bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 1 | Tiny Code Generator - Fabrice Bellard. |
| 2 | |
| 3 | 1) Introduction |
| 4 | |
| 5 | TCG (Tiny Code Generator) began as a generic backend for a C |
| 6 | compiler. It was simplified to be used in QEMU. It also has its roots |
| 7 | in the QOP code generator written by Paul Brook. |
| 8 | |
| 9 | 2) Definitions |
| 10 | |
| 11 | The TCG "target" is the architecture for which we generate the |
| 12 | code. It is of course not the same as the "target" of QEMU which is |
| 13 | the emulated architecture. As TCG started as a generic C backend used |
| 14 | for cross compiling, it is assumed that the TCG target is different |
| 15 | from the host, although it is never the case for QEMU. |
| 16 | |
陳韋任 (Wei-Ren Chen) | 294e466 | 2013-03-20 11:42:08 +0800 | [diff] [blame] | 17 | In this document, we use "guest" to specify what architecture we are |
| 18 | emulating; "target" always means the TCG target, the machine on which |
| 19 | we are running QEMU. |
| 20 | |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 21 | A TCG "function" corresponds to a QEMU Translated Block (TB). |
| 22 | |
bellard | 0a6b7b7 | 2008-05-25 18:24:40 +0000 | [diff] [blame] | 23 | A TCG "temporary" is a variable only live in a basic |
| 24 | block. Temporaries are allocated explicitly in each function. |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 25 | |
bellard | 0a6b7b7 | 2008-05-25 18:24:40 +0000 | [diff] [blame] | 26 | A TCG "local temporary" is a variable only live in a function. Local |
| 27 | temporaries are allocated explicitly in each function. |
| 28 | |
| 29 | A TCG "global" is a variable which is live in all the functions |
| 30 | (equivalent of a C global variable). They are defined before the |
| 31 | functions defined. A TCG global can be a memory location (e.g. a QEMU |
| 32 | CPU register), a fixed host register (e.g. the QEMU CPU state pointer) |
| 33 | or a memory location which is stored in a register outside QEMU TBs |
| 34 | (not implemented yet). |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 35 | |
| 36 | A TCG "basic block" corresponds to a list of instructions terminated |
| 37 | by a branch instruction. |
| 38 | |
Richard Henderson | 20022fa | 2014-03-18 08:21:44 -0700 | [diff] [blame] | 39 | An operation with "undefined behavior" may result in a crash. |
| 40 | |
| 41 | An operation with "unspecified behavior" shall not crash. However, |
| 42 | the result may be one of several possibilities so may be considered |
| 43 | an "undefined result". |
| 44 | |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 45 | 3) Intermediate representation |
| 46 | |
| 47 | 3.1) Introduction |
| 48 | |
bellard | 0a6b7b7 | 2008-05-25 18:24:40 +0000 | [diff] [blame] | 49 | TCG instructions operate on variables which are temporaries, local |
| 50 | temporaries or globals. TCG instructions and variables are strongly |
| 51 | typed. Two types are supported: 32 bit integers and 64 bit |
| 52 | integers. Pointers are defined as an alias to 32 bit or 64 bit |
| 53 | integers depending on the TCG target word size. |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 54 | |
| 55 | Each instruction has a fixed number of output variable operands, input |
| 56 | variable operands and always constant operands. |
| 57 | |
| 58 | The notable exception is the call instruction which has a variable |
| 59 | number of outputs and inputs. |
| 60 | |
bellard | 0a6b7b7 | 2008-05-25 18:24:40 +0000 | [diff] [blame] | 61 | In the textual form, output operands usually come first, followed by |
| 62 | input operands, followed by constant operands. The output type is |
