root / tcg / README @ 95d65800
History | View | Annotate | Download (14.9 kB)
1 | c896fe29 | bellard | Tiny Code Generator - Fabrice Bellard. |
---|---|---|---|
2 | c896fe29 | bellard | |
3 | c896fe29 | bellard | 1) Introduction |
4 | c896fe29 | bellard | |
5 | c896fe29 | bellard | TCG (Tiny Code Generator) began as a generic backend for a C |
6 | c896fe29 | bellard | compiler. It was simplified to be used in QEMU. It also has its roots |
7 | c896fe29 | bellard | in the QOP code generator written by Paul Brook. |
8 | c896fe29 | bellard | |
9 | c896fe29 | bellard | 2) Definitions |
10 | c896fe29 | bellard | |
11 | c896fe29 | bellard | The TCG "target" is the architecture for which we generate the |
12 | c896fe29 | bellard | code. It is of course not the same as the "target" of QEMU which is |
13 | c896fe29 | bellard | the emulated architecture. As TCG started as a generic C backend used |
14 | c896fe29 | bellard | for cross compiling, it is assumed that the TCG target is different |
15 | c896fe29 | bellard | from the host, although it is never the case for QEMU. |
16 | c896fe29 | bellard | |
17 | c896fe29 | bellard | A TCG "function" corresponds to a QEMU Translated Block (TB). |
18 | c896fe29 | bellard | |
19 | 0a6b7b78 | bellard | A TCG "temporary" is a variable only live in a basic |
20 | 0a6b7b78 | bellard | block. Temporaries are allocated explicitly in each function. |
21 | c896fe29 | bellard | |
22 | 0a6b7b78 | bellard | A TCG "local temporary" is a variable only live in a function. Local |
23 | 0a6b7b78 | bellard | temporaries are allocated explicitly in each function. |
24 | 0a6b7b78 | bellard | |
25 | 0a6b7b78 | bellard | A TCG "global" is a variable which is live in all the functions |
26 | 0a6b7b78 | bellard | (equivalent of a C global variable). They are defined before the |
27 | 0a6b7b78 | bellard | functions defined. A TCG global can be a memory location (e.g. a QEMU |
28 | 0a6b7b78 | bellard | CPU register), a fixed host register (e.g. the QEMU CPU state pointer) |
29 | 0a6b7b78 | bellard | or a memory location which is stored in a register outside QEMU TBs |
30 | 0a6b7b78 | bellard | (not implemented yet). |
31 | c896fe29 | bellard | |
32 | c896fe29 | bellard | A TCG "basic block" corresponds to a list of instructions terminated |
33 | c896fe29 | bellard | by a branch instruction. |
34 | c896fe29 | bellard | |
35 | c896fe29 | bellard | 3) Intermediate representation |
36 | c896fe29 | bellard | |
37 | c896fe29 | bellard | 3.1) Introduction |
38 | c896fe29 | bellard | |
39 | 0a6b7b78 | bellard | TCG instructions operate on variables which are temporaries, local |
40 | 0a6b7b78 | bellard | temporaries or globals. TCG instructions and variables are strongly |
41 | 0a6b7b78 | bellard | typed. Two types are supported: 32 bit integers and 64 bit |
42 | 0a6b7b78 | bellard | integers. Pointers are defined as an alias to 32 bit or 64 bit |
43 | 0a6b7b78 | bellard | integers depending on the TCG target word size. |
44 | c896fe29 | bellard | |
45 | c896fe29 | bellard | Each instruction has a fixed number of output variable operands, input |
46 | c896fe29 | bellard | variable operands and always constant operands. |
47 | c896fe29 | bellard | |
48 | c896fe29 | bellard | The notable exception is the call instruction which has a variable |
49 | c896fe29 | bellard | number of outputs and inputs. |
50 | c896fe29 | bellard | |
51 | 0a6b7b78 | bellard | In the textual form, output operands usually come first, followed by |
52 | 0a6b7b78 | bellard | input operands, followed by constant operands. The output type is |
53 | 0a6b7b78 | bellard | included in the instruction name. Constants are prefixed with a '$'. |
54 | c896fe29 | bellard | |
55 | c896fe29 | bellard | add_i32 t0, t1, t2 (t0 <- t1 + t2) |
56 | c896fe29 | bellard | |
57 | c896fe29 | bellard | 3.2) Assumptions |
