]> git.proxmox.com Git - mirror_qemu.git/blame - tcg/README
tcg-mips: Support 64-bit opcodes
[mirror_qemu.git] / tcg / README
CommitLineData
c896fe29
FB
1Tiny Code Generator - Fabrice Bellard.
2
31) Introduction
4
5TCG (Tiny Code Generator) began as a generic backend for a C
6compiler. It was simplified to be used in QEMU. It also has its roots
7in the QOP code generator written by Paul Brook.
8
92) Definitions
10
bf28a69e
PB
11TCG receives RISC-like "TCG ops" and performs some optimizations on them,
12including liveness analysis and trivial constant expression
13evaluation. TCG ops are then implemented in the host CPU back end,
14also known as the TCG "target".
15
c896fe29
FB
16The TCG "target" is the architecture for which we generate the
17code. It is of course not the same as the "target" of QEMU which is
18the emulated architecture. As TCG started as a generic C backend used
19for cross compiling, it is assumed that the TCG target is different
20from the host, although it is never the case for QEMU.
21
294e4669
CWR
22In this document, we use "guest" to specify what architecture we are
23emulating; "target" always means the TCG target, the machine on which
24we are running QEMU.
25
c896fe29
FB
26A TCG "function" corresponds to a QEMU Translated Block (TB).
27
0a6b7b78
FB
28A TCG "temporary" is a variable only live in a basic
29block. Temporaries are allocated explicitly in each function.
c896fe29 30
0a6b7b78
FB
31A TCG "local temporary" is a variable only live in a function. Local
32temporaries are allocated explicitly in each function.
33
34A TCG "global" is a variable which is live in all the functions
35(equivalent of a C global variable). They are defined before the
36functions defined. A TCG global can be a memory location (e.g. a QEMU
37CPU register), a fixed host register (e.g. the QEMU CPU state pointer)
38or a memory location which is stored in a register outside QEMU TBs
39(not implemented yet).
c896fe29
FB
40
41A TCG "basic block" corresponds to a list of instructions terminated
42by a branch instruction.
43
20022fa1
RH
44An operation with "undefined behavior" may result in a crash.
45
46An operation with "unspecified behavior" shall not crash. However,
47the result may be one of several possibilities so may be considered
48an "undefined result".
49
c896fe29
FB
503) Intermediate representation
51
523.1) Introduction
53
0a6b7b78
FB
54TCG instructions operate on variables which are temporaries, local
55temporaries or globals. TCG instructions and variables are strongly
56typed. Two types are supported: 32 bit integers and 64 bit
57integers. Pointers are defined as an alias to 32 bit or 64 bit
58integers depending on the TCG target word size.
c896fe29
FB
59
60Each instruction has a fixed number of output variable operands, input
61variable operands and always constant operands.
62
63The notable exception is the call instruction which has a variable
64number of outputs and inputs.
65
0a6b7b78
FB
66In the textual form, output operands usually come first, followed by
67input operands, followed by constant operands. The output type is
68included in the instruction name. Constants are prefixed with a '$'.
c896fe29
FB
69
70add_i32 t0, t1, t2 (t0 <- t1 + t2)
71
c896fe29
FB
723.2) Assumptions
73
74* Basic blocks
75
76- Basic blocks end after branches (e.g. brcond_i32 instruction),
77 goto_tb and exit_tb instructions.
86e840ee
AJ
78- Basic blocks start after the end of a previous basic block, or at a
79 set_label instruction.
c896fe29 80
0a6b7b78
FB
81After the end of a basic block, the content of temporaries is
82destroyed, but local temporaries and globals are preserved.
c896fe29
FB
83
84* Floating point types are not supported yet
85
86* Pointers: depending on the TCG target, pointer size is 32 bit or 64
87 bit. The type TCG_TYPE_PTR is an alias to TCG_TYPE_I32 or
88 TCG_TYPE_I64.
89
90* Helpers:
91
92Using the tcg_gen_helper_x_y it is possible to call any function
aa95e3a5 93taking i32, i64 or pointer types. By default, before calling a helper,
a3f5054b 94all globals are stored at their canonical location and it is assumed
78505279
AJ
95that the function can modify them. By default, the helper is allowed to
96modify the CPU state or raise an exception.