| 63 | included in the instruction name. Constants are prefixed with a '$'. |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 64 | |
| 65 | add_i32 t0, t1, t2 (t0 <- t1 + t2) |
| 66 | |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 67 | 3.2) Assumptions |
| 68 | |
| 69 | * Basic blocks |
| 70 | |
| 71 | - Basic blocks end after branches (e.g. brcond_i32 instruction), |
| 72 | goto_tb and exit_tb instructions. |
aurel32 | 86e840e | 2008-12-07 15:21:23 +0000 | [diff] [blame] | 73 | - Basic blocks start after the end of a previous basic block, or at a |
| 74 | set_label instruction. |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 75 | |
bellard | 0a6b7b7 | 2008-05-25 18:24:40 +0000 | [diff] [blame] | 76 | After the end of a basic block, the content of temporaries is |
| 77 | destroyed, but local temporaries and globals are preserved. |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 78 | |
| 79 | * Floating point types are not supported yet |
| 80 | |
| 81 | * Pointers: depending on the TCG target, pointer size is 32 bit or 64 |
| 82 | bit. The type TCG_TYPE_PTR is an alias to TCG_TYPE_I32 or |
| 83 | TCG_TYPE_I64. |
| 84 | |
| 85 | * Helpers: |
| 86 | |
| 87 | Using the tcg_gen_helper_x_y it is possible to call any function |
Stefan Weil | aa95e3a | 2011-01-07 21:34:50 +0100 | [diff] [blame] | 88 | taking i32, i64 or pointer types. By default, before calling a helper, |
Aurelien Jarno | a3f5054 | 2010-03-05 22:48:03 +0100 | [diff] [blame] | 89 | all globals are stored at their canonical location and it is assumed |
Aurelien Jarno | 7850527 | 2012-10-09 21:53:08 +0200 | [diff] [blame] | 90 | that the function can modify them. By default, the helper is allowed to |
| 91 | modify the CPU state or raise an exception. |
| 92 | |
| 93 | This can be overridden using the following function modifiers: |
| 94 | - TCG_CALL_NO_READ_GLOBALS means that the helper does not read globals, |
| 95 | either directly or via an exception. They will not be saved to their |
| 96 | canonical locations before calling the helper. |
| 97 | - TCG_CALL_NO_WRITE_GLOBALS means that the helper does not modify any globals. |
| 98 | They will only be saved to their canonical location before calling helpers, |
| 99 | but they won't be reloaded afterwise. |
| 100 | - TCG_CALL_NO_SIDE_EFFECTS means that the call to the function is removed if |
| 101 | the return value is not used. |
| 102 | |
| 103 | Note that TCG_CALL_NO_READ_GLOBALS implies TCG_CALL_NO_WRITE_GLOBALS. |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 104 | |
| 105 | On some TCG targets (e.g. x86), several calling conventions are |
| 106 | supported. |
| 107 | |
| 108 | * Branches: |
| 109 | |
Aurelien Jarno | 626cd05 | 2012-10-01 21:00:43 +0200 | [diff] [blame] | 110 | Use the instruction 'br' to jump to a label. |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 111 | |
| 112 | 3.3) Code Optimizations |
| 113 | |
| 114 | When generating instructions, you can count on at least the following |
| 115 | optimizations: |
| 116 | |
| 117 | - Single instructions are simplified, e.g. |
| 118 | |
| 119 | and_i32 t0, t0, $0xffffffff |
| 120 | |
| 121 | is suppressed. |
| 122 | |
| 123 | - A liveness analysis is done at the basic block level. The |
bellard | 0a6b7b7 | 2008-05-25 18:24:40 +0000 | [diff] [blame] | 124 | information is used to suppress moves from a dead variable to |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 125 | another one. It is also used to remove instructions which compute |
| 126 | dead results. The later is especially useful for condition code |
bellard | 9804c8e | 2008-02-01 13:01:47 +0000 | [diff] [blame] | 127 | optimization in QEMU. |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 128 | |
| 129 | In the following example: |