58 | c896fe29 | bellard | |
59 | c896fe29 | bellard | * Basic blocks |
60 | c896fe29 | bellard | |
61 | c896fe29 | bellard | - Basic blocks end after branches (e.g. brcond_i32 instruction), |
62 | c896fe29 | bellard | goto_tb and exit_tb instructions. |
63 | 86e840ee | aurel32 | - Basic blocks start after the end of a previous basic block, or at a |
64 | 86e840ee | aurel32 | set_label instruction. |
65 | c896fe29 | bellard | |
66 | 0a6b7b78 | bellard | After the end of a basic block, the content of temporaries is |
67 | 0a6b7b78 | bellard | destroyed, but local temporaries and globals are preserved. |
68 | c896fe29 | bellard | |
69 | c896fe29 | bellard | * Floating point types are not supported yet |
70 | c896fe29 | bellard | |
71 | c896fe29 | bellard | * Pointers: depending on the TCG target, pointer size is 32 bit or 64 |
72 | c896fe29 | bellard | bit. The type TCG_TYPE_PTR is an alias to TCG_TYPE_I32 or |
73 | c896fe29 | bellard | TCG_TYPE_I64. |
74 | c896fe29 | bellard | |
75 | c896fe29 | bellard | * Helpers: |
76 | c896fe29 | bellard | |
77 | c896fe29 | bellard | Using the tcg_gen_helper_x_y it is possible to call any function |
78 | aa95e3a5 | Stefan Weil | taking i32, i64 or pointer types. By default, before calling a helper, |
79 | a3f5054b | Aurelien Jarno | all globals are stored at their canonical location and it is assumed |
80 | aa95e3a5 | Stefan Weil | that the function can modify them. This can be overridden by the |
81 | a3f5054b | Aurelien Jarno | TCG_CALL_CONST function modifier. By default, the helper is allowed to |
82 | aa95e3a5 | Stefan Weil | modify the CPU state or raise an exception. This can be overridden by |
83 | a3f5054b | Aurelien Jarno | the TCG_CALL_PURE function modifier, in which case the call to the |
84 | a3f5054b | Aurelien Jarno | function is removed if the return value is not used. |
85 | c896fe29 | bellard | |
86 | c896fe29 | bellard | On some TCG targets (e.g. x86), several calling conventions are |
87 | c896fe29 | bellard | supported. |
88 | c896fe29 | bellard | |
89 | c896fe29 | bellard | * Branches: |
90 | c896fe29 | bellard | |
91 | c896fe29 | bellard | Use the instruction 'br' to jump to a label. Use 'jmp' to jump to an |
92 | c896fe29 | bellard | explicit address. Conditional branches can only jump to labels. |
93 | c896fe29 | bellard | |
94 | c896fe29 | bellard | 3.3) Code Optimizations |
95 | c896fe29 | bellard | |
96 | c896fe29 | bellard | When generating instructions, you can count on at least the following |
97 | c896fe29 | bellard | optimizations: |
98 | c896fe29 | bellard | |
99 | c896fe29 | bellard | - Single instructions are simplified, e.g. |
100 | c896fe29 | bellard | |
101 | c896fe29 | bellard | and_i32 t0, t0, $0xffffffff |
102 | c896fe29 | bellard | |
103 | c896fe29 | bellard | is suppressed. |
104 | c896fe29 | bellard | |
105 | c896fe29 | bellard | - A liveness analysis is done at the basic block level. The |
106 | 0a6b7b78 | bellard | information is used to suppress moves from a dead variable to |
107 | c896fe29 | bellard | another one. It is also used to remove instructions which compute |
108 | c896fe29 | bellard | dead results. The later is especially useful for condition code |
109 | 9804c8e2 | bellard | optimization in QEMU. |
110 | c896fe29 | bellard | |
111 | c896fe29 | bellard | In the following example: |
112 | c896fe29 | bellard | |
113 | c896fe29 | bellard | add_i32 t0, t1, t2 |
114 | c896fe29 | bellard | add_i32 t0, t0, $1 |
115 | c896fe29 | bellard | mov_i32 t0, $1 |
116 | c896fe29 | bellard | |
117 | c896fe29 | bellard | only the last instruction is kept. |
118 | c896fe29 | bellard | |
119 | c896fe29 | bellard | 3.4) Instruction Reference |
120 | c896fe29 | bellard | |
121 | c896fe29 | bellard | ********* Function call |
122 | c896fe29 | bellard | |
123 | c896fe29 | bellard | * call <ret> <params> ptr |
