << 15) | (0x0 << 12) /* rm=dynamic */ | (uint32(rd) << 7) | enc.opcode
+		(uint32(rs1) << 15) | (0x0 << 12) /* rm=RNE */ | (uint32(rd) << 7) | enc.opcode
 }
 
 // CSR (Control and Status Register) instructions.
@@ -439,13 +474,78 @@ func riscvJType(rd int, offset int32) uint32 {
 		0x6F // JAL opcode
 }
 
+// ---- RVV ("V" extension) encoding helpers ----
+
+// The OP-V major opcode and its funct3 subclasses.
+const (
+	riscvOpV = 0x57 // the vector operation opcode (also OPcfg for vset*)
+	// funct3 values: 0 OPIVV, 1 OPFVV, 2 OPMVV, 3 OPIVI, 4 OPIVX,
+	// 5 OPFVF, 6 OPMVX, 7 vsetvli.
+	riscvVf3VV  = 0x0 // vector-vector
+	riscvVf3MV  = 0x2 // vector mask
+	riscvVf3VI  = 0x3 // vector-immediate
+	riscvVf3VX  = 0x4 // vector-scalar
+	riscvVf3Cfg = 0x7 // vsetvli
+)
+
+// riscvVType composes the vsetvli/vsetivli vtype immediate: the register
+// group multiplier in [2:0], the selected element width in [5:3] and the
+// tail-agnostic and mask-agnostic policies in bits 6 and 7.
+func riscvVType(vsew, vlmul, vta, vma int) int {
+	return vlmul | vsew<<3 | vta<<6 | vma<<7
+}
+
+// riscvVSetEnc encodes VSETVLI and VSETIVLI: imm[31:20] = vtype, rs1 = the
+// avl register or 5-bit uimm, rd = the destination.  Both carry funct3 7; a
+// vsetivli is distinguished by bits [31:30] set in the immediate (the 0xC00
+// the toolchain writes above its 10-bit vtype).
+func riscvVSetEnc(vsetivli bool, avl, vtype, rd int) uint32 {
+	imm := vtype & 0x3FF
+	if vsetivli {
+		imm |= 0xC00
+	}
+	return uint32(imm)<<20 | uint32(avl&0x1F)<<15 | uint32(riscvVf3Cfg)<<12 |
+		uint32(rd)<<7 | riscvOpV
+}
+
+// riscvVLSType encodes a vector load or store: the full 32-bit word with the
+// segment count in bits [31:29], the addressing mode in bits [28:26], the
+// unmasked bit at 25 and the width in funct3.  width follows the load
+// convention (0 = 8-bit, 5 = 16-bit, 6 = 32-bit, 7 = 64-bit).
+func riscvVLSType(op uint32, nf, mop, width int, rs2 int32, rs1, rd int) uint32 {
+	return uint32(nf&0x7)<<29 | uint32(mop&0x7)<<26 | 1<<25 |
+		uint32(rs2)<<20 | uint32(rs1)<<15 | uint32(width&0x7)<<12 |
+		uint32(rd)<<7 | op
+}
+
+// riscvVVInstr encodes an OP-V instruction with the six-bit operation code in
+// funct7's upper bits, bit 25 as the unmasked flag and the three registers in
+// the standard positions.  vs1 may name an integer register for the *VX forms
+// (the scalar sits in the rs1 field) or an immediate for the *VI forms.
+func riscvVVInstr(funct6, funct3 int, vs1 int32, vs2, vd int) uint32 {
+	return uint32(funct6&0x3F)<<26 | 1<<25 | uint32(vs1)<<15 |
+		uint32(funct3)<<12 | uint32(vs2)<<20 | uint32(vd)<<7 | riscvOpV
+}
+
+// riscvVUnaryInstr encodes a one-vector-operand OP-V instruction whose fixed
+// fields live where the second source register would be: rs1Field and vs2 are
+// written verbatim (the oracle writes fixed non-zero constants there for some
+// instructions, such as 0x11 in the rs1 field of vmfirst.m and vid.v).
+func riscvVUnaryInstr(funct6, funct3 int, rs1Field int32, vs2, vd int) uint32 {
+	return uint32(funct6&0x3F)<<26 | 1<<25 | uint32(vs2&0x1F)<<20 |
+		uint32(rs1Field&0x1F)<<15 | uint32(funct3&0x7)<<12 | uint32(vd&0x1F)<<7 | riscvOpV
+}
+
+// riscvSegNF maps a segment count to the 3-bit nf field (count - 1).
+func riscvSegNF(n int) int32 { return int32(n - 1) }
+
 // ---- RVC (compressed) encoding helpers ----
 
 // isRVCIntReg reports whether a register number can be encoded in the 3-bit
-// prime register field used by compressed instructions (x8–x15).
+// prime register field used by compressed instructions (x8-x15).
 func isRVCIntReg(r int) bool { return r >= 8 && r <= 15 }
 
-// rvcReg3 returns the 3-bit encoding for registers x8–x15 (0–7).
+// rvcReg3 returns the 3-bit encoding for registers x8-x15 (0-7).
 func rvcReg3(r int) uint32 { return uint32(r - 8) }
 
 // rvcCR encodes a CR-type (register) compressed instruction.
@@ -455,7 +555,7 @@ func rvcCR(funct4, rd, rs2 uint32) uint16 {
 }
 
 // rvcCI encodes a CI-type (immediate) compressed instruction.
-// Used for C.ADDI, C.LI, C.LUI, C.ADDIW — linear 6-bit immediate.
+// Used for C.ADDI, C.LI, C.LUI, C.ADDIW, linear 6-bit immediate.
 func rvcCI(funct3, rd uint32, imm uint32) uint16 {
 	return uint16((funct3 << 13) | ((imm>>5)&1)<<12 | (rd << 7) | (imm&0x1F)<<2 | 0x1)
 }
@@ -520,11 +620,13 @@ func rvcCL(funct3, rd, rs1 uint32, imm uint32) uint16 {
 
 // rvcCS encodes a register-relative compressed store (op=00 quadrant): C.SW
 // (funct3=6), C.SD (funct3=7) or C.FSD (funct3=5).  imm is the full byte
-// offset; the immediate bits are extracted per the RISC-V CS format.
+// offset; the immediate bits are extracted per the RISC-V CS format, with the
+// same five-bit patterns as the load side ({5,4,3,7,6} and {5,4,3,2,6},
+// matching the toolchain's encodeCS).
 func rvcCS(funct3, rs2, rs1 uint32, imm uint32) uint16 {
-	pattern := []int{5, 3, 7, 6}
+	pattern := []int{5, 4, 3, 7, 6}
 	if funct3 == 0x6 {
-		pattern = []int{5, 3, 2, 6}
+		pattern = []int{5, 4, 3, 2, 6}
 	}
 	packed := encodeRVCPattern(imm, pattern)
 	return uint16((funct3 << 13) | ((packed>>2)&0x7)<<10 | (rs1 << 7) | ((packed & 0x3) << 5) | (rs2 << 2))

asm/riscv_encode_test.go

@@ -5,6 +5,9 @@ package asm
 
 import (
 	"bytes"
+	"encoding/binary"
+	"encoding/hex"
+	"strings"
 	"testing"
 
 	"sourcedock.dev/petrbalvin/gasm-devkit/ast"
@@ -289,7 +292,7 @@ TEXT ·cmp(SB), NOSPLIT, $0
 }
 
 func TestRISCV_forwardBranch(t *testing.T) {
-	// Forward label reference — must not fail.
+	// Forward label reference; must not fail.
 	fn := firstTextRISCV(t, `#include "textflag.h"
 TEXT ·fwd(SB), NOSPLIT, $0
 	ADDI $1, X10, X10
@@ -691,6 +694,81 @@ DATA answer<>+0(SB)/8, $42
 	}
 }
 
+// TestRISCV_RVC_StorePatterns pins the register-relative compressed store
+// encodings for offsets with immediate bits 4 and 5 set, byte-identical to
+// the toolchain's encodeCS (patterns {5,4,3,7,6} and {5,4,3,2,6}).
+// Regression: the store-side patterns dropped imm[4], so every such store
+// silently encoded the wrong address while the loads stayed correct.
+func TestRISCV_RVC_StorePatterns(t *testing.T) {
+	fn := firstTextRISCV(t, `#include "textflag.h"
+TEXT ·csstores(SB), NOSPLIT, $0
+	SD  X9, 24(X8)
+	SW  X10, 16(X11)
+	FSD F8, 40(X12)
+	LD  24(X8), X9
+	LW  16(X11), X10
+	FLD 40(X12), F8
+	RET
+`)
+	code := assembleRISCVHelper(t, fn)
+	want := []byte{
+		0x04, 0xec, // c.sd x9, 24(x8)
+		0x88, 0xc9, // c.sw x10, 16(x11)
+		0x00, 0xb6, // c.fsd f8, 40(x12)
+		0x04, 0x6c, // c.ld x9, 24(x8)
+		0x88, 0x49, // c.lw x10, 16(x11)
+		0x00, 0x36, // c.fld f8, 40(x12)
+		0x67, 0x80, 0x00, 0x00, // jalr x0, 0(x1)
+	}
+	if !bytes.Equal(code, want) {
+		t.Errorf("code = % x\nwant % x", code, want)
+	}
+}
+
+// TestRISCV_FENCE pins the FENCE encoding: the toolchain expands the bare
+// mnemonic to fence iorw, iorw (0x0FF0000F), not fence 0,0.
+func TestRISCV_FENCE(t *testing.T) {
+	fn := firstTextRISCV(t, `#include "textflag.h"
+TEXT ·fence(SB), NOSPLIT, $0
+	FENCE
+	RET
+`)
+	code := assembleRISCVHelper(t, fn)
+	want := []byte{
+		0x0f, 0x00, 0xf0, 0x0f, // fence iorw, iorw
+		0x67, 0x80, 0x00, 0x00, // jalr x0, 0(x1)
+	}
+	if !bytes.Equal(code, want) {
+		t.Errorf("code = % x\nwant % x", code, want)
+	}
+}
+
+// TestRISCV_RVC_WidthSpellings pins the compression of the GOROOT width
+// spellings: MOVW and MOVD lower to their base load/store and compress
+// exactly like LW/SW/FLD/FSD would (the toolchain compresses these shapes;
+// before the normalisation they stayed 4 bytes).
+func TestRISCV_RVC_WidthSpellings(t *testing.T) {
+	fn := firstTextRISCV(t, `#include "textflag.h"
+TEXT ·widths(SB), NOSPLIT, $0-16
+	MOVW w+0(FP), X9
+	MOVW X9, v+4(FP)
+	MOVD d+0(FP), F8
+	MOVD F8, r+8(FP)
+	RET
+`)
+	code := assembleRISCVHelper(t, fn)
+	want := []byte{
+		0xa2, 0x44, // c.lwsp x9, 8
+		0x26, 0xc6, // c.swsp x9, 12
+		0x22, 0x24, // c.fldsp f8, 8
+		0x22, 0xa8, // c.fsdsp f8, 16
+		0x67, 0x80, 0x00, 0x00, // jalr x0, 0(x1)
+	}
+	if !bytes.Equal(code, want) {
+		t.Errorf("code = % x\nwant % x", code, want)
+	}
+}
+
 func TestRISCV_system_instrs(t *testing.T) {
 	// Test FENCE, ECALL, EBREAK encoding.
 	fn := firstTextRISCV(t, `#include "textflag.h"
@@ -761,3 +839,358 @@ sub:
 		t.Error("expected error for CALL to local label, got nil")
 	}
 }
+
+// TestRISCVIndirectBranch pins the indirect branch encodings: JMP (X5) is the
+// toolchain's JALR X0, 0(X5), and the trampoline form JALR rd, offset(rs1)
+// takes its destination from the first operand (regression: the base
+// register was once read as the destination, silently jumping to X0).
+func TestRISCVIndirectBranch(t *testing.T) {
+	fn := firstTextRISCV(t, `#include "textflag.h"
+TEXT ·f(SB), NOSPLIT, $0-0
+	JMP (X5)
+	JALR X0, 0(X6)
+	JALR X28, 0(X9)
+	RET
+`)
+	code := assembleRISCVHelper(t, fn)
+	wantWords(t, code,
+		0x00028067, // jalr x0, 5(x0), 0
+		0x00030067, // jalr x0, 6(x0), 0
+		0x00048e67, // jalr x28, 9(x0), 0
+		0x00008067, // jalr x0, 1(x0), 0 (RET)
+	)
+}
+
+// encodeOneInstrRISCV encodes a single parsed instruction against a synthetic
+// offsets map, the smallest honest harness for the branch-range diagnostics:
+// the spans are far larger than any source a test would want to spell out.
+func encodeOneInstrRISCV(t *testing.T, src string, pc int, offsets map[string]int) ([]byte, error) {
+	t.Helper()
+	fn := firstTextRISCV(t, "#include \"textflag.h\"\n"+src)
+	instr := fn.Body[0].(*ast.Instr)
+	return encodeRISCVInstr(instr, pc, offsets, riscvFrameInfo{}, nil)
+}
+
+// TestRISCVBranchJumpRange checks that displacements beyond the B-type span
+// [-4096, 4094] and the J-type span [-1048576, 1048574] are diagnosed instead
+// of wrapping silently to a wrong target.
+func TestRISCVBranchJumpRange(t *testing.T) {
+	cases := []struct {
+		name string
+		src  string
+		off  int // the target's function-relative offset (pc 0)
+		ok   bool
+	}{
+		{"branch max", "BEQ X10, X11, tgt\nRET\n", 4094, true},
+		{"branch past max", "BEQ X10, X11, tgt\nRET\n", 4096, false},
+		{"branch back max", "BEQ X10, X11, tgt\nRET\n", -4096, true},
+		{"branch back past max", "BEQ X10, X11, tgt\nRET\n", -4098, false},
+		{"branchz past max", "BEQZ X10, tgt\nRET\n", 4096, false},
+		{"jump max", "JMP tgt\nRET\n", 1048574, true},
+		{"jump past max", "JMP tgt\nRET\n", 1048576, false},
+		{"jump back max", "JMP tgt\nRET\n", -1048576, true},
+		{"jump back past max", "JMP tgt\nRET\n", -1048578, false},
+		{"jal past max", "JAL tgt\nRET\n", 1048576, false},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			_, err := encodeOneInstrRISCV(t, "TEXT ·f(SB), NOSPLIT, $0\n\t"+c.src, 0, map[string]int{"tgt": c.off})
+			if c.ok && err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if !c.ok && err == nil {
+				t.Fatal("expected an out-of-range diagnostic, got none")
+			}
+		})
+	}
+}
+
+// TestRISCVBranchFarBody drives the range check through the full two-pass
+// assembler: a forward branch over a body larger than the B-type span must
+// error rather than wrap.
+func TestRISCVBranchFarBody(t *testing.T) {
+	var sb strings.Builder
+	sb.WriteString("#include \"textflag.h\"\nTEXT ·far(SB), NOSPLIT, $0\n\tBEQ X10, X11, done\n")
+	for range 1100 {
+		sb.WriteString("\tADD X10, X11, X12\n")
+	}
+	sb.WriteString("done:\n\tRET\n")
+	fn := firstTextRISCV(t, sb.String())
+	if _, _, _, _, _, err := assembleRISCV(fn); err == nil {
+		t.Error("expected a branch-out-of-range error, got none")
+	}
+}
+
+// TestRISCV_CSRRange checks the CSR address range: the 12-bit field is
+// diagnosed rather than masked, so CSRRW $4096 does not silently address
+// CSR 0.
+func TestRISCV_CSRRange(t *testing.T) {
+	fn := firstTextRISCV(t, `#include "textflag.h"
+TEXT ·csrhi(SB), NOSPLIT, $0
+	CSRRW $4096, X10, X11
+	RET
+`)
+	if _, _, _, _, _, err := assembleRISCV(fn); err == nil {
+		t.Error("expected an out-of-range error for CSR $4096, got none")
+	}
+	fn = firstTextRISCV(t, `#include "textflag.h"
+TEXT ·csrmax(SB), NOSPLIT, $0
+	CSRRW $4095, X10, X11
+	RET
+`)
+	if _, _, _, _, _, err := assembleRISCV(fn); err != nil {
+		t.Errorf("CSR $4095 must assemble: %v", err)
+	}
+}
+
+// TestRISCV_Imm64Rejected checks that immediates outside the signed 32-bit
+// span are diagnosed instead of silently truncated to their low 32 bits (the
+// toolchain materialises such constants via SLLI expansion, which this
+// assembler does not implement).
+func TestRISCV_Imm64Rejected(t *testing.T) {
+	cases := []string{
+		"MOV $0x123456789, X10",
+		"ADDI $0x100000000, X10, X11",
+		"ANDI $-0x800000001, X10, X11",
+		"SUB $0x100000000, X10, X11",
+	}
+	for _, src := range cases {
+		fn := firstTextRISCV(t, "#include \"textflag.h\"\nTEXT ·wide(SB), NOSPLIT, $0\n\t"+src+"\n\tRET\n")
+		if _, _, _, _, _, err := assembleRISCV(fn); err == nil {
+			t.Errorf("%s: expected an out-of-range error, got none", src)
+		}
+	}
+	// The full signed 32-bit span still assembles, including the SUB form
+	// whose negated immediate only just fits.
+	fn := firstTextRISCV(t, `#include "textflag.h"
+TEXT ·edge(SB), NOSPLIT, $0
+	MOV  $2147483647, X10
+	MOV  $-2147483648, X11
+	SUB  $0x80000000, X12, X13
+	RET
+`)
+	if _, _, _, _, _, err := assembleRISCV(fn); err != nil {
+		t.Errorf("int32-span immediates must assemble: %v", err)
+	}
+}
+
+// riscvWants decodes code as little-endian words and pins each one; the
+// expected values below were read off GOARCH=riscv64 go tool objdump of
+// kernels assembled with go tool asm (the toolchain's riscv64.s testdata
+// cross-checks the same words).
+func riscvWants(t *testing.T, code []byte, want ...uint32) {
+	t.Helper()
+	got := make([]uint32, 0, len(code)/4)
+	for i := 0; i+4 <= len(code); i += 4 {
+		got = append(got, binary.LittleEndian.Uint32(code[i:]))
+	}
+	if len(got) < len(want) {
+		t.Fatalf("word count = %d, want %d\ncode: % x", len(got), len(want), code)
+	}
+	// The RET (JALR) ends the sequence; only the pinned prefix is compared.
+	for i := range want {
+		if got[i] != want[i] {
+			t.Errorf("word %d = %08x, want %08x", i, got[i], want[i])
+		}
+	}
+}
+
+// riscvWantsHex pins the exact hex encoding of a function's instruction
+// bytes, including any 2-byte compressed instructions in the stream; the
+// expected strings were read off GOARCH=riscv64 go tool objdump of kernels
+// assembled with go tool asm (the toolchain's riscv64.s testdata
+// cross-checks the same words).
+func riscvWantsHex(t *testing.T, code []byte, wantHex string) {
+	t.Helper()
+	got := hex.EncodeToString(code)
+	if got != wantHex {
+		t.Errorf("code = %s, want %s", got, wantHex)
+	}
+}
+
+// TestRISCV_extendedPseudos pins the toolchain-synthesised instructions:
+// ANDN/ORN (XORI + AND/OR through the destination or TMP), the five-word
+// MIN/MAX expansion, the four-word rotate, ROR's compressed reverse shift
+// (C.SLLI when rd == rs1, both non-zero, 1 <= sll <= 63), the identical-
+// input MIN/MAX fold to C.MV, FABSD (FSGNJX.D), SEQZ and RDTIME (csrrs with
+// the time CSR).
+func TestRISCV_extendedPseudos(t *testing.T) {
+	t.Run("logic and minmax", func(t *testing.T) {
+		fn := firstTextRISCV(t, `#include "textflag.h"
+TEXT ·l(SB), NOSPLIT, $0
+	ANDN X19, X20, X21
+	ANDN X19, X20
+	ORN X20, X19
+	MAX X26, X28, X29
+	MIN X29, X30, X5
+	MAX X5, X5
+	MAX X5, X5, X6
+	SEQZ X5, X6
+	NEG X5, X6
+	NOT X5
+	RDTIME X5
+	RET
+`)
+		code := assembleRISCVHelper(t, fn)
+		// Words 0-10 up to the folded C.MV pair (halfwords 96 82 and 16 83),
+		// then SEQZ, NEG, NOT and RDTIME.
+		riscvWantsHex(t, code,
+			"93caf9ffb37a5a01"+"93cff9ff337afa01"+"934ffaffb3e9f901"+
+				"b32fae01b30ff041b34eae01b3fedf01b34ede01"+
+				"b3afee01b30ff041b342df01b3f25f00b3425f00"+
+				"9682"+"1683"+
+				"13b31200"+"33035040"+"93c2f2ff"+"f32210c0"+"67800000")
+	})
+
+	t.Run("rotate", func(t *testing.T) {
+		fn := firstTextRISCV(t, `#include "textflag.h"
+TEXT ·r(SB), NOSPLIT, $0
+	ROR X10, X11, X12
+	ROR X10, X11
+	ROR $63, X11
+	RORIW $31, X13, X14
+	RORIW $1, X14, X15
+	RORIW $3, X14
+	RORW X15, X16, X17
+	RORW $31, X13
+	RET
+`)
+		code := assembleRISCVHelper(t, fn)
+		// The third ROR carries the compressed C.SLLI (05 86) in mid-stream.
+		riscvWantsHex(t, code,
+			"b30fa040b39ff50133d6a50033e6cf00"+
+				"b30fa040b39ff501b3d5a500b3e5bf00"+
+				"93dff5038605b3e5bf00"+
+				"9bdff6011b97160033e7ef00"+
+				"9b5f17009b17f701b3e7ff00"+
+				"9b5f37001b17d70133e7ef00"+
+				"b30ff040bb1ff801bb58f800b3e81f01"+
+				"9bdff6019b961600b3e6df00"+"67800000")
+	})
+
+	t.Run("fp and branches", func(t *testing.T) {
+		fn := firstTextRISCV(t, `#include "textflag.h"
+TEXT ·f(SB), NOSPLIT, $0
+	FABSD F1, F2
+	FSGNJD F1, F0, F2
+	FMADDD F1, F2, F3, F4
+	FMSUBD F1, F2, F3, F4
+	FNMSUBD F1, F2, F3, F4
+	BGT X5, X6, tgt
+	BLE X5, X6, tgt
+	BGTU X5, X6, tgt
+	BLEU X5, X6, tgt
+tgt:
+	RDTIME X5
+	RET
+`)
+		code := assembleRISCVHelper(t, fn)
+		riscvWantsHex(t, code,
+			"53a11022"+"53011022"+"4382201a4782201a4b82201a"+
+				"63485300635653006364530063725300"+ // blt/bge/bltu/bgeu x6, x5
+				"f32210c0"+"67800000")
+	})
+}
+
+// TestRISCV_amoWords pins the full AMO family: every AMO carries aq and rl
+// (funct7 |= 3), LR is acquire (funct7 |= 2) and SC release (funct7 |= 1),
+// exactly as GOARCH=riscv64 go tool asm encodes them.
+func TestRISCV_amoWords(t *testing.T) {
+	fn := firstTextRISCV(t, `#include "textflag.h"
+TEXT ·amo(SB), NOSPLIT, $0
+	AMOSWAPW X5, (X6), X7
+	AMOSWAPD X5, (X6), X7
+	AMOADDW X5, (X6), X7
+	AMOADDD X5, (X6), X7
+	AMOANDW X5, (X6), X7
+	AMOANDD X5, (X6), X7
+	AMOORW X5, (X6), X7
+	AMOORD X5, (X6), X7
+	AMOXORW X5, (X6), X7
+	AMOXORD X5, (X6), X7
+	AMOMAXW X5, (X6), X7
+	AMOMAXD X5, (X6), X7
+	AMOMAXUW X5, (X6), X7
+	AMOMAXUD X5, (X6), X7
+	AMOMINUW X5, (X6), X7
+	AMOMINUD X5, (X6), X7
+	LRW (X5), X6
+	LRD (X5), X6
+	SCW X5, (X6), X7
+	SCD X5, (X6), X7
+	RET
+`)
+	code := assembleRISCVHelper(t, fn)
+	riscvWants(t, code,
+		0x0E5323AF, // amoswap.w
+		0x0E5333AF, // amoswap.d
+		0x065323AF, // amoaddd.w
+		0x065333AF, // amoadd.d
+		0x665323AF, // amoand.w
+		0x665333AF, // amoand.d
+		0x465323AF, // amoor.w
+		0x465333AF, // amoor.d
+		0x265323AF, // amoxor.w
+		0x265333AF, // amoxor.d
+		0xA65323AF, // amomax.w
+		0xA65333AF, // amomax.d
+		0xE65323AF, // amomaxu.w
+		0xE65333AF, // amomaxu.d
+		0xC65323AF, // amominu.w
+		0xC65333AF, // amominu.d
+		0x1402A32F, // lr.w (aq)
+		0x1402B32F, // lr.d
+		0x1A5323AF, // sc.w (rl)
+		0x1A5333AF, // sc.d
+	)
+}
+
+// TestRISCV_vectorWords pins the RVV slice and the VSET* encodings.  The
+// toolchain canonicalises an immediate avl to vsetivli even under the
+// VSETVLI spelling (`VSETVLI $15` and `VSETIVLI $15` come out byte-
+// identical), which is what the 0xC00 bit of the first word carries.
+func TestRISCV_vectorWords(t *testing.T) {
+	fn := firstTextRISCV(t, `#include "textflag.h"
+TEXT ·v(SB), NOSPLIT, $0
+	VSETVLI X5, E8, M8, TA, MA, X6
+	VSETIVLI $4, E32, M1, TA, MA, X0
+	VSETVLI $15, E32, M1, TA, MA, X12
+	VADDVV V1, V2, V3
+	VADDVX X12, V12, V12
+	VXORVV V8, V16, V24
+	VMSEQVX X12, V8, V0
+	VMSNEVV V8, V16, V0
+	VSLLVI $8, V28, V30
+	VSRLVI $25, V29, V29
+	VFIRSTM V0, X6
+	VIDV V12
+	VMV4RV V8, V24
+	VLE8V (X10), V8
+	VSE8V V24, (X10)
+	VSE32V V9, (X11)
+	VLSSEG4E32V (X14), X0, V0
+	VLSSEG8E32V (X10), X0, V4
+	RET
+`)
+	code := assembleRISCVHelper(t, fn)
+	riscvWants(t, code,
+		0x0C32F357, // vsetvli x6, x5, vtype 0xc3 (E8, M8, TA, MA)
+		0xCD027057, // vsetivli x0, 4
+		0xCD07F657, // vsetivli x12, 15: VSETVLI $15 canonicalises to the same word
+		0x022081D7, // vadd.vv v3, v2, v1
+		0x02C64657, // vadd.vx v12, v12, x12
+		0x2F040C57, // vxor.vv v24, v16, v8
+		0x62864057, // vmseq.vx v0, v8, x12
+		0x67040057, // vmsne.vv v0, v16, v8
+		0x97C43F57, // vsll.vi v30, v28, 8
+		0xA3DCBED7, // vsrl.vi v29, v29, 25
+		0x4208A357, // vmfirst.m x6, v0
+		0x5208A657, // vid.v v12
+		0x9E81BC57, // vmv4r.v v24, v8
+		0x02050407, // vle8.v v8, (x10)
+		0x02050C27, // vse8.v v24, (x10)
+		0x0205E4A7, // vse32.v v9, (x11)
+		0x6A076007, // vlsseg4e32.v v0, (x14), x0
+		0xEA056207, // vlsseg8e32.v v4, (x10), x0
+	)
+}

asm/riscv_frame.go

@@ -4,6 +4,7 @@
 package asm
 
 import (
+	"fmt"
 	"strings"
 
 	"sourcedock.dev/petrbalvin/gasm-devkit/ast"
@@ -32,6 +33,13 @@ import (
 // riscvFrameInfo holds the frame layout derived from a TEXT directive.
 type riscvFrameInfo struct {
 	autosize int // the real SP adjustment (locals + saved LR)
+
+	// Stack-split guard state: the toolchain emits the check for every
+	// non-NOSPLIT function whose autosize is nonzero (a zero autosize is
+	// "effectively NOSPLIT"); unlike amd64 and arm64 there is no leaf
+	// auto-NOSPLIT.
+	needSplit  bool
+	splitClass int // 0: <=StackSmall, 1: <=StackBig, 2: >StackBig
 }
 
 // riscvComputeFrame derives the frame layout for a TEXT function.
@@ -40,11 +48,34 @@ func riscvComputeFrame(t *ast.Text) riscvFrameInfo {
 	if frame != 0 || !riscvIsLeaf(t) {
 		// FixedFrameSize = 8: space for the saved link register.  A
 		// zero-frame non-leaf function still opens an 8-byte frame for LR.
-		return riscvFrameInfo{autosize: frame + 8}
+		autosize := frame + 8
+		fi := riscvFrameInfo{autosize: autosize}
+		if !hasNoSplitFlag(t) {
+			fi.needSplit = true
+			switch {
+			case autosize <= stackSmall:
+				fi.splitClass = 0
+			case autosize <= stackBig:
+				fi.splitClass = 1
+			default:
+				fi.splitClass = 2
+			}
+		}
+		return fi
 	}
 	return riscvFrameInfo{}
 }
 
+// hasNoSplitFlag reports whether the TEXT directive carries NOSPLIT.
+func hasNoSplitFlag(t *ast.Text) bool {
+	for _, f := range t.Flags {
+		if strings.EqualFold(f, "NOSPLIT") {
+			return true
+		}
+	}
+	return false
+}
+
 // riscvIsLeaf reports whether a function contains no call instructions.
 // CALL always links; JAL/JALR link only when their destination register is
 // the link register (X1), matching cmd/internal/obj/riscv's containsCall.
@@ -58,17 +89,24 @@ func riscvIsLeaf(t *ast.Text) bool {
 		case "CALL":
 			return false
 		case "JAL":
-			// JAL rd, target — a call only when rd is the link register.
+			// JAL rd, target, a call only when rd is the link register.
 			if len(in.Operands) >= 2 && regFromOperand(in.Operands[0]) == 1 {
 				return false
 			}
 		case "JALR":
-			// JALR rs1, rd — a call when rd is X1; JALR offset(rs1) always
-			// links to X1.
+			// JALR rd, offset(rs1) links when the destination register (the
+			// first operand) is X1; JALR rs1, rd links when the second
+			// register is X1; JALR offset(rs1) always links to X1.
 			if len(in.Operands) == 1 {
 				return false
 			}
-			if len(in.Operands) >= 2 && regFromOperand(in.Operands[1]) == 1 {
+			if isMemOperand(in.Operands[1]) {
+				if regFromOperand(in.Operands[0]) == 1 {
+					return false
+				}
+				continue
+			}
+			if regFromOperand(in.Operands[1]) == 1 {
 				return false
 			}
 		}
@@ -84,28 +122,99 @@ func riscvPrologue(fi riscvFrameInfo) []byte {
 		return nil
 	}
 	var out []byte
-	// MOV LR, -autosize(SP) — SD X1, -autosize(X2).  The negative offset is
-	// not compressible to C.SDSP (unsigned), so it stays 4 bytes.
-	out = append(out, wordLE(riscvSType(riscvEnc{0x23, 0x3, 0x00}, 2, 1, int32(-fi.autosize)))...)
-	// ADDI $-autosize, SP, SP — open the frame (C.ADDI when it fits).
-	out = append(out, riscvSPAdjust(int32(-fi.autosize))...)
-	// MOV LR, 0(SP) — SD X1, 0(X2) → C.SDSP X1, 0.
+	// MOV LR, -autosize(SP), SD X1, -autosize(X2).  The negative offset is
+	// not compressible to C.SDSP (unsigned), so it stays 4 bytes.  Beyond
+	// the imm12 range the toolchain materialises the address in X31.
+	if fits12(int32(-fi.autosize)) {
+		out = append(out, wordLE(riscvSType(riscvEnc{0x23, 0x3, 0x00}, 2, 1, int32(-fi.autosize)))...)
+	} else {
+		out = append(out, riscvAddressInX31(int32(-fi.autosize))...)
+		lo := int32(-fi.autosize) - (splitHi(int32(-fi.autosize)) << 12)
+		out = append(out, wordLE(riscvSType(riscvEnc{0x23, 0x3, 0x00}, 31, 1, lo))...)
+	}
+	// ADDI $-autosize, SP, SP, open the frame (C.ADDI when it fits; X31
+	// materialisation beyond imm12).
+	if fits12(int32(-fi.autosize)) {
+		out = append(out, riscvSPAdjust(int32(-fi.autosize))...)
+	} else {
+		out = append(out, riscvAddToSP(int32(-fi.autosize))...)
+	}
+	// MOV LR, 0(SP), SD X1, 0(X2) → C.SDSP X1, 0.
 	c := rvcSSP(0x7, 1, 0)
 	out = append(out, byte(c), byte(c>>8))
 	return out
 }
 
+func fits12(v int32) bool { return v >= -2048 && v <= 2047 }
+
+// splitHi returns the LUI half of the hi/lo split of v (what remains is the
+// sign-extended 12-bit low part).
+func splitHi(v int32) int32 {
+	_, high := splitRISCV32Imm(v)
+	return high
+}
+
+// riscvAddressInX31 materialises hi(v) into X31 against the stack pointer,
+// matching the toolchain's large-frame addressing: C.LUI (or LUI) X31, hi;
+// C.ADD (or ADD) X31, SP.
+func riscvAddressInX31(v int32) []byte {
+	return riscvAddressInX31WithBase(v, 2)
+}
+
+// riscvAddressInX31WithBase materialises hi(v) into X31 against an arbitrary
+// base register: LUI (or C.LUI) X31, hi; C.ADD X31, rs1.  The CR rs2 field
+// carries the full 5-bit register, so the compressed form is always
+// available.
+func riscvAddressInX31WithBase(v int32, rs1 int) []byte {
+	hi := splitHi(v)
+	var out []byte
+	if hi >= -32 && hi <= 31 {
+		c := rvcCI(0x3, 31, uint32(hi)&0x3F)
+		out = append(out, byte(c), byte(c>>8))
+	} else {
+		out = append(out, wordLE(riscvUType(riscvEnc{0x37, 0x0, 0x00}, 31, hi<<12))...)
+	}
+	c := rvcCR(0x9, 31, uint32(rs1))
+	return append(out, byte(c), byte(c>>8))
+}
+
+// riscvAddToSP adds v to SP through X31 for the values imm12 cannot carry:
+// C.LUI X31, hi; C.ADDIW X31, lo; C.ADD SP, X31 (the toolchain's form).
+func riscvAddToSP(v int32) []byte {
+	hi := splitHi(v)
+	lo := v - (hi << 12)
+	var out []byte
+	if hi >= -32 && hi <= 31 {
+		c := rvcCI(0x3, 31, uint32(hi)&0x3F)
+		out = append(out, byte(c), byte(c>>8))
+	} else {
+		out = append(out, wordLE(riscvUType(riscvEnc{0x37, 0x0, 0x00}, 31, hi<<12))...)
+	}
+	if lo >= -32 && lo <= 31 {
+		c := rvcCI(0x1, 31, uint32(lo)&0x3F)
+		out = append(out, byte(c), byte(c>>8))
+	} else {
+		out = append(out, wordLE(riscvIType(riscvEnc{0x1b, 0x0, 0x00}, 31, 31, lo))...)
+	}
+	c := rvcCR(0x9, 2, 31)
+	return append(out, byte(c), byte(c>>8))
+}
+
 // riscvReturn returns the bytes for a RET: the epilogue (restore LR and
 // deallocate the frame when present) followed by the uncompressed JALR X0,
 // 0(X1) the toolchain emits for RET (it never compresses RET to C.JR).
 func riscvReturn(fi riscvFrameInfo) []byte {
 	var out []byte
 	if fi.autosize != 0 {
-		// MOV 0(SP), LR — LD X1, 0(X2) → C.LDSP X1, 0.
+		// MOV 0(SP), LR, LD X1, 0(X2) → C.LDSP X1, 0.
 		c := rvcLSP(0x3, 1, 0)
 		out = append(out, byte(c), byte(c>>8))
-		// ADDI $autosize, SP, SP — close the frame (C.ADDI when it fits).
-		out = append(out, riscvSPAdjust(int32(fi.autosize))...)
+		// ADDI $autosize, SP, SP, close the frame (C.ADDI when it fits).
+		if fits12(int32(fi.autosize)) {
+			out = append(out, riscvSPAdjust(int32(fi.autosize))...)
+		} else {
+			out = append(out, riscvAddToSP(int32(fi.autosize))...)
+		}
 	}
 	// JALR X0, 0(X1).
 	return append(out, wordLE(riscvIType(riscvEnc{0x67, 0x0, 0x00}, 0, 1, 0))...)
@@ -133,33 +242,36 @@ func riscvFitsCAddi(imm int32) bool {
 }
 
 // riscvPrologueSpadjPC returns the function-relative byte offset where the
-// prologue has finished decrementing SP (the delta becomes autosize).
+// prologue has finished decrementing SP (the delta becomes autosize).  It is
+// computed from the same expansion functions the prologue emits, so the
+// large-frame X31 materialisations are counted: C.LUI + C.ADD before the SD,
+// C.LUI + ADDIW + C.ADD for the SP adjust.
 func riscvPrologueSpadjPC(fi riscvFrameInfo) int {
 	if fi.autosize == 0 {
 		return 0
 	}
-	// SD (4 bytes) + ADDI/C.ADDI (2 or 4 bytes).
-	return 4 + riscvSPAdjustLen(int32(-fi.autosize))
+	adj := int32(-fi.autosize)
+	if fits12(adj) {
+		// SD (4 bytes) + ADDI/C.ADDI (2 or 4 bytes).
+		return 4 + len(riscvSPAdjust(adj))
+	}
+	return len(riscvAddressInX31(adj)) + 4 + len(riscvAddToSP(adj))
 }
 