| 130 | |
| 131 | add_i32 t0, t1, t2 |
| 132 | add_i32 t0, t0, $1 |
| 133 | mov_i32 t0, $1 |
| 134 | |
| 135 | only the last instruction is kept. |
| 136 | |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 137 | 3.4) Instruction Reference |
| 138 | |
| 139 | ********* Function call |
| 140 | |
| 141 | * call <ret> <params> ptr |
| 142 | |
| 143 | call function 'ptr' (pointer type) |
| 144 | |
| 145 | <ret> optional 32 bit or 64 bit return value |
| 146 | <params> optional 32 bit or 64 bit parameters |
| 147 | |
| 148 | ********* Jumps/Labels |
| 149 | |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 150 | * set_label $label |
| 151 | |
| 152 | Define label 'label' at the current program point. |
| 153 | |
| 154 | * br $label |
| 155 | |
| 156 | Jump to label. |
| 157 | |
Richard Henderson | 5a696f6 | 2012-09-21 17:18:09 -0700 | [diff] [blame] | 158 | * brcond_i32/i64 t0, t1, cond, label |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 159 | |
| 160 | Conditional jump if t0 cond t1 is true. cond can be: |
| 161 | TCG_COND_EQ |
| 162 | TCG_COND_NE |
| 163 | TCG_COND_LT /* signed */ |
| 164 | TCG_COND_GE /* signed */ |
| 165 | TCG_COND_LE /* signed */ |
| 166 | TCG_COND_GT /* signed */ |
| 167 | TCG_COND_LTU /* unsigned */ |
| 168 | TCG_COND_GEU /* unsigned */ |
| 169 | TCG_COND_LEU /* unsigned */ |
| 170 | TCG_COND_GTU /* unsigned */ |
| 171 | |
| 172 | ********* Arithmetic |
| 173 | |
| 174 | * add_i32/i64 t0, t1, t2 |
| 175 | |
| 176 | t0=t1+t2 |
| 177 | |
| 178 | * sub_i32/i64 t0, t1, t2 |
| 179 | |
| 180 | t0=t1-t2 |
| 181 | |
pbrook | 390efc5 | 2008-05-11 14:35:37 +0000 | [diff] [blame] | 182 | * neg_i32/i64 t0, t1 |
| 183 | |
| 184 | t0=-t1 (two's complement) |
| 185 | |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 186 | * mul_i32/i64 t0, t1, t2 |
| 187 | |
| 188 | t0=t1*t2 |
| 189 | |
| 190 | * div_i32/i64 t0, t1, t2 |
| 191 | |
| 192 | t0=t1/t2 (signed). Undefined behavior if division by zero or overflow. |
| 193 | |
| 194 | * divu_i32/i64 t0, t1, t2 |
| 195 | |
| 196 | t0=t1/t2 (unsigned). Undefined behavior if division by zero. |
| 197 | |
| 198 | * rem_i32/i64 t0, t1, t2 |
| 199 | |
| 200 | t0=t1%t2 (signed). Undefined behavior if division by zero or overflow. |
| 201 | |
| 202 | * remu_i32/i64 t0, t1, t2 |
| 203 | |
| 204 | t0=t1%t2 (unsigned). Undefined behavior if division by zero. |
| 205 | |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 206 | ********* Logical |
| 207 | |
aurel32 | 5e85404 | 2008-03-12 21:40:02 +0000 | [diff] [blame] | 208 | * and_i32/i64 t0, t1, t2 |
| 209 | |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 210 | t0=t1&t2 |
| 211 | |
| 212 | * or_i32/i64 t0, t1, t2 |
| 213 | |
| 214 | t0=t1|t2 |
| 215 | |
| 216 | * xor_i32/i64 t0, t1, t2 |
| 217 | |
| 218 | t0=t1^t2 |
| 219 | |
bellard | 0a6b7b7 | 2008-05-25 18:24:40 +0000 | [diff] [blame] | 220 | * not_i32/i64 t0, t1 |
| 221 | |
| 222 | t0=~t1 |
| 223 | |
aurel32 | f24cb33 | 2008-10-21 11:28:59 +0000 | [diff] [blame] | 224 | * andc_i32/i64 t0, t1, t2 |
| 225 | |
| 226 | t0=t1&~t2 |
| 227 | |
| 228 | * eqv_i32/i64 t0, t1, t2 |
| 229 | |
Richard Henderson | 8d625cf | 2010-03-19 13:02:02 -0700 | [diff] [blame] | 230 | t0=~(t1^t2), or equivalently, t0=t1^~t2 |
aurel32 | f24cb33 | 2008-10-21 11:28:59 +0000 | [diff] [blame] | 231 | |
| 232 | * nand_i32/i64 t0, t1, t2 |
| 233 | |
| 234 | t0=~(t1&t2) |
| 235 | |
| 236 | * nor_i32/i64 t0, t1, t2 |
| 237 | |
| 238 | t0=~(t1|t2) |
| 239 | |
| 240 | * orc_i32/i64 t0, t1, t2 |
| 241 | |
| 242 | t0=t1|~t2 |
| 243 | |
aurel32 | 1582457 | 2008-11-03 07:08:36 +0000 | [diff] [blame] | 244 | ********* Shifts/Rotates |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 245 | |
