[X86] Unbind the ebx with GOT address in regcall calling convention

[xiangzhangllvm]

Summary

No register can be allocated for indirect call when it use regcall calling convention and passed 5/5+ args.

e.g.

call vreg (ag1, ag2, ag3, ag4, ag5, ...) --> 5 regs (EAX, ECX, EDX, ESI, EDI) used for pass args, 1 reg (EBX )used for hold GOT point,
so no regs can be allocated to vreg.

The Intel386 architecture provides 8 general purpose 32-bit registers. RA mostly
use 6 of them (EAX, EBX, ECX, EDX, ESI, EDI).
5 of this regs can be used to pass function arguments (EAX, ECX, EDX, ESI, EDI).
EBX used to hold the GOT pointer when making function calls via the PLT.
ESP and EBP usually be "reserved" in register allocation.

Reproduce case:

//clang -target i386-unknown-linux-gnu -S -fpic t.c

#define REGCALL __attribute__((regcall))
int REGCALL func (int i1, int i2, int i3, int i4, int i5);
int (REGCALL *fptr) (int, int, int, int, int) = func;
int test() {
    return fptr(1,2,3,4,5);
}

[LuoYuanke]

llvm/lib/Target/X86/X86ISelLowering.cpp

4123–4127

Would you add comments to explain why EBX is avoid in regcall?

4139

Would you add a test case for tail call? Is there any conflict to ECX?

[xiangzhangllvm]

llvm/lib/Target/X86/X86ISelLowering.cpp

4123–4127

I didn't see the rule in regcall calling convertion, let me check how I descript here better.

4139

I check here local before, For X86, tail call will not work with regcall, For X86_64 it will work, but X86_64 don't fix ebx with GOT point.
please check the following case, it will not generate jump for 2nd command.

1 ; llc -mtriple=x86_64-unknown-linux-gnu -relocation-model=pic
2 ; llc -mtriple=i386-unknown-linux-gnu -relocation-model=pic  <-tailcallopt>
3
4 declare x86_regcallcc void @regcall_not_lazy(i32 %a0, i32 %b0)
5
6 define void @tail_call_regcall() nounwind {
7   tail call x86_regcallcc void @regcall_not_lazy(i32 0, i32 1)
8   ret void
9 }

[MaskRay]

llvm/test/CodeGen/X86/x86-regcall-got.ll

56

The attributes can be reduced

64

Unneeded metadatas should be stripped.

[LuoYuanke]

llvm/lib/Target/X86/X86ISelLowering.cpp

4120

To be conservative, do you need to check if the argument number exceed 4 (>=5)?

4139

It seems compiler generate jmp instruction only when the argument number is less or equal to 2 and without pic relocation model.

; llc -mtriple=x86_64-unknown-linux-gnu
; llc -mtriple=i386-unknown-linux-gnu

@foo6 = external global void (i32 %0, i32 %1, i32 %2, i32 %3, i32 %4, i32 %5)*

define void @tail_call_regcall6(i32 %a, i32 %b, i32 %c, i32 %d, i32 %e, ...) nounwind {
  %t0 = alloca i32, align 128
  %t1 = load void (i32, i32, i32, i32, i32, i32)*, void (i32, i32, i32, i32, i32, i32)** @foo6, align 4
  tail call x86_regcallcc void %t1(i32 0, i32 1, i32 2, i32 3, i32 4, i32 5) nounwind
  ret void
}

@foo5 = external global void (i32 %0, i32 %1, i32 %2, i32 %3, i32 %4)*

define void @tail_call_regcall5(i32 %a, i32 %b, i32 %c, i32 %d, i32 %e) nounwind {
  %t1 = load void (i32, i32, i32, i32, i32)*, void (i32, i32, i32, i32, i32)** @foo5, align 4
  ; tail call x86_regcallcc void %t1(i32 0, i32 1, i32 2, i32 3, i32 4) nounwind
  tail call x86_regcallcc void %t1(i32 %a, i32 %b, i32 %c, i32 %d, i32 %e) nounwind
  ret void
}

@foo4 = external global void (i32 %0, i32 %1, i32 %2, i32 %3)*

define void @tail_call_regcall4(i32 %a, i32 %b, i32 %c, i32 %d) nounwind {
  %t1 = load void (i32, i32, i32, i32)*, void (i32, i32, i32, i32)** @foo4, align 4
  ; tail call x86_regcallcc void %t1(i32 0, i32 1, i32 2, i32 3, i32 4) nounwind
  tail call x86_regcallcc void %t1(i32 %a, i32 %b, i32 %c, i32 %d) nounwind
  ret void
}

