Linux x64 Calling Convention - Why are the first 6 args at negative offsets from RBP?

I was reading this page Linux x64 Calling Convention, but got confused about passing function parameters by registers and stack. It says:

> Arguments 1-6 are accessed via registers RDI, RSI, RDX, RCX, R8, R9 before they are modified or via offsets from the RBP register like so: rbp - $offset.

If the first 6 parameters are passed by registers, how come they can also be read from and written to the stack? Are the first 6 parameters stored both in the registers and on the stack?

The article is mixing up the actual calling convention, which simply calls for passing the first 6 arguments in registers, with the way a particular compiler emits code for the called function.

Specifically, when gcc is used with optimization turned off, it will begin the function by "spilling" all the register arguments into stack memory. There is no inherent need to do that - it would work just fine, and be more efficient, to just use the arguments from the registers where they were passed. But when optimizations are off, gcc's priorities are fast compilation and easy debugging, at the expense of emitting code that's often hilariously inefficient.

With regard to debugging, one of its objectives is that every variable in the program, including function parameters, has a well-defined address in memory. (Variables declared register could be an exception.) Moreover, the value is loaded from that address before each line of code that uses it (even if the value happens to already be in a register) and stored back afterward. This makes it easy to inspect and modify values of variables as you step through the program in your debugger, without running into problems with variables that may have been optimized out.

I don't think there is any particular pattern followed by the compiler in deciding which argument goes at which stack offset. It could be simply moving down the stack as the arguments go left to right, but you wouldn't want to rely on that. It certainly isn't a documented behavior.

If you turn on optimizations (-O, -O2, etc), you will see the spills go away. The compiler will just use the argument values from the registers where they were passed. As needed, it might move them into other registers, or overwrite them once they are no longer needed.

So in short, passing the arguments in registers is a well-defined and predictable behavior, specified by the ABI standard. Spilling them to the stack is behavior that occurs only when building with a specific compiler using a specific set of options, and is not standard or predictable in any way.