| 246 | * shl_i32/i64 t0, t1, t2 |
| 247 | |
Richard Henderson | 20022fa | 2014-03-18 08:21:44 -0700 | [diff] [blame] | 248 | t0=t1 << t2. Unspecified behavior if t2 < 0 or t2 >= 32 (resp 64) |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 249 | |
| 250 | * shr_i32/i64 t0, t1, t2 |
| 251 | |
Richard Henderson | 20022fa | 2014-03-18 08:21:44 -0700 | [diff] [blame] | 252 | t0=t1 >> t2 (unsigned). Unspecified behavior if t2 < 0 or t2 >= 32 (resp 64) |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 253 | |
| 254 | * sar_i32/i64 t0, t1, t2 |
| 255 | |
Richard Henderson | 20022fa | 2014-03-18 08:21:44 -0700 | [diff] [blame] | 256 | t0=t1 >> t2 (signed). Unspecified behavior if t2 < 0 or t2 >= 32 (resp 64) |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 257 | |
aurel32 | 1582457 | 2008-11-03 07:08:36 +0000 | [diff] [blame] | 258 | * rotl_i32/i64 t0, t1, t2 |
| 259 | |
Richard Henderson | 20022fa | 2014-03-18 08:21:44 -0700 | [diff] [blame] | 260 | Rotation of t2 bits to the left. |
| 261 | Unspecified behavior if t2 < 0 or t2 >= 32 (resp 64) |
aurel32 | 1582457 | 2008-11-03 07:08:36 +0000 | [diff] [blame] | 262 | |
| 263 | * rotr_i32/i64 t0, t1, t2 |
| 264 | |
Richard Henderson | 20022fa | 2014-03-18 08:21:44 -0700 | [diff] [blame] | 265 | Rotation of t2 bits to the right. |
| 266 | Unspecified behavior if t2 < 0 or t2 >= 32 (resp 64) |
aurel32 | 1582457 | 2008-11-03 07:08:36 +0000 | [diff] [blame] | 267 | |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 268 | ********* Misc |
| 269 | |
| 270 | * mov_i32/i64 t0, t1 |
| 271 | |
| 272 | t0 = t1 |
| 273 | |
| 274 | Move t1 to t0 (both operands must have the same type). |
| 275 | |
| 276 | * ext8s_i32/i64 t0, t1 |
pbrook | 8683143 | 2008-05-11 12:22:01 +0000 | [diff] [blame] | 277 | ext8u_i32/i64 t0, t1 |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 278 | ext16s_i32/i64 t0, t1 |
pbrook | 8683143 | 2008-05-11 12:22:01 +0000 | [diff] [blame] | 279 | ext16u_i32/i64 t0, t1 |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 280 | ext32s_i64 t0, t1 |
pbrook | 8683143 | 2008-05-11 12:22:01 +0000 | [diff] [blame] | 281 | ext32u_i64 t0, t1 |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 282 | |
pbrook | 8683143 | 2008-05-11 12:22:01 +0000 | [diff] [blame] | 283 | 8, 16 or 32 bit sign/zero extension (both operands must have the same type) |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 284 | |
aurel32 | 4ad4ce1 | 2009-03-13 09:35:26 +0000 | [diff] [blame] | 285 | * bswap16_i32/i64 t0, t1 |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 286 | |
Aurelien Jarno | 837d987 | 2010-04-10 03:36:21 +0200 | [diff] [blame] | 287 | 16 bit byte swap on a 32/64 bit value. It assumes that the two/six high order |
| 288 | bytes are set to zero. |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 289 | |
aurel32 | 4ad4ce1 | 2009-03-13 09:35:26 +0000 | [diff] [blame] | 290 | * bswap32_i32/i64 t0, t1 |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 291 | |
Aurelien Jarno | 837d987 | 2010-04-10 03:36:21 +0200 | [diff] [blame] | 292 | 32 bit byte swap on a 32/64 bit value. With a 64 bit value, it assumes that |
| 293 | the four high order bytes are set to zero. |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 294 | |
aurel32 | 4ad4ce1 | 2009-03-13 09:35:26 +0000 | [diff] [blame] | 295 | * bswap64_i64 t0, t1 |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 296 | |
| 297 | 64 bit byte swap |
| 298 | |
bellard | 5ff9d6a | 2008-02-04 00:37:54 +0000 | [diff] [blame] | 299 | * discard_i32/i64 t0 |
| 300 | |
| 301 | Indicate that the value of t0 won't be used later. It is useful to |
| 302 | force dead code elimination. |
| 303 | |
