How does "rsi" get set in x86 prologue?

How does "rsi" get set in x86 prologue?

[Gautam Bhat]

I am trying to understanding the generated code for the x86 target. On
EPILOGUE code below:

0x7fff98000000:  55                       pushq    %rbp
0x7fff98000001:  53                       pushq    %rbx
0x7fff98000002:  41 54                    pushq    %r12
0x7fff98000004:  41 55                    pushq    %r13
0x7fff98000006:  41 56                    pushq    %r14
0x7fff98000008:  41 57                    pushq    %r15
0x7fff9800000a:  48 8b ef                 movq     %rdi, %rbp
0x7fff9800000d:  48 81 c4 78 fb ff ff     addq     $-0x488, %rsp
0x7fff98000014:  ff e6                    jmpq     *%rsi
0x7fff98000016:  33 c0                    xorl     %eax, %eax
0x7fff98000018:  48 81 c4 88 04 00 00     addq     $0x488, %rsp
0x7fff9800001f:  c5 f8 77                 vzeroupper
0x7fff98000022:  41 5f                    popq     %r15
0x7fff98000024:  41 5e                    popq     %r14
0x7fff98000026:  41 5d                    popq     %r13
0x7fff98000028:  41 5c                    popq     %r12
0x7fff9800002a:  5b                       popq     %rbx
0x7fff9800002b:  5d                       popq     %rbp
0x7fff9800002c:  c3                       retq

Can someone help me understand in which file or where in the source
does the "rsi" get set to jump? (0x7fff98000014:  ff e6   jmpq
*%rsi)

Thanks,
Gautam.

Re: How does "rsi" get set in x86 prologue?

[Alex Bennée]

Gautam Bhat <mindentropy@gmail.com> writes:

> I am trying to understanding the generated code for the x86 target. On
> EPILOGUE code below:
>
> 0x7fff98000000:  55                       pushq    %rbp
> 0x7fff98000001:  53                       pushq    %rbx
> 0x7fff98000002:  41 54                    pushq    %r12
> 0x7fff98000004:  41 55                    pushq    %r13
> 0x7fff98000006:  41 56                    pushq    %r14
> 0x7fff98000008:  41 57                    pushq    %r15
> 0x7fff9800000a:  48 8b ef                 movq     %rdi, %rbp
> 0x7fff9800000d:  48 81 c4 78 fb ff ff     addq     $-0x488, %rsp
> 0x7fff98000014:  ff e6                    jmpq     *%rsi
> 0x7fff98000016:  33 c0                    xorl     %eax, %eax
> 0x7fff98000018:  48 81 c4 88 04 00 00     addq     $0x488, %rsp
> 0x7fff9800001f:  c5 f8 77                 vzeroupper
> 0x7fff98000022:  41 5f                    popq     %r15
> 0x7fff98000024:  41 5e                    popq     %r14
> 0x7fff98000026:  41 5d                    popq     %r13
> 0x7fff98000028:  41 5c                    popq     %r12
> 0x7fff9800002a:  5b                       popq     %rbx
> 0x7fff9800002b:  5d                       popq     %rbp
> 0x7fff9800002c:  c3                       retq
>
> Can someone help me understand in which file or where in the source
> does the "rsi" get set to jump? (0x7fff98000014:  ff e6   jmpq
> *%rsi)

The prologue/epilogue code is generated by:

  /* Generate global QEMU prologue and epilogue code */
  static void tcg_target_qemu_prologue(TCGContext *s)
  {
      int i, stack_addend;

      /* TB prologue */

      /* Reserve some stack space, also for TCG temps.  */
      stack_addend = FRAME_SIZE - PUSH_SIZE;
      tcg_set_frame(s, TCG_REG_CALL_STACK, TCG_STATIC_CALL_ARGS_SIZE,
                    CPU_TEMP_BUF_NLONGS * sizeof(long));

      /* Save all callee saved registers.  */
      for (i = 0; i < ARRAY_SIZE(tcg_target_callee_save_regs); i++) {
          tcg_out_push(s, tcg_target_callee_save_regs[i]);
      }

      if (!tcg_use_softmmu && guest_base) {
          int seg = setup_guest_base_seg();
          if (seg != 0) {
              x86_guest_base.seg = seg;
          } else if (guest_base == (int32_t)guest_base) {
              x86_guest_base.ofs = guest_base;
          } else {
              assert(TCG_TARGET_REG_BITS == 64);
              /* Choose R12 because, as a base, it requires a SIB byte. */
              x86_guest_base.index = TCG_REG_R12;
              tcg_out_movi(s, TCG_TYPE_PTR, x86_guest_base.index, guest_base);
              tcg_regset_set_reg(s->reserved_regs, x86_guest_base.index);
          }
      }