 // riscvReturnEpilogueLen returns the byte length of the RET's epilogue up to
-// (but not including) the final JALR — the point where SP is restored.
+// (but not including) the final JALR, the point where SP is restored.  The
+// small frame closes with C.LDSP + ADDI/C.ADDI; the large frame materialises
+// the adjustment through X31 (C.LUI + ADDIW + C.ADD).
 func riscvReturnEpilogueLen(fi riscvFrameInfo) int {
 	if fi.autosize == 0 {
 		return 0
 	}
-	// C.LDSP (2 bytes) + ADDI/C.ADDI (2 or 4 bytes).
-	return 2 + riscvSPAdjustLen(int32(fi.autosize))
-}
-
-func riscvSPAdjustLen(imm int32) int {
-	if imm != 0 && imm%16 == 0 && imm >= -512 && imm <= 511 {
-		return 2
+	adj := int32(fi.autosize)
+	if fits12(adj) {
+		// C.LDSP (2 bytes) + ADDI/C.ADDI (2 or 4 bytes).
+		return 2 + len(riscvSPAdjust(adj))
 	}
-	if riscvFitsCAddi(imm) {
-		return 2
-	}
-	return 4
+	return 2 + len(riscvAddToSP(adj))
 }
 
 // riscvResolvePseudo translates a pseudo-register memory reference into a
@@ -180,3 +292,73 @@ func riscvResolvePseudo(sym *ast.Symbol, fi riscvFrameInfo) (base int, off int32
 	}
 	return -1, 0
 }
+
+// riscvGuardLen returns the byte length of the stack-split guard prefix
+// including the inline morestack call (zero when the function needs no
+// guard).  Unlike amd64 and arm64, the toolchain places the morestack call
+// between the guard and the body: the guard branches forward over it.
+func riscvGuardLen(fi riscvFrameInfo) (int, error) {
+	g, _, err := riscvGuard(fi)
+	if err != nil {
+		return 0, err
+	}
+	return len(g), nil
+}
+
+// riscvGuard emits the stack-split guard prefix with the inline morestack
+// call: the branch skips forward over JAL X5 and JAL X0 straight into the
+// body; the JAL X5 carries the R_RISCV_JAL relocation.  All offsets are
+// relative to the guard itself, which sits at function offset 0.
+func riscvGuard(fi riscvFrameInfo) ([]byte, Reloc, error) {
+	if !fi.needSplit {
+		return nil, Reloc{}, nil
+	}
+	// MOV 16(g), X6 (g.stackguard0), g = X27.
+	out := wordLE(riscvIType(riscvEnc{0x03, 0x3, 0x00}, 6, 27, 16))
+	jalBack := func() []byte {
+		// JAL X0 back to the function start: it sits right after the JAL X5,
+		// so its displacement is minus the current offset.
+		return wordLE(riscvJType(0, int32(-len(out))))
+	}
+	var reloc Reloc
+	switch fi.splitClass {
+	case 0:
+		// BLTU X6, SP, done (+12: over the CALL and the JMP back)
+		out = append(out, wordLE(riscvBType(riscvEnc{0x63, 0x06, 0x00}, 6, 2, 12))...)
+		call := len(out)
+		reloc = Reloc{Off: call, After: call + 4, Name: "runtime\u00b7morestack_noctxt", Kind: RelRISCVJal}
+		out = append(out, wordLE(riscvJType(5, 0))...)
+		out = append(out, jalBack()...)
+	case 1:
+		// ADDI $-(framesize-StackSmall), SP, X7; BLTU X6, X7, done (+12)
+		off := int32(fi.autosize - stackSmall)
+		out = append(out, wordLE(riscvIType(riscvEnc{0x13, 0x0, 0x00}, 7, 2, -off))...)
+		out = append(out, wordLE(riscvBType(riscvEnc{0x63, 0x06, 0x00}, 6, 7, 12))...)
+		call := len(out)
+		reloc = Reloc{Off: call, After: call + 4, Name: "runtime\u00b7morestack_noctxt", Kind: RelRISCVJal}
+		out = append(out, wordLE(riscvJType(5, 0))...)
+		out = append(out, jalBack()...)
+	default:
+		// MOV $(framesize-StackSmall), X7; BLTU SP, X7, call;
+		// ADD $-(framesize-StackSmall), SP, X7; BLTU X6, X7, call
+		off := int32(fi.autosize - stackSmall)
+		mov := encodeRISCVLoadImm(7, off)
+		out = append(out, mov...)
+		addiLen := riscvItypeImmediateSize("ADDI", -off)
+		out = append(out, wordLE(riscvBType(riscvEnc{0x63, 0x06, 0x00}, 2, 7, int32(addiLen+8)))...)
+		addi, err := encodeRISCVItypeImmediate("ADDI", riscvEnc{0x13, 0x0, 0x00}, 7, 2, -off)
+		if err != nil {
+			// The ADDI expansion failed: the SP adjustment this class
+			// depends on is not emittable, and silently dropping it would
+			// corrupt every stack reference in the body.
+			return nil, Reloc{}, fmt.Errorf("stack-split guard: %w", err)
+		}
+		out = append(out, addi...)
+		out = append(out, wordLE(riscvBType(riscvEnc{0x63, 0x06, 0x00}, 6, 7, 12))...)
+		call := len(out)
+		reloc = Reloc{Off: call, After: call + 4, Name: "runtime\u00b7morestack_noctxt", Kind: RelRISCVJal}
+		out = append(out, wordLE(riscvJType(5, 0))...)
+		out = append(out, jalBack()...)
+	}
+	return out, reloc, nil
+}

asm/riscv_frame_test.go

@@ -65,6 +65,47 @@ TEXT ·framed(SB), NOSPLIT, $16-16
 	}
 }
 
+// TestRISCVFrameSpadjLargeFrame checks the stack-adjustment boundaries of a
+// frame past the imm12 range: the prologue materialises the LR-store address
+// and the SP adjustment through X31 (C.LUI + C.ADD + SD, then C.LUI + ADDIW +
+// C.ADD), so the SP boundary lands at PC 16, and the RET closes with
+// C.LDSP plus the same X31 adjustment, 10 bytes.  Regression: both helpers
+// assumed the small-frame prologue and reported 8 and 6.
+func TestRISCVFrameSpadjLargeFrame(t *testing.T) {
+	f, errs := parser.Parse("bigframe_riscv64.s", `#include "textflag.h"
+
+TEXT ·big(SB), NOSPLIT, $9000-8
+	MOV a+0(FP), X10
+	RET
+`)
+	if len(errs) > 0 {
+		t.Fatalf("parse: %v", errs)
+	}
+	img, err := AssembleFileRISCV(f)
+	if err != nil {
+		t.Fatalf("AssembleFileRISCV: %v", err)
+	}
+	fn := img.Funcs[0]
+
+	// autosize = 9008.  Prologue: C.LUI X31 + C.ADD X31,SP (4) + SD (4) +
+	// C.LUI X31 + ADDIW X31 + C.ADD SP,X31 (8) = 16 bytes to the SP boundary;
+	// C.SDSP X1 (2) follows, so the body starts at 18.
+	wantSpadj := []SpadjStep{{PC: 16, Value: 9008}, {PC: 36, Value: 0}}
+	if len(fn.Spadj) != len(wantSpadj) {
+		t.Fatalf("spadj = %v, want %v", fn.Spadj, wantSpadj)
+	}
+	for i := range wantSpadj {
+		if fn.Spadj[i] != wantSpadj[i] {
+			t.Errorf("spadj[%d] = %v, want %v", i, fn.Spadj[i], wantSpadj[i])
+		}
+	}
+	// The FP load materialises its 9016-byte offset through X31 as well
+	// (8 bytes), then RET's epilogue (C.LDSP + X31 adjust = 10) plus JALR.
+	if fn.Size != 18+8+14 {
+		t.Errorf("size = %d, want %d", fn.Size, 18+8+14)
+	}
+}
+
 // TestRISCVRegAliases checks the Go ABI register aliases that the toolchain
 // defines: LR is the link register (X1) and TMP is the assembler scratch
 // register (X31/T6).

asm/riscv_goobj_test.go

@@ -74,6 +74,89 @@ DATA callee<>+0(SB)/8, $42
 		t.Error("ELF object missing R_RISCV_JAL relocation")
 	}
 }
+
+// TestELFRISCVPCRELLO12Anchor checks the psABI's LO12 pairing rule: the
+// R_RISCV_PCREL_LO12_I/S relocation must reference a symbol whose value is
+// the AUIPC site of its HI20 partner (psABI §8.4.9; cmd/link generates one
+// local text symbol per AUIPC for exactly this).  The emitter pairs each
+// HI20 (against the target symbol) with a LO12 against the .text section
+// symbol whose addend is the AUIPC's section-relative offset, so S + A is
+// the AUIPC address.
+func TestELFRISCVPCRELLO12Anchor(t *testing.T) {
+	f, errs := parser.Parse("k_riscv64.s", `
+#include "textflag.h"
+
+TEXT ·sb(SB), NOSPLIT, $0-0
+	MOV $answer<>(SB), X10
+	MOV answer<>(SB), X11
+	MOV X12, answer<>(SB)
+	RET
+
+GLOBL answer<>(SB), RODATA, $8
+DATA answer<>+0(SB)/8, $42
+`)
+	if len(errs) > 0 {
+		t.Fatalf("parse: %v", errs)
+	}
+	img, err := AssembleFileRISCV(f)
+	if err != nil {
+		t.Fatalf("AssembleFileRISCV: %v", err)
+	}
+	obj, err := img.ELFRISCVObject()
+	if err != nil {
+		t.Fatalf("ELFRISCVObject: %v", err)
+	}
+	ef, err := elf.NewFile(bytes.NewReader(obj))
+	if err != nil {
+		t.Fatalf("parse ELF: %v", err)
+	}
+	defer ef.Close()
+	if flags := binary.LittleEndian.Uint32(obj[48:]); flags != efRISCVFloatAbiDouble {
+		t.Errorf("e_flags = %#x, want %#x (EF_RISCV_FLOAT_ABI_DOUBLE)", flags, efRISCVFloatAbiDouble)
+	}
+	rela := ef.Section(".rela.text")
+	if rela == nil {
+		t.Fatal("missing .rela.text")
+	}
+	b, err := rela.Data()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(b) != 6*24 {
+		t.Fatalf(".rela.text holds %d entries, want six (three HI20/LO12 pairs)", len(b)/24)
+	}
+	le := binary.LittleEndian
+	wantLo := []uint32{rRISCVPCRELLO12I, rRISCVPCRELLO12I, rRISCVPCRELLO12S}
+	for p := range 3 {
+		auipc := 8 * p
+		hi := b[p*2*24:]
+		lo := b[(p*2+1)*24:]
+		if off := le.Uint64(hi[0:]); off != uint64(auipc) {
+			t.Errorf("pair %d: HI20 r_offset = %d, want %d (the AUIPC)", p, off, auipc)
+		}
+		if typ := uint32(le.Uint64(hi[8:])); typ != rRISCVPCRELHI20 {
+			t.Errorf("pair %d: HI20 type = %d, want %d", p, typ, rRISCVPCRELHI20)
+		}
+		if sym := int(le.Uint64(hi[8:]) >> 32); sym == 0 || sym == 1 {
+			t.Errorf("pair %d: HI20 against symbol %d, want the target", p, sym)
+		}
+		if off := le.Uint64(lo[0:]); off != uint64(auipc+4) {
+			t.Errorf("pair %d: LO12 r_offset = %d, want %d", p, off, auipc+4)
+		}
+		if typ := uint32(le.Uint64(lo[8:])); typ != wantLo[p] {
+			t.Errorf("pair %d: LO12 type = %d, want %d", p, typ, wantLo[p])
+		}
+		// The LO12 must denote the AUIPC site: the .text section symbol
+		// (index 1) plus the AUIPC's section-relative offset as addend.
+		if sym := int(le.Uint64(lo[8:]) >> 32); sym != 1 {
+			t.Errorf("pair %d: LO12 against symbol %d, want 1 (the .text section symbol)", p, sym)
+		}
+		if add := int64(le.Uint64(lo[16:])); add != int64(auipc) {
+			t.Errorf("pair %d: LO12 addend = %d, want %d (S + A = the AUIPC address)", p, add, auipc)
+		}
+	}
+}
+
 func TestGOObjectRISCVStructure(t *testing.T) {
 	f, errs := parser.Parse("k_riscv64.s", `
 #include "textflag.h"
@@ -141,7 +224,7 @@ DATA answer<>+0(SB)/8, $42
 	first := int(le.Uint32(relocIdx[4*(4+4):]))
 	wantType := []uint16{relocRISCVPcrelItype, relocRISCVPcrelItype, relocRISCVPcrelStype}
 	wantOffAbs := []int{0, 8, 16}
-	for i := 0; i < 3; i++ {
+	for i := range 3 {
 		e := relocs[(first+i)*23:]
 		if int32(le.Uint32(e[0:])) != int32(wantOffAbs[i]) || e[4] != 8 || le.Uint16(e[5:]) != wantType[i] ||
 			le.Uint32(e[15:]) != pkgIdxSelf || le.Uint32(e[19:]) != 0 {
@@ -221,7 +304,7 @@ func main() {
 		t.Fatalf("baseline build: %v\n%s", err, buildLog)
 	}
 	var pkgArch, work, linkLine, asmObj string
-	for _, line := range strings.Split(string(buildLog), "\n") {
+	for line := range strings.SplitSeq(string(buildLog), "\n") {
 		switch {
 		case strings.HasPrefix(line, "WORK="):
 			work = strings.TrimPrefix(line, "WORK=")
@@ -279,7 +362,7 @@ func main() {
 	newArch := filepath.Join(dir, "pkg.a")
 	args := []string{"tool", "pack", "c", newArch}
 	seen := map[string]bool{}
-	for _, m := range strings.Fields(string(listOut)) {
+	for m := range strings.FieldsSeq(string(listOut)) {
 		if seen[m] {
 			continue
 		}

asm/vex.go

@@ -36,12 +36,12 @@ const (
 	vexNDS3Imm
 	// vexExtract is the lane-extract form `OP $imm, ysrc, xdst`: ModRM.reg =
 	// ysrc (op1), ModRM.rm = xdst or memory (op2), imm8 = op0.  The YMM
-	// source lives in the reg field, the destination in r/m — the PEXTR-style
+	// source lives in the reg field, the destination in r/m, the PEXTR-style
 	// layout.  VEXTRACTI128 and VEXTRACTF128 use this shape.
 	vexExtract
 	// vexRMRev is the reversed two-operand form `OP src, dst` with the source
-	// in ModRM.reg and the destination in r/m — the layout of the EVEX
-	// narrowing stores (VPMOVDW, VPMOVQD).
+	// in ModRM.reg and the destination in r/m, the layout of the EVEX
+	// narrowing stores (VPMOVDW, VPMOVQD) and of the non-temporal VMOVNTDQ.
 	vexRMRev
 	// vexRMSrcLen is the two-operand conversion form `OP src, dst` whose
 	// vector length follows the source: the packed-double → dword
@@ -52,6 +52,15 @@ const (
 	vexRMSrcLen
 	// vexZero is the no-operand form (VZEROUPPER).
 	vexZero
+	// vexZeroAll is the no-operand form that zeroes the full upper state
+	// (VZEROALL, the L = 1 twin of VZEROUPPER).
+	vexZeroAll
+	// vexNDS3GPR is the three-operand NDS form over general-purpose
+	// registers (ANDN, MULX): reg = dst, vvvv = src1, rm = src2, L = 0.
+	vexNDS3GPR
+	// vexImmRMGPR is the immediate form over general-purpose registers
+	// (RORX): reg = dst, rm = src, imm8 = op0, L = 0.
+	vexImmRMGPR
 )
 
 // vexSpec describes one VEX instruction's encoding parameters.
@@ -68,7 +77,7 @@ type vexSpec struct {
 // incrementally; every entry is covered by a byte-for-byte ground-truth test
 // against the Go assembler.
 var vexTable = map[string]vexSpec{
-	// VEX.128/256.66.0F.WIG — integer arithmetic / logic / compare.
+	// VEX.128/256.66.0F.WIG, integer arithmetic / logic / compare.
 	"VPADDD":      {1, 0xFE, 0, 1, -1, vexNDS3},
 	"VPADDQ":      {1, 0xD4, 0, 1, -1, vexNDS3},
 	"VPSUBD":      {1, 0xFA, 0, 1, -1, vexNDS3},
@@ -82,7 +91,7 @@ var vexTable = map[string]vexSpec{
 	"VPUNPCKHDQ":  {1, 0x6A, 0, 1, -1, vexNDS3},
 	"VPUNPCKLQDQ": {1, 0x6C, 0, 1, -1, vexNDS3},
 	"VPACKSSDW":   {1, 0x6B, 0, 1, -1, vexNDS3},
-	// VEX.256.66.0F38.W0 — dword permute (three-operand NDS form).
+	// VEX.256.66.0F38.W0, dword permute (three-operand NDS form).
 	"VPERMD": {2, 0x36, 0, 1, -1, vexNDS3},
 	// VEX.128/256.66.0F38.WIG.
 	"VPMULLD":  {2, 0x40, 0, 1, -1, vexNDS3},
@@ -90,14 +99,14 @@ var vexTable = map[string]vexSpec{
 	"VPSHUFB":  {2, 0x00, 0, 1, -1, vexNDS3},
 	"VPCMPGTQ": {2, 0x37, 0, 1, -1, vexNDS3},
 
-	// VEX.128/256.66.0F.WIG — packed double-precision arithmetic / logic.
+	// VEX.128/256.66.0F.WIG, packed double-precision arithmetic / logic.
 	"VADDPD": {1, 0x58, 0, 1, -1, vexNDS3},
 	"VMULPD": {1, 0x59, 0, 1, -1, vexNDS3},
 	"VSUBPD": {1, 0x5C, 0, 1, -1, vexNDS3},
 	"VDIVPD": {1, 0x5E, 0, 1, -1, vexNDS3},
 	"VMINPD": {1, 0x5D, 0, 1, -1, vexNDS3},
 	"VMAXPD": {1, 0x5F, 0, 1, -1, vexNDS3},
-	// VEX.128/256.0F.WIG — packed single-precision arithmetic.
+	// VEX.128/256.0F.WIG, packed single-precision arithmetic.
 	"VADDPS":    {1, 0x58, 0, 0, -1, vexNDS3},
 	"VMULPS":    {1, 0x59, 0, 0, -1, vexNDS3},
 	"VSUBPS":    {1, 0x5C, 0, 0, -1, vexNDS3},
@@ -107,7 +116,7 @@ var vexTable = map[string]vexSpec{
 	"VXORPD":    {1, 0x57, 0, 1, -1, vexNDS3},
 	"VUNPCKHPD": {1, 0x15, 0, 1, -1, vexNDS3},
 	"VUNPCKLPD": {1, 0x14, 0, 1, -1, vexNDS3},
-	// VEX.128.F2.0F.WIG — scalar double-precision arithmetic (the packed
+	// VEX.128.F2.0F.WIG, scalar double-precision arithmetic (the packed
 	// opcodes with an F2 pp).
 	"VADDSD": {1, 0x58, 0, 3, -1, vexNDS3},
 	"VSUBSD": {1, 0x5C, 0, 3, -1, vexNDS3},
@@ -115,7 +124,7 @@ var vexTable = map[string]vexSpec{
 	"VDIVSD": {1, 0x5E, 0, 3, -1, vexNDS3},
 	"VMINSD": {1, 0x5D, 0, 3, -1, vexNDS3},
 	"VMAXSD": {1, 0x5F, 0, 3, -1, vexNDS3},
-	// VEX.128.F3.0F.WIG — scalar single-precision arithmetic (the packed
+	// VEX.128.F3.0F.WIG, scalar single-precision arithmetic (the packed
 	// opcodes with an F3 pp).
 	"VADDSS": {1, 0x58, 0, 2, -1, vexNDS3},
 	"VSUBSS": {1, 0x5C, 0, 2, -1, vexNDS3},
@@ -123,10 +132,16 @@ var vexTable = map[string]vexSpec{
 	"VDIVSS": {1, 0x5E, 0, 2, -1, vexNDS3},
 	"VMINSS": {1, 0x5D, 0, 2, -1, vexNDS3},
 	"VMAXSS": {1, 0x5F, 0, 2, -1, vexNDS3},
-	// VEX.128/256.66.0F38.W1 — fused multiply-add (NDS form).
+	// VEX.128/256.66.0F38.W1, fused multiply-add (NDS form).
 	"VFMADD231PD": {2, 0xB8, 1, 1, -1, vexNDS3},
+	// Scalar fused multiply-add (NDS form).  The Go assembler carries the
+	// same 66 prefix as the packed forms on every FMA row, and W1 on the
+	// double-precision spellings, so SD shares PD's prefix/W pair and the
+	// scalar width rides on the W bit.
+	"VFMADD213SD":  {2, 0xA9, 1, 1, -1, vexNDS3},
+	"VFNMADD231SD": {2, 0xBD, 1, 1, -1, vexNDS3},
 
-	// VEX.128/256.66.0F38.WIG — sign/zero extend and broadcast (reg=dst, rm=src,
+	// VEX.128/256.66.0F38.WIG, sign/zero extend and broadcast (reg=dst, rm=src,
 	// no vvvv).
 	"VPMOVSXWD":    {2, 0x23, 0, 1, -1, vexRM},
 	"VPMOVSXDQ":    {2, 0x25, 0, 1, -1, vexRM},
@@ -141,70 +156,105 @@ var vexTable = map[string]vexSpec{
 	"VPMOVZXWQ":    {2, 0x34, 0, 1, -1, vexRM},
 	"VPBROADCASTD": {2, 0x58, 0, 1, -1, vexRM},
 	"VPBROADCASTQ": {2, 0x59, 0, 1, -1, vexRM},
-	// VEX.128/256.F3.0F.WIG — signed dword to packed double conversion
+	"VPBROADCASTB": {2, 0x78, 0, 1, -1, vexRM},
+	"VPBROADCASTW": {2, 0x79, 0, 1, -1, vexRM},
+	// VEX.128/256.F3.0F.WIG, signed dword to packed double conversion
 	// (reg=dst, rm=src, no vvvv; the length follows the destination).
 	"VCVTDQ2PD": {1, 0xE6, 0, 2, -1, vexRM},
-	// VEX.128/256.0F.WIG — signed dword to packed single conversion
+	// VEX.128/256.0F.WIG, signed dword to packed single conversion
 	// (reg=dst, rm=src, no vvvv, no mandatory prefix).
 	"VCVTDQ2PS": {1, 0x5B, 0, 0, -1, vexRM},
-	// VEX.128/256.0F.WIG — packed single to packed double conversion
+	// VEX.128/256.0F.WIG, packed single to packed double conversion
 	// (reg=dst, rm=src; the destination is the wide operand and sets the
 	// length).  Intel's maps prescribe the F3 prefix here (VEX.pp = 10), but
 	// the Go assembler emits the instruction with pp = 00, and gasm follows
-	// the Go assembler's bytes — its machine code is the oracle, not the
+	// the Go assembler's bytes, its machine code is the oracle, not the
 	// manual.
 	"VCVTPS2PD": {1, 0x5A, 0, 0, -1, vexRM},
-	// VEX.128.F2.0F.WIG — duplicate the low double of each 128-bit lane
+	// VEX.128.F2.0F.WIG, duplicate the low double of each 128-bit lane
 	// (reg=dst, rm=src, no vvvv; the length follows the destination).
 	"VMOVDDUP": {1, 0x12, 0, 3, -1, vexRM},
-	// VEX.128/256.66.0F.WIG — move mask to a GPR (reg=gpr dst, rm=vec src).
+	// VEX.128/256.66.0F.WIG, move mask to a GPR (reg=gpr dst, rm=vec src).
 	"VPMOVMSKB": {1, 0xD7, 0, 1, -1, vexRM},
 	"VMOVMSKPS": {1, 0x50, 0, 0, -1, vexRM}, // no 66 prefix (that would be VMOVMSKPD)
 
-	// VEX.128/256.66.0F.WIG — immediate shifts (opdigit selects the shift).
+	// VEX.128/256.66.0F.WIG, immediate shifts (opdigit selects the shift).
 	"VPSLLD": {1, 0x72, 0, 1, 6, vexShiftImm},
 	"VPSRAD": {1, 0x72, 0, 1, 4, vexShiftImm},
 	"VPSRLD": {1, 0x72, 0, 1, 2, vexShiftImm},
 	"VPSRLQ": {1, 0x73, 0, 1, 2, vexShiftImm},
 	"VPSLLQ": {1, 0x73, 0, 1, 6, vexShiftImm},
 
-	// VEX.128/256.66.0F.WIG — immediate shuffle (reg=dst, rm=src, imm8).
+	// VEX.128/256.66.0F.WIG, immediate shuffle (reg=dst, rm=src, imm8).
 	"VPSHUFD": {1, 0x70, 0, 1, -1, vexImmRM},
-	// VEX.256.66.0F3A.W1 — qword permute (reg=dst, rm=src, imm8).
+	// VEX.256.66.0F3A.W1, qword permute (reg=dst, rm=src, imm8).
 	"VPERMQ": {3, 0x00, 1, 1, -1, vexImmRM},
 
-	// VEX.128/256.66.0F.WIG — two-source shuffle (reg=dst, vvvv=src1, rm=src2,
+	// VEX.128/256.66.0F.WIG, two-source shuffle (reg=dst, vvvv=src1, rm=src2,
 	// imm8).
 	"VSHUFPD": {1, 0xC6, 0, 1, -1, vexNDS3Imm},
-	// VEX.256.66.0F3A.W0 — permute / insert (same shape; VINSERTI128's rm is
+	// VEX.256.66.0F3A.W0, permute / insert (same shape; VINSERTI128's rm is
 	// the XMM or memory source).
 	"VPERM2I128":  {3, 0x46, 0, 1, -1, vexNDS3Imm},
 	"VINSERTI128": {3, 0x38, 0, 1, -1, vexNDS3Imm},
 
-	// VEX.256.66.0F3A.W0 — lane extract (reg=YMM src, rm=XMM/memory dst, imm8).
+	// VEX.256.66.0F3A.W0, lane extract (reg=YMM src, rm=XMM/memory dst, imm8).
 	"VEXTRACTI128": {3, 0x39, 0, 1, -1, vexExtract},
 	"VEXTRACTF128": {3, 0x19, 0, 1, -1, vexExtract},
-	// VEX.128/256.66.0F3A.W0 — half-precision convert back ($imm, src, dst:
-	// reg=src, rm=XMM/memory dst, imm8 — the extract layout).
+	// VEX.128/256.66.0F3A.W0, half-precision convert back ($imm, src, dst:
+	// reg=src, rm=XMM/memory dst, imm8, the extract layout).
 	"VCVTPS2PH": {3, 0x1D, 0, 1, -1, vexExtract},
 
-	// VEX.128.0F.W0 — no operands.
+	// VEX.128.0F.W0, no operands.
 	"VZEROUPPER": {1, 0x77, 0, 0, -1, vexZero},
+	// VEX.256.0F.W0, zero all vector registers (the L = 1 twin).
+	"VZEROALL": {1, 0x77, 0, 0, -1, vexZeroAll},
+	// VEX.128/256.66.0F38, byte shuffle shifts and the packed byte compare.
+	"VPSLLDQ":  {1, 0x73, 0, 1, 7, vexShiftImm},
+	"VPSRLDQ":  {1, 0x73, 0, 1, 3, vexShiftImm},
+	"VPCMPEQB": {1, 0x74, 0, 1, -1, vexNDS3},
+	// VEX.128/256.0F.WIG, packed single XOR (NDS form).
+	"VXORPS": {1, 0x57, 0, 0, -1, vexNDS3},
+	// VEX.256.66.0F3A.W0, two-source permutes and blends with an imm8 control.
+	"VPERM2F128": {3, 0x06, 0, 1, -1, vexNDS3Imm},
+	"VPBLENDD":   {3, 0x02, 0, 1, -1, vexNDS3Imm},
+	// VEX.128/256.66.0F3A.WIG, byte align (NDS + imm8); the ZMM spelling
+	// falls through to the EVEX table.
+	"VPALIGNR": {3, 0x0F, 0, 1, -1, vexNDS3Imm},
+	// VEX.128/256.66.0F3A.W0, carry-less multiply ($imm, src2, src1, dst).
+	"VPCLMULQDQ": {3, 0x44, 0, 1, -1, vexNDS3Imm},
+	// VEX.128/256.66.0F3A.W1, GF(2^8) affine transform (NDS + imm8).
+	"VGF2P8AFFINEQB": {3, 0xCE, 1, 1, -1, vexNDS3Imm},
+	// BMI1/BMI2 general-register VEX forms (see vexNDS3GPR/vexImmRMGPR).
+	"ANDNL": {2, 0xF2, 0, 0, -1, vexNDS3GPR},
+	"ANDNQ": {2, 0xF2, 1, 0, -1, vexNDS3GPR},
+	"MULXL": {2, 0xF6, 0, 3, -1, vexNDS3GPR},
+	"MULXQ": {2, 0xF6, 1, 3, -1, vexNDS3GPR},
+	"RORXL": {3, 0xF0, 0, 3, -1, vexImmRMGPR},
+	"RORXQ": {3, 0xF0, 1, 3, -1, vexImmRMGPR},
 
-	// VEX.128.0F.W0 — mask-register test (KTESTW k1, k2: reg = dst, rm = src).
+	// VEX.128.0F.W0, mask-register test (KTESTW k1, k2: reg = dst, rm = src).
 	"KTESTW": {1, 0x99, 0, 0, -1, vexRM},
 
-	// VEX.66.0F38.W0 — broadcast a single/double to all lanes (reg=dst,
+	// VEX.66.0F38.W0, broadcast a single/double to all lanes (reg=dst,
 	// rm=scalar memory; SD is 256-bit only).
 	"VBROADCASTSS": {2, 0x18, 0, 1, -1, vexRM},
 	"VBROADCASTSD": {2, 0x19, 0, 1, -1, vexRM},
-	// VEX.66.0F38.W0 — half-precision convert (reg=dst, rm=half-width
+	// VEX.256.66.0F38.W0, broadcast a 128-bit lane into both halves of a
+	// YMM (the encoder rejects an XMM destination, as go tool asm does).
+	"VBROADCASTI128": {2, 0x5A, 0, 1, -1, vexRM},
+	// VEX.128/256.66.0F.WIG, non-temporal store (vector source in reg,
+	// memory destination in rm).
+	"VMOVNTDQ": {1, 0xE7, 0, 1, -1, vexRMRev},
+	// VEX.128/256.66.0F38.W0, test (reg=dst, rm=src, no vvvv).
+	"VPTEST": {2, 0x17, 0, 1, -1, vexRM},
+	// VEX.66.0F38.W0, half-precision convert (reg=dst, rm=half-width
 	// source).
 	"VCVTPH2PS": {2, 0x13, 0, 1, -1, vexRM},
-	// VEX.F3.0F.WIG — replicate even/odd singles (reg=dst, rm=src).
+	// VEX.F3.0F.WIG, replicate even/odd singles (reg=dst, rm=src).
 	"VMOVSLDUP": {1, 0x12, 0, 2, -1, vexRM},
 	"VMOVSHDUP": {1, 0x16, 0, 2, -1, vexRM},
-	// VEX.66.0F.WIG — packed double to packed single conversion, the X/Y
+	// VEX.66.0F.WIG, packed double to packed single conversion, the X/Y
 	// spellings: the destination is always XMM and the spelling fixes the
 	// source length (X = 128, Y = 256).
 	"VCVTPD2PSX": {1, 0x5A, 0, 1, -1, vexRMSrcLen},
@@ -228,14 +278,14 @@ var vexTable = map[string]vexSpec{
 	"VCVTSI2SSL": {1, 0x2A, 0, 2, -1, vexNDS3},
 	"VCVTSI2SSQ": {1, 0x2A, 1, 2, -1, vexNDS3},
 
-	// VEX.128/256.66.0F.WIG — word shifts (opdigit selects the shift).
+	// VEX.128/256.66.0F.WIG, word shifts (opdigit selects the shift).
 	"VPSRLW": {1, 0x71, 0, 1, 2, vexShiftImm},
 	"VPSRAW": {1, 0x71, 0, 1, 4, vexShiftImm},
 	"VPSLLW": {1, 0x71, 0, 1, 6, vexShiftImm},
 
-	// VEX.F2.0F — packed double to packed dword conversions, truncating and
+	// VEX.F2.0F, packed double to packed dword conversions, truncating and
 	// non-truncating.  The destination is always XMM; the X/Y spellings fix
-	// the source length (XMM/YMM), and VEX.L follows it — see vexSrcLen.
+	// the source length (XMM/YMM), and VEX.L follows it, see vexSrcLen.
 	"VCVTPD2DQX":  {1, 0xE6, 0, 3, -1, vexRMSrcLen},
 	"VCVTPD2DQY":  {1, 0xE6, 0, 3, -1, vexRMSrcLen},
 	"VCVTTPD2DQX": {1, 0xE6, 0, 1, -1, vexRMSrcLen},
@@ -255,7 +305,7 @@ var vexSrcLen = map[string]int{
 	"VCVTPD2PSY":  1,
 }
 
-// vexVarShift maps the shift mnemonics to their variable-count opcode — the
+// vexVarShift maps the shift mnemonics to their variable-count opcode, the
 // form whose count comes from an XMM register or memory (VPSRLQ X0, Y8, Y8),
 // an ordinary NDS encoding rather than the /digit immediate form above.
 var vexVarShift = map[string]byte{
@@ -286,20 +336,22 @@ type vexMoveSpec struct {
 
 // vexMoveTable maps an upper-case move mnemonic to its encoding.
 var vexMoveTable = map[string]vexMoveSpec{
-	// VEX.128/256.F3.0F.WIG — unaligned integer move.
+	// VEX.128/256.F3.0F.WIG, unaligned integer move.
 	"VMOVDQU": {1, 2, 0x6F, 0x7F, 0, 0, 0, 0, true, false, false},
-	// VEX.128/256.66.0F.WIG — unaligned packed double move.
+	// VEX.128/256.66.0F.WIG, aligned integer move.
+	"VMOVDQA": {1, 1, 0x6F, 0x7F, 0, 0, 0, 0, true, false, false},
+	// VEX.128/256.66.0F.WIG, unaligned packed double move.
 	"VMOVUPD": {1, 1, 0x10, 0x11, 0, 0, 0, 0, true, false, false},
-	// VEX.128.66.0F.W0 — 32-bit GPR/memory ↔ XMM.
+	// VEX.128.66.0F.W0, 32-bit GPR/memory ↔ XMM.
 	"VMOVD": {1, 1, 0x6E, 0x7E, 0, 0, 0, 0, false, true, true},
-	// VMOVQ — 66 6E W1 (r/m→xmm), 66 7E W1 (xmm→r/m), 66 D6 W0 (xmm→xmm).
+	// VMOVQ, 66 6E W1 (r/m→xmm), 66 7E W1 (xmm→r/m), 66 D6 W0 (xmm→xmm).
 	"VMOVQ": {1, 1, 0x6E, 0x7E, 1, 1, 0xD6, 0, true, true, true},
-	// VEX.128.F2.0F.WIG — scalar double move, memory operands only (the
+	// VEX.128.F2.0F.WIG, scalar double move, memory operands only (the
 	// register form takes three operands and is not supported yet).
 	"VMOVSD": {1, 3, 0x10, 0x11, 0, 0, 0, 0, false, false, true},
-	// VEX.128.F3.0F.WIG — scalar single move, memory operands only.
+	// VEX.128.F3.0F.WIG, scalar single move, memory operands only.
 	"VMOVSS": {1, 2, 0x10, 0x11, 0, 0, 0, 0, false, false, true},
-	// VEX.128/256 — aligned packed moves.
+	// VEX.128/256, aligned packed moves.
 	"VMOVAPS": {1, 0, 0x28, 0x29, 0, 0, 0, 0, true, false, false},
 	"VMOVAPD": {1, 1, 0x28, 0x29, 0, 0, 0, 0, true, false, false},
 }
@@ -315,13 +367,21 @@ func isVex(mnemUpper string) bool {
 
 // encodeVex encodes a VEX instruction with operands in Plan 9 order.
 func (e *enc) encodeVex(mnemUpper string, ops []Operand) error {
-	// Vector register indices 16–31 exist only in EVEX encodings; fail
+	// Vector register indices 16-31 exist only in EVEX encodings; fail
 	// loudly rather than silently truncating the index.
 	for _, op := range ops {
 		if r, ok := op.(Reg); ok && r.isVec() && r.idx >= 16 {
 			return fmt.Errorf("%s: vector register index %d needs an EVEX (AVX-512) instruction", mnemUpper, r.idx)
 		}
 	}
+	// VBROADCASTI128 broadcasts a 128-bit lane into a 256-bit destination
+	// only; an XMM destination is rejected exactly as go tool asm does.
+	if mnemUpper == "VBROADCASTI128" {
+		dstReg, ok := ops[len(ops)-1].(Reg)
+		if len(ops) != 2 || !ok || dstReg.size != 32 {
+			return fmt.Errorf("VBROADCASTI128 requires a YMM destination")
+		}
+	}
 	if ms, ok := vexMoveTable[mnemUpper]; ok {
 		return e.encodeVexMove(mnemUpper, ms, ops)
 	}
@@ -354,6 +414,14 @@ func (e *enc) encodeVex(mnemUpper string, ops []Operand) error {
 		return e.encodeVexRMSrcLen(mnemUpper, spec, ops)
 	case vexZero:
 		return e.encodeVexZero(mnemUpper, spec, ops)
+	case vexZeroAll:
+		return e.encodeVexZeroAll(mnemUpper, spec, ops)
+	case vexNDS3GPR:
+		return e.encodeVexNDS3GPR(spec, ops)
+	case vexImmRMGPR:
+		return e.encodeVexImmRMGPR(spec, ops)
+	case vexRMRev:
+		return e.encodeVexRMRev(spec, ops)
 	}
 	return fmt.Errorf("unhandled VEX form for %s", mnemUpper)
 }
@@ -418,7 +486,7 @@ func (e *enc) encodeVexRM(spec vexSpec, ops []Operand) error {
 }
 
 // encodeVexRMSrcLen encodes a length-narrowing conversion: OP src, dst with
-// the destination always XMM and the VEX.L bit following the source — fixed
+// the destination always XMM and the VEX.L bit following the source, fixed
 // by the mnemonic's spelling (VCVTPD2DQX = 128, VCVTPD2DQY = 256) even when
 // the source is memory.
 func (e *enc) encodeVexRMSrcLen(mnem string, spec vexSpec, ops []Operand) error {
@@ -605,6 +673,83 @@ func (e *enc) encodeVexZero(mnem string, spec vexSpec, ops []Operand) error {
 	return nil
 }
 