124 | c896fe29 | bellard | |
125 | c896fe29 | bellard | call function 'ptr' (pointer type) |
126 | c896fe29 | bellard | |
127 | c896fe29 | bellard | <ret> optional 32 bit or 64 bit return value |
128 | c896fe29 | bellard | <params> optional 32 bit or 64 bit parameters |
129 | c896fe29 | bellard | |
130 | c896fe29 | bellard | ********* Jumps/Labels |
131 | c896fe29 | bellard | |
132 | c896fe29 | bellard | * jmp t0 |
133 | c896fe29 | bellard | |
134 | c896fe29 | bellard | Absolute jump to address t0 (pointer type). |
135 | c896fe29 | bellard | |
136 | c896fe29 | bellard | * set_label $label |
137 | c896fe29 | bellard | |
138 | c896fe29 | bellard | Define label 'label' at the current program point. |
139 | c896fe29 | bellard | |
140 | c896fe29 | bellard | * br $label |
141 | c896fe29 | bellard | |
142 | c896fe29 | bellard | Jump to label. |
143 | c896fe29 | bellard | |
144 | c896fe29 | bellard | * brcond_i32/i64 cond, t0, t1, label |
145 | c896fe29 | bellard | |
146 | c896fe29 | bellard | Conditional jump if t0 cond t1 is true. cond can be: |
147 | c896fe29 | bellard | TCG_COND_EQ |
148 | c896fe29 | bellard | TCG_COND_NE |
149 | c896fe29 | bellard | TCG_COND_LT /* signed */ |
150 | c896fe29 | bellard | TCG_COND_GE /* signed */ |
151 | c896fe29 | bellard | TCG_COND_LE /* signed */ |
152 | c896fe29 | bellard | TCG_COND_GT /* signed */ |
153 | c896fe29 | bellard | TCG_COND_LTU /* unsigned */ |
154 | c896fe29 | bellard | TCG_COND_GEU /* unsigned */ |
155 | c896fe29 | bellard | TCG_COND_LEU /* unsigned */ |
156 | c896fe29 | bellard | TCG_COND_GTU /* unsigned */ |
157 | c896fe29 | bellard | |
158 | c896fe29 | bellard | ********* Arithmetic |
159 | c896fe29 | bellard | |
160 | c896fe29 | bellard | * add_i32/i64 t0, t1, t2 |
161 | c896fe29 | bellard | |
162 | c896fe29 | bellard | t0=t1+t2 |
163 | c896fe29 | bellard | |
164 | c896fe29 | bellard | * sub_i32/i64 t0, t1, t2 |
165 | c896fe29 | bellard | |
166 | c896fe29 | bellard | t0=t1-t2 |
167 | c896fe29 | bellard | |
168 | 390efc54 | pbrook | * neg_i32/i64 t0, t1 |
169 | 390efc54 | pbrook | |
170 | 390efc54 | pbrook | t0=-t1 (two's complement) |
171 | 390efc54 | pbrook | |
172 | c896fe29 | bellard | * mul_i32/i64 t0, t1, t2 |
173 | c896fe29 | bellard | |
174 | c896fe29 | bellard | t0=t1*t2 |
175 | c896fe29 | bellard | |
176 | c896fe29 | bellard | * div_i32/i64 t0, t1, t2 |
177 | c896fe29 | bellard | |
178 | c896fe29 | bellard | t0=t1/t2 (signed). Undefined behavior if division by zero or overflow. |
179 | c896fe29 | bellard | |
180 | c896fe29 | bellard | * divu_i32/i64 t0, t1, t2 |
181 | c896fe29 | bellard | |
182 | c896fe29 | bellard | t0=t1/t2 (unsigned). Undefined behavior if division by zero. |
183 | c896fe29 | bellard | |
184 | c896fe29 | bellard | * rem_i32/i64 t0, t1, t2 |
185 | c896fe29 | bellard | |
186 | c896fe29 | bellard | t0=t1%t2 (signed). Undefined behavior if division by zero or overflow. |
187 | c896fe29 | bellard | |
188 | c896fe29 | bellard | * remu_i32/i64 t0, t1, t2 |
189 | c896fe29 | bellard | |
190 | c896fe29 | bellard | t0=t1%t2 (unsigned). Undefined behavior if division by zero. |
191 | c896fe29 | bellard | |
192 | c896fe29 | bellard | ********* Logical |
193 | c896fe29 | bellard | |
194 | 5e85404a | aurel32 | * and_i32/i64 t0, t1, t2 |
195 | 5e85404a | aurel32 | |
196 | c896fe29 | bellard | t0=t1&t2 |
197 | c896fe29 | bellard | |
198 | c896fe29 | bellard | * or_i32/i64 t0, t1, t2 |
199 | c896fe29 | bellard | |
200 | c896fe29 | bellard | t0=t1|t2 |
201 | c896fe29 | bellard | |
202 | c896fe29 | bellard | * xor_i32/i64 t0, t1, t2 |
203 | c896fe29 | bellard | |
204 | c896fe29 | bellard | t0=t1^t2 |
205 | c896fe29 | bellard | |
206 | 0a6b7b78 | bellard | * not_i32/i64 t0, t1 |
207 | 0a6b7b78 | bellard | |
208 | 0a6b7b78 | bellard | t0=~t1 |
209 | 0a6b7b78 | bellard | |
210 | f24cb33e | aurel32 | * andc_i32/i64 t0, t1, t2 |