97
98This can be overridden using the following function modifiers:
99- TCG_CALL_NO_READ_GLOBALS means that the helper does not read globals,
100 either directly or via an exception. They will not be saved to their
101 canonical locations before calling the helper.
102- TCG_CALL_NO_WRITE_GLOBALS means that the helper does not modify any globals.
103 They will only be saved to their canonical location before calling helpers,
104 but they won't be reloaded afterwise.
105- TCG_CALL_NO_SIDE_EFFECTS means that the call to the function is removed if
106 the return value is not used.
107
108Note that TCG_CALL_NO_READ_GLOBALS implies TCG_CALL_NO_WRITE_GLOBALS.
c896fe29
FB
109
110On some TCG targets (e.g. x86), several calling conventions are
111supported.
112
113* Branches:
114
626cd050 115Use the instruction 'br' to jump to a label.
c896fe29
FB
116
1173.3) Code Optimizations
118
119When generating instructions, you can count on at least the following
120optimizations:
121
122- Single instructions are simplified, e.g.
123
124 and_i32 t0, t0, $0xffffffff
125
126 is suppressed.
127
128- A liveness analysis is done at the basic block level. The
0a6b7b78 129 information is used to suppress moves from a dead variable to
c896fe29
FB
130 another one. It is also used to remove instructions which compute
131 dead results. The later is especially useful for condition code
9804c8e2 132 optimization in QEMU.
c896fe29
FB
133
134 In the following example:
135
136 add_i32 t0, t1, t2
137 add_i32 t0, t0, $1
138 mov_i32 t0, $1
139
140 only the last instruction is kept.
141
c896fe29
FB
1423.4) Instruction Reference
143
144********* Function call
145
146* call <ret> <params> ptr
147
148call function 'ptr' (pointer type)
149
150<ret> optional 32 bit or 64 bit return value
151<params> optional 32 bit or 64 bit parameters
152
153********* Jumps/Labels
154
c896fe29
FB
155* set_label $label
156
157Define label 'label' at the current program point.
158
159* br $label
160
161Jump to label.
162
5a696f6a 163* brcond_i32/i64 t0, t1, cond, label
c896fe29
FB
164
165Conditional jump if t0 cond t1 is true. cond can be:
166 TCG_COND_EQ
167 TCG_COND_NE
168 TCG_COND_LT /* signed */
169 TCG_COND_GE /* signed */
170 TCG_COND_LE /* signed */
171 TCG_COND_GT /* signed */
172 TCG_COND_LTU /* unsigned */
173 TCG_COND_GEU /* unsigned */
174 TCG_COND_LEU /* unsigned */
175 TCG_COND_GTU /* unsigned */
176
177********* Arithmetic
178
179* add_i32/i64 t0, t1, t2
180
181t0=t1+t2
182
183* sub_i32/i64 t0, t1, t2
184
185t0=t1-t2
186
390efc54
PB
187* neg_i32/i64 t0, t1
188
189t0=-t1 (two's complement)
190
c896fe29
FB
191* mul_i32/i64 t0, t1, t2
192
193t0=t1*t2
194
195* div_i32/i64 t0, t1, t2
196
197t0=t1/t2 (signed). Undefined behavior if division by zero or overflow.
198
199* divu_i32/i64 t0, t1, t2
200
201t0=t1/t2 (unsigned). Undefined behavior if division by zero.
202
203* rem_i32/i64 t0, t1, t2
204
205t0=t1%t2 (signed). Undefined behavior if division by zero or overflow.
206
207* remu_i32/i64 t0, t1, t2
208
209t0=t1%t2 (unsigned). Undefined behavior if division by zero.