+// encodeVexZeroAll encodes a no-operand instruction (VZEROALL), the L = 1
+// twin of VZEROUPPER.
+func (e *enc) encodeVexZeroAll(mnem string, spec vexSpec, ops []Operand) error {
+	if len(ops) != 0 {
+		return fmt.Errorf("%s expects no operands, got %d", mnem, len(ops))
+	}
+	// 2-byte VEX: R̄ = 1, v̄vvv = 1111 (unused), L = 1.
+	e.out = append(e.out, 0xC5, byte(1<<7|15<<3|1<<2|spec.pp), spec.opcode)
+	return nil
+}
+
+// encodeVexNDS3GPR encodes the three-operand NDS form over general-purpose
+// registers (ANDN, MULX): OP src2, src1, dst with reg = dst, vvvv = src1,
+// rm = src2 and L = 0.
+func (e *enc) encodeVexNDS3GPR(spec vexSpec, ops []Operand) error {
+	if len(ops) != 3 {
+		return fmt.Errorf("VEX NDS instruction expects 3 operands, got %d", len(ops))
+	}
+	src2, src1, dst := ops[0], ops[1], ops[2]
+	dstReg, ok := dst.(Reg)
+	if !ok || dstReg.isVec() {
+		return fmt.Errorf("VEX destination must be a general-purpose register")
+	}
+	vvvvReg, ok := src1.(Reg)
+	if !ok || vvvvReg.isVec() {
+		return fmt.Errorf("VEX vvvv operand must be a general-purpose register")
+	}
+	return e.emitVexFields(spec, 0, dstReg.idx&7, 0, 15-(vvvvReg.idx&15), src2)
+}
+
+// encodeVexImmRMGPR encodes the immediate form over general-purpose
+// registers (RORX): OP $imm, src, dst with reg = dst, rm = src, L = 0.
+func (e *enc) encodeVexImmRMGPR(spec vexSpec, ops []Operand) error {
+	if len(ops) != 3 {
+		return fmt.Errorf("instruction expects 3 operands ($imm, src, dst), got %d", len(ops))
+	}
+	imm, src, dst := ops[0], ops[1], ops[2]
+	immVal, ok := imm.(Imm)
+	if !ok {
+		return fmt.Errorf("shift control must be an immediate")
+	}
+	dstReg, ok := dst.(Reg)
+	if !ok || dstReg.isVec() {
+		return fmt.Errorf("VEX destination must be a general-purpose register")
+	}
+	immByte, err := imm8(int64(immVal))
+	if err != nil {
+		return err
+	}
+	if err := e.emitVexFields(spec, 0, dstReg.idx&7, 0, 15, src); err != nil {
+		return err
+	}
+	e.out = append(e.out, immByte)
+	return nil
+}
+
+// encodeVexRMRev encodes the reversed two-operand form: OP src, dst with the
+// vector source in ModRM.reg and the memory destination in r/m (VMOVNTDQ,
+// a store with no register-destination form).
+func (e *enc) encodeVexRMRev(spec vexSpec, ops []Operand) error {
+	if len(ops) != 2 {
+		return fmt.Errorf("store expects 2 operands, got %d", len(ops))
+	}
+	srcReg, ok := ops[0].(Reg)
+	if !ok || !srcReg.isVec() {
+		return fmt.Errorf("store source must be a vector register")
+	}
+	if !memOperand(ops[1]) {
+		return fmt.Errorf("store destination must be memory")
+	}
+	rBit := 0
+	if srcReg.idx >= 8 {
+		rBit = 1
+	}
+	return e.emitVexFields(spec, srcReg.vecLenBit(), srcReg.idx&7, rBit, 15, ops[1])
+}
+
 // encodeVexMove encodes a two-operand move (VMOVDQU, VMOVUPD, VMOVD, VMOVQ,
 // VMOVSD), picking the direction-specific opcode and VEX.W.  A vector→vector
 // move uses the store-form layout (reg = source, rm = destination), matching

asm/vex_test.go

@@ -19,6 +19,20 @@ func vreg(t *testing.T, name string) Reg {
 	return r
 }
 
+// x86asmUnrecognised lists the VEX mnemonics whose machine code the
+// golang.org/x/arch decoder cannot resolve; their bytes are verified against
+// go tool asm in the ground-truth tests instead.
+var x86asmUnrecognised = map[string]bool{
+	"ANDNL":        true,
+	"ANDNQ":        true,
+	"MULXL":        true,
+	"MULXQ":        true,
+	"RORXL":        true,
+	"RORXQ":        true,
+	"VFMADD213SD":  true,
+	"VFNMADD231SD": true,
+}
+
 // TestVexNDS3 encodes `mnem Y0, Y1, Y2` for every three-operand NDS
 // instruction and verifies it round-trips through the x86 decoder to the same
 // mnemonic.  A wrong opcode/map/pp surfaces as a different decoded instruction.
@@ -37,8 +51,15 @@ func TestVexNDS3(t *testing.T) {
 			t.Errorf("%s: Encode: %v", mnem, err)
 			continue
 		}
+		// The x86 decoder's table lacks a handful of rows the Go assembler
+		// emits (the scalar 213/231 FMA spellings among them); those are
+		// pinned byte for byte against go tool asm in TestVexGroundTruth
+		// instead of round-tripped here.
 		inst, err := x86asm.Decode(code, 64)
 		if err != nil {
+			if strings.Contains(err.Error(), "unrecognized instruction") && x86asmUnrecognised[mnem] {
+				continue
+			}
 			t.Errorf("%s: Decode(% x): %v", mnem, err, code)
 			continue
 		}
@@ -173,7 +194,7 @@ func TestVexGroundTruth(t *testing.T) {
 		{"VPMULLD Y1,Y2,Y3", "VPMULLD", []Operand{vreg(t, "Y1"), vreg(t, "Y2"), vreg(t, "Y3")}, "c4e26d40d9", ""},
 		{"VPUNPCKLDQ Y4,Y3,Y5", "VPUNPCKLDQ", []Operand{vreg(t, "Y4"), vreg(t, "Y3"), vreg(t, "Y5")}, "c5e562ec", ""},
 		{"VPERMD Y1,Y2,Y3", "VPERMD", []Operand{vreg(t, "Y1"), vreg(t, "Y2"), vreg(t, "Y3")}, "c4e26d36d9", ""},
-		// Floating point (packed and scalar) and FMA — same NDS form, the pp
+		// Floating point (packed and scalar) and FMA; same NDS form, the pp
 		// bits and map select the operation.
 		{"VADDPD Y9,Y8,Y8", "VADDPD", []Operand{vreg(t, "Y9"), vreg(t, "Y8"), vreg(t, "Y8")}, "c4413d58c1", ""},
 		{"VADDPD X1,X2,X3", "VADDPD", []Operand{vreg(t, "X1"), vreg(t, "X2"), vreg(t, "X3")}, "c5e958d9", ""},
@@ -184,6 +205,38 @@ func TestVexGroundTruth(t *testing.T) {
 		{"VMULSD X0,X1,X1", "VMULSD", []Operand{vreg(t, "X0"), vreg(t, "X1"), vreg(t, "X1")}, "c5f359c8", ""},
 		{"VFMADD231PD Y14,Y12,Y8", "VFMADD231PD", []Operand{vreg(t, "Y14"), vreg(t, "Y12"), vreg(t, "Y8")}, "c4429db8c6", ""},
 		{"VFMADD231PD (DI),Y12,Y8", "VFMADD231PD", []Operand{Ptr(DI, 0, 32), vreg(t, "Y12"), vreg(t, "Y8")}, "c4629db807", ""},
+		{"VFMADD213SD X0,X1,X2", "VFMADD213SD", []Operand{vreg(t, "X0"), vreg(t, "X1"), vreg(t, "X2")}, "c4e2f1a9d0", ""},
+		{"VFNMADD231SD X0,X1,X2", "VFNMADD231SD", []Operand{vreg(t, "X0"), vreg(t, "X1"), vreg(t, "X2")}, "c4e2f1bdd0", ""},
+		// Packed single XOR and byte compare (NDS form).
+		{"VXORPS Y0,Y1,Y2", "VXORPS", []Operand{vreg(t, "Y0"), vreg(t, "Y1"), vreg(t, "Y2")}, "c5f457d0", ""},
+		{"VPCMPEQB Y0,Y1,Y2", "VPCMPEQB", []Operand{vreg(t, "Y0"), vreg(t, "Y1"), vreg(t, "Y2")}, "c5f574d0", ""},
+		// Octa byte shifts (vvvv carries the destination).
+		{"VPSLLDQ $2,X0,X1", "VPSLLDQ", []Operand{Imm(2), vreg(t, "X0"), vreg(t, "X1")}, "c5f173f802", ""},
+		{"VPSRLDQ $2,Y0,Y1", "VPSRLDQ", []Operand{Imm(2), vreg(t, "Y0"), vreg(t, "Y1")}, "c5f573d802", ""},
+		// Two-source shuffle, blend and carry-less multiply (NDS + imm8).
+		{"VPERM2F128 $3,Y0,Y1,Y2", "VPERM2F128", []Operand{Imm(3), vreg(t, "Y0"), vreg(t, "Y1"), vreg(t, "Y2")}, "c4e37506d003", ""},
+		{"VPBLENDD $3,X0,X1,X2", "VPBLENDD", []Operand{Imm(3), vreg(t, "X0"), vreg(t, "X1"), vreg(t, "X2")}, "c4e37102d003", ""},
+		{"VPBLENDD $3,Y0,Y1,Y2", "VPBLENDD", []Operand{Imm(3), vreg(t, "Y0"), vreg(t, "Y1"), vreg(t, "Y2")}, "c4e37502d003", ""},
+		{"VPCLMULQDQ $0,X0,X1,X2", "VPCLMULQDQ", []Operand{Imm(0), vreg(t, "X0"), vreg(t, "X1"), vreg(t, "X2")}, "c4e37144d000", ""},
+		{"VGF2P8AFFINEQB $0,X0,X1,X2", "VGF2P8AFFINEQB", []Operand{Imm(0), vreg(t, "X0"), vreg(t, "X1"), vreg(t, "X2")}, "c4e3f1ced000", ""},
+		// Two-operand test and the non-temporal and broadcast stores.
+		{"VPTEST X0,X1", "VPTEST", []Operand{vreg(t, "X0"), vreg(t, "X1")}, "c4e27917c8", ""},
+		{"VPTEST Y0,Y1", "VPTEST", []Operand{vreg(t, "Y0"), vreg(t, "Y1")}, "c4e27d17c8", ""},
+		{"VMOVNTDQ Y0,(AX)", "VMOVNTDQ", []Operand{vreg(t, "Y0"), Ptr(AX, 0, 32)}, "c5fde700", ""},
+		{"VMOVNTDQ X0,(AX)", "VMOVNTDQ", []Operand{vreg(t, "X0"), Ptr(AX, 0, 16)}, "c5f9e700", ""},
+		{"VBROADCASTI128 (AX),Y1", "VBROADCASTI128", []Operand{Ptr(AX, 0, 16), vreg(t, "Y1")}, "c4e27d5a08", ""},
+		// Aligned integer move and the full zeroing form.
+		{"VMOVDQA X0,X1", "VMOVDQA", []Operand{vreg(t, "X0"), vreg(t, "X1")}, "c5f97fc1", ""},
+		{"VMOVDQA (AX),X1", "VMOVDQA", []Operand{Ptr(AX, 0, 16), vreg(t, "X1")}, "c5f96f08", ""},
+		{"VMOVDQA Y0,Y1", "VMOVDQA", []Operand{vreg(t, "Y0"), vreg(t, "Y1")}, "c5fd7fc1", ""},
+		{"VZEROALL", "VZEROALL", []Operand{}, "c5fc77", ""},
+		// BMI1/BMI2 general-register VEX forms.
+		{"ANDNL AX,BX,CX", "ANDNL", []Operand{AX, BX, CX}, "c4e260f2c8", ""},
+		{"ANDNQ AX,BX,CX", "ANDNQ", []Operand{AX, BX, CX}, "c4e2e0f2c8", ""},
+		{"MULXL AX,BX,CX", "MULXL", []Operand{AX, BX, CX}, "c4e263f6c8", ""},
+		{"MULXQ AX,BX,CX", "MULXQ", []Operand{AX, BX, CX}, "c4e2e3f6c8", ""},
+		{"RORXL $3,AX,CX", "RORXL", []Operand{Imm(3), AX, CX}, "c4e37bf0c803", ""},
+		{"RORXQ $3,AX,CX", "RORXQ", []Operand{Imm(3), AX, CX}, "c4e3fbf0c803", ""},
 		// Two-operand reg/rm form (v̄vvv must be 1111).
 		{"VPMOVSXDQ X0,Y4", "VPMOVSXDQ", []Operand{vreg(t, "X0"), vreg(t, "Y4")}, "c4e27d25e0", ""},
 		{"VPMOVSXWD (SI),Y0", "VPMOVSXWD", []Operand{Ptr(SI, 0, 8), vreg(t, "Y0")}, "c4e27d2306", ""},
@@ -217,7 +270,7 @@ func TestVexGroundTruth(t *testing.T) {
 		{"VEXTRACTI128 $1,Y8,X9", "VEXTRACTI128", []Operand{Imm(1), vreg(t, "Y8"), vreg(t, "X9")}, "c4437d39c101", ""},
 		{"VEXTRACTI128 $1,Y8,(DI)", "VEXTRACTI128", []Operand{Imm(1), vreg(t, "Y8"), Ptr(DI, 0, 16)}, "c4637d390701", ""},
 		{"VEXTRACTF128 $1,Y8,X9", "VEXTRACTF128", []Operand{Imm(1), vreg(t, "Y8"), vreg(t, "X9")}, "c4437d19c101", ""},
-		// Moves — each direction picks its own opcode and VEX.W.
+		// Moves; each direction picks its own opcode and VEX.W.
 		{"VMOVDQU (SI),Y1", "VMOVDQU", []Operand{Ptr(SI, 0, 32), vreg(t, "Y1")}, "c5fe6f0e", ""},
 		{"VMOVDQU Y3,(DI)", "VMOVDQU", []Operand{vreg(t, "Y3"), Ptr(DI, 0, 32)}, "c5fe7f1f", ""},
 		{"VMOVDQU X1,X2", "VMOVDQU", []Operand{vreg(t, "X1"), vreg(t, "X2")}, "c5fa7fca", ""},
@@ -234,7 +287,7 @@ func TestVexGroundTruth(t *testing.T) {
 		{"VMOVD AX,X0", "VMOVD", []Operand{AX, vreg(t, "X0")}, "c5f96ec0", ""},
 		{"VMOVSD (SI),X8", "VMOVSD", []Operand{Ptr(SI, 0, 8), vreg(t, "X8")}, "c57b1006", ""},
 		{"VMOVSD X8,(SI)", "VMOVSD", []Operand{vreg(t, "X8"), Ptr(SI, 0, 8)}, "c57b1106", ""},
-		// Packed double arithmetic and unpack — the NDS form, the opcode
+		// Packed double arithmetic and unpack; the NDS form, the opcode
 		// selects the operation.
 		{"VSUBPD Y1,Y2,Y3", "VSUBPD", []Operand{vreg(t, "Y1"), vreg(t, "Y2"), vreg(t, "Y3")}, "c5ed5cd9", ""},
 		{"VDIVPD X1,X2,X3", "VDIVPD", []Operand{vreg(t, "X1"), vreg(t, "X2"), vreg(t, "X3")}, "c5e95ed9", ""},
@@ -255,12 +308,12 @@ func TestVexGroundTruth(t *testing.T) {
 		{"VMINSS X6,X7,X8", "VMINSS", []Operand{vreg(t, "X6"), vreg(t, "X7"), vreg(t, "X8")}, "c5425dc6", ""},
 		{"VMAXSS X1,X2,X3", "VMAXSS", []Operand{vreg(t, "X1"), vreg(t, "X2"), vreg(t, "X3")}, "c5ea5fd9", ""},
 		{"VADDSD 8(AX),X1,X2", "VADDSD", []Operand{Ptr(AX, 8, 8), vreg(t, "X1"), vreg(t, "X2")}, "c5f3585008", ""},
-		// VMOVDDUP — duplicate the low double (reg=dst, rm=src, F2 pp).
+		// VMOVDDUP; duplicate the low double (reg=dst, rm=src, F2 pp).
 		{"VMOVDDUP X1,X2", "VMOVDDUP", []Operand{vreg(t, "X1"), vreg(t, "X2")}, "c5fb12d1", ""},
 		{"VMOVDDUP Y1,Y2", "VMOVDDUP", []Operand{vreg(t, "Y1"), vreg(t, "Y2")}, "c5ff12d1", ""},
 		{"VMOVDDUP 8(AX),X1", "VMOVDDUP", []Operand{Ptr(AX, 8, 8), vreg(t, "X1")}, "c5fb124808", ""},
 		// Conversions: DQ→PS (no prefix), PS→PD (Go emits it without the F3
-		// prefix — see the table comment), DQ→PD.
+		// prefix; see the table comment), DQ→PD.
 		{"VCVTDQ2PS X1,X2", "VCVTDQ2PS", []Operand{vreg(t, "X1"), vreg(t, "X2")}, "c5f85bd1", ""},
 		{"VCVTDQ2PS Y3,Y4", "VCVTDQ2PS", []Operand{vreg(t, "Y3"), vreg(t, "Y4")}, "c5fc5be3", ""},
 		{"VCVTPS2PD X1,X2", "VCVTPS2PD", []Operand{vreg(t, "X1"), vreg(t, "X2")}, "c5f85ad1", ""},
@@ -287,6 +340,12 @@ func TestVexGroundTruth(t *testing.T) {
 		}
 		inst, err := x86asm.Decode(code, 64)
 		if err != nil {
+			// The decoder's AVX/BMI table lacks a few rows the Go
+			// assembler emits (the GPR VEX forms and the scalar FMA
+			// spellings); their bytes are the ground truth here.
+			if x86asmUnrecognised[c.mnem] {
+				continue
+			}
 			t.Errorf("%s: Decode(% x): %v", c.name, code, err)
 			continue
 		}

ast/ast.go

@@ -17,7 +17,7 @@ type File struct {
 	Orphans []Stmt // labels/instructions seen before any TEXT directive
 	// Macros holds the names introduced by #define directives in this file.
 	// The linter uses it to avoid flagging macro invocations as unknown
-	// instructions (macro expansion itself is out of scope — see the docs).
+	// instructions (macro expansion itself is out of scope, see the docs).
 	Macros map[string]bool
 }
 
@@ -114,6 +114,7 @@ type Symbol struct {
 	Pkg    string // package prefix before the middle dot ("" = current package)
 	Name   string // identifier without the middle dot or <>
 	Static bool   // the <> marker is present
+	ABI    string // the <NAME> ABI marker, e.g. ABIInternal ("" when absent)
 	Pseudo string // FP, SP, SB or PC ("" for a bare name)
 	Offset int64
 	HasOff bool
@@ -123,10 +124,8 @@ type Symbol struct {
 // OpKind classifies an operand syntactically.
 type OpKind int
 
-// Operand kinds.
 const (
-	OpInvalid   OpKind = iota
-	OpImmediate        // $value
+	OpImmediate = iota // $value
 	OpAddr             // register, memory reference, symbol or label
 )
 
@@ -158,5 +157,5 @@ type Address struct {
 	Scale  int     // index scale; 0 when absent
 	Offset int64   // leading displacement, from off(base)
 	HasOff bool    // a leading displacement is present
-	Shift  string  // verbatim arm64 shift suffix, e.g. "<<2"
+	Shift  string  // verbatim arm64 shift suffix, e.g. "<< 2"
 }

ast/ast_test.go

@@ -54,11 +54,11 @@ func TestStmtPositions(t *testing.T) {
 // TestInterfaces confirms the node types satisfy their interfaces, so callers
 // can range over Decls and Stmts.
 func TestInterfaces(t *testing.T) {
-	var decls []Decl = []Decl{&Include{}, &Preproc{}, &Text{}, &Globl{}, &Data{}}
+	var decls = []Decl{&Include{}, &Preproc{}, &Text{}, &Globl{}, &Data{}}
 	if len(decls) != 5 {
 		t.Fatal("decl interface set")
 	}
-	var stmts []Stmt = []Stmt{&Label{}, &Instr{}}
+	var stmts = []Stmt{&Label{}, &Instr{}}
 	if len(stmts) != 2 {
 		t.Fatal("stmt interface set")
 	}

cmd/gasm/audit.go

@@ -0,0 +1,604 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: BSD-3-Clause
+
+package main
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"runtime"
+	"slices"
+	"strconv"
+	"strings"
+
+	"sourcedock.dev/petrbalvin/gasm-devkit/arch"
+	"sourcedock.dev/petrbalvin/gasm-devkit/asm"
+	"sourcedock.dev/petrbalvin/gasm-devkit/parser"
+)
+
+// cmdAuditInstructions cross-checks a gasm encoder against the Go toolchain's
+// own assembler, probed black-box: every mnemonic in the gasm table is offered
+// to go tool asm in its bare form, and a mnemonic counts as known to Go when
+// the error is anything but "unrecognized instruction" (a wrong-shape error
+// still proves the mnemonic exists in Go's tables).  The audit answers three
+// questions at a glance:
+//
+//   - which mnemonics gasm can encode that go tool asm does not know
+//     (superset encodings, usable only through the gasm goobj path);
+//   - which mnemonics the architecture table knows but the encoder cannot
+//     emit yet (the implementation backlog);
+//   - which mnemonics go tool asm knows that gasm cannot encode (feature
+//     gaps).
+//
+// The amd64 derived families (Jcc, CMOVcc, SETcc) exist on both sides by
+// construction and are excluded from the diff; the other architectures list
+// their conditional branches outright.
+func cmdAuditInstructions(args []string) error {
+	fs := newCommand("audit-instructions", "gasm audit-instructions [--corpus [dir]] [amd64|arm64|riscv64|loong64]", `
+Compare the gasm encoder for the given architecture (default amd64) against
+go tool asm and print the diff: superset encodings (gasm-only, shippable via
+gasm asm --format goobj) and known-but-unencodable names (the backlog).  The
+Go side is probed black-box one bare mnemonic at a time, so the audit tracks
+whatever toolchain `+"`go env GOROOT`"+` provides; the gasm side answers from
+the encoder table on amd64 and from trial assembly over a battery of operand
+shapes elsewhere.  Names go tool asm knows and gasm does not cannot be
+enumerated by probing, because Go's table is visible only through names
+already in the gasm table; the report closes with a note saying so.
+
+With --corpus the audit changes shape: it assembles every .s file under the
+given directory (default GOROOT/src) with the gasm encoder only, no
+toolchain probing.  A file whose name carries a recognisable _arch suffix is
+attempted for that architecture; a file without one is attempted for all
+four, exactly as a GOARCH build would compile it.  The report gives the
+per-architecture pass rates and the most common failure reasons, which drive
+the encodability backlog by frequency rather than by table order.
+`)
+	corpus := fs.Bool("corpus", false, "assemble a corpus of .s files and report pass rates and failure reasons")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	if *corpus {
+		return cmdAuditCorpus(fs.Args())
+	}
+	archName := "amd64"
+	switch n := len(fs.Args()); {
+	case n > 1:
+		return &usageError{fmt.Errorf("audit-instructions takes at most one architecture argument")}
+	case n == 1:
+		archName = strings.ToLower(fs.Arg(0))
+	}
+	a, err := auditArch(archName)
+	if err != nil {
+		return err
+	}
+
+	tab := arch.ForArch(a)
+	var names []string
+	seen := map[string]bool{}
+	for _, in := range tab.Instructions() {
+		name := strings.ToUpper(in.Name)
+		if a == arch.AMD64 && derivedFamily(name) || seen[name] {
+			continue
+		}
+		seen[name] = true
+		names = append(names, name)
+	}
+
+	goKnown, err := probeGoAsm(goarchName(a), names)
+	if err != nil {
+		return err
+	}
+
+	var superset, backlog, shared []string
+	for _, name := range names {
+		switch {
+		case !gasmEncodable(a, name):
+			backlog = append(backlog, name)
+		case !goKnown[name]:
+			superset = append(superset, name)
+		default:
+			shared = append(shared, name)
+		}
+	}
+	// GO-ONLY is not enumerable by probing: Go's table is only visible
+	// through names we already know, so nothing can be reported there.
+
+	slices.Sort(superset)
+	slices.Sort(backlog)
+	slices.Sort(shared)
+
+	w := os.Stdout
+	fmt.Fprintf(w, "gasm table (%s, families excluded): %d mnemonics\n", archName, len(names))
+	fmt.Fprintf(w, "gasm encodable: %d   go tool asm recognised: %d\n", len(shared)+len(superset), countTrue(goKnown))
+	fmt.Fprintf(w, "shared: %d\n", len(shared))
+	fmt.Fprintf(w, "\nSuperset encodings (gasm-only; ship via gasm asm --format goobj):\n")
+	for _, n := range superset {
+		fmt.Fprintf(w, "  %s\n", n)
+	}
+	fmt.Fprintf(w, "\nKnown but not encodable (backlog):\n")
+	for _, n := range backlog {
+		fmt.Fprintf(w, "  %s\n", n)
+	}
+	fmt.Fprintf(w, "\nGo-only names cannot be enumerated by probing; extend the gasm\n")
+	fmt.Fprintf(w, "table from the Go release notes when a new instruction family ships.\n")
+	return nil
+}
+
+// auditArch resolves the audit's architecture argument.
+func auditArch(name string) (arch.Arch, error) {
+	switch strings.ToLower(name) {
+	case "amd64":
+		return arch.AMD64, nil
+	case "arm64":
+		return arch.ARM64, nil
+	case "riscv64", "riscv":
+		return arch.RISCV, nil
+	case "loong64", "loong":
+		return arch.LOONG64, nil
+	}
+	return arch.Unknown, &usageError{fmt.Errorf("unknown architecture %q: want amd64, arm64, riscv64 or loong64", name)}
+}
+
+// goarchName maps an arch identifier onto its GOARCH spelling.
+func goarchName(a arch.Arch) string {
+	switch a {
+	case arch.ARM64:
+		return "arm64"
+	case arch.RISCV:
+		return "riscv64"
+	case arch.LOONG64:
+		return "loong64"
+	}
+	return "amd64"
+}
+
+func countTrue(m map[string]bool) int {
+	n := 0
+	for _, v := range m {
+		if v {
+			n++
+		}
+	}
+	return n
+}
+
+// derivedFamily reports whether a mnemonic belongs to a family both
+// assemblers construct from condition codes rather than list exhaustively
+// (JEQ/CMOVLGT/SETNE and friends).  Such names never probe cleanly, so
+// including them in the diff would be noise.  amd64 only: the other
+// architectures list their conditional branches outright.
+func derivedFamily(name string) bool {
+	if strings.HasPrefix(name, "J") && name != "JMP" && name != "JMPQ" {
+		return true
+	}
+	if strings.HasPrefix(name, "CMOV") || strings.HasPrefix(name, "SET") {
+		return true
+	}
+	return false
+}
+
+var unrecognizedRe = regexp.MustCompile(`unrecognized instruction`)
+
+// probeGoAsm feeds every mnemonic to go tool asm in one generated file and
+// classifies the diagnostics.  "Unrecognized instruction" is a parse-stage
+// verdict on the mnemonic alone, so a single bare-instruction probe per
+// mnemonic decides recognition; the combined file still reports every line's
+// error even when others fail.
+func probeGoAsm(goarch string, names []string) (map[string]bool, error) {
+	dir, err := os.MkdirTemp("", "gasm-audit")
+	if err != nil {
+		return nil, err
+	}
+	defer os.RemoveAll(dir)
+
+	var sb strings.Builder
+	sb.WriteString("TEXT ·probe(SB), 4, $0\n\tRET\n")
+	lineMnemonic := map[int]string{}
+	line := 3
+	for _, name := range names {
+		fmt.Fprintf(&sb, "TEXT ·p%s%d(SB), 4, $0\n", sanitize(name), line)
+		sb.WriteString("\t" + name + "\n\tRET\n")
+		lineMnemonic[line+1] = name // the instruction line, after TEXT
+		line += 3
+	}
+	probePath := filepath.Join(dir, "probe.s")
+	if err := os.WriteFile(probePath, []byte(sb.String()), 0o644); err != nil {
+		return nil, err
+	}
+
+	toolDir, err := exec.Command("go", "env", "GOTOOLDIR").Output()
+	if err != nil {
+		return nil, fmt.Errorf("go env GOTOOLDIR: %w", err)
+	}
+	asmBin := filepath.Join(strings.TrimSpace(string(toolDir)), "asm")
+	if _, err := os.Stat(asmBin); err != nil {
+		return nil, fmt.Errorf("go tool asm not found at %s", asmBin)
+	}
+	cmd := exec.Command(asmBin, "-p", "probe", "-o", filepath.Join(dir, "probe.o"), probePath)
+	cmd.Env = append(os.Environ(), "GOARCH="+goarch, "GOOS="+runtime.GOOS)
+	out, _ := cmd.CombinedOutput()
+	// The expected failure mode is a non-zero exit with compiler diagnostics
+	// on stdout; empty output means the probe broke at the exec level (a
+	// killed child, a tool that would not start), and seeding every name as
+	// recognized on that silence would fake a clean audit.
+	if len(out) == 0 {
+		return nil, fmt.Errorf("go tool asm probe for GOARCH=%s produced no output", goarch)
+	}
+
+	result := map[string]bool{}
+	for _, name := range names {
+		result[name] = true // no news = the name parsed fine
+	}
+	reParse := regexp.MustCompile(`probe\.s:(\d+):`)
+	for l := range strings.SplitSeq(string(out), "\n") {
+		m := reParse.FindStringSubmatch(l)
+		if m == nil {
+			continue
+		}
+		lineNo, err := strconv.Atoi(m[1])
+		if err != nil {
+			continue
+		}
+		if name, ok := lineMnemonic[lineNo]; ok && unrecognizedRe.MatchString(l) {
+			result[name] = false
+		}
+	}
+	return result, nil
+}
+
+// probeShapes lists representative operand shapes for the encodability
+// probe.  The assemblers report an unknown mnemonic and a known mnemonic
+// with no supported form alike ("unsupported <arch> instruction"), so only
+// a shape that assembles cleanly counts, and the backlog over-approximates:
+// a name whose real forms the battery misses lands there.  amd64 keeps its
+// exact table-driven check.
+func probeShapes(a arch.Arch) []string {
+	switch a {
+	case arch.ARM64:
+		return []string{
+			"X0, X1, X2", "X0, X1", "X0", "$1, X0", "X0, (X1)", "(X0), X1",
+			"X0, (X1, 8)", "(SP), X0", "F0, F1, F2", "F0, F1", "F0",
+			"V0.B16, V1.B16, V2.B16", "p2", "X0, p2", "X0, X1, p2",
+			// The conditional select family spells the condition first
+			// and takes R register spellings.
+			"EQ, R0, R1, R2", "EQ, R0, R1", "EQ, R0",
+			"GE, F0, F1, F2", "NE, F0, F1, $0",
+			// Pairs, acquire/release and exclusive atomics, LSE-AL forms.
+			"(R0), R1", "R0, (R1)", "R1, (R2), R3", "(R2, R3), 8(R1)",
+			"8(R1), (R2, R3)", "R1, R2, (R3)", "(R0)",
+			// System operations and their register/operand names.
+			"$4, R1, p2", "$35943", "$1", "$1, SPSel", "SPSel, R0",
+			"IVAC, R0", "(R0), PLDL1KEEP", "R1, R2, R3, R4",
+			// SIMD element, structure and literal-pool forms.
+			"(R0), [V1.B16]", "[V1.B16], (R0)", "V13.S[0], R1",
+			"R1, V2.B[3]", "$4, V1.B16, V2.B16", "V1.B16, (R0)",
+			"(R0), V1.B16", "",
+			// The spellings GOROOT's own kernels use, from the
+			// differential kernels this table was proven against.
+			"R0, p2", "R0, R1", "F0, F1, F2, F3", "$4, V1.B16, V2.B16, V3.B16, V4.B16",
+			"(R0), [V0.B8, V1.B8, V2.B8, V3.B8]", "$1, $2, V1",
+			"R0, R1, p2", "p2, R1", "$1234, R1", "DCZID_EL0, R1",
+			"$0", "R1, $4, EQ", "$33, R1, $25, R2", "$4, R1, p2",
+			"$4, V1.B8, V2.B8, V3.B8", "$63, V1.D2, V2.D2, V3.D2",
+			"V1.B16, [V2.B16], V3.B16", "V1.B8, [V2.B16, V3.B16], V4.B8",
+			"$4, V1.B16, V2.B16, V3.B16", "$15, V1", "V1, V2, p2",
+			"R0, R1, $1, $4, p2",
+		}
+	case arch.RISCV:
+		return []string{
+			"X5, X6, X7", "X5, X6", "X5", "$1, X5", "X5, (X6)", "$1, X5, X6",
+			"(X5), X6", "F0, F1, F2", "F0, F1", "p2", "X1, p2", "X0, p2",
+			"X5, X6, p2", "p2(SB)",
+			// AMO atomics: destination, base, source.
+			"R5, (R4), R6", "X5, (X4), X6",
+			// Segment stores take the first vector register aligned
+			// to the segment count, as the toolchain requires.
+			"(X5), X6, V0, V8", "(X5), X6, V0", "(X5), X0, V4",
+			// The FP multiply-add family takes four registers.
+			"F0, F1, F2, F3",
+			// The RVV slice: register, vector-register and vtype forms.
+			"V1, V2, V3", "V1, X5, V2", "V1", "V1, (X5)", "(X5), V1",
+			"$15, V1", "$15", "V1, V2", "V1, X5",
+			"X5, X6, p2", "R5, R6, p2",
+			"X5, E8, M8, TA, MA, X6", "$4, E32, M1, TA, MA, X1",
+			"(X5), X6, V1, V2",
+			"",
+		}
+	case arch.LOONG64:
+		return []string{
+			"R4, R5, R6", "R4, R5", "R4", "$1, R4", "R4, (R5)", "(R4), R5",
+			"F0, F1, F2", "F0, F1", "p2", "R1, p2", "R4, p2",
+			"$1, R4, R5, R6", "$65536, R4", "R4, R5, p2", "p2(SB)",
+			// AMO atomics: destination, base, source.
+			"R5, (R4), R6", "X5, (X4), X6",
+			// Segment stores take the first vector register aligned
+			// to the segment count, as the toolchain requires.
+			"(X5), X6, V0, V8", "(X5), X6, V0", "(X5), X0, V4",
+			// The LSX and LASX banks share the 5-bit numbering with F.
+			"V1, V2, V3", "X1, X2, X3", "V1, V2", "X1, X2", "V1", "X1",
+			// The vector compare-to-flag forms land in an FCC register.
+			"V1, FCC0", "X1, FCC0",
+			"",
+		}
+	}
+	return nil
+}
+
+// gasmEncodable reports whether the gasm encoder for a can emit the
+// mnemonic, decided by trial assembly over the shape battery.
+func gasmEncodable(a arch.Arch, name string) bool {
+	switch a {
+	case arch.ARM64, arch.RISCV, arch.LOONG64:
+	default:
+		return asm.Encodable(name)
+	}
+	for _, shape := range probeShapes(a) {
+		if gasmAssembles(a, name, shape) {
+			return true
+		}
+	}
+	return false
+}
+
+// gasmAssembles reports whether a one-instruction probe file containing name
+// with the given operand shape assembles without error.
+func gasmAssembles(a arch.Arch, name, shape string) bool {
+	src := "TEXT ·p(SB), NOSPLIT, $0\n\t" + name
+	if shape != "" {
+		src += " " + shape
+	}
+	src += "\n\tRET\np2:\n\tRET\n"
+	f, errs := parser.Parse("probe.s", src)
+	if len(errs) > 0 {
+		return false
+	}
+	var err error
+	switch a {
+	case arch.ARM64:
+		_, err = asm.AssembleFileARM64(f)
+	case arch.RISCV:
+		_, err = asm.AssembleFileRISCV(f)
+	case arch.LOONG64:
+		_, err = asm.AssembleFileLOONG64(f)
+	}
+	return err == nil
+}
+
+// sanitize makes a mnemonic safe for use in a Go symbol name.
+func sanitize(name string) string {
+	return strings.NewReplacer(".", "_", "$", "_").Replace(name)
+}
+
+// --- corpus audit -----------------------------------------------------------
+
+// corpusTarget is one architecture row of the corpus report.
+type corpusTarget struct {
+	a    arch.Arch
+	name string
+}
+
+// corpusTally accumulates one architecture's attempts over the corpus.
+type corpusTally struct {
+	attempted int
+	assembled int
+	reasons   map[string]int    // failure reason → count
+	example   map[string]string // failure reason → one representative file
+}
+
+func (t *corpusTally) fail(path, reason string) {
+	t.reasons[reason]++
+	if t.example[reason] == "" {
+		t.example[reason] = path
+	}
+}
+
+// cmdAuditCorpus implements audit-instructions --corpus.
+func cmdAuditCorpus(args []string) error {
+	if len(args) > 1 {
+		return &usageError{fmt.Errorf("audit-instructions --corpus takes at most one directory argument")}
+	}
+	root := ""
+	if len(args) == 1 {
+		root = args[0]
+	} else {
+		out, err := exec.Command("go", "env", "GOROOT").Output()
+		if err != nil {
+			return fmt.Errorf("locate GOROOT: %w", err)
+		}
+		root = filepath.Join(strings.TrimSpace(string(out)), "src")
+	}
+	stats, err := runCorpusAudit(root)
+	if err != nil {
+		return err
+	}
+	printCorpusStats(stats)
+	return nil
+}
+
+// corpusStats is the outcome of one corpus audit run.
+type corpusStats struct {
+	root      string
+	files     int
+	generic   int // files attempted for all four architectures
+	otherPort int // files named for another Go port: never attempted
+	full      int // files that assembled for every target architecture
+	targets   []corpusTarget
+	tallies   []*corpusTally
+}
+
+// runCorpusAudit assembles every .s file under root and returns the stats.
+// goPortSuffixes lists every architecture the Go project ports to.  A file
+// named for one of them belongs to that port's build, not to the generic
+// set, even when gasm does not support the architecture.
+var goPortSuffixes = []string{
+	"386", "amd64", "arm", "arm64", "loong64", "mips", "mips64",
+	"mips64le", "mipsle", "ppc64", "ppc64le", "riscv", "riscv64",
+	"s390x", "wasm",
+}
+
+// otherPortFile reports whether the file's name carries a Go-architecture
+// suffix gasm does not support.
+func otherPortFile(path string) bool {
+	base := path
+	if i := strings.LastIndexByte(base, '/'); i >= 0 {
+		base = base[i+1:]
+	}
+	for _, sfx := range goPortSuffixes {
+		if strings.HasSuffix(base, "_"+sfx+".s") {
+			return true
+		}
+	}
+	return false
+}
+
+func runCorpusAudit(root string) (*corpusStats, error) {
+	files, err := asmFiles(root)
+	if err != nil {
+		return nil, err
+	}
+
+	targets := []corpusTarget{
+		{arch.AMD64, "amd64"},
+		{arch.ARM64, "arm64"},
+		{arch.RISCV, "riscv64"},
+		{arch.LOONG64, "loong64"},
+	}
+	tallies := make([]*corpusTally, len(targets))
+	for i := range tallies {
+		tallies[i] = &corpusTally{reasons: map[string]int{}, example: map[string]string{}}
+	}
+	// full is the north-star number: a file counts when every architecture
+	// its name allows assembles it.
+	full, generic, otherPort := 0, 0, 0
+
+	for _, path := range files {
+		src, err := readSource(path)
+		if err != nil {
+			return nil, err
+		}
+		f, errs := parser.Parse(path, src)
+
+		var wanted []int // indexes into targets
+		if a := arch.FromFilename(path); a != arch.Unknown {
+			for i, tg := range targets {
+				if tg.a == a {
+					wanted = append(wanted, i)
+				}
+			}
+		} else if otherPortFile(path) {
+			// A file named for a Go port gasm does not support (arm,
+			// 386, s390x, ...) is compiled by no supported-arch build,
+			// so it is neither generic nor a per-arch attempt: counting
+			// it as generic would make the headline unreachably low
+			// for reasons no supported target can fix.
+			otherPort++
+		} else {
+			generic++
+			for i := range targets {
+				wanted = append(wanted, i)
+			}
+		}
+
+		ok := true
+		for _, i := range wanted {
+			tg, t := targets[i], tallies[i]
+			t.attempted++
+			var err error
+			if len(errs) > 0 {
+				err = errs[0] // a parse failure is a failure for every target
+			} else {
+				_, err = assembleFile(tg.a, f)
+			}
+			if err != nil {
+				ok = false
+				t.fail(path, corpusReason(err))
+				continue
+			}
+			t.assembled++
+		}
+		if ok && len(wanted) > 0 {
+			full++
+		}
+	}
+
+	return &corpusStats{
+		root:      root,
+		files:     len(files),
+		generic:   generic,
+		otherPort: otherPort,
+		full:      full,
+		targets:   targets,
+		tallies:   tallies,
+	}, nil
+}
+
+// printCorpusStats renders the corpus audit report.
+func printCorpusStats(s *corpusStats) {
+	fmt.Printf("corpus %s: %d files (%d generic, attempted for all architectures; %d named for other Go ports, never attempted)\n", s.root, s.files, s.generic, s.otherPort)
+	// The rate is over the files a supported build would attempt: the
+	// other ports' files sit in the count for completeness but can never
+	// assemble, so counting them in the denominator would report the gap
+	// of architectures gasm deliberately does not target.
+	attemptable := max(s.files-s.otherPort, 1)
+	fmt.Printf("  assemble for every target architecture: %d of %d attemptable (%.1f%%)\n", s.full, attemptable, 100*float64(s.full)/float64(attemptable))
+	for i, tg := range s.targets {
+		t := s.tallies[i]
+		fmt.Printf("  %s: %d/%d attempted\n", tg.name, t.assembled, t.attempted)
+		for _, r := range topReasons(t) {
+			fmt.Printf("    %4d  %s\n", t.reasons[r], r)
+			fmt.Printf("         e.g. %s\n", t.example[r])
+		}
+	}
+}
+
+// corpusReason buckets an assembly or parse failure for the histogram.
+func corpusReason(err error) string {
+	msg := err.Error()
+	switch {
+	case strings.Contains(msg, "unsupported"), strings.Contains(msg, "cannot encode"):
+		return "instruction not encodable"
+	case strings.Contains(msg, "undefined label"):
+		return "undefined label"
+	case strings.Contains(msg, "undefined symbol"), strings.Contains(msg, "external symbol"), strings.Contains(msg, "file-level assembly"):
+		return "undefined symbol or external"
+	case strings.Contains(msg, "operand"), strings.Contains(msg, "operand form"):
+		return "unsupported operand form"
+	default:
+		return "other: " + firstLine(msg)
+	}
+}
+
+// topReasons returns at most five reasons, most frequent first.
+func topReasons(t *corpusTally) []string {
+	type kv struct {
+		k string
+		n int
+	}
+	var kvs []kv
+	for k, n := range t.reasons {
+		kvs = append(kvs, kv{k, n})
+	}
+	slices.SortFunc(kvs, func(a, b kv) int { return b.n - a.n })
+	if len(kvs) > 5 {
+		kvs = kvs[:5]
+	}
+	out := make([]string, len(kvs))
+	for i, kv := range kvs {
+		out[i] = kv.k
+	}
+	return out
+}
+
+// firstLine returns the first line of an error message, truncated.
+func firstLine(msg string) string {
+	if i := strings.IndexByte(msg, '\n'); i >= 0 {
+		msg = msg[:i]
+	}
+	if len(msg) > 80 {
+		msg = msg[:80]
+	}
+	return msg
+}

