https://devblogs.microsoft.com/oldnewthing/20190805-00/?p=102749

Skip to main content
[RE1Mu3b] Microsoft
The Old New Thing
The Old New Thing
The Old New Thing

  * Home
  * DevBlogs
  * Developer
      + Visual Studio
      + Visual Studio Code
      + Visual Studio for Mac
      + DevOps
      + Windows Developer
      + Developer support
      + ISE Developer
      + Engineering@Microsoft
      + Azure SDK
      + Command Line
      + Perf and Diagnostics
      + Notification Hubs
      + Math in Office
      + React Native
  * Technology
      + DirectX
      + PIX
      + Semantic Kernel
      + SurfaceDuo
      + Startups
      + Sustainable Engineering
      + Windows AI Platform
  * Languages
      + C++
      + C#
      + F#
      + TypeScript
      + PowerShell Community
      + PowerShell Team
      + Python
      + Q#
      + JavaScript
      + Java
      + Java Blog in Chinese
  * .NET
      + All .NET posts
      + .NET MAUI
      + ASP.NET Core
      + Blazor
      + Entity Framework
      + AI
      + Machine Learning
      + NuGet
      + Servicing
      + Xamarin
      + .NET Blog in Chinese
  * Platform Development
      + #ifdef Windows
      + Azure Depth Platform
      + Azure Government
      + Azure VM Runtime Team
      + Bing Dev Center
      + Microsoft Edge Dev
      + Microsoft Azure
      + Microsoft 365 Developer
      + Microsoft Entra Identity Developer Blog
      + Old New Thing
      + Power Platform
      + Windows MIDI and Music dev
  * Data Development
      + Azure Cosmos DB
      + Azure Data Studio
      + Azure SQL Database
      + OData
      + Revolutions R
      + SQL Server Data Tools
  * More

[                    ] Search Search

  * No results

Cancel

The SuperH-3, part 1: Introduction

[png]

Raymond Chen

August 5th, 20198 0

Windows CE supported the Hitachi SuperH-3 and SuperH-4 processors.
These were commonly abbreviated SH-3 and SH-4, or just SH3 and SH4,
and the architecture series was known as SHx.

I'll cover the SH-3 processor in this series, with some nods to the
SH-4 as they arise. But the only binaries I have available for
reverse-engineering are SH-3 binaries, so that's where my focus will
be.

The SH-3 is the next step in the processor series that started with
the SH-1 and SH-2. It was succeeded by the SH-4 as well as the
offshoots SH-3e and SH-3-DSP. The SH-4 is probably most famous for
being the processor behind the Sega Dreamcast.

As with all the processor retrospective series, I'm going to focus on
how Windows CE used the processor in user mode, with particular focus
on the instructions you will see in compiled code.

The SH-3 is a 32-bit RISC-style (load/store) processor with
fixed-length 16-bit instructions. The small instruction size permits
higher code density than its contemporaries, with Hitachi claiming a
code size reduction of a third to a half compared to processors with
32-bit instructions. The design was apparently so successful that ARM
licensed it for their Thumb instruction set.

The SH-3 can operate in either big-endian or little-endian mode.
Windows CE uses it in little-endian mode.

The SH-3 has sixteen general-purpose integer registers, each 32 bits
wide, and formally named r0 through r15. They are conventionally used
as follows:

+------------------------------------------+
|  Register   |    Meaning    | Preserved? |
|-------------+---------------+------------|
| r0          | return value  | No         |
|-------------+---------------+------------|
| r1          |               | No         |
|-------------+---------------+------------|
| r2          |               | No         |
|-------------+---------------+------------|
| r3          |               | No         |
|-------------+---------------+------------|
| r4          | argument 1    | No         |
|-------------+---------------+------------|
| r5          | argument 2    | No         |
|-------------+---------------+------------|
| r6          | argument 3    | No         |
|-------------+---------------+------------|
| r7          | argument 4    | No         |
|-------------+---------------+------------|
| r8          |               | Yes        |
|-------------+---------------+------------|
| r9          |               | Yes        |
|-------------+---------------+------------|
| r10         |               | Yes        |
|-------------+---------------+------------|
| r11         |               | Yes        |
|-------------+---------------+------------|
| r12         |               | Yes        |
|-------------+---------------+------------|
| r13         |               | Yes        |
|-------------+---------------+------------|
| r14, aka fp | frame pointer | Yes        |
|-------------+---------------+------------|
| r15, aka sp | stack pointer | Yes        |
+------------------------------------------+

We'll learn more about the conventions when we study calling
conventions.

