Re: OT: TCG SSA, speed, misc (was Re: [Qemu-devel] Re: [PATCH 08/11] QMP: Port balloon command)

[Laurent Desnogues <laurent.desnogues@gmail.com>]

On Mon, Jun 29, 2009 at 1:35 AM, Filip Navara<filip.navara@gmail.com> wrote:
> On Mon, Jun 29, 2009 at 1:19 AM, Filip Navara<filip.navara@gmail.com> wrote:
>> On x86 host the register allocation still looks very pathetic, I will post a follow-up
>> soon.
>
> Let's look at the very first two instructions generated by the guest:
>
> ----------------
> IN:
> 0x00200070:  ldr        r0, [pc, #108]  ; 0x2000e4
> 0x00200074:  ldr        pc, [pc, #108]  ; 0x2000e8
>
> OP:
>  movi_i32 tmp8,$0x200078
>  movi_i32 tmp9,$0x6c
>  add_i32 tmp8,tmp8,tmp9
>  qemu_ld32u tmp9,tmp8,$0x0
>  mov_i32 r0,tmp9
>  movi_i32 tmp9,$0x20007c
>  movi_i32 tmp10,$0x6c
>  add_i32 tmp9,tmp9,tmp10
>  qemu_ld32u tmp8,tmp9,$0x0
>  movi_i32 tmp10,$0xfffffffe
>  and_i32 tmp8,tmp8,tmp10
>  mov_i32 pc,tmp8
>  exit_tb $0x0
>
> OUT: [size=128]
> 0x03230020:  mov    $0x200078,%eax
> 0x03230025:  add    $0x6c,%eax
> 0x03230028:  mov    %eax,%ecx
> 0x0323002a:  mov    %ecx,%edx
> 0x0323002c:  mov    %ecx,%eax
>
> -- this instruction sets %eax to value that it already has
>
> 0x0323002e:  shr    $0x6,%edx
> 0x03230031:  and    $0xfffffc03,%eax
> 0x03230037:  and    $0xff0,%edx
> 0x0323003d:  lea    0x540(%edx,%ebp,1),%edx
> 0x03230044:  cmp    (%edx),%eax
> 0x03230046:  mov    %ecx,%eax
> 0x03230048:  je     0x3230053
> 0x0323004a:  xor    %edx,%edx
> 0x0323004c:  call   0x55cbc0
> 0x03230051:  jmp    0x3230058
> 0x03230053:  add    0xc(%edx),%eax
> 0x03230056:  mov    (%eax),%eax
> 0x03230058:  mov    $0x20007c,%edx
> 0x0323005d:  add    $0x6c,%edx
> 0x03230060:  mov    %edx,%ecx
> 0x03230062:  mov    %eax,0x0(%ebp)
> 0x03230065:  mov    %ecx,%edx
>
> -- same here
>
> 0x03230067:  mov    %ecx,%eax
> 0x03230069:  shr    $0x6,%edx
> 0x0323006c:  and    $0xfffffc03,%eax
> 0x03230072:  and    $0xff0,%edx
> 0x03230078:  lea    0x540(%edx,%ebp,1),%edx
> 0x0323007f:  cmp    (%edx),%eax
> 0x03230081:  mov    %ecx,%eax
> 0x03230083:  je     0x323008e
> 0x03230085:  xor    %edx,%edx
> 0x03230087:  call   0x55cbc0
> 0x0323008c:  jmp    0x3230093
> 0x0323008e:  add    0xc(%edx),%eax
> 0x03230091:  mov    (%eax),%eax
> 0x03230093:  and    $0xfffffffe,%eax
> 0x03230096:  mov    %eax,0x3c(%ebp)
> 0x03230099:  xor    %eax,%eax
> 0x0323009b:  jmp    0x7ec928
>
> If someone can explain me why the redundant mov instructions are
> generated I'd be very happy. Thanks.

What you see here is due to hard-coded assembly instructions
used to make a load.  cf tcg_out_qemu_ld in tcg-target.c


Laurent