* How does "rsi" get set in x86 prologue? @ 2025-01-01 19:26 Gautam Bhat 2025-01-02 10:15 ` Alex Bennée 0 siblings, 1 reply; 4+ messages in thread From: Gautam Bhat @ 2025-01-01 19:26 UTC (permalink / raw) To: QEMU Developers I am trying to understanding the generated code for the x86 target. On EPILOGUE code below: 0x7fff98000000: 55 pushq %rbp 0x7fff98000001: 53 pushq %rbx 0x7fff98000002: 41 54 pushq %r12 0x7fff98000004: 41 55 pushq %r13 0x7fff98000006: 41 56 pushq %r14 0x7fff98000008: 41 57 pushq %r15 0x7fff9800000a: 48 8b ef movq %rdi, %rbp 0x7fff9800000d: 48 81 c4 78 fb ff ff addq $-0x488, %rsp 0x7fff98000014: ff e6 jmpq *%rsi 0x7fff98000016: 33 c0 xorl %eax, %eax 0x7fff98000018: 48 81 c4 88 04 00 00 addq $0x488, %rsp 0x7fff9800001f: c5 f8 77 vzeroupper 0x7fff98000022: 41 5f popq %r15 0x7fff98000024: 41 5e popq %r14 0x7fff98000026: 41 5d popq %r13 0x7fff98000028: 41 5c popq %r12 0x7fff9800002a: 5b popq %rbx 0x7fff9800002b: 5d popq %rbp 0x7fff9800002c: c3 retq Can someone help me understand in which file or where in the source does the "rsi" get set to jump? (0x7fff98000014: ff e6 jmpq *%rsi) Thanks, Gautam. ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: How does "rsi" get set in x86 prologue? 2025-01-01 19:26 How does "rsi" get set in x86 prologue? Gautam Bhat @ 2025-01-02 10:15 ` Alex Bennée 2025-01-30 15:34 ` Gautam Bhat 0 siblings, 1 reply; 4+ messages in thread From: Alex Bennée @ 2025-01-02 10:15 UTC (permalink / raw) To: Gautam Bhat; +Cc: QEMU Developers Gautam Bhat <mindentropy@gmail.com> writes: > I am trying to understanding the generated code for the x86 target. On > EPILOGUE code below: > > 0x7fff98000000: 55 pushq %rbp > 0x7fff98000001: 53 pushq %rbx > 0x7fff98000002: 41 54 pushq %r12 > 0x7fff98000004: 41 55 pushq %r13 > 0x7fff98000006: 41 56 pushq %r14 > 0x7fff98000008: 41 57 pushq %r15 > 0x7fff9800000a: 48 8b ef movq %rdi, %rbp > 0x7fff9800000d: 48 81 c4 78 fb ff ff addq $-0x488, %rsp > 0x7fff98000014: ff e6 jmpq *%rsi > 0x7fff98000016: 33 c0 xorl %eax, %eax > 0x7fff98000018: 48 81 c4 88 04 00 00 addq $0x488, %rsp > 0x7fff9800001f: c5 f8 77 vzeroupper > 0x7fff98000022: 41 5f popq %r15 > 0x7fff98000024: 41 5e popq %r14 > 0x7fff98000026: 41 5d popq %r13 > 0x7fff98000028: 41 5c popq %r12 > 0x7fff9800002a: 5b popq %rbx > 0x7fff9800002b: 5d popq %rbp > 0x7fff9800002c: c3 retq > > Can someone help me understand in which file or where in the source > does the "rsi" get set to jump? (0x7fff98000014: ff e6 jmpq > *%rsi) The prologue/epilogue code is generated by: /* Generate global QEMU prologue and epilogue code */ static void tcg_target_qemu_prologue(TCGContext *s) { int i, stack_addend; /* TB prologue */ /* Reserve some stack space, also for TCG temps. */ stack_addend = FRAME_SIZE - PUSH_SIZE; tcg_set_frame(s, TCG_REG_CALL_STACK, TCG_STATIC_CALL_ARGS_SIZE, CPU_TEMP_BUF_NLONGS * sizeof(long)); /* Save all callee saved registers. */ for (i = 0; i < ARRAY_SIZE(tcg_target_callee_save_regs); i++) { tcg_out_push(s, tcg_target_callee_save_regs[i]); } if (!tcg_use_softmmu && guest_base) { int seg = setup_guest_base_seg(); if (seg != 0) { x86_guest_base.seg = seg; } else if (guest_base == (int32_t)guest_base) { x86_guest_base.ofs = guest_base; } else { assert(TCG_TARGET_REG_BITS == 64); /* Choose R12 because, as a base, it requires a SIB byte. */ x86_guest_base.index = TCG_REG_R12; tcg_out_movi(s, TCG_TYPE_PTR, x86_guest_base.index, guest_base); tcg_regset_set_reg(s->reserved_regs, x86_guest_base.index); } } if (TCG_TARGET_REG_BITS == 32) { tcg_out_ld(s, TCG_TYPE_PTR, TCG_AREG0, TCG_REG_ESP, (ARRAY_SIZE(tcg_target_callee_save_regs) + 1) * 4); tcg_out_addi(s, TCG_REG_ESP, -stack_addend); /* jmp *tb. */ tcg_out_modrm_offset(s, OPC_GRP5, EXT5_JMPN_Ev, TCG_REG_ESP, (ARRAY_SIZE(tcg_target_callee_save_regs) + 2) * 4 + stack_addend); } else { tcg_out_mov(s, TCG_TYPE_PTR, TCG_AREG0, tcg_target_call_iarg_regs[0]); tcg_out_addi(s, TCG_REG_ESP, -stack_addend); /* jmp *tb. */ tcg_out_modrm(s, OPC_GRP5, EXT5_JMPN_Ev, tcg_target_call_iarg_regs[1]); } /* * Return path for goto_ptr. Set return value to 0, a-la exit_tb, * and fall through to the rest of the epilogue. */ tcg_code_gen_epilogue = tcg_splitwx_to_rx(s->code_ptr); tcg_out_movi(s, TCG_TYPE_REG, TCG_REG_EAX, 0); /* TB epilogue */ tb_ret_addr = tcg_splitwx_to_rx(s->code_ptr); tcg_out_addi(s, TCG_REG_CALL_STACK, stack_addend); if (have_avx2) { tcg_out_vex_opc(s, OPC_VZEROUPPER, 0, 0, 0, 0); } for (i = ARRAY_SIZE(tcg_target_callee_save_regs) - 1; i >= 0; i--) { tcg_out_pop(s, tcg_target_callee_save_regs[i]); } tcg_out_opc(s, OPC_RET, 0, 0, 0); } The call into the prologue comes from: ret = tcg_qemu_tb_exec(cpu_env(cpu), tb_ptr); in cpu_tb_exec. With env in RDI and tb_ptr (the code address) being in RSI. > > Thanks, > Gautam. -- Alex Bennée Virtualisation Tech Lead @ Linaro ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: How does "rsi" get set in x86 prologue? 2025-01-02 10:15 ` Alex Bennée @ 2025-01-30 15:34 ` Gautam Bhat 2025-01-31 12:58 ` Alex Bennée 0 siblings, 1 reply; 4+ messages in thread From: Gautam Bhat @ 2025-01-30 15:34 UTC (permalink / raw) To: Alex Bennée; +Cc: QEMU Developers On Thu, Jan 2, 2025 at 3:45 PM Alex Bennée <alex.bennee@linaro.org> wrote: <SNIP> > The call into the prologue comes from: > > ret = tcg_qemu_tb_exec(cpu_env(cpu), tb_ptr); > > in cpu_tb_exec. With env in RDI and tb_ptr (the code address) being in > RSI. > > > -- > Alex Bennée > Virtualisation Tech Lead @ Linaro Thanks Alex. So this would be regular function calling conventions. I thought there would be some inline assembly to the jump to the disas rather then a call to tcg_qemu_tb_exec(..) I verified all of this in the gdb disas of the function. -Gautam. ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: How does "rsi" get set in x86 prologue? 2025-01-30 15:34 ` Gautam Bhat @ 2025-01-31 12:58 ` Alex Bennée 0 siblings, 0 replies; 4+ messages in thread From: Alex Bennée @ 2025-01-31 12:58 UTC (permalink / raw) To: Gautam Bhat; +Cc: QEMU Developers, Richard Henderson Gautam Bhat <mindentropy@gmail.com> writes: > On Thu, Jan 2, 2025 at 3:45 PM Alex Bennée <alex.bennee@linaro.org> wrote: > <SNIP> >> The call into the prologue comes from: >> >> ret = tcg_qemu_tb_exec(cpu_env(cpu), tb_ptr); >> >> in cpu_tb_exec. With env in RDI and tb_ptr (the code address) being in >> RSI. >> >> >> -- >> Alex Bennée >> Virtualisation Tech Lead @ Linaro > > Thanks Alex. So this would be regular function calling conventions. I > thought there would be some inline assembly to the jump to the disas > rather > then a call to tcg_qemu_tb_exec(..) No it is just regular calling conventions - as it is when the generated code calls out to the helper functions. As TB's chain execution we just maintain the TCG_AREG0 (cpu_env) and TCG_REG_CALL_STACK (stack) until the point they exit and come out back through the epilogue code. I think for *-user we sometimes reserve a register for guest_base as well. > > I verified all of this in the gdb disas of the function. > > -Gautam. -- Alex Bennée Virtualisation Tech Lead @ Linaro ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2025-01-31 13:00 UTC | newest] Thread overview: 4+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2025-01-01 19:26 How does "rsi" get set in x86 prologue? Gautam Bhat 2025-01-02 10:15 ` Alex Bennée 2025-01-30 15:34 ` Gautam Bhat 2025-01-31 12:58 ` Alex Bennée
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).