There are actually two sets (banks) of the first eight registers (r0
through r7). User-mode code uses only bank 0, but kernel mode can
choose whether it uses bank 0 or bank 1. (And when it's using one
bank, kernel mode has special instructions available to access the
registers from the other bank.)

The SH-3 does not support floating point operations, but the SH-4
does. There are sixteen single-precision floating point registers
which are architecturally named fpr0 through fpr15, but which the
Microsoft assembler calls fr0 through fr15. They can be paired up to
produce eight double-precision floating point registers:

+-------------------------------------------------------------+
| Double-precision register | Single-precision register pair  |
|---------------------------+---------------------------------|
| dr0                       | fr0            | fr1            |
|---------------------------+----------------+----------------|
| dr2                       | fr2            | fr3            |
|---------------------------+----------------+----------------|
| dr4                       | fr4            | fr5            |
|---------------------------+----------------+----------------|
| dr6                       | fr6            | fr7            |
|---------------------------+----------------+----------------|
| dr8                       | fr8            | fr9            |
|---------------------------+----------------+----------------|
| dr10                      | fr10           | fr11           |
|---------------------------+----------------+----------------|
| dr12                      | fr12           | fr13           |
|---------------------------+----------------+----------------|
| dr14                      | fr14           | fr15           |
+-------------------------------------------------------------+

If you try to perform a floating point operation on an SH-3, it will
trap, and the kernel will emulate the instruction. As a result,
floating point on an SH-3 is very slow.

Windows NT requires that the stack be kept on a 4-byte boundary. I
did not observe any red zone.

There are also some special registers:

+-------------------------------------------------------------------+
| Register |      Meaning      | Preserved? |         Notes         |
|----------+-------------------+------------+-----------------------|
| pc       | program counter   | duh        | instruction pointer,  |
|          |                   |            | must be even          |
|----------+-------------------+------------+-----------------------|
| gbr      | global base       | No         | bonus pointer         |
|          | register          |            | register              |
|----------+-------------------+------------+-----------------------|
| sr       | status register   | No         | Flags                 |
|----------+-------------------+------------+-----------------------|
| mach     | multiply and      | No         | For multiply-add      |
|          | accumulate high   |            | operations            |
|----------+-------------------+------------+-----------------------|
| macl     | multiply and      | No         | For multiply-add      |
|          | accumulate low    |            | operations            |
|----------+-------------------+------------+-----------------------|
| pr       | procedure         | Yes        | Return address        |
|          | register          |            |                       |
+-------------------------------------------------------------------+

Some calling conventions for the SH-3 say that mach and macl are
preserved, or that gbr is reserved, but in Windows CE, they are all
scratch.

We'll take a closer look at the status register later.

The architectural names for data sizes are as follows:

  * byte: 8-bit value
  * word: 16-bit value
  * longword: 32-bit value
  * quadword: 64-bit value

Unaligned memory accesses will fault. We'll look more closely at
unaligned memory access later.

The SH-3 has branch delay slots. Ugh, branch delay slots. What's
worse is that some branch instructions have branch delay slots and
some don't. Yikes! We'll discuss this in more detail when we get to
control transfer.

Instructions on the SH-3 are generally written with source on the
left and destination on the right. For example,

    MOV     r1, r2      ; move r1 to r2

The SH-3 can potentially retire two instructions per cycle, although
internal resource conflicts may prevent that. For example, an ADD can
execute in parallel with a comparison instruction, but it cannot
execute in parallel with a SUB instruction. In the case of a resource
conflict, only one instruction is retired during that cycle.

After an instruction that modifies flags, the new flags are not
available for a cycle, and after a load instruction, the result is
not available for two cycles. There are other pipeline hazards, but
those are the ones you are likely to encounter. If you try to use the
results of a prior instruction too soon, the processor will stall.
(Don't forget that the SH-3 is dual-issue, so two cycles can mean up
to four instructions.)

Okay, that's enough background. We'll dig in next time by looking at
addressing modes.

[png]

Raymond Chen

Follow    

Tagged History

Read next

The SuperH-3, part 2: Addressing modes
Quite a lot for a RISC.
[png]Raymond Chen
August 6, 2019
4 comments
The SuperH-3, part 3: Status flags and miscellaneous instructions
Basically, there's only one flag.
[png]Raymond Chen
August 7, 2019
0 comment

8 comments

Comments are closed. Login to edit/delete your existing comments

  * [png]
    Peter Cooper Jr. August 5, 2019 7:23 am  0
    collapse this comment copy link to this comment
   
    Hooray, another architecture! I had no idea that Windows had run
    on so many over the years.
    Does the SH-3 have all the floating point registers, and just the
    instructions to manipulate aren't implemented? I was a little
    confused by the section that says they were only on the SH-4, but
    then could be emulated on the SH-3. (Not that I expect I'll ever
    need to actually debug or write code for either of them.)

