EX(opline) / opline can be stale if the IP is not stored, like in this
case on a trace enter. We always need to make sure that the opline is up
to date to make sure we don't use stale data.
Closes GH-17260.
Now it's possible that PHP tracing JIT loses some parts of the "hot"
code. In case we have a root LOOP trace with an inlined call of some
function, and we get a SIDE exit inside that function - we recorded a
side trace, but finished it a the RETURN of the inlined function. As
result the opcodes betwee RETURN from SIDE trace and LOOP exit were not
covered by tracer and were executed in interpreter.
This patch introduces a "ret_depth" argument that prevents stopping
tracing on RETURN of such SIDE trace.
Internally accessible via zend_jit_blacklist_function / externally via opcache_jit_blacklist.
The functionality currently only affects tracing JIT, but may be extended to other JIT modes in future.
* IR update
* Use folding to allow constant folding and common subexpression elimination
* Implement IR JIT for INIT_FCALL, INIT_FCALL_BY_NAME and INIT_NS_FCALL_BY_NAME
* Implement IR JIT for SEND_VAL and SEND_VAL_EX
* Implement IR JIT for SEND_REF
* Implement IR JIT for SEND_VAR* instructions (incompltere - few tests failures)
* Implement IR JIT for CHECK_FUNC_ARG
* Implement IR JIT for CHECK_UNDEF_ARGS
* Implement IR JIT for ROPE_INIT, ROPE_ADD and ROPE_END
* Implement IR JIT for FREE, FE_FREE, ECHO, STRLEN and COUNT
* Implement IR JIT for IN_ARRAY
* Implement IR JIT support for separate VM stack overflow check
* Implement IR JIT for INIT_DYNAMIC_CALL
* Implemenr IR JIT for INIT_METHOD_CALL
* Fix IR JIT for IN_ARRAY and COUNT
* Implement IR JIT for VERIFY_RETURN_TYPE
* Force C compiler to store preserved registers to allow JIT using them
* Implement IR JIT for DO_FCALL, DO_UCALL, DO_ICALL and DO_FCALL_BY_NAME
* Implement IR JIT for FETCH_CONSTANT
* Fix (reverse) guard conditions
* Implement IR JIT for RECV and RECV_INIT
* Implement IR JIT for RETURN
* Implement IR JIT for BIND_GLOBAL
* Fix guard for: int++ => double
* Fix exception handling
* Allow deoptimization of zval type only (if some register is spilled by the IR engine)
* Fix overflow handling
* Implement IR JIT for FE_RESET_R and FE_FETCH_R
* Eliminate extra temporary register
* Better registers usage
* Implement IR JIT for FETCH_DIM_* and ISSET_DIM
* Implement IR JIT for ASSIGN_DIM and ASSIGN_DIM_OP
* cleanup
* Generae IR that produces a better x86[_64] code
* Allow trace register allocation for live ranges terminated before entering a called function
* Remove following END->BEGIN nodes during IR construction
* Remove useless (duplicate) guard
* Avoid useless exception check
* Prevent duplicate store
* Eliminate repatable re-assignment of stack zval types
* Enable combination of some instructions with the following SEND_VAL for IR JIT
* Avoid generation of useless RLOADs
* Eliminatare refcouting in a sequence of FETCH_DIM_R
* Fix assertion
* Remove ZREG_ZVAL_ADDREF flag from an element of abstract stack
* Implement IR JIT for FETCH_OBJ_*
* Implement IR JIT for ASSIGN_OBJ
* Implement IR JIT for ASSIGN_OBJ_OP
* cleanup
* Implement IR JIT for (PRE/POST)_(INC/DEC)_OBJ
* ws
* cleanup
* Fix IR JIT for constructor call
* Fix opcache.jit=1201 IR JIT.
With opcache.jit=1201 we still have to generate code for follow and target basic blocks with single exiting VM instruction. We mat just omit the entry point.
* Fix IR construction for the case when both IF targets are the same
* Avoid PHP LEAVE code duplication in function IR JIT.