211 | f24cb33e | aurel32 | |
212 | f24cb33e | aurel32 | t0=t1&~t2 |
213 | f24cb33e | aurel32 | |
214 | f24cb33e | aurel32 | * eqv_i32/i64 t0, t1, t2 |
215 | f24cb33e | aurel32 | |
216 | 8d625cf1 | Richard Henderson | t0=~(t1^t2), or equivalently, t0=t1^~t2 |
217 | f24cb33e | aurel32 | |
218 | f24cb33e | aurel32 | * nand_i32/i64 t0, t1, t2 |
219 | f24cb33e | aurel32 | |
220 | f24cb33e | aurel32 | t0=~(t1&t2) |
221 | f24cb33e | aurel32 | |
222 | f24cb33e | aurel32 | * nor_i32/i64 t0, t1, t2 |
223 | f24cb33e | aurel32 | |
224 | f24cb33e | aurel32 | t0=~(t1|t2) |
225 | f24cb33e | aurel32 | |
226 | f24cb33e | aurel32 | * orc_i32/i64 t0, t1, t2 |
227 | f24cb33e | aurel32 | |
228 | f24cb33e | aurel32 | t0=t1|~t2 |
229 | f24cb33e | aurel32 | |
230 | 15824571 | aurel32 | ********* Shifts/Rotates |
231 | c896fe29 | bellard | |
232 | c896fe29 | bellard | * shl_i32/i64 t0, t1, t2 |
233 | c896fe29 | bellard | |
234 | c896fe29 | bellard | t0=t1 << t2. Undefined behavior if t2 < 0 or t2 >= 32 (resp 64) |
235 | c896fe29 | bellard | |
236 | c896fe29 | bellard | * shr_i32/i64 t0, t1, t2 |
237 | c896fe29 | bellard | |
238 | c896fe29 | bellard | t0=t1 >> t2 (unsigned). Undefined behavior if t2 < 0 or t2 >= 32 (resp 64) |
239 | c896fe29 | bellard | |
240 | c896fe29 | bellard | * sar_i32/i64 t0, t1, t2 |
241 | c896fe29 | bellard | |
242 | c896fe29 | bellard | t0=t1 >> t2 (signed). Undefined behavior if t2 < 0 or t2 >= 32 (resp 64) |
243 | c896fe29 | bellard | |
244 | 15824571 | aurel32 | * rotl_i32/i64 t0, t1, t2 |
245 | 15824571 | aurel32 | |
246 | 15824571 | aurel32 | Rotation of t2 bits to the left. Undefined behavior if t2 < 0 or t2 >= 32 (resp 64) |
247 | 15824571 | aurel32 | |
248 | 15824571 | aurel32 | * rotr_i32/i64 t0, t1, t2 |
249 | 15824571 | aurel32 | |
250 | 15824571 | aurel32 | Rotation of t2 bits to the right. Undefined behavior if t2 < 0 or t2 >= 32 (resp 64) |
251 | 15824571 | aurel32 | |
252 | c896fe29 | bellard | ********* Misc |
253 | c896fe29 | bellard | |
254 | c896fe29 | bellard | * mov_i32/i64 t0, t1 |
255 | c896fe29 | bellard | |
256 | c896fe29 | bellard | t0 = t1 |
257 | c896fe29 | bellard | |
258 | c896fe29 | bellard | Move t1 to t0 (both operands must have the same type). |
259 | c896fe29 | bellard | |
260 | c896fe29 | bellard | * ext8s_i32/i64 t0, t1 |
261 | 86831435 | pbrook | ext8u_i32/i64 t0, t1 |
262 | c896fe29 | bellard | ext16s_i32/i64 t0, t1 |
263 | 86831435 | pbrook | ext16u_i32/i64 t0, t1 |
264 | c896fe29 | bellard | ext32s_i64 t0, t1 |
265 | 86831435 | pbrook | ext32u_i64 t0, t1 |
266 | c896fe29 | bellard | |
267 | 86831435 | pbrook | 8, 16 or 32 bit sign/zero extension (both operands must have the same type) |
268 | c896fe29 | bellard | |
269 | 4ad4ce16 | aurel32 | * bswap16_i32/i64 t0, t1 |
270 | c896fe29 | bellard | |
271 | 837d987b | Aurelien Jarno | 16 bit byte swap on a 32/64 bit value. It assumes that the two/six high order |
272 | 837d987b | Aurelien Jarno | bytes are set to zero. |
273 | c896fe29 | bellard | |
274 | 4ad4ce16 | aurel32 | * bswap32_i32/i64 t0, t1 |
275 | c896fe29 | bellard | |
276 | 837d987b | Aurelien Jarno | 32 bit byte swap on a 32/64 bit value. With a 64 bit value, it assumes that |
277 | 837d987b | Aurelien Jarno | the four high order bytes are set to zero. |
278 | c896fe29 | bellard | |
279 | 4ad4ce16 | aurel32 | * bswap64_i64 t0, t1 |
280 | c896fe29 | bellard | |
281 | c896fe29 | bellard | 64 bit byte swap |
282 | c896fe29 | bellard | |
283 | 5ff9d6a4 | bellard | * discard_i32/i64 t0 |
284 | 5ff9d6a4 | bellard | |
285 | 5ff9d6a4 | bellard | Indicate that the value of t0 won't be used later. It is useful to |
286 | 5ff9d6a4 | bellard | force dead code elimination. |
287 | 5ff9d6a4 | bellard | |
288 | 3a34dfd7 | Edgar E. Iglesias | * deposit_i32/i64 dest, t1, t2, pos, len |
289 | b7767f0f | Richard Henderson | |