@foo3 = external global void (i32 %0, i32 %1, i32 %2)*

define void @tail_call_regcall3(i32 %a, i32 %b) nounwind {
  %t1 = load void (i32, i32, i32)*, void (i32, i32, i32)** @foo3, align 4
  tail call x86_regcallcc void %t1(i32 0, i32 1, i32 2) nounwind
  ret void
}

@foo2 = external global void (i32 %0, i32 %1)*

define void @tail_call_regcall2(i32 %a, i32 %b) nounwind {
  %t1 = load void (i32, i32)*, void (i32, i32)** @foo2, align 4
  tail call x86_regcallcc void %t1(i32 0, i32 1) nounwind
  ; tail call x86_regcallcc void %t1(i32 %a, i32 %b) nounwind
  ret void
}

[xiangzhangllvm]

llvm/lib/Target/X86/X86ISelLowering.cpp

4120

It is unclear to me why we need fix ebx for GOT points other than let it freely choose, (even in other calling convention),
In my eyes, It is not well/strange to bind the ebx with GOT according to argument number.

4139

I add "-tailcallopt" on your test, all jump disappeared.
The constrain of tail call should just be "variable argument lists are used" (should not according to the numbers of function).
I guess there must be some bug about tail call itself.
Anyway I'll take a deeper look to check the tail call, all my tests I checked before under pic mode.
And for the relation of ebx and GOT we only need to check pic mode.

llvm/test/CodeGen/X86/x86-regcall-got.ll

56

The attributes can be reduced

64

I'll fix it, thank you!

[xiangzhangllvm]

llvm/lib/Target/X86/X86ISelLowering.cpp

4139

It seems compiler generate jmp instruction only when the argument number is less or equal to 2 and without pic relocation model.

 Yes, in fact, current X86 Lowering has consider the "tailcall address may be in a register", and it try to "escape" no register for allocation problem, so it limited the register number for function args.
 For PIC mode, one more register need to be "bind" to GOT, so the register number for function args should less than non-PIC mode. And PIC mode will disable tail calls to external symbols with default visibility.
So I reproduce the tail call case for PIC in following case:

; llc -mtriple=i386-unknown-linux-gnu -relocation-model=pic tail.ll

@a0 = global i32 0, align 4

define x86_regcallcc void @tail_call_regcall2(i32 %a) nounwind {
  tail call x86_regcallcc void @__regcall3__func(i32 %a) nounwind
  ret void
}

define internal x86_regcallcc void @__regcall3__func(i32 %i1) #0 {
entry:
  store i32 %i1, i32* @a0, align 4
  ret void
}

Current change did no affect on it. (tail call load the address of the callee into ECX at PIC duo to the ebx/callee-saved problem)

[xiangzhangllvm]

llvm/lib/Target/X86/X86ISelLowering.cpp

4139

Though this patch not affect tailcall, I still add test (X86/tailregccpic.ll) to make sure it.
What's more, tailcall has limited argument number for tail callee, =1 in pic mode, it has already consider the register allocation problem.

[xiangzhangllvm]

ping
@LuoYuanke I see you give the most comments, could you +1 for this patch. tks

[LuoYuanke]

Thank you! Pls wait for 1 or 2 days to see if any other reviews have any comments.

[xiangzhangllvm]

In D91020#2425403, @LuoYuanke wrote:

Thank you! Pls wait for 1 or 2 days to see if any other reviews have any comments.

NO problem, thank you a lot!

llvm/lib/Target/X86/X86ISelLowering.cpp

if (VA.needsCustom()) {
                                              dl, DAG, VA, Flags, isByVal));
     }
   }
 
   if (!MemOpChains.empty())
     Chain = DAG.getNode(ISD::TokenFactor, dl, MVT::Other, MemOpChains);
 
   if (Subtarget.isPICStyleGOT()) {
     // ELF / PIC requires GOT in the EBX register before function calls via PLT
-    // GOT pointer.
+    // GOT pointer (except regcall).
     if (!isTailCall) {
+      // Indirect call with RegCall calling convertion may use up all the
+      // general registers, so it is not suitable to bind EBX reister for
+      // GOT address, just let register allocator handle it.
+      if (CallConv != CallingConv::X86_RegCall)
         RegsToPass.push_back(std::make_pair(
           Register(X86::EBX), DAG.getNode(X86ISD::GlobalBaseReg, SDLoc(),
                                           getPointerTy(DAG.getDataLayout()))));
     } else {
       // If we are tail calling and generating PIC/GOT style code load the
       // address of the callee into ECX. The value in ecx is used as target of
       // the tail jump. This is done to circumvent the ebx/callee-saved problem
       // for tail calls on PIC/GOT architectures. Normally we would just put the
       // address of GOT into ebx and then call target@PLT. But for tail calls
       // ebx would be restored (since ebx is callee saved) before jumping to the
       // target@PLT.
 