* Reload operands from memeory when overflow (this improves hot code)
* Implement IR JIT for SWITCH_LONG, SWITCH_STRING and MATCH
* Initialize result to IS_UNDEF
* Fix JIT integraion with observer (Zend/tests/gh10346.phpt failure)
* Fix incorrect compilation of FE_FETCH with predicted empty array
* Fix register allocation
* Use sign extension inxted of zero
* Fix trace register allocator
* cleanp
* Fix address sanitizer warning
* Calculate JIT trace prologue sixe on startup (to avoid magic constants).
* Add cgecks for merge arrays overflow (this should be refactored using lists)
* Cache TLS access to perform corresponding read once per basic block
* cleanup unused variable
* Fix IR JIT support for CLANG build (CALL VM without global register variables)
* Fix IR JIT for CALL VM with global register variables
* Allow %rpb ysage in JIT for CALL VM (we save and restore it in prologue/epilogue anyway)
* cleanup
* Allocate enough fixed stack to keep preserved registers
* We don't have to care about x29 and x30
* cleanup (JMPZ/NZ_EX work fine)
* Revert "cleanup (JMPZ/NZ_EX work fine)"
This reverts commit cf8dd74a040e225d290d8ac4f5e33df638e6f8b8.
* Don't allocate register for PHP variables that are loaded from memory and used once
* Eliminate redundand deoptimization stores
* cleanup
* cleanup
* cleanup
* Optimization for constant comparison
* Cleanup and elimination of dead deoptimization stores
* Eliminate duplicate constant loading
* Set proper initial SP offset info for GDB backtraces
This doesn't take into account the following SP/FP modifications
* Add spill stores
* Remove low limit on number of deoptimization constants
* Emit dead code only when it's really necessary for IR graph
* cleanup
* cleanup
* Prefer loading long constants from memory (instead of loading immediate value)
* Regiter disasm labels using macros (add missing helpers)
* Make IR franework to care about GUARD JMP reordering
* Avoid reloading
* Improve register allocation for IR tracing JIT
* Add comment
* Fix deoptimization on result type guard of FETCH_DIM_R and FETCH_OBJ_R
* If HYBRID VM can't provide some stack space for JIT code in "red zone" then JIT has to reserve stack space itself
* Dump IR for stubs only if disassembling of stubs is requested
* Revert "Dump IR for stubs only if disassembling of stubs is requested"
This reverts commit d8b56bec129bc23c2b16f1f3c6367190181b6fdb.
* Dump IR for stubs only if disassembling of stubs is requested (another approach)
* Improve overflow deoptimization for ADD(_,1) and SUB(_,1)
Now we deoptimize to the next instruction, load constant result, and remove op1 from SNAPSHOT
* Switch to IR Builder API
* Switch to new IR builder macros
* Fix jit_set_Z_TYPE_INFO() call. op3 is a simple constant (not a ir_ref).
* Generate better code
* Enable empty ENTRY block merging
* Improve code generated for array separation/creation before an update
(ASSIGN_DIM, ASSING_DIM_OP, etc)
* Fix incorrect deleteion of PHI source (op1 is used for control link)
* Load constant once
* cleanup
* Improve control-flow to avoid two IS_ARRAY checks for REFERENCEs
* Update comments
* cleanup
* Clenup comments
* Fix AAarch 64 build (disable stack adjustment auto-detection)
* Add filename and line number to closure names
* Reserve stack for parameter passing
* Increase size of CPU stack reserved for JIT-ed code
* Fix addess sanitizer warnings
* Clenup: introduce OPTIMIZE_FOR_SIZE macro (disabled by default)
* Port 08e7591206 to IR JIT
Fix (at lease part of the) #GH-10635: ARM64 function JIT causes impossible assertion
* cleanup
* Preload constant and use tests that may be compiled into better code
* Convert helpers to stubs
* Introduce a helper data structure (ir_refs) to collect references for the following use in (MERGE/PHI)_N
* Use ir_refs
* Improve code generated by zend_jit_zval_copy_deref()
* Use "cold" attribute to influence IR block scheduler and achieve better code layout
* Keep info collected by recursion analyzer
* Use HTTPS URL to allow fetching without a SSH key
* Update IR
* Update IR
* Add IR JIT support for Wondows (Win64 support is incomplete)
* Update IR
* Update IR
* Fix support for Windows ZTS build
* Fix stack alignment
* Cleanup ir_ctx.control usage
* Fixed support for irreducable (incomplete) and merged loops
* Revert "Fixed support for irreducable (incomplete) and merged loops"
This reverts commit 672b5b89f47e8b81745fb73c86e0bcb0937daf16.