290 | b7767f0f | Richard Henderson | Deposit T2 as a bitfield into T1, placing the result in DEST. |
291 | 3a34dfd7 | Edgar E. Iglesias | The bitfield is described by POS/LEN, which are immediate values: |
292 | b7767f0f | Richard Henderson | |
293 | b7767f0f | Richard Henderson | LEN - the length of the bitfield |
294 | b7767f0f | Richard Henderson | POS - the position of the first bit, counting from the LSB |
295 | b7767f0f | Richard Henderson | |
296 | b7767f0f | Richard Henderson | For example, pos=8, len=4 indicates a 4-bit field at bit 8. |
297 | b7767f0f | Richard Henderson | This operation would be equivalent to |
298 | b7767f0f | Richard Henderson | |
299 | b7767f0f | Richard Henderson | dest = (t1 & ~0x0f00) | ((t2 << 8) & 0x0f00) |
300 | b7767f0f | Richard Henderson | |
301 | b7767f0f | Richard Henderson | |
302 | be210acb | Richard Henderson | ********* Conditional moves |
303 | be210acb | Richard Henderson | |
304 | be210acb | Richard Henderson | * setcond_i32/i64 cond, dest, t1, t2 |
305 | be210acb | Richard Henderson | |
306 | be210acb | Richard Henderson | dest = (t1 cond t2) |
307 | be210acb | Richard Henderson | |
308 | be210acb | Richard Henderson | Set DEST to 1 if (T1 cond T2) is true, otherwise set to 0. |
309 | be210acb | Richard Henderson | |
310 | c896fe29 | bellard | ********* Type conversions |
311 | c896fe29 | bellard | |
312 | c896fe29 | bellard | * ext_i32_i64 t0, t1 |
313 | c896fe29 | bellard | Convert t1 (32 bit) to t0 (64 bit) and does sign extension |
314 | c896fe29 | bellard | |
315 | c896fe29 | bellard | * extu_i32_i64 t0, t1 |
316 | c896fe29 | bellard | Convert t1 (32 bit) to t0 (64 bit) and does zero extension |
317 | c896fe29 | bellard | |
318 | c896fe29 | bellard | * trunc_i64_i32 t0, t1 |
319 | c896fe29 | bellard | Truncate t1 (64 bit) to t0 (32 bit) |
320 | c896fe29 | bellard | |
321 | 36aa55dc | pbrook | * concat_i32_i64 t0, t1, t2 |
322 | 36aa55dc | pbrook | Construct t0 (64-bit) taking the low half from t1 (32 bit) and the high half |
323 | 36aa55dc | pbrook | from t2 (32 bit). |
324 | 36aa55dc | pbrook | |
325 | 945ca823 | blueswir1 | * concat32_i64 t0, t1, t2 |
326 | 945ca823 | blueswir1 | Construct t0 (64-bit) taking the low half from t1 (64 bit) and the high half |
327 | 945ca823 | blueswir1 | from t2 (64 bit). |
328 | 945ca823 | blueswir1 | |
329 | c896fe29 | bellard | ********* Load/Store |
330 | c896fe29 | bellard | |
331 | c896fe29 | bellard | * ld_i32/i64 t0, t1, offset |
332 | c896fe29 | bellard | ld8s_i32/i64 t0, t1, offset |
333 | c896fe29 | bellard | ld8u_i32/i64 t0, t1, offset |
334 | c896fe29 | bellard | ld16s_i32/i64 t0, t1, offset |
335 | c896fe29 | bellard | ld16u_i32/i64 t0, t1, offset |
336 | c896fe29 | bellard | ld32s_i64 t0, t1, offset |
337 | c896fe29 | bellard | ld32u_i64 t0, t1, offset |
338 | c896fe29 | bellard | |
339 | c896fe29 | bellard | t0 = read(t1 + offset) |
340 | c896fe29 | bellard | Load 8, 16, 32 or 64 bits with or without sign extension from host memory. |
341 | c896fe29 | bellard | offset must be a constant. |
342 | c896fe29 | bellard | |
343 | c896fe29 | bellard | * st_i32/i64 t0, t1, offset |
344 | c896fe29 | bellard | st8_i32/i64 t0, t1, offset |
345 | c896fe29 | bellard | st16_i32/i64 t0, t1, offset |
346 | c896fe29 | bellard | st32_i64 t0, t1, offset |
347 | c896fe29 | bellard | |
348 | c896fe29 | bellard | write(t0, t1 + offset) |
349 | c896fe29 | bellard | Write 8, 16, 32 or 64 bits to host memory. |
350 | c896fe29 | bellard | |
351 | a38e609c | Richard Henderson | ********* 64-bit target on 32-bit host support |
352 | a38e609c | Richard Henderson | |
353 | a38e609c | Richard Henderson | The following opcodes are internal to TCG. Thus they are to be implemented by |
354 | a38e609c | Richard Henderson | 32-bit host code generators, but are not to be emitted by guest translators. |