cmd/gasm/audit_test.go

@@ -0,0 +1,66 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: BSD-3-Clause
+
+package main
+
+import (
+	"testing"
+
+	"sourcedock.dev/petrbalvin/gasm-devkit/arch"
+)
+
+func TestDerivedFamily(t *testing.T) {
+	for _, n := range []string{"JEQ", "JLT", "JCC", "CMOVLGT", "SETNE", "SETA"} {
+		if !derivedFamily(n) {
+			t.Errorf("derivedFamily(%q) = false, want true", n)
+		}
+	}
+	for _, n := range []string{"JMP", "ADDQ", "VPGATHERDD", "MOVBE", "PSHUFB"} {
+		if derivedFamily(n) {
+			t.Errorf("derivedFamily(%q) = true, want false", n)
+		}
+	}
+}
+
+func TestSanitize(t *testing.T) {
+	if got := sanitize("VPCMP.UB"); got != "VPCMP_UB" {
+		t.Errorf("sanitize: got %q", got)
+	}
+}
+
+func TestAuditArch(t *testing.T) {
+	for in, want := range map[string]arch.Arch{
+		"amd64": arch.AMD64, "arm64": arch.ARM64,
+		"riscv64": arch.RISCV, "riscv": arch.RISCV,
+		"loong64": arch.LOONG64, "LOONG": arch.LOONG64,
+	} {
+		got, err := auditArch(in)
+		if err != nil || got != want {
+			t.Errorf("auditArch(%q) = %v, %v; want %v", in, got, err, want)
+		}
+	}
+	if _, err := auditArch("mips"); err == nil {
+		t.Error("auditArch(mips) must fail")
+	}
+}
+
+func TestGasmEncodable(t *testing.T) {
+	cases := []struct {
+		a   arch.Arch
+		yes string
+		no  string
+	}{
+		{arch.AMD64, "ADDQ", "NOSUCHMNEMONIC"},
+		{arch.ARM64, "ADD", "NOSUCHMNEMONIC"},
+		{arch.RISCV, "ADD", "NOSUCHMNEMONIC"},
+		{arch.LOONG64, "ADDV", "NOSUCHMNEMONIC"},
+	}
+	for _, c := range cases {
+		if !gasmEncodable(c.a, c.yes) {
+			t.Errorf("%s: %s should be encodable", c.a, c.yes)
+		}
+		if gasmEncodable(c.a, c.no) {
+			t.Errorf("%s: %s should not be encodable", c.a, c.no)
+		}
+	}
+}

cmd/gasm/debug_linux.go

@@ -0,0 +1,336 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build linux
+
+package main
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"sort"
+	"strings"
+	"time"
+
+	"sourcedock.dev/petrbalvin/gasm-devkit/debug"
+	"sourcedock.dev/petrbalvin/gasm-devkit/verify"
+)
+
+func cmdDebug(args []string) int {
+	fs := newCommand("debug", "gasm debug <file.s> --func <name>", `
+Interactive debugger for JIT-assembled functions.  Launches the
+function in a traced subprocess (ptrace), then provides a REPL for
+single-stepping, breakpoints, register and memory inspection.
+
+REPL commands:
+  break <label|addr|line> [if <reg> <op> <val|reg|*addr>]
+                       set a breakpoint, optionally conditional on a
+                       comparison of one register against a constant,
+                       another register, or the 8-byte word at *addr
+  delete <label|addr>  remove a breakpoint
+  info break           list all breakpoints
+  step [n], s          single-step n instructions (default 1)
+  next, n              step over a CALL
+  finish, fin          run until the function returns
+  continue, c          run until a breakpoint, watchpoint or exit
+  disas [n], u         disassemble n instructions at PC
+  regs                 print general-purpose and vector registers
+  where                show source line and nearest label at PC
+  stack                show stack near RSP (return address + ABI0 args)
+  bt, backtrace        backtrace (current frame + return address)
+  x [addr] [len]       hex-dump memory (default: current PC, 64 bytes)
+  w <addr> <val...>    write bytes to memory
+  set <reg> <value>    set a register
+  watch <addr> [r|w] [size]
+                       set a hardware watchpoint (write by default)
+  unwatch [<slot>]     clear one watchpoint, or all without an argument
+  labels, l            list function labels and offsets
+  help, h, ?           show command help
+  quit, q              kill the debuggee and exit
+`)
+	funcName := fs.String("func", "", "function to debug")
+	argsFile := fs.String("args", "", "file containing the ABI0 argument block")
+	bufSpec := fs.String("buf", "", "buffer specification: name:size:pattern[,name:size:pattern...] where pattern is zero, ones, seq, or hex")
+	script := fs.String("script", "", "run REPL commands from a file (one per line) and exit; '-' reads stdin")
+	cover := fs.Bool("cover", false, "run to completion with a breakpoint on every instruction and report which executed and how often")
+	timeout := fs.Duration("timeout", 0, "kill the debuggee after this duration (e.g. 30s); for headless --script runs; a timeout exits 3")
+	fs.Parse(args)
+
+	// --- Debuggee mode (internal, spawned by the debugger) ---
+	if os.Getenv("GASM_DEBUG_TARGET") != "" {
+		tmpDir := os.Getenv("GASM_DEBUG_TMP")
+		if tmpDir == "" || fs.NArg() < 1 || *funcName == "" || *argsFile == "" {
+			fmt.Fprintln(os.Stderr, "gasm debug: internal debuggee mode")
+			return 2
+		}
+		if err := debug.RunTarget(fs.Arg(0), *funcName, *argsFile, tmpDir); err != nil {
+			fmt.Fprintf(os.Stderr, "gasm debug: %v\n", err)
+			return 1
+		}
+		return 0
+	}
+
+	// --- Debugger mode (interactive REPL) ---
+	if fs.NArg() < 1 || *funcName == "" {
+		fmt.Fprintln(os.Stderr, "usage: gasm debug <file.s> --func <name>")
+		return 2
+	}
+	path := fs.Arg(0)
+
+	// The watchdog is armed before anything can block: ptrace attach and a
+	// continued kernel loop both hang the run when the environment forbids
+	// tracing or the kernel loops forever, and neither is interruptible from
+	// the inside.
+	if *timeout > 0 {
+		go func() {
+			time.Sleep(*timeout)
+			fmt.Fprintf(os.Stderr, "gasm debug: timeout (%s), killing the debuggee\n", *timeout)
+			os.Exit(3)
+		}()
+	}
+
+	// Load the kernel to extract function metadata and labels.
+	k, err := verify.Load(path)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "gasm debug: %v\n", err)
+		return 1
+	}
+	defer k.Close()
+
+	fl, err := k.Func(*funcName)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "gasm debug: %v\n", err)
+		return 1
+	}
+
+	// Build the label list for the REPL.
+	var labels []debug.Label
+	for name, off := range fl.Labels {
+		labels = append(labels, debug.Label{Name: name, Offset: off})
+	}
+	sort.Slice(labels, func(i, j int) bool { return labels[i].Offset < labels[j].Offset })
+
+	// Launch the debuggee with the argument block.
+	var argBlock []byte
+	var bufAddrs []uint64
+	var sess *debug.Session
+	if *bufSpec != "" {
+		// Parse the function signature to determine argument layout.
+		src, err := readSource(path)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "gasm debug: %v\n", err)
+			return 1
+		}
+		sig, ok := verify.ExtractFuncSig(src, *funcName)
+		if !ok {
+			fmt.Fprintf(os.Stderr, "gasm debug: no // func signature found for %s\n", *funcName)
+			return 1
+		}
+		layout := verify.ArgLayout(sig)
+
+		// Parse the buffer spec to get buffer names.
+		bufNames := parseBufNames(*bufSpec)
+
+		// Allocate buffers in the debuggee.
+		argBlock = make([]byte, fl.Args)
+		sess, bufAddrs, err = debug.LaunchWithBuffers("", path, *funcName, argBlock, *bufSpec)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "gasm debug: %v\n", err)
+			return 1
+		}
+
+		// Construct the argument block with buffer pointers at the correct positions.
+		for _, arg := range layout {
+			if !arg.IsPtr {
+				continue
+			}
+			// Find the buffer that matches this argument.
+			for i, name := range bufNames {
+				if i < len(bufAddrs) && (name == arg.Name || strings.HasPrefix(arg.Name, name)) {
+					addr := bufAddrs[i]
+					off := arg.Offset
+					if off+8 <= len(argBlock) {
+						argBlock[off] = byte(addr)
+						argBlock[off+1] = byte(addr >> 8)
+						argBlock[off+2] = byte(addr >> 16)
+						argBlock[off+3] = byte(addr >> 24)
+						argBlock[off+4] = byte(addr >> 32)
+						argBlock[off+5] = byte(addr >> 40)
+						argBlock[off+6] = byte(addr >> 48)
+						argBlock[off+7] = byte(addr >> 56)
+					}
+					// For slices, also set the length and capacity.
+					if strings.HasPrefix(arg.Typ, "[]") && off+24 <= len(argBlock) {
+						// Find the buffer size from the spec.
+						size := parseBufSize(*bufSpec, name)
+						// Length at offset+8, capacity at offset+16.
+						for j := range 8 {
+							argBlock[off+8+j] = byte(size >> (j * 8))
+							argBlock[off+16+j] = byte(size >> (j * 8))
+						}
+					}
+					break
+				}
+			}
+		}
+	} else {
+		argBlock = make([]byte, fl.Args)
+		sess, err = debug.Launch("", path, *funcName, argBlock)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "gasm debug: %v\n", err)
+			return 1
+		}
+	}
+	defer sess.Kill()
+
+	bm := debug.NewBreakpoints(sess)
+	fmt.Printf("gasm debug: %s in %s (pid %d)\n", *funcName, path, sess.Pid())
+
+	// Convert the line table for the command loop.
+	var srcLines []debug.SourceLine
+	for _, le := range fl.Lines {
+		srcLines = append(srcLines, debug.SourceLine{Offset: le.Offset, Line: le.Line})
+	}
+
+	// Coverage mode: pre-register a breakpoint on every instruction (walked
+	// by length through the function body while the debuggee is stopped) and
+	// let the kernel run to completion.  Each trap counts a hit for that
+	// instruction, so the final report shows exactly which instructions
+	// executed and how often, with the label-level view derived from it.
+	// Expect the run to slow to ptrace speed: one trap per executed
+	// instruction.
+	if *cover {
+		base := sess.CodeBase() + uint64(fl.Offset)
+		type coverInstr struct {
+			off  uint64
+			text string
+		}
+		var instrs []coverInstr
+		for off := uint64(0); off < uint64(fl.Size); {
+			text, ln, err := sess.Disassemble(base + off)
+			if err != nil || ln == 0 {
+				break
+			}
+			instrs = append(instrs, coverInstr{off: off, text: text})
+			off += uint64(ln)
+		}
+		for _, in := range instrs {
+			if _, err := bm.SetWithCond(base+in.off, fmt.Sprintf("func+%#x", in.off), nil); err != nil {
+				fmt.Fprintf(os.Stderr, "gasm debug: cover: %v\n", err)
+				return 1
+			}
+		}
+		fmt.Printf("gasm debug: coverage run over %d instructions\n", len(instrs))
+		for {
+			for _, bp := range bm.All() {
+				bm.Reinsert(bp.Addr)
+			}
+			if err := sess.Continue(); err != nil {
+				break // debuggee finished or died
+			}
+			if sess.Exited() {
+				break
+			}
+			// A genuine signal-delivery-stop (a fault in the kernel): the
+			// run cannot make progress, because resuming would restart the
+			// faulting instruction and fault forever.  Report and stop.
+			if sig := sess.LastSignal(); sig != 0 {
+				fmt.Printf("gasm debug: cover: stopped on signal %v\n", sig)
+				break
+			}
+			regs, rerr := sess.GetRegs()
+			if rerr != nil {
+				break
+			}
+			// HandleTrap restores the original byte, rewinds PC and counts
+			// the hit on the breakpoint itself.  Single-step over the
+			// restored instruction so the reinsertion at the top of the
+			// loop cannot re-trap on the same breakpoint.
+			if bp := bm.HandleTrap(&regs); bp != nil {
+				if err := sess.Step(); err != nil {
+					break
+				}
+			}
+		}
+		hits := map[uint64]int{}
+		traps := 0
+		for _, bp := range bm.All() {
+			if n := bp.Hits(); n > 0 {
+				hits[bp.Addr-base] = n
+				traps += n
+			}
+		}
+		var hit []string
+		var missed []string
+		for _, l := range labels {
+			if hits[uint64(l.Offset)] > 0 {
+				hit = append(hit, l.Name)
+			} else {
+				missed = append(missed, l.Name)
+			}
+		}
+		sort.Strings(hit)
+		sort.Strings(missed)
+		fmt.Printf("coverage: %d/%d instructions executed (%d traps)\n", len(hits), len(instrs), traps)
+		fmt.Printf("coverage: %d/%d labels reached\n", len(hit), len(labels))
+		for _, l := range hit {
+			fmt.Printf("  covered   %s\n", l)
+		}
+		for _, l := range missed {
+			fmt.Printf("  MISSED    %s\n", l)
+		}
+		fmt.Println("executed instructions:")
+		for _, in := range instrs {
+			if n := hits[in.off]; n > 0 {
+				fmt.Printf("  func+%#04x  %4dx  %s\n", in.off, n, in.text)
+			}
+		}
+		return 0
+	}
+
+	// Headless mode: run the script through the normal command loop and
+	// exit.  The watchdog armed above covers launch, continue and step.
+	var in io.Reader = os.Stdin
+	if *script != "" {
+		if *script == "-" {
+			in = os.Stdin
+		} else {
+			f, err := os.Open(*script)
+			if err != nil {
+				fmt.Fprintf(os.Stderr, "gasm debug: %v\n", err)
+				return 1
+			}
+			defer f.Close()
+			in = f
+		}
+	}
+	debug.REPL(sess, bm, sess.CodeBase(), fl.Offset, fl.Size, fl.Args, labels, srcLines, in)
+	return 0
+}
+
+// parseBufNames extracts buffer names from a buffer specification.
+// Format: name:size:pattern[,name:size:pattern...]
+func parseBufNames(spec string) []string {
+	var names []string
+	for part := range strings.SplitSeq(spec, ",") {
+		fields := strings.SplitN(part, ":", 3)
+		if len(fields) >= 1 && fields[0] != "" {
+			names = append(names, fields[0])
+		}
+	}
+	return names
+}
+
+// parseBufSize extracts the size of a named buffer from a buffer specification.
+func parseBufSize(spec, name string) int {
+	for part := range strings.SplitSeq(spec, ",") {
+		fields := strings.SplitN(part, ":", 3)
+		if len(fields) >= 2 && fields[0] == name {
+			var size int
+			fmt.Sscanf(fields[1], "%d", &size)
+			return size
+		}
+	}
+	return 0
+}

cmd/gasm/debug_linux_amd64.go

@@ -1,193 +0,0 @@
-// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
-// SPDX-License-Identifier: BSD-3-Clause
-
-//go:build linux && amd64
-
-package main
-
-import (
-	"fmt"
-	"os"
-	"sort"
-	"strings"
-
-	"sourcedock.dev/petrbalvin/gasm-devkit/debug"
-	"sourcedock.dev/petrbalvin/gasm-devkit/verify"
-)
-
-func cmdDebug(args []string) int {
-	fs := newCommand("debug", "gasm debug <file.s> --func <name>", `
-Interactive debugger for JIT-assembled amd64 functions.  Launches the
-function in a traced subprocess (ptrace), then provides a REPL for
-single-stepping, breakpoints, register and memory inspection.
-
-REPL commands:
-  break <label|addr>   set a breakpoint at a label or absolute address
-  step [n]             single-step n instructions (default 1)
-  continue             run until next breakpoint or exit
-  regs                 print general-purpose registers
-  x [addr] [len]       hex-dump memory (default: current PC, 64 bytes)
-  labels               list function labels and offsets
-  quit                 kill the debuggee and exit
-`)
-	target := fs.Bool("target", false, "") // hidden: debuggee subprocess mode
-	funcName := fs.String("func", "", "function to debug")
-	argsFile := fs.String("args", "", "file containing the ABI0 argument block")
-	bufSpec := fs.String("buf", "", "buffer specification: name:size:pattern[,name:size:pattern...] where pattern is zero, ones, seq, or hex")
-	fs.Parse(args)
-
-	// --- Debuggee mode (internal, spawned by the debugger) ---
-	if *target {
-		tmpDir := os.Getenv("GASM_DEBUG_TMP")
-		if tmpDir == "" || fs.NArg() < 1 || *funcName == "" || *argsFile == "" {
-			fmt.Fprintln(os.Stderr, "gasm debug --target: internal mode")
-			return 2
-		}
-		if err := debug.RunTarget(fs.Arg(0), *funcName, *argsFile, tmpDir); err != nil {
-			fmt.Fprintf(os.Stderr, "gasm debug: %v\n", err)
-			return 1
-		}
-		return 0
-	}
-
-	// --- Debugger mode (interactive REPL) ---
-	if fs.NArg() < 1 || *funcName == "" {
-		fmt.Fprintln(os.Stderr, "usage: gasm debug <file.s> --func <name>")
-		return 2
-	}
-	path := fs.Arg(0)
-
-	// Load the kernel to extract function metadata and labels.
-	k, err := verify.Load(path)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "gasm debug: %v\n", err)
-		return 1
-	}
-	defer k.Close()
-
-	fl, err := k.Func(*funcName)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "gasm debug: %v\n", err)
-		return 1
-	}
-
-	// Build the label list for the REPL.
-	var labels []debug.Label
-	for name, off := range fl.Labels {
-		labels = append(labels, debug.Label{Name: name, Offset: off})
-	}
-	sort.Slice(labels, func(i, j int) bool { return labels[i].Offset < labels[j].Offset })
-
-	// Launch the debuggee with the argument block.
-	var argBlock []byte
-	var bufAddrs []uint64
-	var sess *debug.Session
-	if *bufSpec != "" {
-		// Parse the function signature to determine argument layout.
-		src, err := readSource(path)
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "gasm debug: %v\n", err)
-			return 1
-		}
-		sig, ok := verify.ExtractFuncSig(src, *funcName)
-		if !ok {
-			fmt.Fprintf(os.Stderr, "gasm debug: no // func signature found for %s\n", *funcName)
-			return 1
-		}
-		layout := verify.ArgLayout(sig)
-
-		// Parse the buffer spec to get buffer names.
-		bufNames := parseBufNames(*bufSpec)
-
-		// Allocate buffers in the debuggee.
-		argBlock = make([]byte, fl.Args)
-		sess, bufAddrs, err = debug.LaunchWithBuffers("", path, *funcName, argBlock, *bufSpec)
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "gasm debug: %v\n", err)
-			return 1
-		}
-
-		// Construct the argument block with buffer pointers at the correct positions.
-		bufIdx := 0
-		for _, arg := range layout {
-			if !arg.IsPtr {
-				continue
-			}
-			// Find the buffer that matches this argument.
-			for i, name := range bufNames {
-				if i < len(bufAddrs) && (name == arg.Name || strings.HasPrefix(arg.Name, name)) {
-					addr := bufAddrs[i]
-					off := arg.Offset
-					if off+8 <= len(argBlock) {
-						argBlock[off] = byte(addr)
-						argBlock[off+1] = byte(addr >> 8)
-						argBlock[off+2] = byte(addr >> 16)
-						argBlock[off+3] = byte(addr >> 24)
-						argBlock[off+4] = byte(addr >> 32)
-						argBlock[off+5] = byte(addr >> 40)
-						argBlock[off+6] = byte(addr >> 48)
-						argBlock[off+7] = byte(addr >> 56)
-					}
-					// For slices, also set the length and capacity.
-					if strings.HasPrefix(arg.Typ, "[]") && off+24 <= len(argBlock) {
-						// Find the buffer size from the spec.
-						size := parseBufSize(*bufSpec, name)
-						// Length at offset+8, capacity at offset+16.
-						for j := 0; j < 8; j++ {
-							argBlock[off+8+j] = byte(size >> (j * 8))
-							argBlock[off+16+j] = byte(size >> (j * 8))
-						}
-					}
-					bufIdx++
-					break
-				}
-			}
-		}
-		_ = bufIdx
-	} else {
-		argBlock = make([]byte, fl.Args)
-		sess, err = debug.Launch("", path, *funcName, argBlock)
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "gasm debug: %v\n", err)
-			return 1
-		}
-	}
-	defer sess.Kill()
-
-	bm := debug.NewBreakpoints(sess)
-	fmt.Printf("gasm debug: %s in %s (pid %d)\n", *funcName, path, sess.Pid())
-
-	// Convert the line table for the REPL.
-	var srcLines []debug.SourceLine
-	for _, le := range fl.Lines {
-		srcLines = append(srcLines, debug.SourceLine{Offset: le.Offset, Line: le.Line})
-	}
-	debug.REPL(sess, bm, sess.CodeBase(), fl.Offset, fl.Size, fl.Args, labels, srcLines)
-	return 0
-}
-
-// parseBufNames extracts buffer names from a buffer specification.
-// Format: name:size:pattern[,name:size:pattern...]
-func parseBufNames(spec string) []string {
-	var names []string
-	for _, part := range strings.Split(spec, ",") {
-		fields := strings.SplitN(part, ":", 3)
-		if len(fields) >= 1 && fields[0] != "" {
-			names = append(names, fields[0])
-		}
-	}
-	return names
-}
-
-// parseBufSize extracts the size of a named buffer from a buffer specification.
-func parseBufSize(spec, name string) int {
-	for _, part := range strings.Split(spec, ",") {
-		fields := strings.SplitN(part, ":", 3)
-		if len(fields) >= 2 && fields[0] == name {
-			var size int
-			fmt.Sscanf(fields[1], "%d", &size)
-			return size
-		}
-	}
-	return 0
-}

cmd/gasm/debug_other.go

@@ -1,7 +1,7 @@
 // Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
 // SPDX-License-Identifier: BSD-3-Clause
 
-//go:build !(linux && amd64)
+//go:build !linux
 
 package main
 
@@ -11,6 +11,6 @@ import (
 )
 
 func cmdDebug(args []string) int {
-	fmt.Fprintln(os.Stderr, "gasm debug: the interactive debugger requires linux/amd64 (ptrace)")
+	fmt.Fprintln(os.Stderr, "gasm debug: the interactive debugger requires Linux (ptrace)")
 	return 1
 }

cmd/gasm/dis.go

@@ -0,0 +1,148 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: BSD-3-Clause
+
+package main
+
+import (
+	"fmt"
+	"os"
+	"sort"
+	"strings"
+
+	"sourcedock.dev/petrbalvin/gasm-devkit/arch"
+	"sourcedock.dev/petrbalvin/gasm-devkit/disasm"
+	"sourcedock.dev/petrbalvin/gasm-devkit/parser"
+)
+
+// cmdDis disassembles machine code: either a raw binary (standard input with
+// "-") whose architecture is given with -a, or a .s file, which is assembled
+// first so the listing shows the real function and label layout.
+func cmdDis(args []string) int {
+	fs := newCommand("dis", "gasm dis [-a arch] <file>", `
+Disassemble machine code to instruction text (via golang.org/x/arch).
+
+With a .s file, the file is assembled first and the listing follows the
+real layout: one block per TEXT function, local labels printed at their
+offsets.  The architecture comes from the file name suffix, or from -a.
+
+With any other file, or "-" for standard input, the bytes are disassembled
+linearly and -a selects the architecture (amd64, arm64, riscv64 or
+loong64).
+`)
+	archName := fs.String("a", "", "architecture for raw input: amd64, arm64, riscv64 or loong64")
+	fs.Parse(args)
+	if fs.NArg() != 1 {
+		fmt.Fprintln(os.Stderr, "usage: gasm dis [-a arch] <file>")
+		return 2
+	}
+	path := fs.Arg(0)
+	var target arch.Arch
+	if *archName != "" {
+		var err error
+		target, err = auditArch(*archName)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "gasm dis: %v\n", err)
+			return 2
+		}
+	}
+
+	if strings.HasSuffix(path, ".s") {
+		if target == arch.Unknown {
+			target = arch.FromFilename(path)
+		}
+		if target == arch.Unknown {
+			fmt.Fprintln(os.Stderr, "gasm dis: cannot infer the architecture from the file name; use -a")
+			return 2
+		}
+		return disSource(path, target)
+	}
+
+	if target == arch.Unknown {
+		fmt.Fprintln(os.Stderr, "gasm dis: raw input needs -a (amd64, arm64, riscv64 or loong64)")
+		return 2
+	}
+	src, err := readSource(path)
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "gasm dis:", err)
+		return 1
+	}
+	printListing(target, []byte(src), 0, nil)
+	return 0
+}
+
+// disSource assembles a .s file and prints one listing block per function.
+func disSource(path string, target arch.Arch) int {
+	src, err := readSource(path)
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "gasm dis:", err)
+		return 1
+	}
+	f, errs := parser.Parse(path, src)
+	for _, e := range errs {
+		fmt.Fprintf(os.Stderr, "%s: %v\n", path, e)
+	}
+	if len(errs) > 0 {
+		return 1
+	}
+	img, err := assembleFile(target, f)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "gasm dis: %v\n", err)
+		return 1
+	}
+	if len(img.Funcs) == 0 {
+		fmt.Fprintln(os.Stderr, "gasm dis: no assemblable TEXT functions found")
+		return 1
+	}
+	for _, fn := range img.Funcs {
+		code := img.Code[fn.Offset : fn.Offset+fn.Size]
+		fmt.Printf("%s: %d bytes\n", fn.Name, fn.Size)
+		labels := make(map[int][]string, len(fn.Labels))
+		for name, off := range fn.Labels {
+			labels[off] = append(labels[off], name)
+		}
+		for off := range labels {
+			sort.Strings(labels[off])
+		}
+		printListing(target, code, uint64(fn.Offset), labels)
+	}
+	if len(img.Data) > 0 {
+		fmt.Printf("data: %d bytes at 0x%x\n", len(img.Data), len(img.Code))
+	}
+	return 0
+}
+
+// printListing decodes code linearly from offset base, printing label lines
+// (label name to offset within the block) as they are reached.
+func printListing(a arch.Arch, code []byte, base uint64, labels map[int][]string) {
+	pc := 0
+	for pc < len(code) {
+		for _, name := range labels[pc] {
+			fmt.Printf("%s:\n", name)
+		}
+		ins, err := disasm.Decode(a, code[pc:], base+uint64(pc))
+		if err != nil {
+			break
+		}
+		end := min(pc+ins.Len, len(code))
+		fmt.Printf("  %04x: %-16s %s\n", base+uint64(pc), hexBytes(code[pc:end]), ins.Text)
+		if ins.Len <= 0 {
+			break
+		}
+		pc += ins.Len
+	}
+}
+
+// hexBytes renders up to 8 bytes as contiguous hex.
+func hexBytes(b []byte) string {
+	var sb strings.Builder
+	for i, c := range b {
+		if i == 8 {
+			break
+		}
+		if i > 0 {
+			sb.WriteByte(' ')
+		}
+		fmt.Fprintf(&sb, "%02x", c)
+	}
+	return sb.String()
+}

cmd/gasm/main_test.go

@@ -7,9 +7,15 @@ import (
 	"bytes"
 	"io"
 	"os"
+	"os/exec"
 	"path/filepath"
+	"runtime"
 	"strings"
+	"syscall"
 	"testing"
+
+	"sourcedock.dev/petrbalvin/gasm-devkit/arch"
+	"sourcedock.dev/petrbalvin/gasm-devkit/asm"
 )
 
 const clean = "#include \"textflag.h\"\n" +
@@ -216,8 +222,9 @@ func TestCmdVersion(t *testing.T) {
 	if code != 0 {
 		t.Fatalf("code = %d", code)
 	}
-	if !strings.Contains(out, version) {
-		t.Errorf("version output %q does not mention %q", out, version)
+	got := version()
+	if !strings.Contains(out, got) {
+		t.Errorf("version output %q does not mention %q", out, got)
 	}
 }
 