* Generate better code for RECV_ENTRies
* Use simpler and more efficient checks
* Switch to new ENTRY node concept
* Limit register usage across the OSR ENTRY point
* Upate MEM type only if we write to memory
* Use LOOP_END without a reference edge
* Use new ir_init() prototype
* Delay LOAD for better LOAD fusion
* Fix RECV/RECV_INIT compilation with opcache.jit=1235
* iPtoperly compile fake closures (they mau be called as regular functions)
* Fix reabase
* Fix rebase and add --with-capstone support for IR JIT
* Replace zend_uchar -> uint8_t
* IR JIT support for delayed destructor for zend_assign_to_typed_ref/prop
* Handle zend_execute_internal in IR JIT
* Fix readonly+clone IR JIT issues
* Switch to ir_ctx.mflags
* Ckeanup "inputs_count" access
* Disable CSE for nodes bound to PHP local varibles
The stack slots for temporaty variables may be reused and in case of
spilling this may cause clobbering of the value.
(ext/standard/tests/strings/htmlentities20.phpt on x86 with tracing JIT)
* Fix deoptimization code when link traces
See ext/zlib/tests/bug75273.phpt failure
* Fix missing type store
This fixes ext/openssl/tests/openssl_error_string_basic_openssl3.phpt
* Fix tracing JIT for overflowing INC/DEC
Fixes tests/lang/operators/preinc_basiclong_64bit.phpt
* Remove ir_remove_unreachable_blocks() call. Now it's called by ir_build_cfg(), when necessary.
* IR JIT: Fixed inaccurate range inference usage for UNDEF/NULL/FALSE
* IR JIT: Fixed GH-11127 (JIT fault)
* Avoid allocation of unused exit point
* Don't record already stored PHP variables in SNAPSHOTs
* Delay variable load
* Disable CSE across ENTRY
* Fixed disabling CSE
* Fix deoptimization
* Fixed deoptimization
* Disable incorrect register allocation
* Fix JIT for INDENTICAL+JMPZ_EX
* Add comments
* Fixed missed type stores
* IR JIT: added support for CLDEMOTE
* Fixed incorrect constant usage
* Disable compilation of PHP functions with irreducible CGF
* Fixed liveness check
* Fixed code for constant conditional jump
* Add type store to avoid use-after-free
* Fixed liveness analyses
* Gnerate SNAPSHOT for virtual method calls
* More accurate search for staticaly inferred info about a trace SSA vaiable
* Fix incorrect result use type_info
* Fix JMPZ/NZ_EX support and missing type store
* Fixed trace type inference and missing type store
* Store type of unused CV to prevent possible following use after free
* Fixed deoptimizaton info
* Fixed stack layout
* Implemented support for veneers on AArch64
* Dsable CSE to avoid over-optimization
* Don't bind nodes for TMP PHP variables
* Re-enable CSE for temporary variables as we don't bind them anymore
* Switch to CPU stack spill slots
* Add codegen info dump
* Initialize CV variables through FP (this enables some folding optimizatios)
* Use zero-extension that can be eliminated
* Avoid generation of dead PHIs
* Increase preallocated spill stack size
* Enable IR based JIT by default
* Fixed build with -disable-opcache-jit
* Use explicit type conversion & force load values to registerts
* Fix IR build
* Checkout submodules in github actions
* Fixed Windows build
* Fixed Windows build
* Fixed reattach to IR JIT SHM
* Update IR
* Checkout submodules in nightly CI
* Fix MACOS ZTS in IR JIT
* Update ir
* Fixed incorrect register allocation
* Fixed incorect code generation
* Fixed tracing jit for BIND_INIT_STATIC_OR_JMP
* Update README
* Typos
* Revert JIT disabling for run-tests.php workers