355 | a38e609c | Richard Henderson | They are emitted as needed by inline functions within "tcg-op.h". |
356 | a38e609c | Richard Henderson | |
357 | a38e609c | Richard Henderson | * brcond2_i32 cond, t0_low, t0_high, t1_low, t1_high, label |
358 | a38e609c | Richard Henderson | |
359 | a38e609c | Richard Henderson | Similar to brcond, except that the 64-bit values T0 and T1 |
360 | a38e609c | Richard Henderson | are formed from two 32-bit arguments. |
361 | a38e609c | Richard Henderson | |
362 | a38e609c | Richard Henderson | * add2_i32 t0_low, t0_high, t1_low, t1_high, t2_low, t2_high |
363 | a38e609c | Richard Henderson | * sub2_i32 t0_low, t0_high, t1_low, t1_high, t2_low, t2_high |
364 | a38e609c | Richard Henderson | |
365 | a38e609c | Richard Henderson | Similar to add/sub, except that the 64-bit inputs T1 and T2 are |
366 | a38e609c | Richard Henderson | formed from two 32-bit arguments, and the 64-bit output T0 |
367 | a38e609c | Richard Henderson | is returned in two 32-bit outputs. |
368 | a38e609c | Richard Henderson | |
369 | a38e609c | Richard Henderson | * mulu2_i32 t0_low, t0_high, t1, t2 |
370 | a38e609c | Richard Henderson | |
371 | a38e609c | Richard Henderson | Similar to mul, except two 32-bit (unsigned) inputs T1 and T2 yielding |
372 | a38e609c | Richard Henderson | the full 64-bit product T0. The later is returned in two 32-bit outputs. |
373 | a38e609c | Richard Henderson | |
374 | be210acb | Richard Henderson | * setcond2_i32 cond, dest, t1_low, t1_high, t2_low, t2_high |
375 | be210acb | Richard Henderson | |
376 | be210acb | Richard Henderson | Similar to setcond, except that the 64-bit values T1 and T2 are |
377 | be210acb | Richard Henderson | formed from two 32-bit arguments. The result is a 32-bit value. |
378 | be210acb | Richard Henderson | |
379 | c896fe29 | bellard | ********* QEMU specific operations |
380 | c896fe29 | bellard | |
381 | 759c90ba | Mike Frysinger | * exit_tb t0 |
382 | c896fe29 | bellard | |
383 | c896fe29 | bellard | Exit the current TB and return the value t0 (word type). |
384 | c896fe29 | bellard | |
385 | c896fe29 | bellard | * goto_tb index |
386 | c896fe29 | bellard | |
387 | c896fe29 | bellard | Exit the current TB and jump to the TB index 'index' (constant) if the |
388 | c896fe29 | bellard | current TB was linked to this TB. Otherwise execute the next |
389 | c896fe29 | bellard | instructions. |
390 | c896fe29 | bellard | |
391 | f53bca18 | aurel32 | * qemu_ld8u t0, t1, flags |
392 | f53bca18 | aurel32 | qemu_ld8s t0, t1, flags |
393 | f53bca18 | aurel32 | qemu_ld16u t0, t1, flags |
394 | f53bca18 | aurel32 | qemu_ld16s t0, t1, flags |
395 | 86feb1c8 | Richard Henderson | qemu_ld32 t0, t1, flags |
396 | f53bca18 | aurel32 | qemu_ld32u t0, t1, flags |
397 | f53bca18 | aurel32 | qemu_ld32s t0, t1, flags |
398 | f53bca18 | aurel32 | qemu_ld64 t0, t1, flags |
399 | c896fe29 | bellard | |
400 | 86feb1c8 | Richard Henderson | Load data at the QEMU CPU address t1 into t0. t1 has the QEMU CPU address |
401 | 86feb1c8 | Richard Henderson | type. 'flags' contains the QEMU memory index (selects user or kernel access) |
402 | 86feb1c8 | Richard Henderson | for example. |
403 | 86feb1c8 | Richard Henderson | |
404 | 86feb1c8 | Richard Henderson | Note that "qemu_ld32" implies a 32-bit result, while "qemu_ld32u" and |
405 | 86feb1c8 | Richard Henderson | "qemu_ld32s" imply a 64-bit result appropriately extended from 32 bits. |
406 | c896fe29 | bellard | |
407 | f53bca18 | aurel32 | * qemu_st8 t0, t1, flags |
408 | f53bca18 | aurel32 | qemu_st16 t0, t1, flags |
409 | f53bca18 | aurel32 | qemu_st32 t0, t1, flags |
410 | f53bca18 | aurel32 | qemu_st64 t0, t1, flags |
411 | c896fe29 | bellard | |
412 | c896fe29 | bellard | Store the data t0 at the QEMU CPU Address t1. t1 has the QEMU CPU |