210
c896fe29
FB
211********* Logical
212
5e85404a
AJ
213* and_i32/i64 t0, t1, t2
214
c896fe29
FB
215t0=t1&t2
216
217* or_i32/i64 t0, t1, t2
218
219t0=t1|t2
220
221* xor_i32/i64 t0, t1, t2
222
223t0=t1^t2
224
0a6b7b78
FB
225* not_i32/i64 t0, t1
226
227t0=~t1
228
f24cb33e
AJ
229* andc_i32/i64 t0, t1, t2
230
231t0=t1&~t2
232
233* eqv_i32/i64 t0, t1, t2
234
8d625cf1 235t0=~(t1^t2), or equivalently, t0=t1^~t2
f24cb33e
AJ
236
237* nand_i32/i64 t0, t1, t2
238
239t0=~(t1&t2)
240
241* nor_i32/i64 t0, t1, t2
242
243t0=~(t1|t2)
244
245* orc_i32/i64 t0, t1, t2
246
247t0=t1|~t2
248
15824571 249********* Shifts/Rotates
c896fe29
FB
250
251* shl_i32/i64 t0, t1, t2
252
20022fa1 253t0=t1 << t2. Unspecified behavior if t2 < 0 or t2 >= 32 (resp 64)
c896fe29
FB
254
255* shr_i32/i64 t0, t1, t2
256
20022fa1 257t0=t1 >> t2 (unsigned). Unspecified behavior if t2 < 0 or t2 >= 32 (resp 64)
c896fe29
FB
258
259* sar_i32/i64 t0, t1, t2
260
20022fa1 261t0=t1 >> t2 (signed). Unspecified behavior if t2 < 0 or t2 >= 32 (resp 64)
c896fe29 262
15824571
AJ
263* rotl_i32/i64 t0, t1, t2
264
20022fa1
RH
265Rotation of t2 bits to the left.
266Unspecified behavior if t2 < 0 or t2 >= 32 (resp 64)
15824571
AJ
267
268* rotr_i32/i64 t0, t1, t2
269
20022fa1
RH
270Rotation of t2 bits to the right.
271Unspecified behavior if t2 < 0 or t2 >= 32 (resp 64)
15824571 272
c896fe29
FB
273********* Misc
274
275* mov_i32/i64 t0, t1
276
277t0 = t1
278
279Move t1 to t0 (both operands must have the same type).
280
281* ext8s_i32/i64 t0, t1
86831435 282ext8u_i32/i64 t0, t1
c896fe29 283ext16s_i32/i64 t0, t1
86831435 284ext16u_i32/i64 t0, t1
c896fe29 285ext32s_i64 t0, t1
86831435 286ext32u_i64 t0, t1
c896fe29 287
86831435 2888, 16 or 32 bit sign/zero extension (both operands must have the same type)
c896fe29 289
4ad4ce16 290* bswap16_i32/i64 t0, t1
c896fe29 291
837d987b
AJ
29216 bit byte swap on a 32/64 bit value. It assumes that the two/six high order
293bytes are set to zero.
c896fe29 294
4ad4ce16 295* bswap32_i32/i64 t0, t1
c896fe29 296
837d987b
AJ
29732 bit byte swap on a 32/64 bit value. With a 64 bit value, it assumes that
298the four high order bytes are set to zero.
c896fe29 299
4ad4ce16 300* bswap64_i64 t0, t1
c896fe29
FB
301
30264 bit byte swap
303
5ff9d6a4
FB
304* discard_i32/i64 t0
305
306Indicate that the value of t0 won't be used later. It is useful to
307force dead code elimination.
308
3a34dfd7 309* deposit_i32/i64 dest, t1, t2, pos, len
b7767f0f
RH
310
311Deposit T2 as a bitfield into T1, placing the result in DEST.
3a34dfd7 312The bitfield is described by POS/LEN, which are immediate values:
b7767f0f
RH
313
314 LEN - the length of the bitfield
315 POS - the position of the first bit, counting from the LSB
316
317For example, pos=8, len=4 indicates a 4-bit field at bit 8.