* Fixed code review issues
* Update IR
* Update IR
* Update IR
* Allow exit_point duplication, when the deoptimization info differs because of spilling
* Use bound spill slots for CV (once again)
* Improve error handling
* Removed IR submodule
* Remove IR submodule from workflows
* Embed IR
IR commit: 8977307f4e96ee03847d7f2eb809b3080f9ed662
* Add .gitignore
* Fixed according to feedback
* Force C saving preserved registers only for HYBRID VM
* Update IR
IR commit: a2f8452b3d35a756cba38924f5c51a48a7207494
* cleanup
* Replace ZEND_ASSERT(0) by ZEND_UNREACHABLE()
* Update IR and remove unused IR files
IR commit: 399a38771393c202a741336643118991290b4b1b
* Fixed inconsistency between IR code-generation and register-allocation
* Update IR
IR commit: 86685504274b0c71d9985b3c926dccaca2cacf9b
* Update ir_PHI*() according to IR construction API changes
* Fixed 32-bit build
* Update IR
IR commit: d0686408e20cd8c8640e37ed52ab81403a2383cb
* Support for ir_TAILCALL() prototype changes
* Update IR
IR commit: d72ae866e09d17e879378767aceb91d51894818c
* Fixed incorrect extension (ZEXT->SEXT)
* Fix SSA dominance
* Update IR
IR commit: d60d92516dc5f89b93cdf1df7a54141e83226b07
* Fixed support ir_ctx.ret_type
Max length of a single trace. A long trace generates long JITTed
code, which influences the performance slightly.
opcache.jit_max_trace_length range is [4,1024], the default value
is 1024.
Reviewed-by: Su, Tao <tao.su@intel.com>
Signed-off-by: Wang, Xue <xue1.wang@intel.com>
PHP JIT supports three configurations: HYRBID, CALL with global register
variables feature(CALL+GRV for short), and CALL+noGRV.
CALL+GRV mode can be built with the following commands:
```
php Zend/zend_vm_gen.php --with-vm-kind=CALL
./buildconf -f; ./configure; make
```
About 230 test cases failed for tracing JIT under CALL+GRV mode on both
x86 and arm64 machines.
For CALL+GRV mode, the condition to determine whether the execution of
an oparray is finished, is "opline == NULL". See function execute_ex()
around line "if (UNEXPECTED(!OPLINE)) {".
However, such cleanup operation is missing for the JIT wrapper
zend_jit_trace_counter_helper(), and the trace_halt stub function.
Tests:
1. test cases: all .phpt test cases under "Zend/tests/ tests/
ext/opcache/tests/jit/".
2. both JIT/x86 and JIT/arm64: function JIT, tracing JIT and tracing JIT
with "--repeat 3"
3. execution modes: NTS/ZTS, HYBRID/CALL+GRV/CALL+noGRV
In my local test, these test cases passed under all JIT configrations.
Convert zend_hash_find_ex(..., 1) to zend_hash_find_known_hash(...)
Convert zend_hash_find_ex(..., 0) to zend_hash_find(...)
Also add serializable changes to UPGRADING.INTERNALS summary
Support acquiring a Closure to a callable using the syntax
func(...), $obj->method(...), etc. This is essentially a
shortcut for Closure::fromCallable().
RFC: https://wiki.php.net/rfc/first_class_callable_syntax
Closes GH-7019.
Co-Authored-By: Nikita Popov <nikita.ppv@gmail.com>
SUMMARY
We implemented a prototype of PHP JIT/arm64. Briefly speaking,
1. build system
Changes to the build system are made so that PHP JIT can be successfully
built and run on ARM-based machine.
Major change lies in file zend_jit_arm64.dasc, where the handler for
each opcode is generated into machine code. Note that this file is just
copied from zend_jit_x86.dasc and the *unimplemented* parts are
substitued with 'brk' instruction for future work.