413 | c896fe29 | bellard | address type. 'flags' contains the QEMU memory index (selects user or |
414 | c896fe29 | bellard | kernel access) for example. |
415 | c896fe29 | bellard | |
416 | c896fe29 | bellard | Note 1: Some shortcuts are defined when the last operand is known to be |
417 | c896fe29 | bellard | a constant (e.g. addi for add, movi for mov). |
418 | c896fe29 | bellard | |
419 | c896fe29 | bellard | Note 2: When using TCG, the opcodes must never be generated directly |
420 | c896fe29 | bellard | as some of them may not be available as "real" opcodes. Always use the |
421 | c896fe29 | bellard | function tcg_gen_xxx(args). |
422 | c896fe29 | bellard | |
423 | c896fe29 | bellard | 4) Backend |
424 | c896fe29 | bellard | |
425 | c896fe29 | bellard | tcg-target.h contains the target specific definitions. tcg-target.c |
426 | c896fe29 | bellard | contains the target specific code. |
427 | c896fe29 | bellard | |
428 | c896fe29 | bellard | 4.1) Assumptions |
429 | c896fe29 | bellard | |
430 | c896fe29 | bellard | The target word size (TCG_TARGET_REG_BITS) is expected to be 32 bit or |
431 | c896fe29 | bellard | 64 bit. It is expected that the pointer has the same size as the word. |
432 | c896fe29 | bellard | |
433 | c896fe29 | bellard | On a 32 bit target, all 64 bit operations are converted to 32 bits. A |
434 | c896fe29 | bellard | few specific operations must be implemented to allow it (see add2_i32, |
435 | c896fe29 | bellard | sub2_i32, brcond2_i32). |
436 | c896fe29 | bellard | |
437 | c896fe29 | bellard | Floating point operations are not supported in this version. A |
438 | c896fe29 | bellard | previous incarnation of the code generator had full support of them, |
439 | c896fe29 | bellard | but it is better to concentrate on integer operations first. |
440 | c896fe29 | bellard | |
441 | c896fe29 | bellard | On a 64 bit target, no assumption is made in TCG about the storage of |
442 | c896fe29 | bellard | the 32 bit values in 64 bit registers. |
443 | c896fe29 | bellard | |
444 | c896fe29 | bellard | 4.2) Constraints |
445 | c896fe29 | bellard | |
446 | c896fe29 | bellard | GCC like constraints are used to define the constraints of every |
447 | c896fe29 | bellard | instruction. Memory constraints are not supported in this |
448 | c896fe29 | bellard | version. Aliases are specified in the input operands as for GCC. |
449 | c896fe29 | bellard | |
450 | 0c5f3c8d | pbrook | The same register may be used for both an input and an output, even when |
451 | 0c5f3c8d | pbrook | they are not explicitly aliased. If an op expands to multiple target |
452 | 0c5f3c8d | pbrook | instructions then care must be taken to avoid clobbering input values. |
453 | 0c5f3c8d | pbrook | GCC style "early clobber" outputs are not currently supported. |
454 | 0c5f3c8d | pbrook | |
455 | c896fe29 | bellard | A target can define specific register or constant constraints. If an |
456 | c896fe29 | bellard | operation uses a constant input constraint which does not allow all |
457 | c896fe29 | bellard | constants, it must also accept registers in order to have a fallback. |
458 | c896fe29 | bellard | |
459 | c896fe29 | bellard | The movi_i32 and movi_i64 operations must accept any constants. |
460 | c896fe29 | bellard | |
461 | c896fe29 | bellard | The mov_i32 and mov_i64 operations must accept any registers of the |
462 | c896fe29 | bellard | same type. |
463 | c896fe29 | bellard | |
464 | c896fe29 | bellard | The ld/st instructions must accept signed 32 bit constant offsets. It |
465 | c896fe29 | bellard | can be implemented by reserving a specific register to compute the |
466 | c896fe29 | bellard | address if the offset is too big. |
467 | c896fe29 | bellard | |
468 | c896fe29 | bellard | The ld/st instructions must accept any destination (ld) or source (st) |
469 | c896fe29 | bellard | register. |
470 | c896fe29 | bellard | |
