Re: [Qemu-devel] RFC: Code fetch optimisation

[J. Mayer]

On Tue, 2007-10-16 at 23:00 +0100, Paul Brook wrote:
> > Well, we got the same behavior on PowerPC. What I was thinking of is
> > that if we fix the VLE problems, the fix, if done in a proper way, could
> > also allow benefit to RISC targets. What I don't know is; would we
> > really have a benefit not stopping translation on page boundaries ?

> I suspect that we're going to want/need to break the TB to get the exception 
> semantics right, so for RISC targets there's no point having TBs that
> span a 
> page boundary.

My opinion is that this an optimisation that may be tried later, if it
really give an advantage in terms of translation efficiency, which is
far from being evident. Then, let's keep what works well and just try to
solve the VLE problems for now...

> > > For VLE targets we already get this wrong (the prefetch abort occurs some
> > > time before the faulting instruction executes). I don't know if this
> > > behavior is permitted by the ISA, but it's definitely possible to
> > > construct cases where it has visible effect.
> >
> > I think that it would be possible to do things properly.
> > [...] Or maybe the solution would
> > just be to stop the translation knowing that the exception will be
> > raised when trying to translate the first instruction in the next page.
> 
> I'd go for this one. It's approximately the same method currently used for 
> RISC targets.

> In general think this will require target specific support. For RISC targets 
> this is trivial. For x86/m68k figuring out the length of an insn is trickier.
> 
> Detecting crossing a page boundary on subsequent insns in the load/mmu 
> routines is problematic because it happens relatively late. In particular it 
> may theoretically happen after we've output ops that change CPU state.
> 
> I suspect the best solution is to backtrack (remove the generated ops) after 
> decoding the insn if we discover we've passed a page boundary. The ld*_code 
> routines can simply return garbage (e.g. zero) if the read is not on the 
> first page.

The "incorrect" returned value may be target specific to be sure it's
always an invalid opcode.
Backtracking should not be hard if we register the last cc pointer each
time we finish translating an insn. I'll think about this solution,
which really seems feasible to me.

> Trying to generate prefetch aborts at runtime sounds too hairy for my liking.

It might be really tricky and is likely to be bugged, I agree.

-- 
J. Mayer <address@hidden>
Never organized