Edgar E. Iglesias | 3a34dfd | 2011-01-20 12:16:57 +0100 | [diff] [blame] | 304 | * deposit_i32/i64 dest, t1, t2, pos, len |
Richard Henderson | b7767f0 | 2011-01-10 19:23:42 -0800 | [diff] [blame] | 305 | |
| 306 | Deposit T2 as a bitfield into T1, placing the result in DEST. |
Edgar E. Iglesias | 3a34dfd | 2011-01-20 12:16:57 +0100 | [diff] [blame] | 307 | The bitfield is described by POS/LEN, which are immediate values: |
Richard Henderson | b7767f0 | 2011-01-10 19:23:42 -0800 | [diff] [blame] | 308 | |
| 309 | LEN - the length of the bitfield |
| 310 | POS - the position of the first bit, counting from the LSB |
| 311 | |
| 312 | For example, pos=8, len=4 indicates a 4-bit field at bit 8. |
| 313 | This operation would be equivalent to |
| 314 | |
| 315 | dest = (t1 & ~0x0f00) | ((t2 << 8) & 0x0f00) |
| 316 | |
Richard Henderson | 4bb7a41 | 2013-09-09 17:03:24 -0700 | [diff] [blame] | 317 | * trunc_shr_i32 t0, t1, pos |
| 318 | |
| 319 | For 64-bit hosts only, right shift the 64-bit input T1 by POS and |
| 320 | truncate to 32-bit output T0. Depending on the host, this may be |
| 321 | a simple mov/shift, or may require additional canonicalization. |
Richard Henderson | b7767f0 | 2011-01-10 19:23:42 -0800 | [diff] [blame] | 322 | |
Richard Henderson | be210ac | 2010-01-07 10:13:31 -0800 | [diff] [blame] | 323 | ********* Conditional moves |
| 324 | |
Richard Henderson | 5a696f6 | 2012-09-21 17:18:09 -0700 | [diff] [blame] | 325 | * setcond_i32/i64 dest, t1, t2, cond |
Richard Henderson | be210ac | 2010-01-07 10:13:31 -0800 | [diff] [blame] | 326 | |
| 327 | dest = (t1 cond t2) |
| 328 | |
| 329 | Set DEST to 1 if (T1 cond T2) is true, otherwise set to 0. |
| 330 | |
Richard Henderson | 5a696f6 | 2012-09-21 17:18:09 -0700 | [diff] [blame] | 331 | * movcond_i32/i64 dest, c1, c2, v1, v2, cond |
Richard Henderson | ffc5ea0 | 2012-09-21 10:13:34 -0700 | [diff] [blame] | 332 | |
| 333 | dest = (c1 cond c2 ? v1 : v2) |
| 334 | |
| 335 | Set DEST to V1 if (C1 cond C2) is true, otherwise set to V2. |
| 336 | |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 337 | ********* Type conversions |
| 338 | |
| 339 | * ext_i32_i64 t0, t1 |
| 340 | Convert t1 (32 bit) to t0 (64 bit) and does sign extension |
| 341 | |
| 342 | * extu_i32_i64 t0, t1 |
| 343 | Convert t1 (32 bit) to t0 (64 bit) and does zero extension |
| 344 | |
| 345 | * trunc_i64_i32 t0, t1 |
| 346 | Truncate t1 (64 bit) to t0 (32 bit) |
| 347 | |
pbrook | 36aa55d | 2008-09-21 13:48:32 +0000 | [diff] [blame] | 348 | * concat_i32_i64 t0, t1, t2 |
| 349 | Construct t0 (64-bit) taking the low half from t1 (32 bit) and the high half |
| 350 | from t2 (32 bit). |
| 351 | |
blueswir1 | 945ca82 | 2008-09-21 18:32:28 +0000 | [diff] [blame] | 352 | * concat32_i64 t0, t1, t2 |
| 353 | Construct t0 (64-bit) taking the low half from t1 (64 bit) and the high half |
| 354 | from t2 (64 bit). |
| 355 | |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 356 | ********* Load/Store |
| 357 | |
| 358 | * ld_i32/i64 t0, t1, offset |
| 359 | ld8s_i32/i64 t0, t1, offset |
| 360 | ld8u_i32/i64 t0, t1, offset |
| 361 | ld16s_i32/i64 t0, t1, offset |
| 362 | ld16u_i32/i64 t0, t1, offset |
| 363 | ld32s_i64 t0, t1, offset |
| 364 | ld32u_i64 t0, t1, offset |
| 365 | |
| 366 | t0 = read(t1 + offset) |
| 367 | Load 8, 16, 32 or 64 bits with or without sign extension from host memory. |
| 368 | offset must be a constant. |
| 369 | |
| 370 | * st_i32/i64 t0, t1, offset |
| 371 | st8_i32/i64 t0, t1, offset |
| 372 | st16_i32/i64 t0, t1, offset |
| 373 | st32_i64 t0, t1, offset |
| 374 | |
| 375 | write(t0, t1 + offset) |
| 376 | Write 8, 16, 32 or 64 bits to host memory. |
| 377 | |
Aurelien Jarno | b202d41 | 2012-10-09 21:53:08 +0200 | [diff] [blame] | 378 | All this opcodes assume that the pointed host memory doesn't correspond |