471 | c896fe29 | bellard | 4.3) Function call assumptions |
472 | c896fe29 | bellard | |
473 | c896fe29 | bellard | - The only supported types for parameters and return value are: 32 and |
474 | c896fe29 | bellard | 64 bit integers and pointer. |
475 | c896fe29 | bellard | - The stack grows downwards. |
476 | c896fe29 | bellard | - The first N parameters are passed in registers. |
477 | c896fe29 | bellard | - The next parameters are passed on the stack by storing them as words. |
478 | c896fe29 | bellard | - Some registers are clobbered during the call. |
479 | c896fe29 | bellard | - The function can return 0 or 1 value in registers. On a 32 bit |
480 | c896fe29 | bellard | target, functions must be able to return 2 values in registers for |
481 | c896fe29 | bellard | 64 bit return type. |
482 | c896fe29 | bellard | |
483 | 86e840ee | aurel32 | 5) Recommended coding rules for best performance |
484 | 0a6b7b78 | bellard | |
485 | 0a6b7b78 | bellard | - Use globals to represent the parts of the QEMU CPU state which are |
486 | 0a6b7b78 | bellard | often modified, e.g. the integer registers and the condition |
487 | 0a6b7b78 | bellard | codes. TCG will be able to use host registers to store them. |
488 | 0a6b7b78 | bellard | |
489 | 0a6b7b78 | bellard | - Avoid globals stored in fixed registers. They must be used only to |
490 | 0a6b7b78 | bellard | store the pointer to the CPU state and possibly to store a pointer |
491 | 86e840ee | aurel32 | to a register window. |
492 | 0a6b7b78 | bellard | |
493 | 0a6b7b78 | bellard | - Use temporaries. Use local temporaries only when really needed, |
494 | 0a6b7b78 | bellard | e.g. when you need to use a value after a jump. Local temporaries |
495 | 0a6b7b78 | bellard | introduce a performance hit in the current TCG implementation: their |
496 | 0a6b7b78 | bellard | content is saved to memory at end of each basic block. |
497 | 0a6b7b78 | bellard | |
498 | 0a6b7b78 | bellard | - Free temporaries and local temporaries when they are no longer used |
499 | 0a6b7b78 | bellard | (tcg_temp_free). Since tcg_const_x() also creates a temporary, you |
500 | 0a6b7b78 | bellard | should free it after it is used. Freeing temporaries does not yield |
501 | 0a6b7b78 | bellard | a better generated code, but it reduces the memory usage of TCG and |
502 | 0a6b7b78 | bellard | the speed of the translation. |
503 | 0a6b7b78 | bellard | |
504 | 0a6b7b78 | bellard | - Don't hesitate to use helpers for complicated or seldom used target |
505 | aa95e3a5 | Stefan Weil | instructions. There is little performance advantage in using TCG to |
506 | 0a6b7b78 | bellard | implement target instructions taking more than about twenty TCG |
507 | 107a47cc | Peter Maydell | instructions. Note that this rule of thumb is more applicable to |
508 | 107a47cc | Peter Maydell | helpers doing complex logic or arithmetic, where the C compiler has |
509 | 107a47cc | Peter Maydell | scope to do a good job of optimisation; it is less relevant where |
510 | 107a47cc | Peter Maydell | the instruction is mostly doing loads and stores, and in those cases |
511 | 107a47cc | Peter Maydell | inline TCG may still be faster for longer sequences. |
512 | 107a47cc | Peter Maydell | |
513 | 107a47cc | Peter Maydell | - The hard limit on the number of TCG instructions you can generate |
514 | 107a47cc | Peter Maydell | per target instruction is set by MAX_OP_PER_INSTR in exec-all.h -- |
515 | 107a47cc | Peter Maydell | you cannot exceed this without risking a buffer overrun. |
516 | 0a6b7b78 | bellard | |
517 | 0a6b7b78 | bellard | - Use the 'discard' instruction if you know that TCG won't be able to |
518 | 0a6b7b78 | bellard | prove that a given global is "dead" at a given program point. The |
519 | 0a6b7b78 | bellard | x86 target uses it to improve the condition codes optimisation. |