@@ -237,3 +244,219 @@ func TestCmdArgErrors(t *testing.T) {
 		t.Errorf("cmdParse() code = %d, want 2", code)
 	}
 }
+
+// TestUsageExitCodes pins the exit-code contract for the commands whose main
+// dispatches on a returned error: a wrong argument set exits 2, the same as
+// the commands that count their arguments themselves, while a runtime
+// failure (an unreadable file) keeps exit 1.
+func TestUsageExitCodes(t *testing.T) {
+	for name, err := range map[string]error{
+		"audit-instructions extra argument": cmdAuditInstructions([]string{"amd64", "extra"}),
+		"audit-instructions unknown arch":   cmdAuditInstructions([]string{"mips"}),
+		"audit-instructions corpus extra":   cmdAuditInstructions([]string{"--corpus", "a", "b"}),
+		"scaffold no arguments":             cmdScaffold(nil),
+		"scaffold extra arguments":          cmdScaffold([]string{"differential", "a.s", "b.s"}),
+	} {
+		if err == nil {
+			t.Errorf("%s: expected an error", name)
+			continue
+		}
+		if code := exitCodeFor(err); code != 2 {
+			t.Errorf("%s: exit code = %d, want 2 (err: %v)", name, code, err)
+		}
+	}
+	if err := cmdScaffold([]string{"differential", "/nonexistent/file.s"}); err == nil {
+		t.Error("scaffold on a missing file should fail")
+	} else if code := exitCodeFor(err); code != 1 {
+		t.Errorf("scaffold on a missing file: exit code = %d, want 1", code)
+	}
+}
+
+// TestCmdAsmFormatValidation checks that an unknown --format exits 2 with
+// and without -o, instead of assembling and silently dumping a raw image.
+func TestCmdAsmFormatValidation(t *testing.T) {
+	path := writeTemp(t, "f_amd64.s", clean)
+	out := filepath.Join(t.TempDir(), "f.bin")
+	if _, _, code := capture(func() int { return cmdAsm([]string{"--format", "bogus", path}) }); code != 2 {
+		t.Errorf("asm --format bogus without -o: code = %d, want 2", code)
+	}
+	if _, _, code := capture(func() int { return cmdAsm([]string{"--format", "bogus", "-o", out, path}) }); code != 2 {
+		t.Errorf("asm --format bogus with -o: code = %d, want 2", code)
+	}
+}
+
+// TestCmdAsmOutputFile pins the documented -o behaviour: the output goes to
+// the file and stdout carries no hex dump; without -o the dump is the output.
+func TestCmdAsmOutputFile(t *testing.T) {
+	path := writeTemp(t, "f_amd64.s", clean)
+	out := filepath.Join(t.TempDir(), "f.bin")
+	stdout, _, code := capture(func() int { return cmdAsm([]string{"-o", out, path}) })
+	if code != 0 {
+		t.Fatalf("code = %d", code)
+	}
+	if strings.Contains(stdout, "0000:") {
+		t.Errorf("stdout carries a hex dump despite -o:\n%s", stdout)
+	}
+	if !strings.Contains(stdout, "wrote ") {
+		t.Errorf("stdout misses the wrote line:\n%s", stdout)
+	}
+	b, err := os.ReadFile(out)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(b) == 0 {
+		t.Error("the output file is empty")
+	}
+
+	stdout, _, code = capture(func() int { return cmdAsm([]string{path}) })
+	if code != 0 {
+		t.Fatalf("without -o: code = %d", code)
+	}
+	if !strings.Contains(stdout, "0000:") {
+		t.Errorf("without -o the hex dump is missing:\n%s", stdout)
+	}
+}
+
+// TestVerifyNonJITAMD64GroundTruth drives the cross-architecture
+// ground-truth path for an amd64 kernel: the path a host of any other
+// architecture takes, which must compare against the toolchain rather than
+// refuse to run.
+func TestVerifyNonJITAMD64GroundTruth(t *testing.T) {
+	if testing.Short() {
+		t.Skip("runs go tool asm")
+	}
+	path := writeTemp(t, "f_amd64.s", clean)
+	out, _, code := capture(func() int { return cmdVerifyNonJIT(path, arch.AMD64, true, false) })
+	if code != 0 {
+		t.Fatalf("code = %d (%s)", code, out)
+	}
+	if !strings.Contains(out, "1/1 matched") {
+		t.Errorf("output misses the matched report:\n%s", out)
+	}
+}
+
+// TestVerifySmokeCrashIsolation checks that a function faulting on its
+// zeroed smoke arguments is reported as CRASH by a child process instead of
+// killing `gasm verify` itself.
+func TestVerifySmokeCrashIsolation(t *testing.T) {
+	if testing.Short() {
+		t.Skip("builds the gasm binary")
+	}
+	if runtime.GOARCH != "amd64" {
+		t.Skip("amd64 JIT only")
+	}
+	bin := filepath.Join(t.TempDir(), "gasm")
+	if out, err := exec.Command("go", "build", "-o", bin, ".").CombinedOutput(); err != nil {
+		t.Fatalf("build gasm: %v\n%s", err, out)
+	}
+	src := filepath.Join(t.TempDir(), "crash_amd64.s")
+	kernel := "#include \"textflag.h\"\n" +
+		"\n" +
+		"// func Fault(x []byte) int\n" +
+		"TEXT ·Fault(SB), NOSPLIT, $0-32\n" +
+		"\tMOVQ\tx+0(FP), AX\n" +
+		"\tMOVQ\t(AX), AX // faults on the zeroed nil pointer\n" +
+		"\tMOVQ\tAX, ret+24(FP)\n" +
+		"\tRET\n"
+	if err := os.WriteFile(src, []byte(kernel), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	cmd := exec.Command(bin, "verify", "-smoke", src)
+	out, err := cmd.CombinedOutput()
+	if err == nil {
+		t.Fatalf("expected a failure report, got success:\n%s", out)
+	}
+	if exitErr, ok := err.(*exec.ExitError); ok {
+		if ws, ok := exitErr.Sys().(syscall.WaitStatus); ok && ws.Signaled() {
+			t.Fatalf("verify died from %v; the crash was not isolated:\n%s", ws.Signal(), out)
+		}
+	}
+	if !strings.Contains(string(out), "CRASH") {
+		t.Errorf("output does not report CRASH:\n%s", out)
+	}
+}
+
+func TestSweepCheckLines(t *testing.T) {
+	out := []byte("crash_amd64.s: 1 functions JIT-loaded\n" +
+		"  Fault: 21 bytes, args=32, frame=0 NOSPLIT\n" +
+		"    smoke: OK\n" +
+		"    abi: clean (10 varied inputs)\n")
+	want := "    smoke: OK\n    abi: clean (10 varied inputs)"
+	if got := sweepCheckLines(out); got != want {
+		t.Errorf("sweepCheckLines = %q, want %q", got, want)
+	}
+}
+
+// TestRunCorpusAudit drives the corpus audit over a small fixture tree: one
+// suffixed amd64 file, one suffixed arm64 file whose body is not arm64, one
+// generic file, and one file that does not parse.
+func TestRunCorpusAudit(t *testing.T) {
+	dir := t.TempDir()
+	write := func(name, src string) {
+		t.Helper()
+		if err := os.WriteFile(filepath.Join(dir, name), []byte(src), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	write("good_amd64.s", "#include \"textflag.h\"\nTEXT ·add(SB), NOSPLIT, $0-0\n\tMOVQ AX, BX\n\tRET\n")
+	write("bad_arm64.s", "#include \"textflag.h\"\nTEXT ·f(SB), NOSPLIT, $0-0\n\tMOVQ AX, BX\n\tRET\n")
+	write("generic.s", "#include \"textflag.h\"\nTEXT ·g(SB), NOSPLIT, $0-0\n\tRET\n")
+	write("broken.s", "#include \"textflag.h\"\nTEXT ·b(SB), NOSPLIT, $0-0\n\tJMP nowhere\n\tRET\n")
+
+	stats, err := runCorpusAudit(dir)
+	if err != nil {
+		t.Fatalf("runCorpusAudit: %v", err)
+	}
+	if stats.files != 4 {
+		t.Errorf("files = %d, want 4", stats.files)
+	}
+	if stats.generic != 2 {
+		t.Errorf("generic = %d, want 2 (generic.s and broken.s)", stats.generic)
+	}
+	// good_amd64 and generic.s assemble everywhere they are attempted.
+	if stats.full != 2 {
+		t.Errorf("full = %d, want 2", stats.full)
+	}
+	get := func(name string) *corpusTally {
+		for i, tg := range stats.targets {
+			if tg.name == name {
+				return stats.tallies[i]
+			}
+		}
+		t.Fatalf("no tally for %s", name)
+		return nil
+	}
+	// amd64: good_amd64 + generic.s + broken.s; the broken file fails to parse.
+	if a := get("amd64"); a.attempted != 3 || a.assembled != 2 {
+		t.Errorf("amd64 = %d/%d, want 2/3", a.assembled, a.attempted)
+	}
+	// arm64: bad_arm64 (MOVQ is not arm64) + generic.s + broken.s.
+	if a := get("arm64"); a.attempted != 3 || a.assembled != 1 {
+		t.Errorf("arm64 = %d/%d, want 1/3", a.assembled, a.attempted)
+	}
+	if r := get("amd64").reasons["instruction not encodable"]; r != 0 {
+		t.Errorf("amd64 unexpected unencodable reason: %d", r)
+	}
+	if r := get("arm64").reasons["instruction not encodable"]; r != 1 {
+		t.Errorf("arm64 unencodable reasons = %d, want 1", r)
+	}
+}
+
+// TestCompareGroundTruthPadding pins the padding-aware ground-truth
+// comparison: the toolchain pads text symbols to 16-byte boundaries, so
+// trailing zeros in the reference must not read as a mismatch, while any
+// non-zero tail still must.
+func TestCompareGroundTruthPadding(t *testing.T) {
+	code := []byte{0x48, 0x8b, 0x07, 0xc3} // 4 bytes, not a multiple of 16
+	img := &asm.Image{Code: code, Funcs: []asm.FuncLayout{{Name: "f", Offset: 0, Size: len(code)}}}
+	padded := append(append([]byte(nil), code...), 0, 0, 0)
+	matched, total, diffs := compareGroundTruth(img, map[string][]byte{"f": padded})
+	if matched != 1 || total != 1 || diffs != 0 {
+		t.Fatalf("zero padding should match: matched=%d total=%d diffs=%d", matched, total, diffs)
+	}
+	dirty := append(append([]byte(nil), code...), 0, 0x90, 0)
+	matched, _, diffs = compareGroundTruth(img, map[string][]byte{"f": dirty})
+	if matched != 0 || diffs != 1 {
+		t.Fatalf("non-zero padding must mismatch: matched=%d diffs=%d", matched, diffs)
+	}
+}

cmd/gasm/man_test.go

@@ -0,0 +1,241 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: BSD-3-Clause
+
+package main
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"testing"
+)
+
+// TestManPagesTrackTheCLI builds the binary once, then compares every
+// command's live `-h` output with its docs/man/gasm-<command>.1 page: the
+// flag sets must agree both ways, and the page's SYNOPSIS line must carry
+// the command's usage line.  A flag or a usage change that skips the man
+// page fails here, so the pages cannot drift from the binary.
+func TestManPagesTrackTheCLI(t *testing.T) {
+	if testing.Short() {
+		t.Skip("builds the gasm binary")
+	}
+	bin := filepath.Join(t.TempDir(), "gasm")
+	if out, err := exec.Command("go", "build", "-o", bin, ".").CombinedOutput(); err != nil {
+		t.Fatalf("build gasm: %v\n%s", err, out)
+	}
+
+	for _, cmd := range []string{
+		"tokens", "parse", "fmt", "lint", "asm", "dis", "verify",
+		"debug", "diff", "profile", "audit-instructions", "scaffold", "lsp",
+	} {
+		t.Run(cmd, func(t *testing.T) {
+			raw, err := os.ReadFile(filepath.Join("..", "..", "docs", "man", "gasm-"+cmd+".1"))
+			if err != nil {
+				t.Fatalf("read man page: %v", err)
+			}
+			page := string(raw)
+
+			out, _ := exec.Command(bin, cmd, "-h").CombinedOutput()
+			help := string(out)
+
+			binFlags := helpFlags(help)
+			pageFlags := roffFlags(page)
+			for f := range binFlags {
+				if !pageFlags[f] {
+					t.Errorf("flag -%s is in the binary's help but missing from the man page", f)
+				}
+			}
+			for f := range pageFlags {
+				if !binFlags[f] {
+					t.Errorf("flag -%s is in the man page but the binary does not accept it", f)
+				}
+			}
+
+			want := helpUsage(help)
+			got := roffSynopsis(page)
+			if want != "" && got != want {
+				t.Errorf("SYNOPSIS drift:\n page: %s\nbinary: %s", got, want)
+			}
+		})
+	}
+}
+
+// TestManCommandsTrackHelp compares the gasm(1) COMMANDS list with the
+// top-level help output, so a subcommand added to the binary cannot miss
+// its man entry and a stale entry cannot outlive its command.
+func TestManCommandsTrackHelp(t *testing.T) {
+	if testing.Short() {
+		t.Skip("builds the gasm binary")
+	}
+	bin := filepath.Join(t.TempDir(), "gasm")
+	if out, err := exec.Command("go", "build", "-o", bin, ".").CombinedOutput(); err != nil {
+		t.Fatalf("build gasm: %v\n%s", err, out)
+	}
+
+	raw, err := os.ReadFile(filepath.Join("..", "..", "docs", "man", "gasm.1"))
+	if err != nil {
+		t.Fatalf("read man page: %v", err)
+	}
+
+	helpOut, err := exec.Command(bin, "--help").Output()
+	if err != nil {
+		t.Fatalf("gasm --help: %v", err)
+	}
+
+	binCmds := helpCommands(string(helpOut))
+	pageCmds := roffCommands(string(raw))
+	for c := range binCmds {
+		if !pageCmds[c] {
+			t.Errorf("command %q is in the binary's help but missing from gasm(1) COMMANDS", c)
+		}
+	}
+	for c := range pageCmds {
+		if !binCmds[c] {
+			t.Errorf("command %q is in gasm(1) COMMANDS but the binary does not list it", c)
+		}
+	}
+}
+
+// helpFlags extracts the flag names from a `gasm <cmd> -h` output.
+func helpFlags(help string) map[string]bool {
+	m := map[string]bool{}
+	inFlags := false
+	for line := range strings.SplitSeq(help, "\n") {
+		if strings.TrimRight(line, " \t") == "Flags:" {
+			inFlags = true
+			continue
+		}
+		if !inFlags {
+			continue
+		}
+		if !strings.HasPrefix(line, "  -") {
+			continue
+		}
+		token := strings.FieldsFunc(strings.TrimLeft(line, " "), func(r rune) bool {
+			return r == ' ' || r == '\t'
+		})
+		if len(token) == 0 {
+			continue
+		}
+		m[strings.TrimLeft(token[0], "-")] = true
+	}
+	return m
+}
+
+var roffEscape = regexp.MustCompile(`\\f[BIRP]`)
+
+// roffFlags extracts the flag names from a man page's OPTIONS section.
+func roffFlags(page string) map[string]bool {
+	m := map[string]bool{}
+	inOptions := false
+	for line := range strings.SplitSeq(page, "\n") {
+		if strings.HasPrefix(line, ".SH ") {
+			inOptions = strings.HasPrefix(line, ".SH OPTIONS")
+			continue
+		}
+		if !inOptions {
+			continue
+		}
+		// Flag entries are written as either `.B \-flag` or `\fB\-flag`.
+		var body string
+		switch {
+		case strings.HasPrefix(line, `.B \-`):
+			body = line[3:]
+		case strings.HasPrefix(line, `\fB\-`):
+			body = line[1:]
+		default:
+			continue
+		}
+		name := roffEscape.ReplaceAllString(body, "")
+		name = strings.ReplaceAll(name, `\-`, "-")
+		name = strings.TrimSpace(name)
+		if i := strings.IndexAny(name, " \t"); i >= 0 {
+			name = name[:i]
+		}
+		m[strings.TrimLeft(name, "-")] = true
+	}
+	return m
+}
+
+// helpCommands extracts the command names from the top-level help output's
+// Commands section.
+func helpCommands(help string) map[string]bool {
+	m := map[string]bool{}
+	inCmds := false
+	for line := range strings.SplitSeq(help, "\n") {
+		if strings.TrimSpace(line) == "Commands:" {
+			inCmds = true
+			continue
+		}
+		if !inCmds {
+			continue
+		}
+		t := strings.TrimSpace(line)
+		if t == "" {
+			break
+		}
+		name, _, _ := strings.Cut(t, " ")
+		m[name] = true
+	}
+	return m
+}
+
+// roffCommands extracts the command names from gasm(1)'s COMMANDS section,
+// where each entry is written as `.B gasm\-<name>(1)` or `.B gasm <name>`.
+func roffCommands(page string) map[string]bool {
+	m := map[string]bool{}
+	inCmds := false
+	for line := range strings.SplitSeq(page, "\n") {
+		if strings.HasPrefix(line, ".SH ") {
+			inCmds = strings.HasPrefix(line, ".SH COMMANDS")
+			continue
+		}
+		if !inCmds || !strings.HasPrefix(line, ".B gasm") {
+			continue
+		}
+		entry := strings.ReplaceAll(strings.TrimPrefix(line, ".B "), `\-`, "-")
+		entry = strings.TrimSuffix(entry, "(1)")
+		switch {
+		case strings.HasPrefix(entry, "gasm-"):
+			m[strings.TrimPrefix(entry, "gasm-")] = true
+		case strings.HasPrefix(entry, "gasm "):
+			m[strings.TrimPrefix(entry, "gasm ")] = true
+		}
+	}
+	return m
+}
+
+// helpUsage returns the command's usage line without the "Usage: " prefix.
+func helpUsage(help string) string {
+	for line := range strings.SplitSeq(help, "\n") {
+		if strings.HasPrefix(line, "Usage: ") {
+			return normaliseUsage(line[len("Usage: "):])
+		}
+	}
+	return ""
+}
+
+// roffSynopsis returns the page's SYNOPSIS usage line, unescaped.
+func roffSynopsis(page string) string {
+	inSyn := false
+	for line := range strings.SplitSeq(page, "\n") {
+		if strings.HasPrefix(line, ".SH ") {
+			inSyn = strings.HasPrefix(line, ".SH SYNOPSIS")
+			continue
+		}
+		if !inSyn || !strings.HasPrefix(line, ".B ") {
+			continue
+		}
+		return normaliseUsage(strings.ReplaceAll(line[3:], `\-`, "-"))
+	}
+	return ""
+}
+
+// normaliseUsage flattens whitespace and drops the roff font escapes so that
+// the binary's usage line and the page's SYNOPSIS line compare equal.
+func normaliseUsage(s string) string {
+	s = roffEscape.ReplaceAllString(s, "")
+	return strings.Join(strings.Fields(s), " ")
+}

cmd/gasm/scaffold.go

@@ -0,0 +1,345 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: BSD-3-Clause
+
+package main
+
+import (
+	"fmt"
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"os"
+	"strings"
+
+	gasmast "sourcedock.dev/petrbalvin/gasm-devkit/ast"
+	gasmparser "sourcedock.dev/petrbalvin/gasm-devkit/parser"
+)
+
+// cmdScaffold generates a differential test skeleton for every kernel in a
+// file: a Go test that seeds random states, drives both the assembly kernel
+// and a caller-provided portable reference, and compares the outputs
+// byte-for-byte.  The lesson this encodes: a pipeline-level fuzz cannot see
+// an unwired kernel, only a direct-call differential against the portable
+// specification can, so every kernel ships with one.
+//
+// The generated file follows two conventions the caller fills in:
+//   - the assembly symbols resolve because the test lives in the kernel's
+//     own package (the //go:noescape declarations reference them);
+//   - each kernel gets a <name>Portable Go function the author implements as
+//     the specification, and the test fails on the first divergent byte.
+func cmdScaffold(args []string) error {
+	fs := newCommand("scaffold", "gasm scaffold differential <file.s>", `
+Print a differential test skeleton for every // func signature in FILE.
+The test seeds random states, drives the kernel and a portable reference
+(<name>Portable), and compares outputs byte-for-byte.  Write the reference
+bodies, place the file in the kernel's package, and run it in CI.
+`)
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	rest := fs.Args()
+	// The first positional word is the scaffold style; "differential" is the
+	// only one today.
+	if len(rest) > 0 && rest[0] == "differential" {
+		rest = rest[1:]
+	}
+	if len(rest) != 1 {
+		return &usageError{fmt.Errorf("usage: gasm scaffold differential <file.s>")}
+	}
+	path := rest[0]
+	src, err := os.ReadFile(path)
+	if err != nil {
+		return err
+	}
+	f, errs := gasmparser.Parse(path, string(src))
+	if len(errs) > 0 {
+		return fmt.Errorf("parse: %v", errs[0])
+	}
+
+	var out strings.Builder
+	out.WriteString(headerComment)
+	out.WriteString("package " + packageName + "\n\n")
+	out.WriteString("import (\n\t\"bytes\"\n\t\"math/rand\"\n\t\"testing\"\n)\n\n")
+	out.WriteString(generatedHelpers)
+
+	kernels := 0
+	for _, d := range f.Decls {
+		txt, ok := d.(*gasmast.Text)
+		if !ok {
+			continue
+		}
+		params, results, ok := parseSig(txt.Doc)
+		if !ok || len(params) == 0 {
+			continue
+		}
+		kernels++
+		name := txt.Name.Name
+		fmt.Fprintf(&out, "// %sPortable is the specification %s is pinned against:\n", name, name)
+		fmt.Fprintf(&out, "// fill in a straightforward implementation of the same contract.\n")
+		fmt.Fprintf(&out, "func %sPortable(%s) (%s) {\n\tpanic(\"implement the portable specification\")\n}\n\n", name, paramDecl(params), resultDecl(results))
+
+		fmt.Fprintf(&out, "func Test%sDifferential(t *testing.T) {\n", strings.ToUpper(name[:1])+name[1:])
+		fmt.Fprintf(&out, "\trng := rand.New(rand.NewSource(1))\n")
+		fmt.Fprintf(&out, "\tfor range 1000 {\n")
+		// Seed two independent argument sets per iteration: the kernel runs
+		// on set A, the portable reference on set B, so in-place writes
+		// through pointer/slice arguments cannot contaminate the other side.
+		var sliceNames []string
+		seen := map[string]bool{}
+		aArgs := make([]string, 0, len(params))
+		bArgs := make([]string, 0, len(params))
+		for _, p := range params {
+			a, b, slices := genParamSeed(&out, p, seen)
+			aArgs = append(aArgs, a)
+			bArgs = append(bArgs, b)
+			sliceNames = append(sliceNames, slices...)
+		}
+		fmt.Fprintf(&out, "\t\tgot := %s(%s)\n", name, strings.Join(aArgs, ", "))
+		fmt.Fprintf(&out, "\t\twant := %sPortable(%s)\n", name, strings.Join(bArgs, ", "))
+		fmt.Fprintf(&out, "\t\tif !bytes.Equal(outputBytes(got), outputBytes(want)) {\n")
+		fmt.Fprintf(&out, "\t\t\tt.Fatalf(\"kernel diverges from the portable spec (seed 1, deterministic)\")\n")
+		fmt.Fprintf(&out, "\t\t}\n")
+		for _, s := range sliceNames {
+			fmt.Fprintf(&out, "\t\tif !bytes.Equal(outputBytes(%sA), outputBytes(%sB)) {\n", s, s)
+			fmt.Fprintf(&out, "\t\t\tt.Fatalf(\"kernel mutated %%q differently (seed 1, deterministic)\", %q)\n", s)
+			fmt.Fprintf(&out, "\t\t}\n")
+		}
+		fmt.Fprintf(&out, "\t}\n}\n\n")
+	}
+	if kernels == 0 {
+		return fmt.Errorf("%s: no // func signatures found; add one doc comment per kernel", path)
+	}
+	os.Stdout.WriteString(out.String())
+	return nil
+}
+
+const packageName = "yourpkg"
+
+const headerComment = `// Code generated by gasm scaffold differential; EDIT THE PANICS.
+// Each Test*Differential drives the assembly kernel and its portable
+// reference over the same random states and compares the outputs.
+// Place this file in the kernel's own package so the symbols resolve.
+
+`
+
+// sigParam is one parsed // func parameter.
+type sigParam struct {
+	Names []string
+	Type  string
+}
+
+type sigResult struct {
+	Names []string
+	Type  string
+}
+
+// parseSig parses the // func signature of a doc comment.
+func parseSig(doc string) ([]sigParam, []sigResult, bool) {
+	var line string
+	for l := range strings.SplitSeq(doc, "\n") {
+		if t := strings.TrimSpace(l); strings.HasPrefix(t, "func ") {
+			line = t
+			break
+		}
+	}
+	if line == "" {
+		return nil, nil, false
+	}
+	fset := token.NewFileSet()
+	f, err := parser.ParseFile(fset, "sig.go", "package p\n"+line+" {}\n", 0)
+	if err != nil {
+		return nil, nil, false
+	}
+	fd, ok := f.Decls[0].(*ast.FuncDecl)
+	if !ok || fd.Type == nil {
+		return nil, nil, false
+	}
+	var params []sigParam
+	for _, field := range fd.Type.Params.List {
+		typ := exprString(field.Type)
+		if len(field.Names) == 0 {
+			params = append(params, sigParam{Names: []string{""}, Type: typ})
+			continue
+		}
+		// Shared names (`L, result *byte`) expand to one entry per name:
+		// every name is a separate argument at the call site.
+		for _, n := range field.Names {
+			params = append(params, sigParam{Names: []string{n.Name}, Type: typ})
+		}
+	}
+	var results []sigResult
+	if fd.Type.Results != nil {
+		for _, field := range fd.Type.Results.List {
+			results = append(results, sigResult{Names: identNames(field.Names), Type: exprString(field.Type)})
+		}
+	}
+	return params, results, true
+}
+
+func identNames(idents []*ast.Ident) []string {
+	var out []string
+	for _, id := range idents {
+		out = append(out, id.Name)
+	}
+	return out
+}
+
+func exprString(e ast.Expr) string {
+	switch t := e.(type) {
+	case *ast.Ident:
+		return t.Name
+	case *ast.StarExpr:
+		return "*" + exprString(t.X)
+	case *ast.SelectorExpr:
+		return exprString(t.X) + "." + t.Sel.Name
+	case *ast.ArrayType:
+		if t.Len == nil {
+			return "[]" + exprString(t.Elt)
+		}
+		return "[N]" + exprString(t.Elt)
+	}
+	return "interface{}"
+}
+
+// paramDecl renders a parameter list for the portable reference signature.
+func paramDecl(params []sigParam) string {
+	var parts []string
+	for _, p := range params {
+		if len(p.Names) == 0 {
+			parts = append(parts, p.Type)
+			continue
+		}
+		for _, n := range p.Names {
+			parts = append(parts, n+" "+p.Type)
+		}
+	}
+	return strings.Join(parts, ", ")
+}
+
+// resultDecl renders a result list; unnamed results keep bare types.
+func resultDecl(results []sigResult) string {
+	if len(results) == 0 {
+		return ""
+	}
+	var parts []string
+	for _, r := range results {
+		parts = append(parts, r.Type)
+	}
+	return strings.Join(parts, ", ")
+}
+
+// genParamSeed emits the seeding statements for one parameter and returns
+// the kernel-side (A) and reference-side (B) argument expressions, plus the
+// names of any slice variables written in place (compared after the calls).
+func genParamSeed(out *strings.Builder, p sigParam, seen map[string]bool) (aArg, bArg string, slices []string) {
+	name := p.Names[0]
+	elem := strings.TrimPrefix(p.Type, "*")
+	isSlice := strings.HasPrefix(p.Type, "[]")
+	if isSlice {
+		elem = strings.TrimPrefix(p.Type, "[]")
+	}
+	switch {
+	case isSlice:
+		v := uniqueName(seen, name)
+		fmt.Fprintf(out, "\t\t%sA := make([]%s, 1+rng.Intn(512))\n", v, elem)
+		fmt.Fprintf(out, "\t\t%sB := make([]%s, len(%sA))\n", v, elem, v)
+		fmt.Fprintf(out, "\t\tfor i := range %sA {\n", v)
+		fmt.Fprintf(out, "\t\t\tw%s := %s(rng.Intn(256))\n", v, goCast(elem))
+		fmt.Fprintf(out, "\t\t\t%sA[i] = w%s\n", v, v)
+		fmt.Fprintf(out, "\t\t\t%sB[i] = w%s\n", v, v)
+		fmt.Fprintf(out, "\t\t}\n")
+		return v, v, []string{v}
+	case strings.HasPrefix(p.Type, "*"):
+		v := uniqueName(seen, name)
+		fmt.Fprintf(out, "\t\tvar %sA, %sB %s\n", v, v, elem)
+		fmt.Fprintf(out, "\t\tw%s := %s(rng.Intn(256))\n", v, goCast(elem))
+		fmt.Fprintf(out, "\t\t%sA = w%s\n", v, v)
+		fmt.Fprintf(out, "\t\t%sB = w%s\n", v, v)
+		return "&" + v + "A", "&" + v + "B", nil
+	default:
+		v := uniqueName(seen, name)
+		fmt.Fprintf(out, "\t\tw%s := %s(rng.Intn(512))\n", v, goCast(""))
+		fmt.Fprintf(out, "\t\tvar %sA, %sB %s = w%s, w%s\n", v, v, p.Type, v, v)
+		return v + "A", v + "B", nil
+	}
+}
+
+// uniqueName de-duplicates seeded variable names when one kernel takes two
+// parameters of the same name (impossible in Go) or a name repeats across
+// kernels in one file.
+func uniqueName(seen map[string]bool, base string) string {
+	if base == "" {
+		base = "arg"
+	}
+	if !seen[base] {
+		seen[base] = true
+		return base
+	}
+	for i := 2; ; i++ {
+		cand := fmt.Sprintf("%s%d", base, i)
+		if !seen[cand] {
+			seen[cand] = true
+			return cand
+		}
+	}
+}
+
+// goCast returns the conversion turning rng.Intn into the element type.
+func goCast(elem string) string {
+	switch elem {
+	case "byte", "uint8":
+		return "byte"
+	case "int8":
+		return "int8"
+	case "uint16":
+		return "uint16"
+	case "int16":
+		return "int16"
+	case "uint32":
+		return "uint32"
+	case "int32":
+		return "int32"
+	case "uint64":
+		return "uint64"
+	default:
+		return "int"
+	}
+}
+
+// generatedHelpers is emitted into every generated test file: outputBytes
+// narrows returned slices and scalars to a byte form for the comparison.
+// It lives in the template, not in this binary, because only the generated
+// file ever calls it.
+const generatedHelpers = `// outputBytes narrows a returned slice or scalar to bytes for the
+// comparison; extend the switch when a kernel returns a wider type.
+func outputBytes(v any) []byte {
+	switch t := v.(type) {
+	case []byte:
+		return t
+	case []int32:
+		b := make([]byte, 4*len(t))
+		for i, x := range t {
+			b[i*4] = byte(x)
+			b[i*4+1] = byte(x >> 8)
+			b[i*4+2] = byte(x >> 16)
+			b[i*4+3] = byte(x >> 24)
+		}
+		return b
+	case []uint16:
+		b := make([]byte, 2*len(t))
+		for i, x := range t {
+			b[i*2] = byte(x)
+			b[i*2+1] = byte(x >> 8)
+		}
+		return b
+	case int:
+		b := make([]byte, 8)
+		for i := range 8 {
+			b[i] = byte(uint64(t) >> (8 * i))
+		}
+		return b
+	default:
+		return nil
+	}
+}
+`

cmd/gasm/unidiff.go

@@ -0,0 +1,140 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: BSD-3-Clause
+
+package main
+
+import (
+	"fmt"
+	"slices"
+	"strings"
+)
+
+// unifiedDiff renders a unified diff with three lines of context between the
+// two line slices, in the form `gofmt -d` prints.  An empty result means the
+// inputs are identical.
+func unifiedDiff(name string, a, b []string) string {
+	if slices.Equal(a, b) {
+		return ""
+	}
+	var out strings.Builder
+	fmt.Fprintf(&out, "--- %s\n+++ %s\n", name, name)
+
+	// Longest common subsequence over the lines (assembly files are small
+	// enough for the quadratic table).
+	n, m := len(a), len(b)
+	lcs := make([][]int, n+1)
+	for i := range lcs {
+		lcs[i] = make([]int, m+1)
+	}
+	for i := n - 1; i >= 0; i-- {
+		for j := m - 1; j >= 0; j-- {
+			if a[i] == b[j] {
+				lcs[i][j] = lcs[i+1][j+1] + 1
+			} else if lcs[i+1][j] >= lcs[i][j+1] {
+				lcs[i][j] = lcs[i+1][j]
+			} else {
+				lcs[i][j] = lcs[i][j+1]
+			}
+		}
+	}
+
+	// Walk the LCS once, assigning every op its absolute position in both
+	// files (1-based, the position an insertion sits before).
+	type op struct {
+		kind         byte // ' ', '-' or '+'
+		aLine, bLine int
+		text         string
+	}
+	var ops []op
+	aPos, bPos := 0, 0
+	emit := func(kind byte, text string) {
+		ops = append(ops, op{kind: kind, aLine: aPos + 1, bLine: bPos + 1, text: text})
+		switch kind {
+		case ' ':
+			aPos++
+			bPos++
+		case '-':
+			aPos++
+		case '+':
+			bPos++
+		}
+	}
+	i, j := 0, 0
+	for i < n && j < m {
+		switch {
+		case a[i] == b[j]:
+			emit(' ', a[i])
+			i++
+			j++
+		case lcs[i+1][j] >= lcs[i][j+1]:
+			emit('-', a[i])
+			i++
+		default:
+			emit('+', b[j])
+			j++
+		}
+	}
+	for ; i < n; i++ {
+		emit('-', a[i])
+	}
+	for ; j < m; j++ {
+		emit('+', b[j])
+	}
+
+	// Group the edits into hunks: consecutive changes separated by more than
+	// twice the context lines start a new hunk.
+	const context = 3
+	var changes []int
+	for k, o := range ops {
+		if o.kind != ' ' {
+			changes = append(changes, k)
+		}
+	}
+	for g := 0; g < len(changes); {
+		last := g
+		for last+1 < len(changes) && changes[last+1]-changes[last]-1 <= 2*context {
+			last++
+		}
+		lo := max(0, changes[g]-context)
+		hi := min(len(ops), changes[last]+1+context)
+		// The header numbers are the first line of each side actually shown:
+		// the first context, deletion or insertion line.  A hunk that shows
+		// no old lines is a pure insertion and reports the position it sits
+		// before (0 at the top of the file); the mirror rule holds for a
+		// pure deletion.
+		aStart := ops[lo].aLine - 1
+		bStart := ops[lo].bLine - 1
+		countA, countB := 0, 0
+		for _, o := range ops[lo:hi] {
+			switch o.kind {
+			case ' ':
+				countA++
+				countB++
+			case '-':
+				countA++
+			case '+':
+				countB++
+			}
+		}
+		for _, o := range ops[lo:hi] {
+			if o.kind != '+' {
+				aStart = o.aLine
+				break
+			}
+		}
+		for _, o := range ops[lo:hi] {
+			if o.kind != '-' {
+				bStart = o.bLine
+				break
+			}
+		}
+		fmt.Fprintf(&out, "@@ -%d,%d +%d,%d @@\n", aStart, countA, bStart, countB)
+		for _, o := range ops[lo:hi] {
+			out.WriteByte(o.kind)
+			out.WriteString(o.text)
+			out.WriteByte('\n')
+		}
+		g = last + 1
+	}
+	return out.String()
+}

cmd/gasm/unidiff_test.go

@@ -0,0 +1,94 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: BSD-3-Clause
+
+package main
+
+import (
+	"slices"
+	"strings"
+	"testing"
+)
+
+func lines(ss ...string) []string { return ss }
+
+func TestUnifiedDiffIdentical(t *testing.T) {
+	if got := unifiedDiff("f", lines("a", "b"), lines("a", "b")); got != "" {
+		t.Errorf("identical inputs produced %q, want empty", got)
+	}
+}
+
+func TestUnifiedDiffSingleChange(t *testing.T) {
+	a := lines("1", "2", "3", "4", "5", "6", "7", "8")
+	b := lines("1", "2", "3!", "4", "5", "6", "7", "8")
+	want := "--- f\n+++ f\n" +
+		"@@ -1,6 +1,6 @@\n" +
+		" 1\n 2\n-3\n+3!\n 4\n 5\n 6\n"
+	if got := unifiedDiff("f", a, b); got != want {
+		t.Errorf("diff = %q, want %q", got, want)
+	}
+}
+
+func TestUnifiedDiffInsertAtStart(t *testing.T) {
+	got := unifiedDiff("f", lines("x"), lines("new", "x"))
+	// The single existing line is shown as trailing context, so the hunk
+	// covers it.
+	want := "--- f\n+++ f\n@@ -1,1 +1,2 @@\n+new\n x\n"
+	if got != want {
+		t.Errorf("diff = %q, want %q", got, want)
+	}
+}
+
+func TestUnifiedDiffDeleteAtEnd(t *testing.T) {
+	got := unifiedDiff("f", lines("x", "y"), lines("x"))
+	want := "--- f\n+++ f\n@@ -1,2 +1,1 @@\n x\n-y\n"
+	if got != want {
+		t.Errorf("diff = %q, want %q", got, want)
+	}
+}
+
+func TestUnifiedDiffTwoHunks(t *testing.T) {
+	var a, b []string
+	for i := 1; i <= 20; i++ {
+		a = append(a, itoa(i))
+		b = append(b, itoa(i))
+	}
+	b[1] = "2!"
+	b[17] = "18!"
+	got := unifiedDiff("f", a, b)
+	if !strings.Contains(got, "@@ -1,5 +1,5 @@\n 1\n-2\n+2!\n 3\n 4\n 5\n") {
+		t.Errorf("first hunk wrong:\n%s", got)
+	}
+	if !strings.Contains(got, "@@ -15,6 +15,6 @@\n 15\n 16\n 17\n-18\n+18!\n 19\n 20\n") {
+		t.Errorf("second hunk wrong:\n%s", got)
+	}
+}
+
+// TestUnifiedDiffAdjacentHunks merges changes separated by exactly twice the
+// context into one hunk.
+func TestUnifiedDiffAdjacentHunks(t *testing.T) {
+	a := lines("1", "2", "3", "4", "5", "6", "7", "8")
+	b := slices.Clone(a)
+	b[0] = "1!"
+	b[7] = "8!"
+	got := unifiedDiff("f", a, b)
+	want := "--- f\n+++ f\n" +
+		"@@ -1,8 +1,8 @@\n" +
+		"-1\n+1!\n 2\n 3\n 4\n 5\n 6\n 7\n-8\n+8!\n"
+	if got != want {
+		t.Errorf("diff = %q, want %q", got, want)
+	}
+}
+
+func itoa(n int) string {
+	if n == 0 {
+		return "0"
+	}
+	var buf [4]byte
+	i := len(buf)
+	for n > 0 {
+		i--
+		buf[i] = byte('0' + n%10)
+		n /= 10
+	}
+	return string(buf[i:])
+}

debug/breakpoint.go

@@ -1,89 +1,101 @@
 // Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
 // SPDX-License-Identifier: BSD-3-Clause
 
+//go:build linux
+
 package debug
 
+import "strings"
+
 import "fmt"
 
-// Breakpoint is one INT3 breakpoint in the debuggee.
+// Breakpoint is one software breakpoint in the debuggee.
 type Breakpoint struct {
 	Addr    uint64 // absolute address in the debuggee
 	Label   string // source label ("" for raw addresses)
-	Orig    byte   // original byte at Addr (restored on removal)
+	Orig    []byte // original bytes at Addr (restored on removal)
 	Enabled bool
 	Cond    *Condition // optional condition (nil = unconditional)
 	hits    int
 }
 
-// Condition is a simple register-comparison condition evaluated when a
-// breakpoint is hit.  Format: <reg> <op> <value>.
+// Condition is a register-comparison condition evaluated when a breakpoint
+// is hit.  Supports three forms:
+//   - register vs constant:  <reg> <op> <value>
+//   - register vs register:  <reg> <op> <reg2>
+//   - register vs memory:    <reg> <op> *<addr>
 type Condition struct {
-	Reg   string // register name (rax, rbx, rip, rsp, ...)
-	Op    string // comparison operator: ==, !=, <, >, <=, >=
-	Value uint64
+	Reg     string // register name (rax, rbx, rip, rsp, ...)
+	Op      string // comparison operator: ==, !=, <, >, <=, >=
+	Value   uint64 // constant value (when Reg2 == "" and MemAddr == 0)
+	Reg2    string // second register name (for register-register comparison)
+	MemAddr uint64 // memory address (for register-memory comparison, prefixed with *)
 }
 
-// Eval checks the condition against the current registers.
-func (c *Condition) Eval(regs *Regs) bool {
-	var actual uint64
-	switch c.Reg {
-	case "rax", "eax", "ax", "al":
-		actual = regs.RAX
-	case "rbx", "ebx", "bx", "bl":
-		actual = regs.RBX
-	case "rcx", "ecx", "cx", "cl":
-		actual = regs.RCX
-	case "rdx", "edx", "dx", "dl":
-		actual = regs.RDX
-	case "rsi", "esi", "si":
-		actual = regs.RSI
-	case "rdi", "edi", "di":
-		actual = regs.RDI
-	case "rbp", "ebp", "bp":
-		actual = regs.RBP
-	case "rsp", "esp", "sp":
-		actual = regs.RSP
-	case "r8":
-		actual = regs.R8
-	case "r9":
-		actual = regs.R9
-	case "r10":
-		actual = regs.R10
-	case "r11":
-		actual = regs.R11
-	case "r12":
-		actual = regs.R12
-	case "r13":
-		actual = regs.R13
-	case "r14":
-		actual = regs.R14
-	case "r15":
-		actual = regs.R15
-	case "rip", "eip":
-		actual = regs.RIP
+// Eval checks the condition against the current registers.  For the
+// register-memory form, mem reads an 8-byte little-endian word from the
+// debuggee; it may be nil when no reader is available.  Anything that cannot
+// be decided (unknown register or operator, unreadable memory) does not
+// block the breakpoint.
+func (c *Condition) Eval(regs *Regs, mem func(addr uint64) (uint64, bool)) bool {
+	actual, ok := regs.RegValue(c.Reg)
+	if !ok {
+		return true // unknown register, don't block
+	}
+	var expected uint64
+	switch {
+	case c.Reg2 != "":
+		// Register-register comparison.
+		v, ok := regs.RegValue(c.Reg2)
+		if !ok {
+			return true
+		}
+		expected = v
+	case c.MemAddr != 0:
+		// Register-memory comparison, resolved in the debuggee at
+		// evaluation time.
+		if mem == nil {
+			return true
+		}
+		v, ok := mem(c.MemAddr)
+		if !ok {
+			return true
+		}
+		expected = v
 	default:
-		return true // unknown register — don't block
+		expected = c.Value
 	}
 	switch c.Op {
 	case "==", "=":
-		return actual == c.Value
+		return actual == expected
 	case "!=":
-		return actual != c.Value
+		return actual != expected
 	case "<":
-		return actual < c.Value
+		return actual < expected
 	case ">":
-		return actual > c.Value
+		return actual > expected
 	case "<=":
-		return actual <= c.Value
+		return actual <= expected
 	case ">=":
-		return actual >= c.Value
+		return actual >= expected
 	default:
 		return true
 	}
 }
 