    Looking forward to the rest of the series!

      + [png]
        Reinhard Weiss August 5, 2019 9:47 am  0
        collapse this comment copy link to this comment
       
        There are neither floating point instructions nor registers
        implemented on the processor. The kernel stores the floating
        point registers in RAM.

          o [png]
            Rick C August 5, 2019 10:38 am  0
            collapse this comment copy link to this comment
           
            The later version Raymond mentions, the SH-3e, had
            floating point hardware, but the original SH-3 didn't.
            It looks like (maybe only some of) the HP Jornadas used
            the SH-3; I had an HP 4705 in 2005, but it used an Intel
            ARM CPU.

  * [png]
    Yukkuri Reimu August 5, 2019 10:39 am  0
    collapse this comment copy link to this comment
   
    Oh yeah, more chip stuff!

  * [png]
    Dave Gzorple August 5, 2019 5:21 pm  0
    collapse this comment copy link to this comment
   
    The SuperH's were nice CPUs for the time, reasonably clean
    instruction set, fast, cheap, they were nice to work with.

  * [png]
    Matteo Italia August 6, 2019 12:59 pm  0
    collapse this comment copy link to this comment
   
    > Windows NT requires that the stack be kept on a 4-byte
    boundary.
    I may be wrong (Windows CE was always a bit of a mistery zone to
    me, it isn't related to NT, right?), but I suppose you mean
    Windows CE.

  * [png]
    Joshua Hudson August 6, 2019 7:10 pm  0
    collapse this comment copy link to this comment
   
    In honor of Raymond's excellent series on processor instruction
    sets and coding for them, I wrote down a hypothetical instruction
    set for a hypothetical 64 bit processor. https://pastebin.com/
    bXkjuxhN

  * [png]
    Alex Nesemann August 12, 2019 9:47 am  0
    collapse this comment copy link to this comment
   
    Some corrections:
    1: I have never seen the floating point registers referred to as
    fpr_ in any official documentation, only as fr_. It's probably an
    invention of... wherever it is that you saw it.
    2: Maybe you were planning to get into this later, but the SH-4
    actually has 32 floating point registers, made up of two banks of
    16 registers. The front bank is the one that's normally accessed
    by most floating point instructions, while the back bank is used
    as a 4x4 matrix. The SH-4 has a instruction that multiplies the
    4x4 matrix with a 4D vector, producting a new 4D vector, in a
    single instruction. Very handy for 3D graphics. The floating
    point registers are also grouped into 4 vectors, called fv0, fv4,
    fv8, and fv12. The individual back bank registers are called xd0
    through xd15, their double pairs are called xd0 through xd14.
    3: The SH-3 was single issue, only the SH-4 was superscalar.