| 379 | to a global. In the latter case the behaviour is unpredictable. |
| 380 | |
Richard Henderson | d7156f7 | 2013-02-19 23:51:52 -0800 | [diff] [blame] | 381 | ********* Multiword arithmetic support |
| 382 | |
| 383 | * add2_i32/i64 t0_low, t0_high, t1_low, t1_high, t2_low, t2_high |
| 384 | * sub2_i32/i64 t0_low, t0_high, t1_low, t1_high, t2_low, t2_high |
| 385 | |
| 386 | Similar to add/sub, except that the double-word inputs T1 and T2 are |
| 387 | formed from two single-word arguments, and the double-word output T0 |
| 388 | is returned in two single-word outputs. |
| 389 | |
| 390 | * mulu2_i32/i64 t0_low, t0_high, t1, t2 |
| 391 | |
| 392 | Similar to mul, except two unsigned inputs T1 and T2 yielding the full |
| 393 | double-word product T0. The later is returned in two single-word outputs. |
| 394 | |
Richard Henderson | 4d3203f | 2013-02-19 23:51:53 -0800 | [diff] [blame] | 395 | * muls2_i32/i64 t0_low, t0_high, t1, t2 |
| 396 | |
| 397 | Similar to mulu2, except the two inputs T1 and T2 are signed. |
| 398 | |
陳韋任 (Wei-Ren Chen) | 294e466 | 2013-03-20 11:42:08 +0800 | [diff] [blame] | 399 | ********* 64-bit guest on 32-bit host support |
Richard Henderson | a38e609 | 2010-01-07 10:07:35 -0800 | [diff] [blame] | 400 | |
| 401 | The following opcodes are internal to TCG. Thus they are to be implemented by |
| 402 | 32-bit host code generators, but are not to be emitted by guest translators. |
| 403 | They are emitted as needed by inline functions within "tcg-op.h". |
| 404 | |
Richard Henderson | 5a696f6 | 2012-09-21 17:18:09 -0700 | [diff] [blame] | 405 | * brcond2_i32 t0_low, t0_high, t1_low, t1_high, cond, label |
Richard Henderson | a38e609 | 2010-01-07 10:07:35 -0800 | [diff] [blame] | 406 | |
| 407 | Similar to brcond, except that the 64-bit values T0 and T1 |
| 408 | are formed from two 32-bit arguments. |
| 409 | |
Richard Henderson | 5a696f6 | 2012-09-21 17:18:09 -0700 | [diff] [blame] | 410 | * setcond2_i32 dest, t1_low, t1_high, t2_low, t2_high, cond |
Richard Henderson | be210ac | 2010-01-07 10:13:31 -0800 | [diff] [blame] | 411 | |
| 412 | Similar to setcond, except that the 64-bit values T1 and T2 are |
| 413 | formed from two 32-bit arguments. The result is a 32-bit value. |
| 414 | |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 415 | ********* QEMU specific operations |
| 416 | |
Mike Frysinger | 759c90b | 2011-01-09 03:45:45 -0500 | [diff] [blame] | 417 | * exit_tb t0 |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 418 | |
| 419 | Exit the current TB and return the value t0 (word type). |
| 420 | |
| 421 | * goto_tb index |
| 422 | |
| 423 | Exit the current TB and jump to the TB index 'index' (constant) if the |
| 424 | current TB was linked to this TB. Otherwise execute the next |
Max Filippov | 9bacf41 | 2012-09-21 04:18:07 +0400 | [diff] [blame] | 425 | instructions. Only indices 0 and 1 are valid and tcg_gen_goto_tb may be issued |
| 426 | at most once with each slot index per TB. |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 427 | |
Richard Henderson | f713d6a | 2013-09-04 08:11:05 -0700 | [diff] [blame] | 428 | * qemu_ld_i32/i64 t0, t1, flags, memidx |
| 429 | * qemu_st_i32/i64 t0, t1, flags, memidx |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 430 | |
Richard Henderson | f713d6a | 2013-09-04 08:11:05 -0700 | [diff] [blame] | 431 | Load data at the guest address t1 into t0, or store data in t0 at guest |
| 432 | address t1. The _i32/_i64 size applies to the size of the input/output |
| 433 | register t0 only. The address t1 is always sized according to the guest, |
| 434 | and the width of the memory operation is controlled by flags. |