-// Breakpoints manages the set of breakpoints for a Session.
-// Breakpoints manages software breakpoints for a debuggee.
+// String renders the condition for display.
+func (c *Condition) String() string {
+	switch {
+	case c.Reg2 != "":
+		return fmt.Sprintf("%s %s %s", c.Reg, c.Op, c.Reg2)
+	case c.MemAddr != 0:
+		return fmt.Sprintf("%s %s *%#x", c.Reg, c.Op, c.MemAddr)
+	default:
+		return fmt.Sprintf("%s %s %#x", c.Reg, c.Op, c.Value)
+	}
+}
+
+// Breakpoints manages the software breakpoints of one Session.
 type Breakpoints struct {
 	t   tracer
 	bps map[uint64]*Breakpoint
@@ -94,6 +106,18 @@ func NewBreakpoints(t tracer) *Breakpoints {
 	return &Breakpoints{t: t, bps: make(map[uint64]*Breakpoint)}
 }
 
+// breakpointMask is the byte mask of the breakpoint instruction inside a
+// peeked word: the low len(breakpointInsn) bytes, because every supported
+// architecture is little-endian and patches the instruction at the lowest
+// address of the word.
+func breakpointMask() uint64 {
+	var mask uint64
+	for range breakpointInsn {
+		mask = (mask << 8) | 0xFF
+	}
+	return mask
+}
+
 // Set installs a breakpoint at addr (replaces any existing one).
 func (bm *Breakpoints) Set(addr uint64, label string) (*Breakpoint, error) {
 	return bm.SetWithCond(addr, label, nil)
@@ -106,14 +130,17 @@ func (bm *Breakpoints) SetWithCond(addr uint64, label string, cond *Condition) (
 		bp.Cond = cond
 		return bp, nil
 	}
-	// Read the original byte.
+	// Read the original bytes.
 	word, err := bm.t.Peek(addr)
 	if err != nil {
 		return nil, err
 	}
-	orig := byte(word)
-	// Patch with INT3 (0xCC), preserving the rest of the word.
-	patched := (word &^ 0xFF) | 0xCC
+	orig := make([]byte, len(breakpointInsn))
+	for i := range orig {
+		orig[i] = byte(word >> (8 * i))
+	}
+	// Patch with the breakpoint instruction, preserving the rest of the word.
+	patched := (word &^ breakpointMask()) | breakpointWord(breakpointInsn)
 	if err := bm.t.Poke(addr, patched); err != nil {
 		return nil, err
 	}
@@ -122,17 +149,12 @@ func (bm *Breakpoints) SetWithCond(addr uint64, label string, cond *Condition) (
 	return bp, nil
 }
 
-// Hits returns the number of times the breakpoint has been hit.
-func (bp *Breakpoint) Hits() int {
-	return bp.hits
-}
-
 // Info returns a formatted list of all breakpoints.
 func (bm *Breakpoints) Info() string {
 	if len(bm.bps) == 0 {
 		return "no breakpoints set\n"
 	}
-	result := ""
+	var result strings.Builder
 	i := 0
 	for _, bp := range bm.bps {
 		i++
@@ -146,26 +168,40 @@ func (bm *Breakpoints) Info() string {
 		}
 		cond := ""
 		if bp.Cond != nil {
-			cond = fmt.Sprintf(" if %s %s %#x", bp.Cond.Reg, bp.Cond.Op, bp.Cond.Value)
+			cond = " if " + bp.Cond.String()
 		}
-		result += fmt.Sprintf("  %d: %s at %#x [%s, %d hits]%s\n", i, label, bp.Addr, status, bp.hits, cond)
+		result.WriteString(fmt.Sprintf("  %d: %s at %#x [%s, %d hits]%s\n", i, label, bp.Addr, status, bp.hits, cond))
 	}
-	return result
+	return result.String()
 }
 
-// Clear removes the breakpoint at addr, restoring the original byte.
+// restore writes the saved original bytes back over the breakpoint
+// instruction, preserving the rest of the peeked word.  It reports whether
+// both the peek and the poke succeeded.
+func (bm *Breakpoints) restore(addr uint64, bp *Breakpoint) bool {
+	word, err := bm.t.Peek(addr)
+	if err != nil {
+		return false
+	}
+	orig := uint64(0)
+	for i, b := range bp.Orig {
+		orig |= uint64(b) << (8 * i)
+	}
+	return bm.t.Poke(addr, (word&^breakpointMask())|orig) == nil
+}
+
+// Clear removes the breakpoint at addr, restoring the original bytes.
 func (bm *Breakpoints) Clear(addr uint64) error {
 	bp, ok := bm.bps[addr]
 	if !ok {
 		return fmt.Errorf("debug: no breakpoint at %#x", addr)
 	}
-	word, err := bm.t.Peek(addr)
-	if err != nil {
-		return err
-	}
-	restored := (word &^ 0xFF) | uint64(bp.Orig)
-	if err := bm.t.Poke(addr, restored); err != nil {
-		return err
+	if !bm.restore(addr, bp) {
+		word, err := bm.t.Peek(addr)
+		if err != nil {
+			return err
+		}
+		return fmt.Errorf("debug: restore breakpoint at %#x failed, word is %#x", addr, word)
 	}
 	delete(bm.bps, addr)
 	return nil
@@ -196,41 +232,55 @@ func (bm *Breakpoints) All() []*Breakpoint {
 }
 
 // HandleTrap is called after the debuggee stops on SIGTRAP.  It checks
-// whether the trap was caused by one of our breakpoints (RIP-1 matches
-// a breakpoint address), restores the original byte, rewinds RIP, and
+// whether the trap was caused by one of our breakpoints (PC-adjust matches
+// a breakpoint address), restores the original bytes, rewinds PC, and
 // returns the breakpoint that was hit (or nil if it was a single-step).
+// Hits returns how many times the breakpoint has been hit.
+func (bp *Breakpoint) Hits() int { return bp.hits }
+
 func (bm *Breakpoints) HandleTrap(regs *Regs) *Breakpoint {
-	// After INT3, RIP points to the byte AFTER the 0xCC.
-	trapAddr := regs.RIP - 1
+	// On amd64 the kernel reports the trap with RIP past the INT3; on the
+	// other supported architectures the PC still stands on the trap
+	// instruction, which breakpointPCAdjust encodes per architecture.
+	trapAddr := regs.GetPC() - uint64(breakpointPCAdjust)
 	bp, ok := bm.bps[trapAddr]
 	if !ok || !bp.Enabled {
 		return nil // single-step trap or unknown
 	}
 	// Check the condition (if any).
-	if bp.Cond != nil && !bp.Cond.Eval(regs) {
-		// Condition not met — restore the byte but do NOT rewind RIP.
-		// The process continues from the next instruction (past the INT3).
-		word, err := bm.t.Peek(trapAddr)
-		if err == nil {
-			restored := (word &^ 0xFF) | uint64(bp.Orig)
-			bm.t.Poke(trapAddr, restored)
+	if bp.Cond != nil && !bp.Cond.Eval(regs, bm.peekValue) {
+		// Condition not met: step the original instruction and re-arm the
+		// breakpoint, leaving the debuggee stopped just past it, ready to
+		// resume silently.  The PC must be rewound first: on architectures
+		// that report the trap past the instruction (amd64) it would
+		// otherwise sit on the second byte of the replaced instruction.
+		if !bm.restore(trapAddr, bp) {
+			return nil
 		}
-		// RIP is already past the INT3 (trapAddr + 1). Don't rewind.
+		regs.SetPC(trapAddr)
+		if err := bm.t.SetRegs(regs); err != nil {
+			return nil
+		}
+		if err := bm.t.Step(); err != nil {
+			return nil
+		}
+		bm.Reinsert(trapAddr)
 		return nil
 	}
 	bp.hits++
-	// Restore the original byte.
-	word, err := bm.t.Peek(trapAddr)
-	if err == nil {
-		restored := (word &^ 0xFF) | uint64(bp.Orig)
-		bm.t.Poke(trapAddr, restored)
-	}
-	// Rewind RIP to re-execute the original instruction.
-	regs.RIP = trapAddr
+	// Restore the original bytes and rewind PC to re-execute them.
+	bm.restore(trapAddr, bp)
+	regs.SetPC(trapAddr)
 	bm.t.SetRegs(regs)
 	return bp
 }
 
+// peekValue adapts tracer.Peek to the Condition value reader.
+func (bm *Breakpoints) peekValue(addr uint64) (uint64, bool) {
+	v, err := bm.t.Peek(addr)
+	return v, err == nil
+}
+
 // Reinsert re-inserts the breakpoint at addr after a single-step past it.
 // Called after Step() when we want the breakpoint to fire again on the
 // next Continue().
@@ -243,6 +293,15 @@ func (bm *Breakpoints) Reinsert(addr uint64) error {
 	if err != nil {
 		return err
 	}
-	patched := (word &^ 0xFF) | 0xCC
+	patched := (word &^ breakpointMask()) | breakpointWord(breakpointInsn)
 	return bm.t.Poke(addr, patched)
 }
+
+// breakpointWord converts the breakpoint instruction bytes to a uint64.
+func breakpointWord(insn []byte) uint64 {
+	var w uint64
+	for i, b := range insn {
+		w |= uint64(b) << (i * 8)
+	}
+	return w
+}

debug/debug_arch_test.go

@@ -0,0 +1,265 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build linux
+
+package debug
+
+// Architecture-neutral tests: label and line tables, and the breakpoint
+// manager against the mock tracer.  These do not launch a debuggee, so they
+// build on every supported linux architecture.
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestLineAt(t *testing.T) {
+	lines := []SourceLine{
+		{Offset: 0, Line: 5},
+		{Offset: 5, Line: 6},
+		{Offset: 10, Line: 7},
+		{Offset: 15, Line: 8},
+	}
+
+	tests := []struct {
+		offset int
+		want   int
+	}{
+		{0, 5},
+		{1, 5},
+		{4, 5},
+		{5, 6},
+		{7, 6},
+		{10, 7},
+		{12, 7},
+		{15, 8},
+		{20, 8},
+	}
+
+	for _, tt := range tests {
+		got := lineAt(lines, tt.offset)
+		if got != tt.want {
+			t.Errorf("lineAt(lines, %d) = %d, want %d", tt.offset, got, tt.want)
+		}
+	}
+
+	// Empty table.
+	if lineAt(nil, 5) != 0 {
+		t.Error("lineAt(nil, 5) should return 0")
+	}
+}
+
+func TestOffsetForLine(t *testing.T) {
+	lines := []SourceLine{
+		{Offset: 0, Line: 5},
+		{Offset: 5, Line: 6},
+		{Offset: 10, Line: 7},
+	}
+
+	tests := []struct {
+		line int
+		want int
+	}{
+		{5, 0},
+		{6, 5},
+		{7, 10},
+		{99, -1}, // not found
+		{0, -1},  // not found
+	}
+
+	for _, tt := range tests {
+		got := offsetForLine(lines, tt.line)
+		if got != tt.want {
+			t.Errorf("offsetForLine(lines, %d) = %d, want %d", tt.line, got, tt.want)
+		}
+	}
+}
+
+func TestNearestLabel(t *testing.T) {
+	labels := []Label{
+		{Name: "start", Offset: 0},
+		{Name: "loop", Offset: 10},
+		{Name: "done", Offset: 20},
+	}
+
+	tests := []struct {
+		offset int
+		want   string
+	}{
+		{0, "start"},
+		{5, "start"},
+		{10, "loop"},
+		{15, "loop"},
+		{20, "done"},
+		{25, "done"},
+	}
+
+	for _, tt := range tests {
+		got := nearestLabel(labels, tt.offset)
+		if got != tt.want {
+			t.Errorf("nearestLabel(labels, %d) = %q, want %q", tt.offset, got, tt.want)
+		}
+	}
+}
+
+func TestBreakpointsSetAndClear(t *testing.T) {
+	tr := newMockTracer()
+	bm := NewBreakpoints(tr)
+
+	// Set a breakpoint at address 0x1000.
+	bp, err := bm.Set(0x1000, "test")
+	if err != nil {
+		t.Fatalf("Set: %v", err)
+	}
+	if !bp.Enabled {
+		t.Error("breakpoint not enabled")
+	}
+	if bp.Label != "test" {
+		t.Errorf("label = %q, want test", bp.Label)
+	}
+
+	// Verify Peek was called.
+	if len(tr.peeks) != 1 || tr.peeks[0] != 0x1000 {
+		t.Errorf("peeks = %v, want [0x1000]", tr.peeks)
+	}
+
+	// Verify Poke wrote the breakpoint instruction's bytes.
+	if len(tr.pokes) != 1 || tr.pokes[0].addr != 0x1000 {
+		t.Errorf("pokes = %v", tr.pokes)
+	}
+	if got := tr.pokes[0].val & breakpointMask(); got != breakpointWord(breakpointInsn) {
+		t.Errorf("patched bytes %#x, want %#x", got, breakpointWord(breakpointInsn))
+	}
+
+	// At should find it.
+	if bm.At(0x1000) == nil {
+		t.Error("At(0x1000) returned nil")
+	}
+
+	// All should return it.
+	all := bm.All()
+	if len(all) != 1 {
+		t.Errorf("All() = %d breakpoints, want 1", len(all))
+	}
+
+	// Clear it.
+	if err := bm.Clear(0x1000); err != nil {
+		t.Fatalf("Clear: %v", err)
+	}
+	if bm.At(0x1000) != nil {
+		t.Error("At(0x1000) after Clear should be nil")
+	}
+}
+
+// TestBreakpointRestoreWidth proves the restore path writes back every
+// byte of the breakpoint instruction's width, not just the first byte: on
+// arm64, riscv64 and loong64 the instruction is four bytes, and restoring
+// one byte would leave three bytes of the trap instruction in place.
+func TestBreakpointRestoreWidth(t *testing.T) {
+	tr := newMockTracer()
+	bm := NewBreakpoints(tr)
+	tr.mem[0x3000] = 0x11
+	tr.mem[0x3001] = 0x22
+	tr.mem[0x3002] = 0x33
+	tr.mem[0x3003] = 0x44
+
+	if _, err := bm.Set(0x3000, "width"); err != nil {
+		t.Fatalf("Set: %v", err)
+	}
+	for i, b := range breakpointInsn {
+		if tr.mem[0x3000+uint64(i)] != b {
+			t.Fatalf("byte %d after Set = %#x, want the breakpoint byte %#x", i, tr.mem[0x3000+uint64(i)], b)
+		}
+	}
+	if len(bm.At(0x3000).Orig) != len(breakpointInsn) {
+		t.Fatalf("Orig holds %d bytes, want %d", len(bm.At(0x3000).Orig), len(breakpointInsn))
+	}
+
+	if err := bm.Clear(0x3000); err != nil {
+		t.Fatalf("Clear: %v", err)
+	}
+	want := []byte{0x11, 0x22, 0x33, 0x44}
+	for i, b := range want {
+		if tr.mem[0x3000+uint64(i)] != b {
+			t.Errorf("byte %d after Clear = %#x, want %#x (restore must cover the full instruction width)", i, tr.mem[0x3000+uint64(i)], b)
+		}
+	}
+}
+
+func TestBreakpointsSetWithCond(t *testing.T) {
+	tr := newMockTracer()
+	bm := NewBreakpoints(tr)
+
+	cond := &Condition{Reg: "rax", Op: "==", Value: 42}
+	bp, err := bm.SetWithCond(0x2000, "cond_test", cond)
+	if err != nil {
+		t.Fatalf("SetWithCond: %v", err)
+	}
+	if bp.Cond == nil || bp.Cond.Value != 42 {
+		t.Error("condition not set")
+	}
+
+	// Re-setting the same address should update the condition.
+	cond2 := &Condition{Reg: "rbx", Op: "<", Value: 100}
+	bp2, err := bm.SetWithCond(0x2000, "cond_test2", cond2)
+	if err != nil {
+		t.Fatalf("SetWithCond (update): %v", err)
+	}
+	if bp2.Cond.Value != 100 {
+		t.Error("condition not updated")
+	}
+	// Should have only 1 Peek (first Set), second is update (no Peek needed).
+	if len(tr.peeks) != 1 {
+		t.Errorf("expected 1 Peek, got %d", len(tr.peeks))
+	}
+}
+
+func TestBreakpointsClearAll(t *testing.T) {
+	tr := newMockTracer()
+	bm := NewBreakpoints(tr)
+
+	bm.Set(0x1000, "a")
+	bm.Set(0x2000, "b")
+	bm.Set(0x3000, "c")
+
+	if len(bm.All()) != 3 {
+		t.Fatalf("expected 3 breakpoints, got %d", len(bm.All()))
+	}
+
+	bm.ClearAll()
+	if len(bm.All()) != 0 {
+		t.Errorf("ClearAll: expected 0 breakpoints, got %d", len(bm.All()))
+	}
+}
+
+func TestBreakpointInfo(t *testing.T) {
+	tr := newMockTracer()
+	bm := NewBreakpoints(tr)
+	bm.Set(0x4000, "info_test")
+
+	info := bm.Info()
+	if info == "" {
+		t.Error("Info returned empty string")
+	}
+	if !strings.Contains(info, "info_test") {
+		t.Errorf("Info %q does not contain label", info)
+	}
+}
+
+// TestConditionString covers the display of all three condition forms.
+func TestConditionString(t *testing.T) {
+	tests := []struct {
+		cond Condition
+		want string
+	}{
+		{Condition{Reg: "rax", Op: "==", Value: 42}, "rax == 0x2a"},
+		{Condition{Reg: "rax", Op: "!=", Reg2: "rbx"}, "rax != rbx"},
+		{Condition{Reg: "rax", Op: "<", MemAddr: 0x5000}, "rax < *0x5000"},
+	}
+	for _, tt := range tests {
+		if got := tt.cond.String(); got != tt.want {
+			t.Errorf("Condition.String() = %q, want %q", got, tt.want)
+		}
+	}
+}

debug/debug_test.go

@@ -1,10 +1,11 @@
 // Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
 // SPDX-License-Identifier: BSD-3-Clause
 
+//go:build linux && amd64
+
 package debug
 
 import (
-	"strings"
 	"testing"
 )
 
@@ -46,7 +47,7 @@ func TestConditionEval(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		got := tt.cond.Eval(regs)
+		got := tt.cond.Eval(regs, nil)
 		if got != tt.want {
 			t.Errorf("Condition{%q %q %d}.Eval() = %v, want %v",
 				tt.cond.Reg, tt.cond.Op, tt.cond.Value, got, tt.want)
@@ -54,65 +55,33 @@ func TestConditionEval(t *testing.T) {
 	}
 }
 
-func TestLineAt(t *testing.T) {
-	lines := []SourceLine{
-		{Offset: 0, Line: 5},
-		{Offset: 5, Line: 6},
-		{Offset: 10, Line: 7},
-		{Offset: 15, Line: 8},
-	}
-
-	tests := []struct {
-		offset int
-		want   int
-	}{
-		{0, 5},
-		{1, 5},
-		{4, 5},
-		{5, 6},
-		{7, 6},
-		{10, 7},
-		{12, 7},
-		{15, 8},
-		{20, 8},
-	}
-
-	for _, tt := range tests {
-		got := lineAt(lines, tt.offset)
-		if got != tt.want {
-			t.Errorf("lineAt(lines, %d) = %d, want %d", tt.offset, got, tt.want)
+// TestConditionEvalMem covers the register-memory form: the value is read
+// through the supplied reader, and a missing or failing reader must not
+// block the breakpoint.
+func TestConditionEvalMem(t *testing.T) {
+	regs := &Regs{RAX: 7}
+	mem := func(addr uint64) (uint64, bool) {
+		if addr == 0x5000 {
+			return 7, true
 		}
+		return 0, false
 	}
 
-	// Empty table.
-	if lineAt(nil, 5) != 0 {
-		t.Error("lineAt(nil, 5) should return 0")
+	eq := Condition{Reg: "rax", Op: "==", MemAddr: 0x5000}
+	if !eq.Eval(regs, mem) {
+		t.Error("register-memory comparison with matching word should hold")
 	}
-}
-
-func TestOffsetForLine(t *testing.T) {
-	lines := []SourceLine{
-		{Offset: 0, Line: 5},
-		{Offset: 5, Line: 6},
-		{Offset: 10, Line: 7},
+	ne := Condition{Reg: "rax", Op: "!=", MemAddr: 0x5000}
+	if ne.Eval(regs, mem) {
+		t.Error("register-memory comparison with mismatching word should not hold")
 	}
-
-	tests := []struct {
-		line int
-		want int
-	}{
-		{5, 0},
-		{6, 5},
-		{7, 10},
-		{99, -1}, // not found
-		{0, -1},  // not found
+	bad := Condition{Reg: "rax", Op: "==", MemAddr: 0x6000}
+	if !bad.Eval(regs, mem) {
+		t.Error("unreadable memory must not block the breakpoint")
 	}
-
-	for _, tt := range tests {
-		got := offsetForLine(lines, tt.line)
-		if got != tt.want {
-			t.Errorf("offsetForLine(lines, %d) = %d, want %d", tt.line, got, tt.want)
-		}
+	noReader := Condition{Reg: "rax", Op: "==", MemAddr: 0x5000}
+	if !noReader.Eval(regs, nil) {
+		t.Error("missing memory reader must not block the breakpoint")
 	}
 }
 
@@ -139,144 +108,11 @@ func TestDecodeRflags(t *testing.T) {
 	}
 }
 
-func TestNearestLabel(t *testing.T) {
-	labels := []Label{
-		{Name: "start", Offset: 0},
-		{Name: "loop", Offset: 10},
-		{Name: "done", Offset: 20},
-	}
-
-	tests := []struct {
-		offset int
-		want   string
-	}{
-		{0, "start"},
-		{5, "start"},
-		{10, "loop"},
-		{15, "loop"},
-		{20, "done"},
-		{25, "done"},
-	}
-
-	for _, tt := range tests {
-		got := nearestLabel(labels, tt.offset)
-		if got != tt.want {
-			t.Errorf("nearestLabel(labels, %d) = %q, want %q", tt.offset, got, tt.want)
-		}
-	}
-}
-
-func TestBreakpointsSetAndClear(t *testing.T) {
-	tr := newMockTracer()
-	bm := NewBreakpoints(tr)
-
-	// Set a breakpoint at address 0x1000.
-	bp, err := bm.Set(0x1000, "test")
-	if err != nil {
-		t.Fatalf("Set: %v", err)
-	}
-	if !bp.Enabled {
-		t.Error("breakpoint not enabled")
-	}
-	if bp.Label != "test" {
-		t.Errorf("label = %q, want test", bp.Label)
-	}
-
-	// Verify Peek was called.
-	if len(tr.peeks) != 1 || tr.peeks[0] != 0x1000 {
-		t.Errorf("peeks = %v, want [0x1000]", tr.peeks)
-	}
-
-	// Verify Poke wrote INT3.
-	if len(tr.pokes) != 1 || tr.pokes[0].addr != 0x1000 {
-		t.Errorf("pokes = %v", tr.pokes)
-	}
-
-	// At should find it.
-	if bm.At(0x1000) == nil {
-		t.Error("At(0x1000) returned nil")
-	}
-
-	// All should return it.
-	all := bm.All()
-	if len(all) != 1 {
-		t.Errorf("All() = %d breakpoints, want 1", len(all))
-	}
-
-	// Clear it.
-	if err := bm.Clear(0x1000); err != nil {
-		t.Fatalf("Clear: %v", err)
-	}
-	if bm.At(0x1000) != nil {
-		t.Error("At(0x1000) after Clear should be nil")
-	}
-}
-
-func TestBreakpointsSetWithCond(t *testing.T) {
-	tr := newMockTracer()
-	bm := NewBreakpoints(tr)
-
-	cond := &Condition{Reg: "rax", Op: "==", Value: 42}
-	bp, err := bm.SetWithCond(0x2000, "cond_test", cond)
-	if err != nil {
-		t.Fatalf("SetWithCond: %v", err)
-	}
-	if bp.Cond == nil || bp.Cond.Value != 42 {
-		t.Error("condition not set")
-	}
-
-	// Re-setting the same address should update the condition.
-	cond2 := &Condition{Reg: "rbx", Op: "<", Value: 100}
-	bp2, err := bm.SetWithCond(0x2000, "cond_test2", cond2)
-	if err != nil {
-		t.Fatalf("SetWithCond (update): %v", err)
-	}
-	if bp2.Cond.Value != 100 {
-		t.Error("condition not updated")
-	}
-	// Should have only 1 Peek (first Set), second is update (no Peek needed).
-	if len(tr.peeks) != 1 {
-		t.Errorf("expected 1 Peek, got %d", len(tr.peeks))
-	}
-}
-
-func TestBreakpointsClearAll(t *testing.T) {
-	tr := newMockTracer()
-	bm := NewBreakpoints(tr)
-
-	bm.Set(0x1000, "a")
-	bm.Set(0x2000, "b")
-	bm.Set(0x3000, "c")
-
-	if len(bm.All()) != 3 {
-		t.Fatalf("expected 3 breakpoints, got %d", len(bm.All()))
-	}
-
-	bm.ClearAll()
-	if len(bm.All()) != 0 {
-		t.Errorf("ClearAll: expected 0 breakpoints, got %d", len(bm.All()))
-	}
-}
-
-func TestBreakpointInfo(t *testing.T) {
-	tr := newMockTracer()
-	bm := NewBreakpoints(tr)
-	bm.Set(0x4000, "info_test")
-
-	info := bm.Info()
-	if info == "" {
-		t.Error("Info returned empty string")
-	}
-	if !strings.Contains(info, "info_test") {
-		t.Errorf("Info %q does not contain label", info)
-	}
-}
-
 func TestWatchpointSlotTracking(t *testing.T) {
-	s := &Session{}
+	s := &Session{} // per-session slots start free
 
 	// All four slots are free initially.
-	for i := 0; i < 4; i++ {
+	for i := range 4 {
 		if s.IsWatchpointSlotUsed(i) {
 			t.Errorf("slot %d should be free initially", i)
 		}
@@ -314,10 +150,26 @@ func TestWatchpointSlotTracking(t *testing.T) {
 	}
 
 	// Mark all slots used: FindFreeWatchpointSlot returns -1.
-	for i := 0; i < 4; i++ {
+	for i := range 4 {
 		s.wpSlots[i] = true
 	}
 	if got := s.FindFreeWatchpointSlot(); got != -1 {
 		t.Errorf("FindFreeWatchpointSlot() with all slots used = %d, want -1", got)
 	}
 }
+
+// TestUnwatchSlotBound checks the bound the REPL parses against: it must
+// cover the architecture's whole slot range, not a hardcoded 0-3.
+func TestUnwatchSlotBound(t *testing.T) {
+	max := maxWatchpoints()
+	if max < 4 {
+		t.Fatalf("maxWatchpoints() = %d, want at least 4", max)
+	}
+	s := &Session{}
+	if s.IsWatchpointSlotUsed(max - 1) {
+		t.Errorf("slot %d should be free initially", max-1)
+	}
+	if s.IsWatchpointSlotUsed(max) {
+		t.Errorf("slot %d must be out of range", max)
+	}
+}

debug/disasm_linux_amd64.go

@@ -7,46 +7,50 @@ package debug
 
 import (
 	"fmt"
+	"strings"
 
-	"golang.org/x/arch/x86/x86asm"
+	"sourcedock.dev/petrbalvin/gasm-devkit/arch"
+	"sourcedock.dev/petrbalvin/gasm-devkit/disasm"
 )
 
 // Disassemble decodes the instruction at the given address in the debuggee's
 // memory and returns its text representation and length in bytes.
 func (s *Session) Disassemble(addr uint64) (string, int, error) {
-	// Read up to 15 bytes (max x86 instruction length).
 	mem, err := s.ReadMemory(addr, 15)
 	if err != nil {
-		// Try a shorter read if we're near a page boundary.
-		mem, err = s.ReadMemory(addr, 1)
-		if err != nil {
-			return "", 0, err
-		}
+		return "", 0, err
 	}
-	inst, err := x86asm.Decode(mem, 64)
+	ins, err := disasm.Decode(arch.AMD64, mem, addr)
 	if err != nil {
-		return "???", 1, nil
+		return "", 0, err
 	}
-	text := x86asm.IntelSyntax(inst, addr, nil)
-	return text, inst.Len, nil
+	return ins.Text, ins.Len, nil
 }
 
 // DisassembleN decodes up to n instructions starting at addr and returns
 // them as a formatted string with addresses and byte offsets.
 func (s *Session) DisassembleN(addr uint64, n int) string {
-	var result string
+	var result strings.Builder
 	pc := addr
-	for i := 0; i < n; i++ {
+	for range n {
 		text, length, err := s.Disassemble(pc)
 		if err != nil {
-			result += fmt.Sprintf("  %#08x: <error: %v>\n", pc, err)
+			result.WriteString(fmt.Sprintf("  %#08x: <error: %v>\n", pc, err))
 			break
 		}
-		result += fmt.Sprintf("  %#08x: %s\n", pc, text)
+		result.WriteString(fmt.Sprintf("  %#08x: %s\n", pc, text))
 		if length == 0 {
 			length = 1
 		}
 		pc += uint64(length)
 	}
-	return result
+	return result.String()
+}
+
+// isCallInsn reports whether disassembled text (x86asm.IntelSyntax) is a
+// call.  The first token must match exactly: a prefix test would also catch
+// unrelated mnemonics.
+func isCallInsn(text string) bool {
+	m, _, _ := strings.Cut(text, " ")
+	return strings.ToLower(m) == "call"
 }

debug/disasm_linux_arm64.go

@@ -0,0 +1,59 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build linux && arm64
+
+package debug
+
+import (
+	"fmt"
+	"strings"
+
+	"sourcedock.dev/petrbalvin/gasm-devkit/arch"
+	"sourcedock.dev/petrbalvin/gasm-devkit/disasm"
+)
+
+// Disassemble decodes the instruction at the given address in the debuggee's
+// memory and returns its text representation and length in bytes.
+func (s *Session) Disassemble(addr uint64) (string, int, error) {
+	mem, err := s.ReadMemory(addr, 4)
+	if err != nil {
+		return "", 0, err
+	}
+	ins, err := disasm.Decode(arch.ARM64, mem, addr)
+	if err != nil {
+		return "", 0, err
+	}
+	return ins.Text, ins.Len, nil
+}
+
+// DisassembleN decodes up to n instructions starting at addr.
+func (s *Session) DisassembleN(addr uint64, n int) string {
+	var result string
+	pc := addr
+	for range n {
+		text, length, err := s.Disassemble(pc)
+		if err != nil {
+			result += fmt.Sprintf("  %#08x: <error: %v>\n", pc, err)
+			break
+		}
+		result += fmt.Sprintf("  %#08x: %s\n", pc, text)
+		if length == 0 {
+			length = 4
+		}
+		pc += uint64(length)
+	}
+	return result
+}
+
+// isCallInsn reports whether disassembled text (arm64asm.GoSyntax) is a
+// call.  GoSyntax renders bl as CALL; the native mnemonic is accepted too.
+// The first token must match exactly so branches never match.
+func isCallInsn(text string) bool {
+	m, _, _ := strings.Cut(text, " ")
+	switch strings.ToLower(m) {
+	case "call", "bl":
+		return true
+	}
+	return false
+}

debug/disasm_linux_loong64.go

@@ -0,0 +1,60 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build linux && loong64
+
+package debug
+
+import (
+	"fmt"
+	"strings"
+
+	"sourcedock.dev/petrbalvin/gasm-devkit/arch"
+	"sourcedock.dev/petrbalvin/gasm-devkit/disasm"
+)
+
+// Disassemble decodes the instruction at the given address in the debuggee's
+// memory and returns its text representation and length in bytes.
+func (s *Session) Disassemble(addr uint64) (string, int, error) {
+	mem, err := s.ReadMemory(addr, 4)
+	if err != nil {
+		return "", 0, err
+	}
+	ins, err := disasm.Decode(arch.LOONG64, mem, addr)
+	if err != nil {
+		return "", 0, err
+	}
+	return ins.Text, ins.Len, nil
+}
+
+// DisassembleN decodes up to n instructions starting at addr.
+func (s *Session) DisassembleN(addr uint64, n int) string {
+	var result string
+	pc := addr
+	for range n {
+		text, length, err := s.Disassemble(pc)
+		if err != nil {
+			result += fmt.Sprintf("  %#08x: <error: %v>\n", pc, err)
+			break
+		}
+		result += fmt.Sprintf("  %#08x: %s\n", pc, text)
+		if length == 0 {
+			length = 4
+		}
+		pc += uint64(length)
+	}
+	return result
+}
+
+// isCallInsn reports whether disassembled text (loong64asm.GoSyntax) is a
+// call.  GoSyntax renders bl and jirl calls as CALL (jirl returns print
+// RET); the native mnemonics are accepted too.  The first token must match
+// exactly: a "bl" prefix would catch bltz and other branches.
+func isCallInsn(text string) bool {
+	m, _, _ := strings.Cut(text, " ")
+	switch strings.ToLower(m) {
+	case "call", "bl", "jirl":
+		return true
+	}
+	return false
+}

debug/disasm_linux_riscv64.go

@@ -0,0 +1,61 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build linux && riscv64
+
+package debug
+
+import (
+	"fmt"
+	"strings"
+
+	"sourcedock.dev/petrbalvin/gasm-devkit/arch"
+	"sourcedock.dev/petrbalvin/gasm-devkit/disasm"
+)
+
+// Disassemble decodes the instruction at the given address in the debuggee's
+// memory and returns its text representation and length in bytes.
+func (s *Session) Disassemble(addr uint64) (string, int, error) {
+	mem, err := s.ReadMemory(addr, 4)
+	if err != nil {
+		return "", 0, err
+	}
+	ins, err := disasm.Decode(arch.RISCV, mem, addr)
+	if err != nil {
+		return "", 0, err
+	}
+	return ins.Text, ins.Len, nil
+}
+
+// DisassembleN decodes up to n instructions starting at addr.
+func (s *Session) DisassembleN(addr uint64, n int) string {
+	var result string
+	pc := addr
+	for range n {
+		text, length, err := s.Disassemble(pc)
+		if err != nil {
+			result += fmt.Sprintf("  %#08x: <error: %v>\n", pc, err)
+			break
+		}
+		result += fmt.Sprintf("  %#08x: %s\n", pc, text)
+		if length == 0 {
+			length = 4
+		}
+		pc += uint64(length)
+	}
+	return result
+}
+
+// isCallInsn reports whether disassembled text (riscv64asm.GoSyntax) is a
+// call.  GoSyntax renders jal and jalr calls as CALL; the native mnemonics
+// are accepted too.  The first token must match exactly: a prefix test on
+// "bl" would catch branches on other architectures, and jalr as ret prints
+// RET, which must not be stepped over.
+func isCallInsn(text string) bool {
+	m, _, _ := strings.Cut(text, " ")
+	switch strings.ToLower(m) {
+	case "call", "jal", "jalr":
+		return true
+	}
+	return false
+}

debug/display_linux_amd64.go

@@ -0,0 +1,102 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build linux && amd64
+
+package debug
+
+import "fmt"
+
+func printRegs(regs *Regs, codeBase, funcOff uint64) {
+	fmt.Printf("  RIP = %#016x  (func+%#x)\n", regs.RIP, regs.RIP-codeBase-funcOff)
+	fmt.Printf("  RSP = %#016x  RBP = %#016x\n", regs.RSP, regs.RBP)
+	fmt.Printf("  RAX = %#016x  RBX = %#016x\n", regs.RAX, regs.RBX)
+	fmt.Printf("  RCX = %#016x  RDX = %#016x\n", regs.RCX, regs.RDX)
+	fmt.Printf("  RSI = %#016x  RDI = %#016x\n", regs.RSI, regs.RDI)
+	fmt.Printf("  R8  = %#016x  R9  = %#016x\n", regs.R8, regs.R9)
+	fmt.Printf("  R10 = %#016x  R11 = %#016x\n", regs.R10, regs.R11)
+	fmt.Printf("  R12 = %#016x  R13 = %#016x\n", regs.R12, regs.R13)
+	fmt.Printf("  R14 = %#016x  R15 = %#016x\n", regs.R14, regs.R15)
+	fmt.Printf("  RFLAGS = %#x  [%s]\n", regs.RFLAGS, decodeRflags(regs.RFLAGS))
+}
+
+func printVectorRegs(v *VectorRegs) {
+	fmt.Println("\n  Vector registers (YMM):")
+	for i := 0; i < 16; i += 2 {
+		fmt.Printf("  YMM%-2d = ", i)
+		printYMM(v.YMM[i][:])
+		fmt.Printf("  YMM%-2d = ", i+1)
+		printYMM(v.YMM[i+1][:])
+		fmt.Println()
+	}
+}
+
+func printYMM(b []byte) {
+	for j := 0; j < 32; j += 4 {
+		v := uint32(b[j]) | uint32(b[j+1])<<8 | uint32(b[j+2])<<16 | uint32(b[j+3])<<24
+		fmt.Printf("%08x ", v)
+	}
+}
+
+func decodeRflags(f uint64) string {
+	var flags string
+	if f&1 != 0 {
+		flags += "CF "
+	}
+	if f&(1<<2) != 0 {
+		flags += "PF "
+	}
+	if f&(1<<4) != 0 {
+		flags += "AF "
+	}
+	if f&(1<<6) != 0 {
+		flags += "ZF "
+	}
+	if f&(1<<7) != 0 {
+		flags += "SF "
+	}
+	if f&(1<<8) != 0 {
+		flags += "TF "
+	}
+	if f&(1<<9) != 0 {
+		flags += "IF "
+	}
+	if f&(1<<10) != 0 {
+		flags += "DF "
+	}
+	if f&(1<<11) != 0 {
+		flags += "OF "
+	}
+	if flags == "" {
+		return "none"
+	}
+	return flags[:len(flags)-1]
+}
+
+// archReturnAddr reads the return address of the current frame (amd64
+// ABI0 convention).  A function that contains a CALL (or has a frame) is
+// assembled with the prologue PUSHQ BP; MOVQ SP, BP, so mid-function the
+// word at SP is the saved caller BP, a stack address, and the return
+// address sits further up.  Walk the stack from SP and take the first word
+// that lies in an executable mapping: stack and data words never do, a
+// return address always does.
+func archReturnAddr(s *Session, regs *Regs) (uint64, error) {
+	ranges := execRanges(s.pid)
+	for off := uint64(0); off < 512; off += 8 {
+		word, err := s.Peek(regs.RSP + off)
+		if err != nil {
+			break
+		}
+		for _, r := range ranges {
+			if word >= r.lo && word < r.hi {
+				return word, nil
+			}
+		}
+	}
+	// No mapping available or nothing code-like on the stack: fall back to
+	// the raw entry convention, [SP] before any push.
+	return s.Peek(regs.RSP)
+}
+
+// archSPLabel returns the SP register name for display.
+func archSPLabel() string { return "RSP" }