318This operation would be equivalent to
319
320 dest = (t1 & ~0x0f00) | ((t2 << 8) & 0x0f00)
321
609ad705 322* extrl_i64_i32 t0, t1
4bb7a41e 323
609ad705
RH
324For 64-bit hosts only, extract the low 32-bits of input T1 and place it
325into 32-bit output T0. Depending on the host, this may be a simple move,
326or may require additional canonicalization.
327
328* extrh_i64_i32 t0, t1
329
330For 64-bit hosts only, extract the high 32-bits of input T1 and place it
331into 32-bit output T0. Depending on the host, this may be a simple shift,
332or may require additional canonicalization.
b7767f0f 333
be210acb
RH
334********* Conditional moves
335
5a696f6a 336* setcond_i32/i64 dest, t1, t2, cond
be210acb
RH
337
338dest = (t1 cond t2)
339
340Set DEST to 1 if (T1 cond T2) is true, otherwise set to 0.
341
5a696f6a 342* movcond_i32/i64 dest, c1, c2, v1, v2, cond
ffc5ea09
RH
343
344dest = (c1 cond c2 ? v1 : v2)
345
346Set DEST to V1 if (C1 cond C2) is true, otherwise set to V2.
347
c896fe29
FB
348********* Type conversions
349
350* ext_i32_i64 t0, t1
351Convert t1 (32 bit) to t0 (64 bit) and does sign extension
352
353* extu_i32_i64 t0, t1
354Convert t1 (32 bit) to t0 (64 bit) and does zero extension
355
356* trunc_i64_i32 t0, t1
357Truncate t1 (64 bit) to t0 (32 bit)
358
36aa55dc
PB
359* concat_i32_i64 t0, t1, t2
360Construct t0 (64-bit) taking the low half from t1 (32 bit) and the high half
361from t2 (32 bit).
362
945ca823
BS
363* concat32_i64 t0, t1, t2
364Construct t0 (64-bit) taking the low half from t1 (64 bit) and the high half
365from t2 (64 bit).
366
c896fe29
FB
367********* Load/Store
368
369* ld_i32/i64 t0, t1, offset
370ld8s_i32/i64 t0, t1, offset
371ld8u_i32/i64 t0, t1, offset
372ld16s_i32/i64 t0, t1, offset
373ld16u_i32/i64 t0, t1, offset
374ld32s_i64 t0, t1, offset
375ld32u_i64 t0, t1, offset
376
377t0 = read(t1 + offset)
378Load 8, 16, 32 or 64 bits with or without sign extension from host memory.
379offset must be a constant.
380
381* st_i32/i64 t0, t1, offset
382st8_i32/i64 t0, t1, offset
383st16_i32/i64 t0, t1, offset
384st32_i64 t0, t1, offset
385
386write(t0, t1 + offset)
387Write 8, 16, 32 or 64 bits to host memory.
388
b202d41e
AJ
389All this opcodes assume that the pointed host memory doesn't correspond
390to a global. In the latter case the behaviour is unpredictable.
391
d7156f7c
RH
392********* Multiword arithmetic support
393
394* add2_i32/i64 t0_low, t0_high, t1_low, t1_high, t2_low, t2_high
395* sub2_i32/i64 t0_low, t0_high, t1_low, t1_high, t2_low, t2_high
396
397Similar to add/sub, except that the double-word inputs T1 and T2 are
398formed from two single-word arguments, and the double-word output T0
399is returned in two single-word outputs.
400
401* mulu2_i32/i64 t0_low, t0_high, t1, t2
402
403Similar to mul, except two unsigned inputs T1 and T2 yielding the full
404double-word product T0. The later is returned in two single-word outputs.
405
4d3203fd
RH
406* muls2_i32/i64 t0_low, t0_high, t1, t2
407
408Similar to mulu2, except the two inputs T1 and T2 are signed.