       // Note: The actual moving to ECX is done further down.
       GlobalAddressSDNode *G = dyn_cast<GlobalAddressSDNode>(Callee);
       if (G && !G->getGlobal()->hasLocalLinkage() &&
           G->getGlobal()->hasDefaultVisibility())
         Callee = LowerGlobalAddress(Callee, DAG);
       else if (isa<ExternalSymbolSDNode>(Callee))
         Callee = LowerExternalSymbol(Callee, DAG);
     }
   }

llvm/test/CodeGen/X86/tailregccpic.ll

+; RUN: llc < %s  -mtriple=i386-pc-unknown-linux-gnu -relocation-model=pic | FileCheck %s
+
+@a0 = global i32 0, align 4
+
+define x86_regcallcc void @tail_call_regcall(i32 %a) nounwind {
+  tail call x86_regcallcc void @__regcall3__func(i32 %a) nounwind
+  ret void
+}
+
+define internal x86_regcallcc void @__regcall3__func(i32 %i1) {
+entry:
+  store i32 %i1, i32* @a0, align 4
+  ret void
+}
+
+;CHECK-LABLE: tail_call_regcall:
+;CHECK:       # %bb.0:
+;CHECK-NEXT:  jmp     __regcall3__func                # TAILCALL
+;CHECK-NEXT:  .Lfunc_end0:
+
+;CHECK-LABLE: __regcall3__func:
+;CHECK:       addl    $_GLOBAL_OFFSET_TABLE_+({{.*}}), %ecx
+;CHECK-NEXT:  movl    a0@GOT(%ecx), %ecx
+;CHECK-NEXT:  movl    %eax, (%ecx)
+;CHECK-NEXT:  retl
+;CHECK-NEXT:  .Lfunc_end1:

llvm/test/CodeGen/X86/x86-regcall-got.ll

+; RUN: llc -O0 -mtriple=i386-unknown-linux-gnu -relocation-model=pic < %s | FileCheck %s
+
+; Unbind the ebx with GOT address in regcall calling convention, or the following
+; case will failed in register allocation by no register can be used.
+
+;#define REGCALL __attribute__((regcall))
+;int REGCALL func (int i1, int i2, int i3, int i4, int i5);
+;int (REGCALL *fptr) (int, int, int, int, int) = func;
+;int test() {
+;    return fptr(1,2,3,4,5);
+;}
+
+@fptr = global i32 (i32, i32, i32, i32, i32)* @__regcall3__func, align 4
+
+declare x86_regcallcc i32 @__regcall3__func(i32 inreg, i32 inreg, i32 inreg, i32 inreg, i32 inreg)
+
+; Function Attrs: noinline nounwind optnone
+define i32 @test() {
+; CHECK-LABEL: test:
+; CHECK:       .L0$pb:
+; CHECK-NEXT:    popl %eax
+; CHECK:       .Ltmp0:
+; CHECK-NEXT:    addl    $_GLOBAL_OFFSET_TABLE_+(.Ltmp0-.L0$pb), %eax
+; CHECK-NEXT:    movl    fptr@GOT(%eax), %eax
+; CHECK-NEXT:    movl    (%eax), %ebx
+; CHECK-NEXT:    movl    $1, %eax
+; CHECK-NEXT:    movl    $2, %ecx
+; CHECK-NEXT:    movl    $3, %edx
+; CHECK-NEXT:    movl    $4, %edi
+; CHECK-NEXT:    movl    $5, %esi
+; CHECK-NEXT:    calll   *%ebx
+
+entry:
+  %0 = load i32 (i32, i32, i32, i32, i32)*, i32 (i32, i32, i32, i32, i32)** @fptr, align 4
+  %call = call x86_regcallcc i32 %0(i32 inreg 1, i32 inreg 2, i32 inreg 3, i32 inreg 4, i32 inreg 5)
+  ret i32 %call
+}