debug/display_linux_arm64.go

@@ -0,0 +1,48 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build linux && arm64
+
+package debug
+
+import (
+	"encoding/binary"
+	"fmt"
+)
+
+func printRegs(regs *Regs, codeBase, funcOff uint64) {
+	fmt.Printf("  PC  = %#016x  (func+%#x)\n", regs.PC, regs.PC-codeBase-funcOff)
+	fmt.Printf("  SP  = %#016x  FP  = %#016x\n", regs.SP, regs.X29)
+	fmt.Printf("  LR  = %#016x\n", regs.X30)
+	fmt.Printf("  X0  = %#016x  X1  = %#016x\n", regs.X0, regs.X1)
+	fmt.Printf("  X2  = %#016x  X3  = %#016x\n", regs.X2, regs.X3)
+	fmt.Printf("  X4  = %#016x  X5  = %#016x\n", regs.X4, regs.X5)
+	fmt.Printf("  X6  = %#016x  X7  = %#016x\n", regs.X6, regs.X7)
+	fmt.Printf("  X8  = %#016x  X9  = %#016x\n", regs.X8, regs.X9)
+	fmt.Printf("  X10 = %#016x  X11 = %#016x\n", regs.X10, regs.X11)
+	fmt.Printf("  X12 = %#016x  X13 = %#016x\n", regs.X12, regs.X13)
+	fmt.Printf("  X14 = %#016x  X15 = %#016x\n", regs.X14, regs.X15)
+	fmt.Printf("  X16 = %#016x  X17 = %#016x\n", regs.X16, regs.X17)
+	fmt.Printf("  X18 = %#016x  X19 = %#016x\n", regs.X18, regs.X19)
+	fmt.Printf("  X20 = %#016x  X21 = %#016x\n", regs.X20, regs.X21)
+	fmt.Printf("  X22 = %#016x  X23 = %#016x\n", regs.X22, regs.X23)
+	fmt.Printf("  X24 = %#016x  X25 = %#016x\n", regs.X24, regs.X25)
+	fmt.Printf("  X26 = %#016x  X27 = %#016x\n", regs.X26, regs.X27)
+	fmt.Printf("  X28 = %#016x  PSTATE = %#x\n", regs.X28, regs.PSTATE)
+}
+
+func printVectorRegs(v *VectorRegs) {
+	fmt.Println("\n  Vector registers (V0-V31):")
+	for i := 0; i < 32; i += 2 {
+		fmt.Printf("  V%-2d  = %016x%016x\n", i, binary.LittleEndian.Uint64(v.V[i][8:16]), binary.LittleEndian.Uint64(v.V[i][0:8]))
+		fmt.Printf("  V%-2d  = %016x%016x\n", i+1, binary.LittleEndian.Uint64(v.V[i+1][8:16]), binary.LittleEndian.Uint64(v.V[i+1][0:8]))
+	}
+}
+
+// archReturnAddr reads the return address from LR (arm64 convention).
+func archReturnAddr(s *Session, regs *Regs) (uint64, error) {
+	return regs.X30, nil
+}
+
+// archSPLabel returns the SP register name for display.
+func archSPLabel() string { return "SP" }

debug/display_linux_loong64.go

@@ -0,0 +1,44 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build linux && loong64
+
+package debug
+
+import "fmt"
+
+func printRegs(regs *Regs, codeBase, funcOff uint64) {
+	fmt.Printf("  PC  = %#016x  (func+%#x)\n", regs.R31, regs.R31-codeBase-funcOff)
+	fmt.Printf("  SP  = %#016x  FP  = %#016x\n", regs.R3, regs.R21)
+	fmt.Printf("  RA  = %#016x\n", regs.R1)
+	fmt.Printf("  A0  = %#016x  A1  = %#016x\n", regs.R4, regs.R5)
+	fmt.Printf("  A2  = %#016x  A3  = %#016x\n", regs.R6, regs.R7)
+	fmt.Printf("  A4  = %#016x  A5  = %#016x\n", regs.R8, regs.R9)
+	fmt.Printf("  A6  = %#016x  A7  = %#016x\n", regs.R10, regs.R11)
+	fmt.Printf("  T0  = %#016x  T1  = %#016x\n", regs.R12, regs.R13)
+	fmt.Printf("  T2  = %#016x  T3  = %#016x\n", regs.R14, regs.R15)
+	fmt.Printf("  T4  = %#016x  T5  = %#016x\n", regs.R16, regs.R17)
+	fmt.Printf("  T6  = %#016x  T7  = %#016x\n", regs.R18, regs.R19)
+	fmt.Printf("  T8  = %#016x\n", regs.R20)
+	fmt.Printf("  S0  = %#016x  S1  = %#016x\n", regs.R22, regs.R23)
+	fmt.Printf("  S2  = %#016x  S3  = %#016x\n", regs.R24, regs.R25)
+	fmt.Printf("  S4  = %#016x  S5  = %#016x\n", regs.R26, regs.R27)
+	fmt.Printf("  S6  = %#016x  S7  = %#016x\n", regs.R28, regs.R29)
+	fmt.Printf("  S8  = %#016x\n", regs.R30)
+}
+
+func printVectorRegs(v *VectorRegs) {
+	fmt.Println("\n  FP registers (F0-F31):")
+	for i := 0; i < 32; i += 2 {
+		fmt.Printf("  F%-2d  = %#018x  F%-2d  = %#018x\n", i, v.F[i], i+1, v.F[i+1])
+	}
+	fmt.Printf("  FCC  = %#016x  FCSR = %#x\n", v.FCC, v.FCSR)
+}
+
+// archReturnAddr reads the return address from RA (loong64 convention).
+func archReturnAddr(s *Session, regs *Regs) (uint64, error) {
+	return regs.R1, nil
+}
+
+// archSPLabel returns the SP register name for display.
+func archSPLabel() string { return "SP" }

debug/display_linux_riscv64.go

@@ -0,0 +1,44 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build linux && riscv64
+
+package debug
+
+import "fmt"
+
+func printRegs(regs *Regs, codeBase, funcOff uint64) {
+	fmt.Printf("  PC  = %#016x  (func+%#x)\n", regs.PC, regs.PC-codeBase-funcOff)
+	fmt.Printf("  SP  = %#016x  FP  = %#016x\n", regs.Sp, regs.S0)
+	fmt.Printf("  RA  = %#016x\n", regs.Ra)
+	fmt.Printf("  A0  = %#016x  A1  = %#016x\n", regs.A0, regs.A1)
+	fmt.Printf("  A2  = %#016x  A3  = %#016x\n", regs.A2, regs.A3)
+	fmt.Printf("  A4  = %#016x  A5  = %#016x\n", regs.A4, regs.A5)
+	fmt.Printf("  A6  = %#016x  A7  = %#016x\n", regs.A6, regs.A7)
+	fmt.Printf("  T0  = %#016x  T1  = %#016x\n", regs.T0, regs.T1)
+	fmt.Printf("  T2  = %#016x  T3  = %#016x\n", regs.T2, regs.T3)
+	fmt.Printf("  T4  = %#016x  T5  = %#016x\n", regs.T4, regs.T5)
+	fmt.Printf("  T6  = %#016x\n", regs.T6)
+	fmt.Printf("  S1  = %#016x  S2  = %#016x\n", regs.S1, regs.S2)
+	fmt.Printf("  S3  = %#016x  S4  = %#016x\n", regs.S3, regs.S4)
+	fmt.Printf("  S5  = %#016x  S6  = %#016x\n", regs.S5, regs.S6)
+	fmt.Printf("  S7  = %#016x  S8  = %#016x\n", regs.S7, regs.S8)
+	fmt.Printf("  S9  = %#016x  S10 = %#016x\n", regs.S9, regs.S10)
+	fmt.Printf("  S11 = %#016x\n", regs.S11)
+}
+
+func printVectorRegs(v *VectorRegs) {
+	fmt.Println("\n  FP registers (F0-F31):")
+	for i := 0; i < 32; i += 2 {
+		fmt.Printf("  F%-2d  = %#018x  F%-2d  = %#018x\n", i, v.F[i], i+1, v.F[i+1])
+	}
+	fmt.Printf("  FCSR = %#x\n", v.FCSR)
+}
+
+// archReturnAddr reads the return address from RA (riscv64 convention).
+func archReturnAddr(s *Session, regs *Regs) (uint64, error) {
+	return regs.Ra, nil
+}
+
+// archSPLabel returns the SP register name for display.
+func archSPLabel() string { return "SP" }

debug/ptrace_extra_test.go

@@ -0,0 +1,427 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build linux && amd64
+
+package debug
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+	"time"
+	"unsafe"
+
+	"sourcedock.dev/petrbalvin/gasm-devkit/asm"
+	"sourcedock.dev/petrbalvin/gasm-devkit/verify"
+)
+
+// Integration tests beyond the basic entry breakpoint: hardware watchpoints,
+// conditional breakpoints, next/finish over a CALL, faulting kernels and the
+// xstate vector-register readout.  All drive a real ptrace session, so they
+// run on amd64 hosts only.
+
+// writeKernel writes an assembly source to a temporary file with the
+// architecture suffix the assembler dispatcher expects.
+func writeKernel(t *testing.T, src string) string {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "kernel_amd64.s")
+	if err := os.WriteFile(path, []byte(src), 0o644); err != nil {
+		t.Fatalf("write kernel: %v", err)
+	}
+	return path
+}
+
+// launchKernel launches a session for the kernel source and returns the
+// session, its breakpoint manager and the function layout.
+func launchKernel(t *testing.T, bin, path, funcName string, args []byte) (*Session, *Breakpoints, asm.FuncLayout) {
+	t.Helper()
+	k, err := verify.Load(path)
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	t.Cleanup(k.Close)
+	fl, err := k.Func(funcName)
+	if err != nil {
+		t.Fatalf("Func: %v", err)
+	}
+	if len(args) < fl.Args {
+		padded := make([]byte, fl.Args)
+		copy(padded, args)
+		args = padded
+	}
+	sess, err := Launch(bin, path, funcName, args)
+	if err != nil {
+		t.Fatalf("Launch: %v", err)
+	}
+	t.Cleanup(sess.Kill)
+	bm := NewBreakpoints(sess)
+	return sess, bm, fl
+}
+
+// runToEntry resumes the freshly launched debuggee until the breakpoint at
+// the function entry traps, mirroring the REPL continue loop: the debuggee
+// SIGSTOPs twice (launch barrier and entry barrier) before entering the JIT
+// call.
+func runToEntry(t *testing.T, sess *Session, bm *Breakpoints, entry uint64) {
+	t.Helper()
+	for range 50 {
+		for _, bp := range bm.All() {
+			bm.Reinsert(bp.Addr)
+		}
+		if err := sess.Continue(); err != nil {
+			t.Fatalf("Continue: %v", err)
+		}
+		if sess.Exited() {
+			t.Fatal("debuggee exited before the entry breakpoint trapped")
+		}
+		regs, err := sess.GetRegs()
+		if err != nil {
+			t.Fatalf("GetRegs: %v", err)
+		}
+		if bm.HandleTrap(&regs) != nil {
+			return
+		}
+	}
+	t.Fatal("no entry breakpoint trap after 50 resumes")
+}
+
+// captureStdout runs fn with os.Stdout redirected to a pipe and returns
+// what it printed (the REPL writes its reports to stdout).
+func captureStdout(t *testing.T, fn func()) string {
+	t.Helper()
+	r, w, err := os.Pipe()
+	if err != nil {
+		t.Fatalf("pipe: %v", err)
+	}
+	old := os.Stdout
+	os.Stdout = w
+	done := make(chan string, 1)
+	go func() {
+		b, _ := io.ReadAll(r)
+		done <- string(b)
+	}()
+	defer func() { os.Stdout = old }()
+	fn()
+	w.Close()
+	return <-done
+}
+
+// TestWatchpointArmRunHit proves the debug-register offsets: the watchpoint
+// must fire on the store, with si_addr naming the watched address.  The
+// kernel writes its return value to ret+0(FP), which is the 8-byte word
+// right above the stack pointer at entry.
+func TestWatchpointArmRunHit(t *testing.T) {
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+	bin := buildGasm(t)
+
+	const kernel = `#include "textflag.h"
+
+// func wpret() int64
+TEXT ·wpret(SB), NOSPLIT, $0-8
+	MOVQ $0x5a5a5a5a5a5a5a5a, AX
+	MOVQ AX, ret+0(FP)
+	RET
+`
+	path := writeKernel(t, kernel)
+	sess, bm, fl := launchKernel(t, bin, path, "wpret", nil)
+
+	entry := sess.CodeBase() + uint64(fl.Offset)
+	if _, err := bm.Set(entry, "entry"); err != nil {
+		t.Fatalf("Set: %v", err)
+	}
+	runToEntry(t, sess, bm, entry)
+
+	regs, err := sess.GetRegs()
+	if err != nil {
+		t.Fatalf("GetRegs: %v", err)
+	}
+	watched := regs.RSP + 8 // ret+0(FP): the store target
+
+	slot := sess.FindFreeWatchpointSlot()
+	if slot < 0 {
+		t.Fatal("no free watchpoint slot")
+	}
+	if err := sess.SetWatchpoint(slot, watched, WatchWrite, 8); err != nil {
+		t.Fatalf("SetWatchpoint: %v (wrong debug-register offsets?)", err)
+	}
+
+	if err := sess.Continue(); err != nil {
+		t.Fatalf("Continue: %v", err)
+	}
+	reason, addr := sess.StopInfo()
+	if reason != StopWatchpoint {
+		t.Fatalf("stop reason = %v, want StopWatchpoint (DR0-DR3/DR7 offsets are wrong)", reason)
+	}
+	if addr != watched {
+		t.Fatalf("watchpoint address = %#x, want %#x", addr, watched)
+	}
+
+	// The watched word holds the stored value: x86 data breakpoints are
+	// reported with the access complete.
+	if word, err := sess.Peek(watched); err != nil || word != 0x5a5a5a5a5a5a5a5a {
+		t.Errorf("watched word = %#x (err %v), want 0x5a5a5a5a5a5a5a5a", word, err)
+	}
+	if err := sess.ClearWatchpoint(slot); err != nil {
+		t.Fatalf("ClearWatchpoint: %v", err)
+	}
+}
+
+// TestConditionalBreakpointFalseThenTrue proves the false-condition path:
+// the breakpoint steps over the original instruction, re-arms itself and
+// keeps running silently, and the true condition stops exactly once with the
+// register in the expected state.
+func TestConditionalBreakpointFalseThenTrue(t *testing.T) {
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+	bin := buildGasm(t)
+
+	const kernel = `#include "textflag.h"
+
+// func countdown(n int64) int64
+TEXT ·countdown(SB), NOSPLIT, $0-16
+	MOVQ n+0(FP), CX
+loop:
+	DECQ CX
+	CMPQ CX, $0
+	JNE loop
+	MOVQ CX, ret+8(FP)
+	RET
+`
+	path := writeKernel(t, kernel)
+	sess, bm, fl := launchKernel(t, bin, path, "countdown", []byte{8})
+
+	loopAddr := sess.CodeBase() + uint64(fl.Offset) + uint64(fl.Labels["loop"])
+	// The length of the breakpointed instruction, from a disassembly taken
+	// before the INT3 is patched in.
+	_, insnLen, err := sess.Disassemble(loopAddr)
+	if err != nil || insnLen <= 0 {
+		t.Fatalf("Disassemble at %#x: len=%d err=%v", loopAddr, insnLen, err)
+	}
+	cond := &Condition{Reg: "rcx", Op: "==", Value: 1}
+	bp, err := bm.SetWithCond(loopAddr, "loop", cond)
+	if err != nil {
+		t.Fatalf("SetWithCond: %v", err)
+	}
+
+	hits := 0
+	exited := false
+	for range 200 {
+		for _, b := range bm.All() {
+			bm.Reinsert(b.Addr)
+		}
+		if err := sess.Continue(); err != nil {
+			exited = true
+			break // the debuggee finished
+		}
+		if sess.Exited() {
+			exited = true
+			break
+		}
+		if sig := sess.LastSignal(); sig != 0 {
+			t.Fatalf("unexpected signal stop %v", sig)
+		}
+		regs, err := sess.GetRegs()
+		if err != nil {
+			t.Fatalf("GetRegs: %v", err)
+		}
+		if hit := bm.HandleTrap(&regs); hit != nil {
+			hits++
+			if regs.RCX != 1 {
+				t.Fatalf("hit with RCX=%d, want 1", regs.RCX)
+			}
+			// Park after the instruction, as the REPL does.
+			if err := sess.Step(); err != nil {
+				t.Fatalf("Step: %v", err)
+			}
+		} else {
+			// A false evaluation must leave the debuggee past the whole
+			// original instruction: a PC inside it (trapAddr+1 on amd64)
+			// means the resume happens mid-instruction.
+			fresh, err := sess.GetRegs()
+			if err != nil {
+				t.Fatalf("GetRegs: %v", err)
+			}
+			if fresh.RIP > loopAddr && fresh.RIP < loopAddr+uint64(insnLen) {
+				t.Fatalf("false evaluation left the PC at %#x, inside the %d-byte instruction at %#x",
+					fresh.RIP, insnLen, loopAddr)
+			}
+		}
+	}
+	if hits != 1 {
+		t.Fatalf("conditional breakpoint hit %d times, want exactly 1 (false evaluations must run through silently)", hits)
+	}
+	if bp.Hits() != 1 {
+		t.Errorf("bp.Hits() = %d, want 1", bp.Hits())
+	}
+	if !exited || !sess.Exited() {
+		t.Fatal("debuggee did not run to completion after the conditional hit")
+	}
+}
+
+// TestNextAndFinishOverCall proves next and finish evaluate the trap with
+// registers fetched after the stop: next lands exactly on the instruction
+// after the CALL, and finish stops exactly on the return address.
+func TestNextAndFinishOverCall(t *testing.T) {
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+	bin := buildGasm(t)
+
+	const kernel = `#include "textflag.h"
+
+// func caller(x int64) int64
+// The argument travels in AX: FP argument slots of CALL-bearing functions
+// are an assembler concern outside this test's scope.
+TEXT ·caller(SB), NOSPLIT, $0-16
+	MOVQ $5, AX
+	CALL ·bump(SB)
+aftercall:
+	MOVQ AX, ret+8(FP)
+	RET
+
+// func bump(x int64) int64
+TEXT ·bump(SB), NOSPLIT, $0-0
+	ADDQ $3, AX
+	RET
+`
+	path := writeKernel(t, kernel)
+
+	// next: step the prologue and the constant load (3 instructions), then
+	// step over the CALL and check the landing address and RAX.
+	sess, bm, fl := launchKernel(t, bin, path, "caller", nil)
+	entry := sess.CodeBase() + uint64(fl.Offset)
+	if _, err := bm.Set(entry, "entry"); err != nil {
+		t.Fatalf("Set: %v", err)
+	}
+	runToEntry(t, sess, bm, entry)
+	afterOff := uint64(fl.Labels["aftercall"])
+
+	out := captureStdout(t, func() {
+		REPL(sess, bm, sess.CodeBase(), fl.Offset, fl.Size, fl.Args, nil, nil,
+			strings.NewReader("step 3\nnext\nregs\nquit\n"))
+	})
+	if !strings.Contains(out, fmt.Sprintf("func+%#x", afterOff)) {
+		t.Errorf("next did not land on the instruction after the CALL (func+%#x); output:\n%s", afterOff, out)
+	}
+	if !strings.Contains(out, "RAX = 0x0000000000000008") {
+		t.Errorf("callee did not run exactly once under next (want RAX=8); output:\n%s", out)
+	}
+
+	// finish: run to the return address read off the stack at entry.
+	sess2, bm2, fl2 := launchKernel(t, bin, path, "caller", nil)
+	entry2 := sess2.CodeBase() + uint64(fl2.Offset)
+	if _, err := bm2.Set(entry2, "entry"); err != nil {
+		t.Fatalf("Set: %v", err)
+	}
+	runToEntry(t, sess2, bm2, entry2)
+	regs, err := sess2.GetRegs()
+	if err != nil {
+		t.Fatalf("GetRegs: %v", err)
+	}
+	retAddr, err := sess2.Peek(regs.RSP)
+	if err != nil {
+		t.Fatalf("Peek return address: %v", err)
+	}
+
+	out2 := captureStdout(t, func() {
+		REPL(sess2, bm2, sess2.CodeBase(), fl2.Offset, fl2.Size, fl2.Args, nil, nil,
+			strings.NewReader("step 1\nfinish\nquit\n"))
+	})
+	want := fmt.Sprintf("finished, now at %#x\n", retAddr)
+	if !strings.Contains(out2, want) {
+		t.Errorf("finish stopped at the wrong PC; want %q in output:\n%s", want, out2)
+	}
+}
+
+// TestSignalStopSurfaced proves a faulting kernel surfaces as a reported
+// stop instead of an infinite fault loop.  A regression here hangs, so a
+// watchdog fails the run rather than letting CI stall.
+func TestSignalStopSurfaced(t *testing.T) {
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+	bin := buildGasm(t)
+
+	const kernel = `#include "textflag.h"
+
+// func crash() int64
+TEXT ·crash(SB), NOSPLIT, $0-8
+	XORQ AX, AX
+	MOVQ (AX), AX
+	MOVQ AX, ret+0(FP)
+	RET
+`
+	path := writeKernel(t, kernel)
+	sess, bm, _ := launchKernel(t, bin, path, "crash", nil)
+
+	timer := time.AfterFunc(time.Minute, func() {
+		panic("watchdog: the debugger hung on the faulting kernel instead of reporting the signal stop")
+	})
+	defer timer.Stop()
+
+	out := captureStdout(t, func() {
+		REPL(sess, bm, sess.CodeBase(), 0, 0, 0, nil, nil,
+			strings.NewReader("continue\nquit\n"))
+	})
+	if !strings.Contains(out, "stopped on signal") {
+		t.Errorf("SIGSEGV did not surface as a reported stop; output:\n%s", out)
+	}
+	if !sess.Exited() {
+		t.Error("debuggee should be killed by quit after the signal stop")
+	}
+}
+
+// TestGetVectorRegsXState proves the NT_X86_XSTATE readout: the request
+// succeeds on a normal process and the XMM halves agree with
+// PTRACE_GETFPREGS.
+func TestGetVectorRegsXState(t *testing.T) {
+	// The FPRegs layout must mirror the kernel's user_fpregs_struct
+	// exactly: PTRACE_GETFPREGS fills all 512 bytes, so a short struct
+	// overflows the caller's memory.
+	if got := unsafe.Sizeof(FPRegs{}); got != 512 {
+		t.Fatalf("sizeof(FPRegs) = %d, want 512", got)
+	}
+	if got := unsafe.Offsetof(FPRegs{}.XMM); got != 160 {
+		t.Fatalf("offsetof(FPRegs.XMM) = %d, want 160", got)
+	}
+
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+	bin := buildGasm(t)
+
+	const kernel = `#include "textflag.h"
+
+// func vprobe() int64
+TEXT ·vprobe(SB), NOSPLIT, $0-8
+	MOVQ $1, AX
+	MOVQ AX, ret+0(FP)
+	RET
+`
+	path := writeKernel(t, kernel)
+	sess, bm, fl := launchKernel(t, bin, path, "vprobe", nil)
+
+	entry := sess.CodeBase() + uint64(fl.Offset)
+	if _, err := bm.Set(entry, "entry"); err != nil {
+		t.Fatalf("Set: %v", err)
+	}
+	runToEntry(t, sess, bm, entry)
+
+	v, err := sess.GetVectorRegs()
+	if err != nil {
+		t.Fatalf("GetVectorRegs: %v", err)
+	}
+	fp, err := sess.GetFPRegs()
+	if err != nil {
+		t.Fatalf("GetFPRegs: %v", err)
+	}
+	for i := range 16 {
+		if !bytes.Equal(v.YMM[i][:16], fp.XMM[i][:]) {
+			t.Errorf("YMM%d low half %x, want the FPRegs XMM half %x", i, v.YMM[i][:16], fp.XMM[i][:])
+		}
+	}
+}

debug/ptrace_integration_test.go

@@ -0,0 +1,126 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build linux && amd64
+
+package debug
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+
+	"sourcedock.dev/petrbalvin/gasm-devkit/verify"
+)
+
+// buildGasm produces the gasm binary the debugger spawns as its debuggee.
+func buildGasm(t *testing.T) string {
+	t.Helper()
+	if p := os.Getenv("GASM_TEST_BIN"); p != "" {
+		return p
+	}
+	bin := filepath.Join(t.TempDir(), "gasm")
+	cmd := exec.Command("go", "build", "-o", bin, "sourcedock.dev/petrbalvin/gasm-devkit/cmd/gasm")
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("build gasm: %v: %s", err, out)
+	}
+	return bin
+}
+
+// TestLaunchAndBreakpoint drives a real ptrace session end to end: launch the
+// debuggee, break on the first instruction of the function and expect a
+// breakpoint trap instead of a clean exit.
+func TestLaunchAndBreakpoint(t *testing.T) {
+	if runtime.GOARCH != "amd64" {
+		t.Skip("runs only on amd64 hosts")
+	}
+	// The tracer is the OS thread that forked the debuggee (PTRACE_TRACEME
+	// binds the relation to that thread); every ptrace request must come
+	// from the same thread, so pin the test goroutine to one thread.
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+	bin := buildGasm(t)
+
+	const kernelPath = "../testdata/verify/basic_amd64.s"
+	k, err := verify.Load(kernelPath)
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	t.Cleanup(k.Close)
+	fl, err := k.Func("wideCopy")
+	if err != nil {
+		t.Fatalf("Func: %v", err)
+	}
+
+	sess, err := Launch(bin, kernelPath, "wideCopy", make([]byte, fl.Args))
+	if err != nil {
+		t.Fatalf("Launch: %v", err)
+	}
+	t.Cleanup(sess.Kill)
+
+	bm := NewBreakpoints(sess)
+	entry := sess.CodeBase() + uint64(fl.Offset)
+	if _, err := bm.Set(entry, "entry"); err != nil {
+		t.Fatalf("Set: %v", err)
+	}
+
+	// The INT3 must be visible in the debuggee's memory.
+	word, err := sess.Peek(entry)
+	if err != nil {
+		t.Fatalf("Peek: %v", err)
+	}
+	if b := word & 0xFF; b != 0xCC {
+		t.Fatalf("int3 not patched: first byte %#02x at %#x", b, entry)
+	}
+
+	// The debuggee raises a second SIGSTOP after the launch barrier (the
+	// child's RunTarget marks its entry), so like the REPL and the cover
+	// mode the test keeps resuming until the breakpoint trap arrives.
+	for range 10 {
+		if err := sess.Continue(); err != nil {
+			st, _ := os.ReadFile(fmt.Sprintf("/proc/%d/stat", sess.Pid()))
+			status, _ := os.ReadFile(fmt.Sprintf("/proc/%d/status", sess.Pid()))
+			t.Fatalf("Continue: %v\nstate: %s\n%s", err, fieldName(st), statusDump(status))
+		}
+		if sess.Exited() {
+			t.Fatal("debuggee exited instead of trapping on the breakpoint")
+		}
+		regs, err := sess.GetRegs()
+		if err != nil {
+			t.Fatalf("GetRegs: %v", err)
+		}
+		if bp := bm.HandleTrap(&regs); bp != nil {
+			if bp.Addr != entry {
+				t.Fatalf("trap at %#x, want %#x", bp.Addr, entry)
+			}
+			return // trap on the entry breakpoint: the whole flow works
+		}
+	}
+	t.Fatal("no breakpoint trap after 10 resumes")
+}
+
+func fieldName(stat []byte) string {
+	f := strings.Split(string(stat), " ")
+	if len(f) > 2 {
+		return "state=" + f[2]
+	}
+	return "no stat"
+}
+
+func statusDump(b []byte) string {
+	var out []string
+	for l := range strings.SplitSeq(string(b), "\n") {
+		if strings.HasPrefix(l, "State") || strings.HasPrefix(l, "Pid") ||
+			strings.HasPrefix(l, "PPid") || strings.HasPrefix(l, "TracerPid") ||
+			strings.HasPrefix(l, "Threads") || strings.HasPrefix(l, "SigPnd") ||
+			strings.HasPrefix(l, "SigBlk") || strings.HasPrefix(l, "SigIgn") {
+			out = append(out, l)
+		}
+	}
+	return strings.Join(out, "\n")
+}

debug/ptrace_linux.go

@@ -0,0 +1,367 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build linux
+
+package debug
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"syscall"
+	"time"
+)
+
+// Session is a ptrace debugging session controlling one debuggee process.
+type Session struct {
+	pid      int
+	cmd      *exec.Cmd
+	stopped  bool
+	exited   bool
+	codeBase uint64   // base address of the JIT code in the debuggee
+	tmpDir   string   // scratch directory of the session, removed on Kill
+	wpSlots  [16]bool // hardware watchpoint slots in use (DR0-DR3, arm64 DBGWVR0-15)
+	// lastSignal holds the signal of the most recent stop when that stop
+	// was a genuine signal-delivery-stop the caller must see (a fault such
+	// as SIGSEGV, SIGBUS, SIGFPE or SIGILL); 0 for breakpoint traps,
+	// single-steps, SIGSTOP and suppressed runtime signals.
+	lastSignal syscall.Signal
+}
+
+// Launch starts the debuggee subprocess (gasm debug --target ...) and
+// attaches to it via ptrace.
+func Launch(gasmBin, asmPath, funcName string, args []byte) (*Session, error) {
+	sess, _, err := LaunchWithBuffers(gasmBin, asmPath, funcName, args, "")
+	return sess, err
+}
+
+// LaunchWithBuffers is like Launch but also allocates buffers in the debuggee.
+//
+// It pins the calling goroutine to its OS thread and leaves it pinned: the
+// debuggee's PTRACE_TRACEME binds the tracer relation to the forking thread,
+// and every ptrace request on the session must come from that same thread.
+// All Session methods must therefore be called from the goroutine that
+// launched the session (the REPL and coverage loops do exactly that).
+func LaunchWithBuffers(gasmBin, asmPath, funcName string, args []byte, bufSpec string) (*Session, []uint64, error) {
+	runtime.LockOSThread() // ptrace requests must stay on the forking thread
+	self, err := os.Executable()
+	if err != nil {
+		return nil, nil, fmt.Errorf("debug: cannot find gasm binary: %w", err)
+	}
+	if gasmBin != "" {
+		self = gasmBin
+	}
+
+	tmpDir, err := os.MkdirTemp("", "gasm-debug-*")
+	if err != nil {
+		return nil, nil, fmt.Errorf("debug: tempdir: %w", err)
+	}
+	argsFile := filepath.Join(tmpDir, "args.bin")
+	if err := os.WriteFile(argsFile, args, 0o644); err != nil {
+		os.RemoveAll(tmpDir)
+		return nil, nil, fmt.Errorf("debug: write args: %w", err)
+	}
+
+	if bufSpec != "" {
+		if err := os.WriteFile(filepath.Join(tmpDir, "bufspec"), []byte(bufSpec), 0o644); err != nil {
+			os.RemoveAll(tmpDir)
+			return nil, nil, fmt.Errorf("debug: write bufspec: %w", err)
+		}
+	}
+
+	cmd := exec.Command(self, "debug", "--func", funcName, "--args", argsFile, asmPath)
+	cmd.Env = append(os.Environ(), "GASM_DEBUG_TARGET=1", "GASM_DEBUG_TMP="+tmpDir)
+	cmd.Stdout = nil
+	cmd.Stderr = os.Stderr
+	cmd.SysProcAttr = &syscall.SysProcAttr{}
+
+	if err := cmd.Start(); err != nil {
+		os.RemoveAll(tmpDir)
+		return nil, nil, fmt.Errorf("debug: start debuggee: %w", err)
+	}
+
+	s := &Session{pid: cmd.Process.Pid, cmd: cmd, tmpDir: tmpDir}
+
+	readyFile := filepath.Join(tmpDir, "ready")
+	for range 500 {
+		if _, err := os.Stat(readyFile); err == nil {
+			break
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+
+	// The debuggee parks itself with SIGSTOP once the JIT code is mapped.
+	// A Go tracee also reports SIGURG preemption as signal-delivery-stops,
+	// so the wait loops until a stop the debugger cares about instead of
+	// assuming the first event is the SIGSTOP.
+	if _, err := s.waitStopped(); err != nil {
+		cmd.Process.Kill()
+		os.RemoveAll(tmpDir)
+		return nil, nil, fmt.Errorf("debug: wait for debuggee: %w", err)
+	}
+	s.stopped = true
+
+	// The debuggee reports its JIT mapping in the codebase file; that is the
+	// exact region the kernel was written to.  Scanning /proc/pid/maps for
+	// any RWX region is only the fallback.
+	if data, err := os.ReadFile(filepath.Join(tmpDir, "codebase")); err == nil {
+		fmt.Sscanf(string(data), "%d", &s.codeBase)
+	}
+	if s.codeBase == 0 {
+		s.codeBase = findRWXMapping(s.pid)
+	}
+
+	var bufAddrs []uint64
+	if bufSpec != "" {
+		addrFile := filepath.Join(tmpDir, "bufaddrs")
+		if data, err := os.ReadFile(addrFile); err == nil {
+			for line := range strings.SplitSeq(strings.TrimSpace(string(data)), "\n") {
+				var addr uint64
+				if _, err := fmt.Sscanf(line, "%d", &addr); err == nil {
+					bufAddrs = append(bufAddrs, addr)
+				}
+			}
+		}
+	}
+
+	return s, bufAddrs, nil
+}
+
+// waitStopped consumes ptrace-stop events until one the debugger cares
+// about arrives: SIGTRAP (a breakpoint or a completed single-step), the
+// debuggee's own SIGSTOP, or a genuine signal-delivery-stop.  A Go tracee's
+// runtime raises SIGURG for asynchronous preemption, and every signal on a
+// traced thread surfaces as a signal-delivery-stop, so SIGURG is suppressed
+// and the tracee resumed without it.  Every other signal (SIGSEGV, SIGBUS,
+// SIGFPE, SIGILL, ...) is returned to the caller: resuming with signal 0
+// would restart the faulting instruction and fault forever, so a faulting
+// kernel must surface as a stop the caller reports.  Runtime noise is also
+// why a single wait can return in the middle of runtime code and a resume
+// can then fail: the event stream must be drained by the tracer.
+func (s *Session) waitStopped() (syscall.Signal, error) {
+	for {
+		var ws syscall.WaitStatus
+		if _, err := syscall.Wait4(s.pid, &ws, syscall.WUNTRACED, nil); err != nil {
+			return 0, err
+		}
+		if ws.Exited() {
+			s.exited = true
+			return 0, fmt.Errorf("debuggee exited with status %d", ws.ExitStatus())
+		}
+		if ws.Signaled() {
+			s.exited = true
+			return 0, fmt.Errorf("debuggee killed by signal %v", ws.Signal())
+		}
+		switch sig := ws.StopSignal(); sig {
+		case syscall.SIGTRAP, syscall.SIGSTOP:
+			s.stopped = true
+			s.lastSignal = 0
+			return sig, nil
+		case syscall.SIGURG:
+			// Go runtime asynchronous preemption: resume the tracee
+			// without delivering the signal.
+			s.lastSignal = 0
+			if _, _, errno := syscall.Syscall6(
+				syscall.SYS_PTRACE,
+				uintptr(syscall.PTRACE_CONT),
+				uintptr(s.pid),
+				0, 0, 0, 0,
+			); errno != 0 {
+				return 0, fmt.Errorf("debug: PTRACE_CONT: %w", errno)
+			}
+		default:
+			// A genuine signal-delivery-stop.  Report it; the caller
+			// decides how to proceed.
+			s.stopped = true
+			s.lastSignal = sig
+			return sig, nil
+		}
+	}
+}
+
+// LastSignal returns the signal of the most recent stop when that stop was
+// a genuine signal-delivery-stop (a fault such as SIGSEGV, SIGFPE, SIGILL
+// or SIGBUS), and 0 for breakpoint traps, single-steps, SIGSTOP and
+// suppressed runtime signals.
+func (s *Session) LastSignal() syscall.Signal { return s.lastSignal }
+
+// Peek reads a word (8 bytes) from the debuggee's memory at addr.
+func (s *Session) Peek(addr uint64) (uint64, error) {
+	mem, err := os.OpenFile(fmt.Sprintf("/proc/%d/mem", s.pid), os.O_RDONLY, 0)
+	if err != nil {
+		return 0, fmt.Errorf("debug: open /proc/%d/mem: %w", s.pid, err)
+	}
+	defer mem.Close()
+	buf := make([]byte, 8)
+	if _, err := mem.ReadAt(buf, int64(addr)); err != nil {
+		return 0, fmt.Errorf("debug: read mem %#x: %w", addr, err)
+	}
+	return uint64(buf[0]) | uint64(buf[1])<<8 | uint64(buf[2])<<16 | uint64(buf[3])<<24 |
+		uint64(buf[4])<<32 | uint64(buf[5])<<40 | uint64(buf[6])<<48 | uint64(buf[7])<<56, nil
+}
+
+// Poke writes a word (8 bytes) to the debuggee's memory at addr.
+func (s *Session) Poke(addr, val uint64) error {
+	mem, err := os.OpenFile(fmt.Sprintf("/proc/%d/mem", s.pid), os.O_WRONLY, 0)
+	if err != nil {
+		return fmt.Errorf("debug: open /proc/%d/mem: %w", s.pid, err)
+	}
+	defer mem.Close()
+	buf := []byte{byte(val), byte(val >> 8), byte(val >> 16), byte(val >> 24),
+		byte(val >> 32), byte(val >> 40), byte(val >> 48), byte(val >> 56)}
+	if _, err := mem.WriteAt(buf, int64(addr)); err != nil {
+		return fmt.Errorf("debug: write mem %#x: %w", addr, err)
+	}
+	return nil
+}
+
+// ReadMemory reads len bytes from the debuggee's memory at addr.
+func (s *Session) ReadMemory(addr uint64, length int) ([]byte, error) {
+	out := make([]byte, length)
+	for i := 0; i < length; i += 8 {
+		word, err := s.Peek(addr + uint64(i))
+		if err != nil {
+			return out[:i], err
+		}
+		for j := 0; j < 8 && i+j < length; j++ {
+			out[i+j] = byte(word >> (8 * j))
+		}
+	}
+	return out, nil
+}
+
+// WriteMemory writes bytes to the debuggee's memory at addr.
+func (s *Session) WriteMemory(addr uint64, data []byte) error {
+	for i := 0; i < len(data); i += 8 {
+		end := min(i+8, len(data))
+		var word uint64
+		for j := 0; j < end-i; j++ {
+			word |= uint64(data[i+j]) << (8 * j)
+		}
+		if end-i < 8 {
+			existing, err := s.Peek(addr + uint64(i))
+			if err != nil {
+				return err
+			}
+			mask := ^((uint64(1) << (8 * (end - i))) - 1)
+			word = (existing & mask) | word
+		}
+		if err := s.Poke(addr+uint64(i), word); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// Step executes a single instruction in the debuggee.
+func (s *Session) Step() error {
+	if s.exited {
+		return fmt.Errorf("debug: debuggee has exited")
+	}
+	_, _, errno := syscall.Syscall6(
+		syscall.SYS_PTRACE,
+		uintptr(syscall.PTRACE_SINGLESTEP),
+		uintptr(s.pid),
+		0, 0, 0, 0,
+	)
+	if errno != 0 {
+		return fmt.Errorf("debug: PTRACE_SINGLESTEP: %w", errno)
+	}
+	_, err := s.waitStopped()
+	return err
+}
+
+// Continue resumes execution until the next breakpoint or exit.
+func (s *Session) Continue() error {
+	if s.exited {
+		return fmt.Errorf("debug: debuggee has exited")
+	}
+	_, _, errno := syscall.Syscall6(
+		syscall.SYS_PTRACE,
+		uintptr(syscall.PTRACE_CONT),
+		uintptr(s.pid),
+		0, 0, 0, 0,
+	)
+	if errno != 0 {
+		return fmt.Errorf("debug: PTRACE_CONT: %w", errno)
+	}
+	_, err := s.waitStopped()
+	return err
+}
+
+// Exited returns true if the debuggee has terminated.
+func (s *Session) Exited() bool { return s.exited }
+
+// Pid returns the debuggee's process ID.
+func (s *Session) Pid() int { return s.pid }
+
+// CodeBase returns the base address of the JIT code in the debuggee.
+func (s *Session) CodeBase() uint64 { return s.codeBase }
+
+// Kill terminates the debuggee and removes the session's scratch
+// directory, so a successful session leaves no gasm-debug-* debris behind.
+func (s *Session) Kill() {
+	if !s.exited {
+		syscall.Kill(s.pid, syscall.SIGKILL)
+		syscall.Wait4(s.pid, nil, 0, nil)
+		s.exited = true
+	}
+	if s.cmd != nil && s.cmd.Process != nil {
+		s.cmd.Wait()
+	}
+	if s.tmpDir != "" {
+		os.RemoveAll(s.tmpDir)
+		s.tmpDir = ""
+	}
+}
+
+// execRange is one executable mapping of the debuggee.
+type execRange struct {
+	lo, hi uint64
+}
+
+// execRanges parses the debuggee's executable mappings from /proc/pid/maps.
+func execRanges(pid int) []execRange {
+	data, err := os.ReadFile(fmt.Sprintf("/proc/%d/maps", pid))
+	if err != nil {
+		return nil
+	}
+	var out []execRange
+	for line := range strings.SplitSeq(string(data), "\n") {
+		fields := strings.Fields(line)
+		if len(fields) < 2 || !strings.Contains(fields[1], "x") {
+			continue
+		}
+		var lo, hi uint64
+		if _, err := fmt.Sscanf(fields[0], "%x-%x", &lo, &hi); err == nil {
+			out = append(out, execRange{lo, hi})
+		}
+	}
+	return out
+}
+
+// findRWXMapping reads /proc/pid/maps and returns the base address of the
+// first read-write-execute mapping (the JIT code region).
+func findRWXMapping(pid int) uint64 {
+	data, err := os.ReadFile(fmt.Sprintf("/proc/%d/maps", pid))
+	if err != nil {
+		return 0
+	}
+	for line := range strings.SplitSeq(string(data), "\n") {
+		fields := strings.Fields(line)
+		if len(fields) < 2 {
+			continue
+		}
+		perms := fields[1]
+		if len(perms) >= 3 && perms[0] == 'r' && perms[1] == 'w' && perms[2] == 'x' {
+			var start uint64
+			fmt.Sscanf(fields[0], "%x-", &start)
+			return start
+		}
+	}
+	return 0
+}

debug/ptrace_linux_amd64.go

@@ -3,165 +3,15 @@
 
 //go:build linux && amd64
 
-// Package debug implements the interactive debugger for gasm (Phase 4):
-// single-stepping, breakpoints, register and memory inspection for
-// JIT-assembled Plan 9 amd64 functions, controlled via ptrace.
 package debug
 
 import (
+	"encoding/binary"
 	"fmt"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
 	"syscall"
-	"time"
 	"unsafe"
 )
 