Richard Henderson | 86feb1c | 2010-03-19 12:00:26 -0700 | [diff] [blame] | 435 | |
Richard Henderson | f713d6a | 2013-09-04 08:11:05 -0700 | [diff] [blame] | 436 | Both t0 and t1 may be split into little-endian ordered pairs of registers |
| 437 | if dealing with 64-bit quantities on a 32-bit host. |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 438 | |
Richard Henderson | f713d6a | 2013-09-04 08:11:05 -0700 | [diff] [blame] | 439 | The memidx selects the qemu tlb index to use (e.g. user or kernel access). |
| 440 | The flags are the TCGMemOp bits, selecting the sign, width, and endianness |
| 441 | of the memory access. |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 442 | |
Richard Henderson | f713d6a | 2013-09-04 08:11:05 -0700 | [diff] [blame] | 443 | For a 32-bit host, qemu_ld/st_i64 is guaranteed to only be used with a |
| 444 | 64-bit memory access specified in flags. |
| 445 | |
| 446 | ********* |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 447 | |
| 448 | Note 1: Some shortcuts are defined when the last operand is known to be |
| 449 | a constant (e.g. addi for add, movi for mov). |
| 450 | |
| 451 | Note 2: When using TCG, the opcodes must never be generated directly |
| 452 | as some of them may not be available as "real" opcodes. Always use the |
| 453 | function tcg_gen_xxx(args). |
| 454 | |
| 455 | 4) Backend |
| 456 | |
| 457 | tcg-target.h contains the target specific definitions. tcg-target.c |
| 458 | contains the target specific code. |
| 459 | |
| 460 | 4.1) Assumptions |
| 461 | |
| 462 | The target word size (TCG_TARGET_REG_BITS) is expected to be 32 bit or |
| 463 | 64 bit. It is expected that the pointer has the same size as the word. |
| 464 | |
| 465 | On a 32 bit target, all 64 bit operations are converted to 32 bits. A |
| 466 | few specific operations must be implemented to allow it (see add2_i32, |
| 467 | sub2_i32, brcond2_i32). |
| 468 | |
| 469 | Floating point operations are not supported in this version. A |
| 470 | previous incarnation of the code generator had full support of them, |
| 471 | but it is better to concentrate on integer operations first. |
| 472 | |
| 473 | On a 64 bit target, no assumption is made in TCG about the storage of |
| 474 | the 32 bit values in 64 bit registers. |
| 475 | |
| 476 | 4.2) Constraints |
| 477 | |
| 478 | GCC like constraints are used to define the constraints of every |
| 479 | instruction. Memory constraints are not supported in this |
| 480 | version. Aliases are specified in the input operands as for GCC. |
| 481 | |
pbrook | 0c5f3c8 | 2008-11-04 13:17:17 +0000 | [diff] [blame] | 482 | The same register may be used for both an input and an output, even when |
| 483 | they are not explicitly aliased. If an op expands to multiple target |
| 484 | instructions then care must be taken to avoid clobbering input values. |
| 485 | GCC style "early clobber" outputs are not currently supported. |
| 486 | |
bellard | c896fe2 | 2008-02-01 10:05:41 +0000 | [diff] [blame] | 487 | A target can define specific register or constant constraints. If an |
| 488 | operation uses a constant input constraint which does not allow all |
| 489 | constants, it must also accept registers in order to have a fallback. |
| 490 | |
| 491 | The movi_i32 and movi_i64 operations must accept any constants. |
| 492 | |
| 493 | The mov_i32 and mov_i64 operations must accept any registers of the |
| 494 | same type. |
| 495 | |
| 496 | The ld/st instructions must accept signed 32 bit constant offsets. It |
| 497 | can be implemented by reserving a specific register to compute the |
| 498 | address if the offset is too big. |
| 499 | |
| 500 | The ld/st instructions must accept any destination (ld) or source (st) |