      if (TCG_TARGET_REG_BITS == 32) {
          tcg_out_ld(s, TCG_TYPE_PTR, TCG_AREG0, TCG_REG_ESP,
                     (ARRAY_SIZE(tcg_target_callee_save_regs) + 1) * 4);
          tcg_out_addi(s, TCG_REG_ESP, -stack_addend);
          /* jmp *tb.  */
          tcg_out_modrm_offset(s, OPC_GRP5, EXT5_JMPN_Ev, TCG_REG_ESP,
                               (ARRAY_SIZE(tcg_target_callee_save_regs) + 2) * 4
                               + stack_addend);
      } else {
          tcg_out_mov(s, TCG_TYPE_PTR, TCG_AREG0, tcg_target_call_iarg_regs[0]);
          tcg_out_addi(s, TCG_REG_ESP, -stack_addend);
          /* jmp *tb.  */
          tcg_out_modrm(s, OPC_GRP5, EXT5_JMPN_Ev, tcg_target_call_iarg_regs[1]);
      }

      /*
       * Return path for goto_ptr. Set return value to 0, a-la exit_tb,
       * and fall through to the rest of the epilogue.
       */
      tcg_code_gen_epilogue = tcg_splitwx_to_rx(s->code_ptr);
      tcg_out_movi(s, TCG_TYPE_REG, TCG_REG_EAX, 0);

      /* TB epilogue */
      tb_ret_addr = tcg_splitwx_to_rx(s->code_ptr);

      tcg_out_addi(s, TCG_REG_CALL_STACK, stack_addend);

      if (have_avx2) {
          tcg_out_vex_opc(s, OPC_VZEROUPPER, 0, 0, 0, 0);
      }
      for (i = ARRAY_SIZE(tcg_target_callee_save_regs) - 1; i >= 0; i--) {
          tcg_out_pop(s, tcg_target_callee_save_regs[i]);
      }
      tcg_out_opc(s, OPC_RET, 0, 0, 0);
  }

The call into the prologue comes from:

  ret = tcg_qemu_tb_exec(cpu_env(cpu), tb_ptr);

in cpu_tb_exec. With env in RDI and tb_ptr (the code address) being in
RSI.

>
> Thanks,
> Gautam.

-- 
Alex Bennée
Virtualisation Tech Lead @ Linaro

Re: How does "rsi" get set in x86 prologue?

[Gautam Bhat]

On Thu, Jan 2, 2025 at 3:45 PM Alex Bennée <alex.bennee@linaro.org> wrote:
<SNIP>
> The call into the prologue comes from:
>
>   ret = tcg_qemu_tb_exec(cpu_env(cpu), tb_ptr);
>
> in cpu_tb_exec. With env in RDI and tb_ptr (the code address) being in
> RSI.
>
>
> --
> Alex Bennée
> Virtualisation Tech Lead @ Linaro

Thanks Alex. So this would be regular function calling conventions. I
thought there would be some inline assembly to the jump to the disas
rather
then a call to tcg_qemu_tb_exec(..)

I verified all of this in the gdb disas of the function.

-Gautam.

Re: How does "rsi" get set in x86 prologue?

[Alex Bennée]

Gautam Bhat <mindentropy@gmail.com> writes:

> On Thu, Jan 2, 2025 at 3:45 PM Alex Bennée <alex.bennee@linaro.org> wrote:
> <SNIP>
>> The call into the prologue comes from:
>>
>>   ret = tcg_qemu_tb_exec(cpu_env(cpu), tb_ptr);
>>
>> in cpu_tb_exec. With env in RDI and tb_ptr (the code address) being in
>> RSI.
>>
>>
>> --
>> Alex Bennée
>> Virtualisation Tech Lead @ Linaro
>
> Thanks Alex. So this would be regular function calling conventions. I
> thought there would be some inline assembly to the jump to the disas
> rather
> then a call to tcg_qemu_tb_exec(..)

No it is just regular calling conventions - as it is when the generated
code calls out to the helper functions.

As TB's chain execution we just maintain the TCG_AREG0 (cpu_env) and
TCG_REG_CALL_STACK (stack) until the point they exit and come out back
through the epilogue code. I think for *-user we sometimes reserve a
register for guest_base as well.

>
> I verified all of this in the gdb disas of the function.
>
> -Gautam.

-- 
Alex Bennée
Virtualisation Tech Lead @ Linaro