409
f65e19bc
PK
410********* Memory Barrier support
411
412* mb <$arg>
413
414Generate a target memory barrier instruction to ensure memory ordering as being
415enforced by a corresponding guest memory barrier instruction. The ordering
416enforced by the backend may be stricter than the ordering required by the guest.
417It cannot be weaker. This opcode takes a constant argument which is required to
418generate the appropriate barrier instruction. The backend should take care to
419emit the target barrier instruction only when necessary i.e., for SMP guests and
420when MTTCG is enabled.
421
422The guest translators should generate this opcode for all guest instructions
423which have ordering side effects.
424
425Please see docs/atomics.txt for more information on memory barriers.
426
294e4669 427********* 64-bit guest on 32-bit host support
a38e609c
RH
428
429The following opcodes are internal to TCG. Thus they are to be implemented by
43032-bit host code generators, but are not to be emitted by guest translators.
431They are emitted as needed by inline functions within "tcg-op.h".
432
5a696f6a 433* brcond2_i32 t0_low, t0_high, t1_low, t1_high, cond, label
a38e609c
RH
434
435Similar to brcond, except that the 64-bit values T0 and T1
436are formed from two 32-bit arguments.
437
5a696f6a 438* setcond2_i32 dest, t1_low, t1_high, t2_low, t2_high, cond
be210acb
RH
439
440Similar to setcond, except that the 64-bit values T1 and T2 are
441formed from two 32-bit arguments. The result is a 32-bit value.
442
c896fe29
FB
443********* QEMU specific operations
444
759c90ba 445* exit_tb t0
c896fe29
FB
446
447Exit the current TB and return the value t0 (word type).
448
449* goto_tb index
450
451Exit the current TB and jump to the TB index 'index' (constant) if the
452current TB was linked to this TB. Otherwise execute the next
9bacf414
MF
453instructions. Only indices 0 and 1 are valid and tcg_gen_goto_tb may be issued
454at most once with each slot index per TB.
c896fe29 455
f713d6ad
RH
456* qemu_ld_i32/i64 t0, t1, flags, memidx
457* qemu_st_i32/i64 t0, t1, flags, memidx
458
459Load data at the guest address t1 into t0, or store data in t0 at guest
460address t1. The _i32/_i64 size applies to the size of the input/output
461register t0 only. The address t1 is always sized according to the guest,
462and the width of the memory operation is controlled by flags.
463
464Both t0 and t1 may be split into little-endian ordered pairs of registers
465if dealing with 64-bit quantities on a 32-bit host.
466
467The memidx selects the qemu tlb index to use (e.g. user or kernel access).
468The flags are the TCGMemOp bits, selecting the sign, width, and endianness
469of the memory access.
470
471For a 32-bit host, qemu_ld/st_i64 is guaranteed to only be used with a
47264-bit memory access specified in flags.
473
474*********
c896fe29
FB
475
476Note 1: Some shortcuts are defined when the last operand is known to be
477a constant (e.g. addi for add, movi for mov).
478
479Note 2: When using TCG, the opcodes must never be generated directly
480as some of them may not be available as "real" opcodes. Always use the
481function tcg_gen_xxx(args).
482
4834) Backend
484
ce151109
PM
485tcg-target.h contains the target specific definitions. tcg-target.inc.c
486contains the target specific code; it is #included by tcg/tcg.c, rather
487than being a standalone C file.
c896fe29
FB
488
4894.1) Assumptions
490
491The target word size (TCG_TARGET_REG_BITS) is expected to be 32 bit or
49264 bit. It is expected that the pointer has the same size as the word.
493
494On a 32 bit target, all 64 bit operations are converted to 32 bits. A
495few specific operations must be implemented to allow it (see add2_i32,
496sub2_i32, brcond2_i32).