-// Session is a ptrace debugging session controlling one debuggee process.
-type Session struct {
-	pid      int
-	cmd      *exec.Cmd
-	stopped  bool
-	exited   bool
-	codeBase uint64  // base address of the JIT code in the debuggee
-	wpSlots  [4]bool // watchpoint slot occupancy (DR0-DR3)
-}
-
-// Launch starts the debuggee subprocess (gasm debug --target ...) and
-// attaches to it via ptrace.  The debuggee assembles the file, maps the
-// JIT code, calls PTRACE_TRACEME and raises SIGSTOP; Launch waits for
-// that initial stop and returns a ready Session.
-func Launch(gasmBin, asmPath, funcName string, args []byte) (*Session, error) {
-	sess, _, err := LaunchWithBuffers(gasmBin, asmPath, funcName, args, "")
-	return sess, err
-}
-
-// LaunchWithBuffers is like Launch but also allocates buffers in the debuggee
-// based on the buffer specification.  Returns the Session and the buffer
-// addresses (in the order they appear in the spec).
-func LaunchWithBuffers(gasmBin, asmPath, funcName string, args []byte, bufSpec string) (*Session, []uint64, error) {
-	self, err := os.Executable()
-	if err != nil {
-		return nil, nil, fmt.Errorf("debug: cannot find gasm binary: %w", err)
-	}
-	if gasmBin != "" {
-		self = gasmBin
-	}
-
-	// Write the arg block to a temp file (the child reads it).
-	tmpDir, err := os.MkdirTemp("", "gasm-debug-*")
-	if err != nil {
-		return nil, nil, fmt.Errorf("debug: tempdir: %w", err)
-	}
-	argsFile := filepath.Join(tmpDir, "args.bin")
-	if err := os.WriteFile(argsFile, args, 0o644); err != nil {
-		os.RemoveAll(tmpDir)
-		return nil, nil, fmt.Errorf("debug: write args: %w", err)
-	}
-
-	// Write the buffer spec if present.
-	if bufSpec != "" {
-		if err := os.WriteFile(filepath.Join(tmpDir, "bufspec"), []byte(bufSpec), 0o644); err != nil {
-			os.RemoveAll(tmpDir)
-			return nil, nil, fmt.Errorf("debug: write bufspec: %w", err)
-		}
-	}
-
-	cmd := exec.Command(self, "debug", "--target", "--func", funcName, "--args", argsFile, asmPath)
-	cmd.Env = append(os.Environ(), "GASM_DEBUG_TMP="+tmpDir)
-	cmd.Stdout = nil // output goes to the debugger, not the terminal
-	cmd.Stderr = os.Stderr
-	cmd.SysProcAttr = &syscall.SysProcAttr{}
-
-	if err := cmd.Start(); err != nil {
-		os.RemoveAll(tmpDir)
-		return nil, nil, fmt.Errorf("debug: start debuggee: %w", err)
-	}
-
-	s := &Session{pid: cmd.Process.Pid, cmd: cmd}
-
-	// Wait for the child to signal readiness and stop.  The child calls
-	// PTRACE_TRACEME then SIGSTOP, so Wait4 with WUNTRACED observes the
-	// ptrace-stop directly (no PTRACE_ATTACH needed).
-	readyFile := filepath.Join(tmpDir, "ready")
-	for i := 0; i < 500; i++ {
-		if _, err := os.Stat(readyFile); err == nil {
-			break
-		}
-		time.Sleep(5 * time.Millisecond)
-	}
-	var ws syscall.WaitStatus
-	if _, err := syscall.Wait4(s.pid, &ws, syscall.WUNTRACED, nil); err != nil {
-		cmd.Process.Kill()
-		os.RemoveAll(tmpDir)
-		return nil, nil, fmt.Errorf("debug: wait for stop: %w", err)
-	}
-
-	// Wait for the debuggee to reach the function entry point.
-	entryFile := filepath.Join(tmpDir, "entry")
-	for i := 0; i < 500; i++ {
-		if _, err := os.Stat(entryFile); err == nil {
-			break
-		}
-		time.Sleep(5 * time.Millisecond)
-	}
-
-	// Continue the debuggee to the entry point.
-	if err := s.Continue(); err != nil {
-		return nil, nil, fmt.Errorf("debug: continue to entry: %w", err)
-	}
-
-	// Wait for the entry stop.
-	if _, err := syscall.Wait4(s.pid, &ws, syscall.WUNTRACED, nil); err != nil {
-		return nil, nil, fmt.Errorf("debug: wait for entry: %w", err)
-	}
-
-	s.stopped = true
-
-	// Read the code base from /proc/pid/maps (find the RWX mapping).
-	s.codeBase = findRWXMapping(s.pid)
-	if s.codeBase == 0 {
-		// Fallback: try the file the child wrote.
-		baseFile := filepath.Join(tmpDir, "codebase")
-		if data, err := os.ReadFile(baseFile); err == nil {
-			fmt.Sscanf(string(data), "%d", &s.codeBase)
-		}
-	}
-
-	// Read buffer addresses if buffers were allocated.
-	var bufAddrs []uint64
-	if bufSpec != "" {
-		addrFile := filepath.Join(tmpDir, "bufaddrs")
-		if data, err := os.ReadFile(addrFile); err == nil {
-			for _, line := range strings.Split(strings.TrimSpace(string(data)), "\n") {
-				var addr uint64
-				if _, err := fmt.Sscanf(line, "%d", &addr); err == nil {
-					bufAddrs = append(bufAddrs, addr)
-				}
-			}
-		}
-	}
-
-	return s, bufAddrs, nil
-}
-
-// wait waits for the debuggee to stop and returns the wait status.
-func (s *Session) wait() error {
-	var ws syscall.WaitStatus
-	_, err := syscall.Wait4(s.pid, &ws, 0, nil)
-	if err != nil {
-		return err
-	}
-	if ws.Exited() {
-		s.exited = true
-		return fmt.Errorf("debuggee exited with status %d", ws.ExitStatus())
-	}
-	s.stopped = true
-	return nil
-}
-
 // GetRegs reads the general-purpose registers of the stopped debuggee.
 func (s *Session) GetRegs() (Regs, error) {
 	var regs Regs
@@ -195,20 +45,24 @@ func (s *Session) SetRegs(regs *Regs) error {
 	return nil
 }
 
-// FPRegs holds the x87 FPU and SSE (XMM) register state from PTRACE_GETFPREGS.
+// FPRegs holds the x87 FPU and SSE (XMM) register state from
+// PTRACE_GETFPREGS.  The layout is the kernel's struct user_fpregs_struct
+// (sys/user.h), the FXSAVE image: 512 bytes with XMM0-15 at offset 160.
+// The i387 fcs/ds segment fields do not exist in the 64-bit layout.  The
+// size matters: the copy fills all 512 bytes, so a short or misaligned
+// struct makes PTRACE_GETFPREGS overflow the caller's memory.
 type FPRegs struct {
 	FCW       uint16
 	FSW       uint16
-	FTW       byte
+	FTW       uint16
 	FOP       uint16
 	FIP       uint64
-	FCS       uint16
 	FDP       uint64
-	FDS       uint16
 	MXCSR     uint32
 	MXCSRMask uint32
 	ST        [8][16]byte  // x87 stack (10 bytes per reg, padded to 16)
-	XMM       [16][16]byte // XMM0-15
+	XMM       [16][16]byte // XMM0-15, struct offset 160
+	Reserved  [96]byte     // FXSAVE padding, to the full 512 bytes
 }
 
 // GetFPRegs retrieves the FPU/SSE register state of the stopped debuggee.
@@ -233,180 +87,69 @@ type VectorRegs struct {
 	YMM [16][32]byte // YMM0-15 (full 256-bit values)
 }
 
-// GetVectorRegs retrieves the YMM registers via PTRACE_GETREGSET + XSAVE.
-// Falls back to XMM if XSAVE is unavailable.
+// NT_X86_XSTATE (0x202), the xsave extended-state regset
+// (include/uapi/linux/elf.h).
+const ntX86XState = 0x202
+
+// Layout of the buffer PTRACE_GETREGSET returns for NT_X86_XSTATE: the
+// 512-byte legacy fxsave image (x87 state in 0-159, XMM0-15 in 160-511),
+// then the 64-byte xsave header whose first 8 bytes are xstate_bv, then one
+// component per set feature bit, each 64-byte aligned.  The YMM high halves
+// are the first extended component, at offset 576; that offset is fixed by
+// the ISA on AVX-capable x86-64.  XFEATURE_MASK_YMM is bit 2 of xstate_bv
+// (arch/x86/include/asm/fpu/types.h); the high halves are zero when the bit
+// is clear.
+const (
+	xsaveXMMOffset    = 160
+	xsaveXMMSize      = 256
+	xsaveHeaderOffset = 512
+	xsaveBVOffset     = xsaveHeaderOffset
+	ymmOffset         = xsaveHeaderOffset + 64 // 576
+	ymmSize           = 256                    // 16 registers, 16 bytes each
+	xfeatureMaskYMM   = 1 << 2
+	xstateMaxBuffer   = 4096 // CPUID(0xD).xsave_size is far below this
+)
+
+// GetVectorRegs retrieves the YMM registers via PTRACE_GETREGSET on
+// NT_X86_XSTATE.  The low (XMM) halves always come from the legacy image;
+// the high halves are copied only when xstate_bv reports the YMM feature,
+// and read as zero otherwise.  When the regset request fails the FP image
+// still provides correct XMM halves, so that is the fallback.
 func (s *Session) GetVectorRegs() (VectorRegs, error) {
 	var v VectorRegs
-	fp, err := s.GetFPRegs()
-	if err != nil {
-		return v, err
+	buf := make([]byte, xstateMaxBuffer)
+	iovec := syscall.Iovec{
+		Base: &buf[0],
+		Len:  uint64(len(buf)),
 	}
-	// PTRACE_GETFPREGS gives XMM registers (lower 128 bits).
-	// For YMM we'd need XSAVE; for now, copy XMM and zero the upper half.
-	for i := 0; i < 16; i++ {
-		for j := 0; j < 16; j++ {
-			v.YMM[i][j] = fp.XMM[i][j]
+	_, _, errno := syscall.Syscall6(
+		syscall.SYS_PTRACE,
+		uintptr(syscall.PTRACE_GETREGSET),
+		uintptr(s.pid),
+		uintptr(ntX86XState),
+		uintptr(unsafe.Pointer(&iovec)),
+		0, 0,
+	)
+	if errno != 0 {
+		fp, err := s.GetFPRegs()
+		if err != nil {
+			return v, err
+		}
+		for i := range 16 {
+			copy(v.YMM[i][:16], fp.XMM[i][:])
+		}
+		return v, nil
+	}
+	n := int(iovec.Len)
+	for i := range 16 {
+		copy(v.YMM[i][:16], buf[xsaveXMMOffset+16*i:xsaveXMMOffset+16*i+16])
+	}
+	if n >= ymmOffset+ymmSize {
+		if binary.LittleEndian.Uint64(buf[xsaveBVOffset:xsaveBVOffset+8])&xfeatureMaskYMM != 0 {
+			for i := range 16 {
+				copy(v.YMM[i][16:], buf[ymmOffset+16*i:ymmOffset+16*i+16])
+			}
 		}
-		// Upper 128 bits would come from XSAVE, not available via GETFPREGS.
 	}
 	return v, nil
 }
-
-// Peek reads a word (8 bytes) from the debuggee's memory at addr.
-// Uses /proc/pid/mem which works reliably with Go's multi-threaded runtime.
-func (s *Session) Peek(addr uint64) (uint64, error) {
-	mem, err := os.OpenFile(fmt.Sprintf("/proc/%d/mem", s.pid), os.O_RDONLY, 0)
-	if err != nil {
-		return 0, fmt.Errorf("debug: open /proc/%d/mem: %w", s.pid, err)
-	}
-	defer mem.Close()
-	buf := make([]byte, 8)
-	if _, err := mem.ReadAt(buf, int64(addr)); err != nil {
-		return 0, fmt.Errorf("debug: read mem %#x: %w", addr, err)
-	}
-	return uint64(buf[0]) | uint64(buf[1])<<8 | uint64(buf[2])<<16 | uint64(buf[3])<<24 |
-		uint64(buf[4])<<32 | uint64(buf[5])<<40 | uint64(buf[6])<<48 | uint64(buf[7])<<56, nil
-}
-
-// Poke writes a word (8 bytes) to the debuggee's memory at addr.
-func (s *Session) Poke(addr, val uint64) error {
-	mem, err := os.OpenFile(fmt.Sprintf("/proc/%d/mem", s.pid), os.O_WRONLY, 0)
-	if err != nil {
-		return fmt.Errorf("debug: open /proc/%d/mem: %w", s.pid, err)
-	}
-	defer mem.Close()
-	buf := []byte{byte(val), byte(val >> 8), byte(val >> 16), byte(val >> 24),
-		byte(val >> 32), byte(val >> 40), byte(val >> 48), byte(val >> 56)}
-	if _, err := mem.WriteAt(buf, int64(addr)); err != nil {
-		return fmt.Errorf("debug: write mem %#x: %w", addr, err)
-	}
-	return nil
-}
-
-// ReadMemory reads len bytes from the debuggee's memory at addr.
-func (s *Session) ReadMemory(addr uint64, length int) ([]byte, error) {
-	out := make([]byte, length)
-	for i := 0; i < length; i += 8 {
-		word, err := s.Peek(addr + uint64(i))
-		if err != nil {
-			return out[:i], err
-		}
-		for j := 0; j < 8 && i+j < length; j++ {
-			out[i+j] = byte(word >> (8 * j))
-		}
-	}
-	return out, nil
-}
-
-// WriteMemory writes bytes to the debuggee's memory at addr.
-func (s *Session) WriteMemory(addr uint64, data []byte) error {
-	for i := 0; i < len(data); i += 8 {
-		end := i + 8
-		if end > len(data) {
-			end = len(data)
-		}
-		var word uint64
-		for j := 0; j < end-i; j++ {
-			word |= uint64(data[i+j]) << (8 * j)
-		}
-		// For partial writes, read-modify-write the existing word.
-		if end-i < 8 {
-			existing, err := s.Peek(addr + uint64(i))
-			if err != nil {
-				return err
-			}
-			// Clear the bytes we're overwriting and merge.
-			mask := ^((uint64(1) << (8 * (end - i))) - 1)
-			word = (existing & mask) | word
-		}
-		if err := s.Poke(addr+uint64(i), word); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-// Step executes a single instruction in the debuggee.
-func (s *Session) Step() error {
-	if s.exited {
-		return fmt.Errorf("debug: debuggee has exited")
-	}
-	_, _, errno := syscall.Syscall6(
-		syscall.SYS_PTRACE,
-		uintptr(syscall.PTRACE_SINGLESTEP),
-		uintptr(s.pid),
-		0, 0, 0, 0,
-	)
-	if errno != 0 {
-		return fmt.Errorf("debug: PTRACE_SINGLESTEP: %w", errno)
-	}
-	return s.wait()
-}
-
-// Continue resumes execution until the next breakpoint or exit.
-func (s *Session) Continue() error {
-	if s.exited {
-		return fmt.Errorf("debug: debuggee has exited")
-	}
-	_, _, errno := syscall.Syscall6(
-		syscall.SYS_PTRACE,
-		uintptr(syscall.PTRACE_CONT),
-		uintptr(s.pid),
-		0, 0, 0, 0,
-	)
-	if errno != 0 {
-		return fmt.Errorf("debug: PTRACE_CONT: %w", errno)
-	}
-	return s.wait()
-}
-
-// Exited returns true if the debuggee has terminated.
-func (s *Session) Exited() bool {
-	return s.exited
-}
-
-// Pid returns the debuggee's process ID.
-func (s *Session) Pid() int {
-	return s.pid
-}
-
-// CodeBase returns the base address of the JIT code in the debuggee.
-func (s *Session) CodeBase() uint64 {
-	return s.codeBase
-}
-
-// Kill terminates the debuggee.
-func (s *Session) Kill() {
-	if !s.exited {
-		syscall.Kill(s.pid, syscall.SIGKILL)
-		syscall.Wait4(s.pid, nil, 0, nil)
-		s.exited = true
-	}
-	if s.cmd != nil && s.cmd.Process != nil {
-		s.cmd.Wait()
-	}
-}
-
-// findRWXMapping reads /proc/pid/maps and returns the base address of the
-// first read-write-execute mapping (the JIT code region).
-func findRWXMapping(pid int) uint64 {
-	data, err := os.ReadFile(fmt.Sprintf("/proc/%d/maps", pid))
-	if err != nil {
-		return 0
-	}
-	for _, line := range strings.Split(string(data), "\n") {
-		// Format: addr-addr perms offset dev inode pathname
-		fields := strings.Fields(line)
-		if len(fields) < 2 {
-			continue
-		}
-		perms := fields[1]
-		if len(perms) >= 3 && perms[0] == 'r' && perms[1] == 'w' && perms[2] == 'x' {
-			// Parse the start address.
-			var start uint64
-			fmt.Sscanf(fields[0], "%x-", &start)
-			return start
-		}
-	}
-	return 0
-}

debug/ptrace_linux_arm64.go

@@ -0,0 +1,94 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build linux && arm64
+
+package debug
+
+import (
+	"fmt"
+	"syscall"
+	"unsafe"
+)
+
+// GetRegs reads the general-purpose registers of the stopped debuggee.
+func (s *Session) GetRegs() (Regs, error) {
+	var regs Regs
+	_, _, errno := syscall.Syscall6(
+		syscall.SYS_PTRACE,
+		uintptr(syscall.PTRACE_GETREGS),
+		uintptr(s.pid),
+		0,
+		uintptr(unsafe.Pointer(&regs)),
+		0, 0,
+	)
+	if errno != 0 {
+		return regs, fmt.Errorf("debug: PTRACE_GETREGS: %w", errno)
+	}
+	return regs, nil
+}
+
+// SetRegs writes the general-purpose registers of the stopped debuggee.
+func (s *Session) SetRegs(regs *Regs) error {
+	_, _, errno := syscall.Syscall6(
+		syscall.SYS_PTRACE,
+		uintptr(syscall.PTRACE_SETREGS),
+		uintptr(s.pid),
+		0,
+		uintptr(unsafe.Pointer(regs)),
+		0, 0,
+	)
+	if errno != 0 {
+		return fmt.Errorf("debug: PTRACE_SETREGS: %w", errno)
+	}
+	return nil
+}
+
+// ntPrFPREG is the NT_PRFPREG note type (ELF NT ver): the FP register set.
+const ntPrFPREG = 0x2
+
+// FPRegs holds the arm64 FP/NEON register state, matching the kernel's
+// user_fpsimd_struct layout (32 128-bit V registers, then FPSR and FPCR).
+type FPRegs struct {
+	V    [32][16]byte // V0-V31 (128-bit NEON/FP registers)
+	FPSR uint32
+	FPCR uint32
+}
+
+// GetFPRegs retrieves the FP register state via PTRACE_GETREGSET with
+// NT_PRFPREG (this architecture has no PTRACE_GETFPREGS request).
+func (s *Session) GetFPRegs() (FPRegs, error) {
+	var fp FPRegs
+	iovec := syscall.Iovec{
+		Base: (*byte)(unsafe.Pointer(&fp)),
+		Len:  uint64(unsafe.Sizeof(fp)),
+	}
+	_, _, errno := syscall.Syscall6(
+		syscall.SYS_PTRACE,
+		uintptr(syscall.PTRACE_GETREGSET),
+		uintptr(s.pid),
+		uintptr(ntPrFPREG),
+		uintptr(unsafe.Pointer(&iovec)),
+		0, 0,
+	)
+	if errno != 0 {
+		return fp, fmt.Errorf("debug: PTRACE_GETREGSET (NT_PRFPREG): %w", errno)
+	}
+	return fp, nil
+}
+
+// VectorRegs holds the full SIMD register state.
+type VectorRegs struct {
+	V [32][16]byte // V0-V31 (128-bit)
+}
+
+// GetVectorRegs retrieves the SIMD registers.
+func (s *Session) GetVectorRegs() (VectorRegs, error) {
+	var v VectorRegs
+	fp, err := s.GetFPRegs()
+	if err != nil {
+		return v, err
+	}
+	copy(v.V[:][:], fp.V[:][:])
+	return v, nil
+}

debug/ptrace_linux_loong64.go

@@ -0,0 +1,97 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build linux && loong64
+
+package debug
+
+import (
+	"fmt"
+	"syscall"
+	"unsafe"
+)
+
+// GetRegs reads the general-purpose registers of the stopped debuggee.
+func (s *Session) GetRegs() (Regs, error) {
+	var regs Regs
+	_, _, errno := syscall.Syscall6(
+		syscall.SYS_PTRACE,
+		uintptr(syscall.PTRACE_GETREGS),
+		uintptr(s.pid),
+		0,
+		uintptr(unsafe.Pointer(&regs)),
+		0, 0,
+	)
+	if errno != 0 {
+		return regs, fmt.Errorf("debug: PTRACE_GETREGS: %w", errno)
+	}
+	return regs, nil
+}
+
+// SetRegs writes the general-purpose registers of the stopped debuggee.
+func (s *Session) SetRegs(regs *Regs) error {
+	_, _, errno := syscall.Syscall6(
+		syscall.SYS_PTRACE,
+		uintptr(syscall.PTRACE_SETREGS),
+		uintptr(s.pid),
+		0,
+		uintptr(unsafe.Pointer(regs)),
+		0, 0,
+	)
+	if errno != 0 {
+		return fmt.Errorf("debug: PTRACE_SETREGS: %w", errno)
+	}
+	return nil
+}
+
+// ntPrFPREG is the NT_PRFPREG note type (ELF NT ver): the FP register set.
+const ntPrFPREG = 0x2
+
+// FPRegs holds the LoongArch FP register state, matching the kernel's
+// user_fp_struct layout (32 64-bit FP registers, the fcc condition flags,
+// and fcsr).
+type FPRegs struct {
+	F    [32]uint64 // F0-F31 (64-bit FP registers)
+	FCC  uint64     // eight per-register condition flags, packed
+	FCSR uint32
+}
+
+// GetFPRegs retrieves the FP register state via PTRACE_GETREGSET with
+// NT_PRFPREG (this architecture has no PTRACE_GETFPREGS request).
+func (s *Session) GetFPRegs() (FPRegs, error) {
+	var fp FPRegs
+	iovec := syscall.Iovec{
+		Base: (*byte)(unsafe.Pointer(&fp)),
+		Len:  uint64(unsafe.Sizeof(fp)),
+	}
+	_, _, errno := syscall.Syscall6(
+		syscall.SYS_PTRACE,
+		uintptr(syscall.PTRACE_GETREGSET),
+		uintptr(s.pid),
+		uintptr(ntPrFPREG),
+		uintptr(unsafe.Pointer(&iovec)),
+		0, 0,
+	)
+	if errno != 0 {
+		return fp, fmt.Errorf("debug: PTRACE_GETREGSET (NT_PRFPREG): %w", errno)
+	}
+	return fp, nil
+}
+
+// VectorRegs holds the FP register state shown by the regs command
+// (the scalar FP subset: 32 64-bit registers, fcc and fcsr; the LSX/LASX
+// vector files are not read yet).
+type VectorRegs struct {
+	F    [32]uint64
+	FCC  uint64
+	FCSR uint32
+}
+
+// GetVectorRegs retrieves the FP registers.
+func (s *Session) GetVectorRegs() (VectorRegs, error) {
+	fp, err := s.GetFPRegs()
+	if err != nil {
+		return VectorRegs{}, err
+	}
+	return VectorRegs{F: fp.F, FCC: fp.FCC, FCSR: fp.FCSR}, nil
+}

debug/ptrace_linux_riscv64.go

@@ -0,0 +1,93 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build linux && riscv64
+
+package debug
+
+import (
+	"fmt"
+	"syscall"
+	"unsafe"
+)
+
+// GetRegs reads the general-purpose registers of the stopped debuggee.
+func (s *Session) GetRegs() (Regs, error) {
+	var regs Regs
+	_, _, errno := syscall.Syscall6(
+		syscall.SYS_PTRACE,
+		uintptr(syscall.PTRACE_GETREGS),
+		uintptr(s.pid),
+		0,
+		uintptr(unsafe.Pointer(&regs)),
+		0, 0,
+	)
+	if errno != 0 {
+		return regs, fmt.Errorf("debug: PTRACE_GETREGS: %w", errno)
+	}
+	return regs, nil
+}
+
+// SetRegs writes the general-purpose registers of the stopped debuggee.
+func (s *Session) SetRegs(regs *Regs) error {
+	_, _, errno := syscall.Syscall6(
+		syscall.SYS_PTRACE,
+		uintptr(syscall.PTRACE_SETREGS),
+		uintptr(s.pid),
+		0,
+		uintptr(unsafe.Pointer(regs)),
+		0, 0,
+	)
+	if errno != 0 {
+		return fmt.Errorf("debug: PTRACE_SETREGS: %w", errno)
+	}
+	return nil
+}
+
+// ntPrFPREG is the NT_PRFPREG note type (ELF NT ver): the FP register set.
+const ntPrFPREG = 0x2
+
+// FPRegs holds the RISC-V FP register state, matching the kernel's
+// user_fp_struct layout (32 64-bit FP registers plus fcsr).
+type FPRegs struct {
+	F    [32]uint64 // F0-F31 (64-bit FP registers)
+	FCSR uint32
+}
+
+// GetFPRegs retrieves the FP register state via PTRACE_GETREGSET with
+// NT_PRFPREG (this architecture has no PTRACE_GETFPREGS request).
+func (s *Session) GetFPRegs() (FPRegs, error) {
+	var fp FPRegs
+	iovec := syscall.Iovec{
+		Base: (*byte)(unsafe.Pointer(&fp)),
+		Len:  uint64(unsafe.Sizeof(fp)),
+	}
+	_, _, errno := syscall.Syscall6(
+		syscall.SYS_PTRACE,
+		uintptr(syscall.PTRACE_GETREGSET),
+		uintptr(s.pid),
+		uintptr(ntPrFPREG),
+		uintptr(unsafe.Pointer(&iovec)),
+		0, 0,
+	)
+	if errno != 0 {
+		return fp, fmt.Errorf("debug: PTRACE_GETREGSET (NT_PRFPREG): %w", errno)
+	}
+	return fp, nil
+}
+
+// VectorRegs holds the FP register state shown by the regs command
+// (riscv64 has 32 64-bit FP registers and fcsr).
+type VectorRegs struct {
+	F    [32]uint64
+	FCSR uint32
+}
+
+// GetVectorRegs retrieves the FP registers.
+func (s *Session) GetVectorRegs() (VectorRegs, error) {
+	fp, err := s.GetFPRegs()
+	if err != nil {
+		return VectorRegs{}, err
+	}
+	return VectorRegs{F: fp.F, FCSR: fp.FCSR}, nil
+}

debug/regs_linux_amd64.go

@@ -0,0 +1,99 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build linux && amd64
+
+package debug
+
+// Regs holds the full general-purpose register set of a traced process
+// (the Linux amd64 user_regs_struct layout).
+type Regs struct {
+	R15     uint64
+	R14     uint64
+	R13     uint64
+	R12     uint64
+	RBP     uint64
+	RBX     uint64
+	R11     uint64
+	R10     uint64
+	R9      uint64
+	R8      uint64
+	RAX     uint64
+	RCX     uint64
+	RDX     uint64
+	RSI     uint64
+	RDI     uint64
+	OrigRAX uint64
+	RIP     uint64
+	CS      uint64
+	RFLAGS  uint64
+	RSP     uint64
+	SS      uint64
+	FSBase  uint64
+	GSBase  uint64
+	DS      uint64
+	ES      uint64
+	FS      uint64
+	GS      uint64
+}
+
+// GetPC returns the program counter.
+func (r *Regs) GetPC() uint64 { return r.RIP }
+
+// SetPC sets the program counter.
+func (r *Regs) SetPC(pc uint64) { r.RIP = pc }
+
+// GetSP returns the stack pointer.
+func (r *Regs) GetSP() uint64 { return r.RSP }
+
+// RegValue returns the value of the named register, or false if unknown.
+func (r *Regs) RegValue(name string) (uint64, bool) {
+	switch name {
+	case "rax", "eax", "ax", "al":
+		return r.RAX, true
+	case "rbx", "ebx", "bx", "bl":
+		return r.RBX, true
+	case "rcx", "ecx", "cx", "cl":
+		return r.RCX, true
+	case "rdx", "edx", "dx", "dl":
+		return r.RDX, true
+	case "rsi", "esi", "si":
+		return r.RSI, true
+	case "rdi", "edi", "di":
+		return r.RDI, true
+	case "rbp", "ebp", "bp":
+		return r.RBP, true
+	case "rsp", "esp", "sp":
+		return r.RSP, true
+	case "r8":
+		return r.R8, true
+	case "r9":
+		return r.R9, true
+	case "r10":
+		return r.R10, true
+	case "r11":
+		return r.R11, true
+	case "r12":
+		return r.R12, true
+	case "r13":
+		return r.R13, true
+	case "r14":
+		return r.R14, true
+	case "r15":
+		return r.R15, true
+	case "rip", "eip":
+		return r.RIP, true
+	default:
+		return 0, false
+	}
+}
+
+// breakpointInsn is the software breakpoint instruction.
+var breakpointInsn = []byte{0xCC} // INT3
+
+// breakpointPCAdjust is how far PC is past the breakpoint instruction after
+// a trap.  x86-64 reports the #DB for INT3 with RIP on the byte after the
+// INT3 (Intel SDM vol 3, "Debug Exceptions"), so the trap address is
+// PC-1.  The other supported architectures leave the PC on the trap
+// instruction and use 0 there.
+const breakpointPCAdjust = 1

debug/regs_linux_arm64.go

@@ -0,0 +1,140 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build linux && arm64
+
+package debug
+
+// Regs holds the full general-purpose register set of a traced process
+// (the Linux arm64 user_pt_regs layout).
+type Regs struct {
+	X0     uint64
+	X1     uint64
+	X2     uint64
+	X3     uint64
+	X4     uint64
+	X5     uint64
+	X6     uint64
+	X7     uint64
+	X8     uint64
+	X9     uint64
+	X10    uint64
+	X11    uint64
+	X12    uint64
+	X13    uint64
+	X14    uint64
+	X15    uint64
+	X16    uint64
+	X17    uint64
+	X18    uint64
+	X19    uint64
+	X20    uint64
+	X21    uint64
+	X22    uint64
+	X23    uint64
+	X24    uint64
+	X25    uint64
+	X26    uint64
+	X27    uint64
+	X28    uint64
+	X29    uint64 // FP (frame pointer)
+	X30    uint64 // LR (link register)
+	SP     uint64
+	PC     uint64
+	PSTATE uint64
+}
+
+// PC returns the program counter.
+func (r *Regs) GetPC() uint64 { return r.PC }
+
+// SetPC sets the program counter.
+func (r *Regs) SetPC(pc uint64) { r.PC = pc }
+
+// GetSP returns the stack pointer.
+func (r *Regs) GetSP() uint64 { return r.SP }
+
+// RegValue returns the value of the named register, or false if unknown.
+func (r *Regs) RegValue(name string) (uint64, bool) {
+	switch name {
+	case "x0":
+		return r.X0, true
+	case "x1":
+		return r.X1, true
+	case "x2":
+		return r.X2, true
+	case "x3":
+		return r.X3, true
+	case "x4":
+		return r.X4, true
+	case "x5":
+		return r.X5, true
+	case "x6":
+		return r.X6, true
+	case "x7":
+		return r.X7, true
+	case "x8":
+		return r.X8, true
+	case "x9":
+		return r.X9, true
+	case "x10":
+		return r.X10, true
+	case "x11":
+		return r.X11, true
+	case "x12":
+		return r.X12, true
+	case "x13":
+		return r.X13, true
+	case "x14":
+		return r.X14, true
+	case "x15":
+		return r.X15, true
+	case "x16":
+		return r.X16, true
+	case "x17":
+		return r.X17, true
+	case "x18":
+		return r.X18, true
+	case "x19":
+		return r.X19, true
+	case "x20":
+		return r.X20, true
+	case "x21":
+		return r.X21, true
+	case "x22":
+		return r.X22, true
+	case "x23":
+		return r.X23, true
+	case "x24":
+		return r.X24, true
+	case "x25":
+		return r.X25, true
+	case "x26":
+		return r.X26, true
+	case "x27":
+		return r.X27, true
+	case "x28":
+		return r.X28, true
+	case "x29", "fp":
+		return r.X29, true
+	case "x30", "lr":
+		return r.X30, true
+	case "sp":
+		return r.SP, true
+	case "pc":
+		return r.PC, true
+	default:
+		return 0, false
+	}
+}
+
+// breakpointInsn is the software breakpoint instruction (BRK #0).
+var breakpointInsn = []byte{0x00, 0x00, 0x20, 0xD4} // BRK #0
+
+// breakpointPCAdjust is how far PC is past the breakpoint instruction after
+// a trap: 0, because the arm64 kernel delivers the BRK SIGTRAP with the PC
+// still on the BRK.  do_el0_brk64 calls send_user_sigtrap, which uses
+// instruction_pointer(regs) unmodified (arch/arm64/kernel/debug-monitors.c);
+// only the kernel-internal skip paths advance the PC.  GDB history agrees:
+// decr_pc_after_break on aarch64 Linux is 0 (the +4 variant was a QEMU bug,
+// sourceware PR 17280).
+const breakpointPCAdjust = 0