Archive

  * January 2024
  * December 2023
  * November 2023
  * October 2023
  * September 2023
  * August 2023
  * July 2023
  * June 2023
  * May 2023
  * April 2023
  * March 2023
  * February 2023
  * January 2023
  * December 2022
  * November 2022
  * October 2022
  * September 2022
  * August 2022
  * July 2022
  * June 2022
  * May 2022
  * April 2022
  * March 2022
  * February 2022
  * January 2022
  * December 2021
  * November 2021
  * October 2021
  * September 2021
  * August 2021
  * July 2021
  * June 2021
  * May 2021
  * April 2021
  * March 2021
  * February 2021
  * January 2021
  * December 2020
  * November 2020
  * October 2020
  * September 2020
  * August 2020
  * July 2020
  * June 2020
  * May 2020
  * April 2020
  * March 2020
  * February 2020
  * January 2020
  * December 2019
  * November 2019
  * October 2019
  * September 2019
  * August 2019
  * July 2019
  * June 2019
  * May 2019
  * April 2019
  * March 2019
  * February 2019
  * January 2019
  * December 2018
  * November 2018
  * October 2018
  * September 2018
  * August 2018
  * July 2018
  * June 2018
  * May 2018
  * April 2018
  * March 2018
  * February 2018
  * January 2018
  * December 2017
  * November 2017
  * October 2017
  * September 2017
  * August 2017
  * July 2017
  * June 2017
  * May 2017
  * April 2017
  * March 2017
  * February 2017
  * January 2017
  * December 2016
  * November 2016
  * October 2016
  * September 2016
  * August 2016
  * July 2016
  * June 2016
  * May 2016
  * April 2016
  * March 2016
  * February 2016
  * January 2016
  * December 2015
  * November 2015
  * October 2015
  * September 2015
  * August 2015
  * July 2015
  * June 2015
  * May 2015
  * April 2015
  * March 2015
  * February 2015
  * January 2015
  * December 2014
  * November 2014
  * October 2014
  * September 2014
  * August 2014
  * July 2014
  * June 2014
  * May 2014
  * April 2014
  * March 2014
  * February 2014
  * January 2014
  * December 2013
  * November 2013
  * October 2013
  * September 2013
  * August 2013
  * July 2013
  * June 2013
  * May 2013
  * April 2013
  * March 2013
  * February 2013
  * January 2013
  * December 2012
  * November 2012
  * October 2012
  * September 2012
  * August 2012
  * July 2012
  * June 2012
  * May 2012
  * April 2012
  * March 2012
  * February 2012
  * January 2012
  * December 2011
  * November 2011
  * October 2011
  * September 2011
  * August 2011
  * July 2011
  * June 2011
  * May 2011
  * April 2011
  * March 2011
  * February 2011
  * January 2011
  * December 2010
  * November 2010
  * October 2010
  * September 2010
  * August 2010
  * July 2010
  * June 2010
  * May 2010
  * April 2010
  * March 2010
  * February 2010
  * January 2010
  * December 2009
  * November 2009
  * October 2009
  * September 2009
  * August 2009
  * July 2009
  * June 2009
  * May 2009
  * April 2009
  * March 2009
  * February 2009
  * January 2009
  * December 2008
  * November 2008
  * October 2008
  * September 2008
  * August 2008
  * July 2008
  * June 2008
  * May 2008
  * April 2008
  * March 2008
  * February 2008
  * January 2008
  * December 2007
  * November 2007
  * October 2007
  * September 2007
  * August 2007
  * July 2007
  * June 2007
  * May 2007
  * April 2007
  * March 2007
  * February 2007
  * January 2007
  * December 2006
  * November 2006
  * October 2006
  * September 2006
  * August 2006
  * July 2006
  * June 2006
  * May 2006
  * April 2006
  * March 2006
  * February 2006
  * January 2006
  * December 2005
  * November 2005
  * October 2005
  * September 2005
  * August 2005
  * July 2005
  * June 2005
  * May 2005
  * April 2005
  * March 2005
  * February 2005
  * January 2005
  * December 2004
  * November 2004
  * October 2004
  * September 2004
  * August 2004
  * July 2004
  * June 2004
  * May 2004
  * April 2004
  * March 2004
  * February 2004
  * January 2004
  * December 2003
  * November 2003
  * October 2003
  * September 2003
  * August 2003
  * July 2003

Relevant Links

I wrote a book
Ground rules
Disclaimers and such
My necktie's Twitter

Categories

Code
History
Tips/Support
Other
Non-Computer

Stay informed

[                    ]
[Subscribe]
By subscribing you agree to our Terms of Use and Privacy Policy
    
   
Share on Social media

  *  
  *  
  *  

  
Login
Theme

  * light-theme-iconLight
  * dark-theme-iconDark

Code Block

x
Paste your code snippet [                    ]
Cancel Ok
 

Feedback usabilla icon

What's new

  * Surface Laptop Studio 2
  * Surface Laptop Go 3
  * Surface Pro 9
  * Surface Laptop 5
  * Surface Studio 2+
  * Copilot in Windows
  * Microsoft 365
  * Windows 11 apps

Microsoft Store

  * Account profile
  * Download Center
  * Microsoft Store support
  * Returns
  * Order tracking
  * Certified Refurbished
  * Microsoft Store Promise
  * Flexible Payments

Education

  * Microsoft in education
  * Devices for education
  * Microsoft Teams for Education
  * Microsoft 365 Education
  * How to buy for your school
  * Educator training and development
  * Deals for students and parents
  * Azure for students

Business

  * Microsoft Cloud
  * Microsoft Security
  * Dynamics 365
  * Microsoft 365
  * Microsoft Power Platform
  * Microsoft Teams
  * Microsoft Industry
  * Small Business

Developer & IT

  * Azure
  * Developer Center
  * Documentation
  * Microsoft Learn
  * Microsoft Tech Community
  * Azure Marketplace
  * AppSource
  * Visual Studio

Company

  * Careers
  * About Microsoft
  * Company news
  * Privacy at Microsoft
  * Investors
  * Diversity and inclusion
  * Accessibility
  * Sustainability

 Your Privacy Choices  Your Privacy Choices

  * Sitemap
  * Contact Microsoft
  * Privacy
  * Manage cookies
  * Terms of use
  * Trademarks
  * Safety & eco
  * Recycling
  * About our ads
  * (c) Microsoft 2024