| 501 | register. |
| 502 | |
| 503 | 4.3) Function call assumptions |
| 504 | |
| 505 | - The only supported types for parameters and return value are: 32 and |
| 506 | 64 bit integers and pointer. |
| 507 | - The stack grows downwards. |
| 508 | - The first N parameters are passed in registers. |
| 509 | - The next parameters are passed on the stack by storing them as words. |
| 510 | - Some registers are clobbered during the call. |
| 511 | - The function can return 0 or 1 value in registers. On a 32 bit |
| 512 | target, functions must be able to return 2 values in registers for |
| 513 | 64 bit return type. |
| 514 | |
aurel32 | 86e840e | 2008-12-07 15:21:23 +0000 | [diff] [blame] | 515 | 5) Recommended coding rules for best performance |
bellard | 0a6b7b7 | 2008-05-25 18:24:40 +0000 | [diff] [blame] | 516 | |
| 517 | - Use globals to represent the parts of the QEMU CPU state which are |
| 518 | often modified, e.g. the integer registers and the condition |
| 519 | codes. TCG will be able to use host registers to store them. |
| 520 | |
| 521 | - Avoid globals stored in fixed registers. They must be used only to |
| 522 | store the pointer to the CPU state and possibly to store a pointer |
aurel32 | 86e840e | 2008-12-07 15:21:23 +0000 | [diff] [blame] | 523 | to a register window. |
bellard | 0a6b7b7 | 2008-05-25 18:24:40 +0000 | [diff] [blame] | 524 | |
| 525 | - Use temporaries. Use local temporaries only when really needed, |
| 526 | e.g. when you need to use a value after a jump. Local temporaries |
| 527 | introduce a performance hit in the current TCG implementation: their |
| 528 | content is saved to memory at end of each basic block. |
| 529 | |
| 530 | - Free temporaries and local temporaries when they are no longer used |
| 531 | (tcg_temp_free). Since tcg_const_x() also creates a temporary, you |
| 532 | should free it after it is used. Freeing temporaries does not yield |
| 533 | a better generated code, but it reduces the memory usage of TCG and |
| 534 | the speed of the translation. |
| 535 | |
陳韋任 (Wei-Ren Chen) | 294e466 | 2013-03-20 11:42:08 +0800 | [diff] [blame] | 536 | - Don't hesitate to use helpers for complicated or seldom used guest |
Stefan Weil | aa95e3a | 2011-01-07 21:34:50 +0100 | [diff] [blame] | 537 | instructions. There is little performance advantage in using TCG to |
陳韋任 (Wei-Ren Chen) | 294e466 | 2013-03-20 11:42:08 +0800 | [diff] [blame] | 538 | implement guest instructions taking more than about twenty TCG |
Peter Maydell | 107a47c | 2011-06-22 15:40:06 +0100 | [diff] [blame] | 539 | instructions. Note that this rule of thumb is more applicable to |
| 540 | helpers doing complex logic or arithmetic, where the C compiler has |
| 541 | scope to do a good job of optimisation; it is less relevant where |
| 542 | the instruction is mostly doing loads and stores, and in those cases |
| 543 | inline TCG may still be faster for longer sequences. |
| 544 | |
| 545 | - The hard limit on the number of TCG instructions you can generate |
陳韋任 (Wei-Ren Chen) | 294e466 | 2013-03-20 11:42:08 +0800 | [diff] [blame] | 546 | per guest instruction is set by MAX_OP_PER_INSTR in exec-all.h -- |
Peter Maydell | 107a47c | 2011-06-22 15:40:06 +0100 | [diff] [blame] | 547 | you cannot exceed this without risking a buffer overrun. |
bellard | 0a6b7b7 | 2008-05-25 18:24:40 +0000 | [diff] [blame] | 548 | |
| 549 | - Use the 'discard' instruction if you know that TCG won't be able to |
| 550 | prove that a given global is "dead" at a given program point. The |
陳韋任 (Wei-Ren Chen) | 294e466 | 2013-03-20 11:42:08 +0800 | [diff] [blame] | 551 | x86 guest uses it to improve the condition codes optimisation. |