497
cb8d4c8f 498On a 64 bit target, the values are transferred between 32 and 64-bit
870ad154
AJ
499registers using the following ops:
500- trunc_shr_i64_i32
501- ext_i32_i64
502- extu_i32_i64
503
504They ensure that the values are correctly truncated or extended when
505moved from a 32-bit to a 64-bit register or vice-versa. Note that the
506trunc_shr_i64_i32 is an optional op. It is not necessary to implement
507it if all the following conditions are met:
508- 64-bit registers can hold 32-bit values
509- 32-bit values in a 64-bit register do not need to stay zero or
510 sign extended
511- all 32-bit TCG ops ignore the high part of 64-bit registers
512
c896fe29
FB
513Floating point operations are not supported in this version. A
514previous incarnation of the code generator had full support of them,
515but it is better to concentrate on integer operations first.
516
c896fe29
FB
5174.2) Constraints
518
519GCC like constraints are used to define the constraints of every
520instruction. Memory constraints are not supported in this
521version. Aliases are specified in the input operands as for GCC.
522
0c5f3c8d
PB
523The same register may be used for both an input and an output, even when
524they are not explicitly aliased. If an op expands to multiple target
525instructions then care must be taken to avoid clobbering input values.
526GCC style "early clobber" outputs are not currently supported.
527
c896fe29
FB
528A target can define specific register or constant constraints. If an
529operation uses a constant input constraint which does not allow all
530constants, it must also accept registers in order to have a fallback.
531
532The movi_i32 and movi_i64 operations must accept any constants.
533
534The mov_i32 and mov_i64 operations must accept any registers of the
535same type.
536
537The ld/st instructions must accept signed 32 bit constant offsets. It
538can be implemented by reserving a specific register to compute the
539address if the offset is too big.
540
541The ld/st instructions must accept any destination (ld) or source (st)
542register.
543
5444.3) Function call assumptions
545
546- The only supported types for parameters and return value are: 32 and
547 64 bit integers and pointer.
548- The stack grows downwards.
549- The first N parameters are passed in registers.
550- The next parameters are passed on the stack by storing them as words.
551- Some registers are clobbered during the call.
552- The function can return 0 or 1 value in registers. On a 32 bit
553 target, functions must be able to return 2 values in registers for
554 64 bit return type.
555
86e840ee 5565) Recommended coding rules for best performance
0a6b7b78
FB
557
558- Use globals to represent the parts of the QEMU CPU state which are
559 often modified, e.g. the integer registers and the condition
560 codes. TCG will be able to use host registers to store them.
561
562- Avoid globals stored in fixed registers. They must be used only to
563 store the pointer to the CPU state and possibly to store a pointer
86e840ee 564 to a register window.
0a6b7b78
FB
565
566- Use temporaries. Use local temporaries only when really needed,
567 e.g. when you need to use a value after a jump. Local temporaries
568 introduce a performance hit in the current TCG implementation: their
569 content is saved to memory at end of each basic block.
570
571- Free temporaries and local temporaries when they are no longer used
572 (tcg_temp_free). Since tcg_const_x() also creates a temporary, you
573 should free it after it is used. Freeing temporaries does not yield
574 a better generated code, but it reduces the memory usage of TCG and
575 the speed of the translation.
576
294e4669 577- Don't hesitate to use helpers for complicated or seldom used guest
aa95e3a5 578 instructions. There is little performance advantage in using TCG to
294e4669 579 implement guest instructions taking more than about twenty TCG
107a47cc
PM
580 instructions. Note that this rule of thumb is more applicable to
581 helpers doing complex logic or arithmetic, where the C compiler has
582 scope to do a good job of optimisation; it is less relevant where
583 the instruction is mostly doing loads and stores, and in those cases
584 inline TCG may still be faster for longer sequences.
585
586- The hard limit on the number of TCG instructions you can generate
294e4669 587 per guest instruction is set by MAX_OP_PER_INSTR in exec-all.h --
107a47cc 588 you cannot exceed this without risking a buffer overrun.
0a6b7b78
FB
589
590- Use the 'discard' instruction if you know that TCG won't be able to
591 prove that a given global is "dead" at a given program point. The
294e4669 592 x86 guest uses it to improve the condition codes optimisation.