2. registers
AArch64 registers are defined in file zend_jit_arm64.h. From our
perspectives, the register usage is quite different from the x86
implementation due to the different ABI, number of registers and
addressing modes.
We had many confusions on this part, and will discuss it in details in
the final section.
3. opcodes
Several opcodes are partially supported, including INIT_FCALL, DO_UCALL,
DO_ICALL, RETURN, ADD, PRE_INC, JMP, QM_ASSIGN, etc. Hence, simple use
scenarios such as user function call, loops, addition with integer and
floating point numbers can be supported.
18 micro test cases are added under 'ext/opcache/tests/jit/arm64/'. Note
that majority of these test cases are design for functional JIT, and
cases 'hot_func_*.phpt' and 'loop_002.phpt' can trigger tracing JIT.
4. test
Our local test environment is an ARM-based server with Ubuntu 20.04 and
GCC-10. Note that both HYBRID and CALL VM modes are supported. We
suggest running the JIT test cases using the following command. Out of
all 130 test cases, 66 cases can be passed currently.
```
$ make test TESTS='-d opcache.jit=1203 ext/opcache/tests/jit/'
```
DETAILS
1. I-cache flush
Instruction cache must be flushed for the JIT-ed code on AArch64. See
macro JIT_CACHE_FLUSH in file 'zend_jit_internal.h'.
2. Disassembler
Add initialization and jump target parse operations for AArch64 backed.
See the updates in file 'zend_jit_disasm.c'.
3. redzone
Enable redzone for AArch64. See the update in zend_vm_opcodes.h.
Redzone is designated to prevent 'vm_stack_data' from being optimized
out by compilers. It's worth noting that this 16-byte redzone might be
reused as temporary use(treated as extra stack space) for HYBRID mode.
4. stack space reservation
The definitions of HYBRID_SPAD, SPAD and NR_SPAD are a bit tricky for
x86/64.
In AArch64, HYBRID_SPAD and SPAD are both defined as 16. These 16 bytes
are pre-allocated for tempoerary usage along the exuection of JIT-ed
code. Take line 4185 in file zend_jit_arm64.dasc as an example. NR_SPAD
is defined as 48, out of which 32 bytes to save FP/IP/LR registers.
Note that we choose to always reserve HYBRID_SPAD bytes in HYBRID mode,
no matter whether redzone is used or not, for the sake of safety.
5. stack alignment
In AArch64 the stack pointer should be 16-byte aligned. Since shadow
stack is used for JIT, it's easy to guarantee the stack alignment, via
simply moving SP with an offset like 16 or a multiple of 16. That's why
NR_SPAD is defined as 48 and we use 32 of them to save FP/IP/LR
registers which only occupies 24 bytes.
6. global registers
x27 and x28 are reserved as global registers. See the updates in file
zend_jit_vm_helpers.c
7. function prologue for CALL mode
Two callee-saved registers x27 and x28 should saved in function
zend_jit_prologue() in file zend_jit_arm64.dasc. Besides the LR, i.e.
x30, should also be saved since runtime C helper functions(such as
zend_jit_find_func_helper) might be invoked along the execution of
JIT-ed code.
8. regset
Minor changes are done to regset operations particularly for AArch64.
See the updates in file zend_jit_internal.h.
REGISTER USAGE
In this section, we will first talk about our understanding on register
usage and then demonstrate our design.
1. Register usage for HYBRID/CALL modes
Registers are used similarly between HYBRID mode and CALL mode.
One difference is how FP and IP are saved. In HYBRID mode, they are
assigned to global registers, while in CALL mode they are saved/restored
on the VM stack explicitly in prologue/epilogue.
The other difference is that LR register should also be saved/restored
in CALL mode since JIT-ed code are invoked as normal functions.
2. Register usage for functional/tracing JIT
The way registers are used differs a lot between functional JIT and
tracing JIT.
For functional JIT, runtime C code (e.g. helper functions) would be
invoked along the execution of JIT-ed code. As the operands for *most*
opcodes are accessed via the stack slot, i.e. FP + offset. Hence there
is no need to save/restore local(caller-saved) registers before/after
invoking runtime C code.
Exception lies in Phi node and registers might be allocated for these
nodes. Currently I don't fully understand the reason, why registers are
allocated for Phi functions, because I suppose for different versions of
SSA variables at the Phi function, their postions on the stack slot
should be identical(in other words, access via the stack slot is enough
and there is no need to allocate registers).
For tracing JIT, runtime information are recorded for traces(before the
JIT compilation), and the data types and control flows are concrete as
well. Hence it's would be faster to conduct operations and computations
via registers rather than stack slots(as functional JIT does) for these
collected hot paths. Besides, runtime C code can be invoked for tracing
JIT, however this only happends for deoptimization and all registers are
saved to stack in advance.
3. Candidates for register allocator
1) opcode candidates
Function zend_jit_opline_supports_reg() determines the candidate opcodes
which can use CPU registers.
2) register candidates
Registers in set "ZEND_REGSET_FP + ZEND_REGSET_GP - ZEND_REGSET_FIXED -
ZEND_REGSET_PRESERVED" are available for register allocator.
Note that registers from ZEND_REGSET_FIXED are reserved for special
purpose, such as the stack pointer, and they are excluded from register
allocation process.
Note that registers from ZEND_REGSET_PRESERVED are callee-saved based on
the ABI and it's safe to not use them either.
4. Temporary registers
Temporary registers are needed by some opcodes to save intermediate
computation results.
1) Functions zend_jit_get_def_scratch_regset() and
zend_jit_get_scratch_regset() return which registers might be clobbered
by some opcodes. Hence register allocator would spill these scratch
registers if necessary when encountering these opcodes.
2) Macro ZEND_REGSET_LOW_PRIORITY denotes a set of registers which would
be allocated with low priority, and these registers can be used as
temporary usage to avoid conflicts to its best.
5. Compared to the x86 implementation, in JIT/arm64
1) Called-saved FP registers are included into ZEND_REGSET_PRESERVED for
AArch64.
2) We follow the logic of function zend_jit_opline_supports_reg().
3) We reserve 4 GPRs and 2 FPRs out from register allocator and use them
as temporary registers in particular. Note that these 6 registers are
included in set ZEND_REGSET_FIXED.
Since they are reserved, may-clobbered registers can be removed for most
opcodes except for function calls. Besides, low-priority registers are
defined as empty since all candidate registers are of the same priority.
See the updates in function zend_jit_get_scratch_regset() and macro
ZEND_REGSET_LOW_PRIORITY.
6. Why we reserve registers for temporary usage?
1) Addressing mode in AArch64 needs more temporary registers.
The addressing mode is different from x86 and tempory registers might be
*always* needed for most opcodes. For instance, an immediate must be
first moved into one register before storing into memory in AArch64,
whereas in x86 this immediate can be stored directly.
2) There are more registers in AArch64.
Compared to the solution in JIT/x86(that is, temporary registers are
reserved on demand, i.e. different registers for different opcodes under
different conditions), our solution seems a coarse-granularity and
brute-force solution, and the execution performance might be downgraded
to some extent since the number of candidate registers used for
allocation becomes less.
We suppose the performance loss might be acceptable since there are more
registers in AArch64.
3) Based on my understanding, scratch registers defined in x86 are
excluded from candidates for register allocator with *low possibility*,
and it can still allocate these registers. Special handling should be
conducted, such as checking 'reg != ZREG_R0'.
Hence, as we see it, it's simpler to reserve some temporary registers
exclusively. See the updates in function zend_jit_math_long_long() for
instance. TMP1 can be used directly without checking.
Co-Developed-by: Nick Gasson <Nick.Gasson@arm.com>
1. Update: http://www.php.net/license/3_01.txt to https, as there is anyway server header "Location:" to https.
2. Update few license 3.0 to 3.01 as 3.0 states "php 5.1.1, 4.1.1, and earlier".
3. In some license comments is "at through the world-wide-web" while most is without "at", so deleted.
4. fixed indentation in some files before |
We're starting to see a mix between uses of zend_bool and bool.
Replace all usages with the standard bool type everywhere.
Of course, zend_bool is retained as an alias.
