The document describes QEMU's recompilation engine and how it converts CPU instructions from different instruction set architectures (ISAs) into Tiny Code Generator (TCG) micro-operations. It provides examples of PowerPC and x86 instructions being converted and their equivalent TCG micro-code. The document also shows how TCG is used to emulate different CPU instructions like addition and multiplication through the use of temporary variables and generation of low-level operations.

1. QEMU’s recompilation
engine
Donnerstag, 15. August 13

2. About Me
• Alexander Graf
• Freelance developer for SUSE and Freescale
• KVM and Qemu developer
• Server class PowerPC KVM port
• S390x Qemu guest support
• x86 Mac OS X in KVM
• Nested SVM
• ...
Donnerstag, 15. August 13

3. What is Emulation
Donnerstag, 15. August 13

4. Donnerstag, 15. August 13

5. Donnerstag, 15. August 13

6. Donnerstag, 15. August 13

7. Donnerstag, 15. August 13

8. Donnerstag, 15. August 13

9. Donnerstag, 15. August 13

10. Donnerstag, 15. August 13

11. CPU Instructions
Donnerstag, 15. August 13

12. CPU Instructions
Register Value
r0
r1
...
0
0
0
Donnerstag, 15. August 13

13. CPU Instructions
Register Value
r0
r1
...
0
0
...
38 21 00 01 !addi r1,r1,1
code:
38 20 00 01 !li r1,1
7c 20 0b 78 !mr r0,r1
Donnerstag, 15. August 13

14. CPU Instructions
Register Value
r0
r1
...
0
0
...
38 21 00 01 !addi r1,r1,1
code:
38 20 00 01 !li r1,1
7c 20 0b 78 !mr r0,r1
Donnerstag, 15. August 13

15. CPU Instructions
38 21 00 01 !addi r1,r1,1
code:
38 20 00 01 !li r1,1
7c 20 0b 78 !mr r0,r1
Register Value
r0
r1
...
0
...
0
Donnerstag, 15. August 13

16. CPU Instructions
38 21 00 01 !addi r1,r1,1
code:
38 20 00 01 !li r1,1
7c 20 0b 78 !mr r0,r1
Register Value
r0
r1
...
0
...
10
Donnerstag, 15. August 13

17. CPU Instructions
38 21 00 01 !addi r1,r1,1
code:
38 20 00 01 !li r1,1
7c 20 0b 78 !mr r0,r1
Register Value
r0
r1
...
0
...
1
Donnerstag, 15. August 13

18. CPU Instructions
Register Value
r0
r1
...
0
1
...
38 21 00 01 !addi r1,r1,1
code:
38 20 00 01 !li r1,1
7c 20 0b 78 !mr r0,r1
Donnerstag, 15. August 13

19. CPU Instructions
Register Value
r0
r1
...
0
1
...
38 21 00 01 !addi r1,r1,1
code:
38 20 00 01 !li r1,1
7c 20 0b 78 !mr r0,r1
Donnerstag, 15. August 13

20. CPU Instructions
Register Value
r0
r1
...
0
1
...
38 21 00 01 !addi r1,r1,1
code:
38 20 00 01 !li r1,1
7c 20 0b 78 !mr r0,r1
Donnerstag, 15. August 13

21. CPU Instructions
Register Value
r0
r1
...
1
...
38 21 00 01 !addi r1,r1,1
code:
38 20 00 01 !li r1,1
7c 20 0b 78 !mr r0,r1
0
Donnerstag, 15. August 13

22. CPU Instructions
Register Value
r0
r1
...
1
...
38 21 00 01 !addi r1,r1,1
code:
38 20 00 01 !li r1,1
7c 20 0b 78 !mr r0,r1
1
0
Donnerstag, 15. August 13

23. CPU Instructions
Register Value
r0
r1
...
1
...
38 21 00 01 !addi r1,r1,1
code:
38 20 00 01 !li r1,1
7c 20 0b 78 !mr r0,r1
1
Donnerstag, 15. August 13

24. CPU Instructions
Register Value
r0
r1
...
1
1
...
38 21 00 01 !addi r1,r1,1
code:
38 20 00 01 !li r1,1
7c 20 0b 78 !mr r0,r1
Donnerstag, 15. August 13

25. CPU Instructions
Register Value
r0
r1
...
1
1
...
code:
38 20 00 01 !li r1,1
7c 20 0b 78 !mr r0,r1
38 21 00 01 !addi r1,r1,1
Donnerstag, 15. August 13

26. CPU Instructions
Register Value
r0
r1
...
1
1
...
code:
38 20 00 01 !li r1,1
7c 20 0b 78 !mr r0,r1
38 21 00 01 !addi r1,r1,1
1
Donnerstag, 15. August 13

27. CPU Instructions
Register Value
r0
r1
...
1
1
...
code:
38 20 00 01 !li r1,1
7c 20 0b 78 !mr r0,r1
38 21 00 01 !addi r1,r1,1
1 + 1 =
Donnerstag, 15. August 13

28. CPU Instructions
Register Value
r0
r1
...
1
...
38 21 00 01 !addi r1,r1,1
code:
38 20 00 01 !li r1,1
7c 20 0b 78 !mr r0,r1
1 + 1 = 21
Donnerstag, 15. August 13

29. CPU Instructions
Register Value
r0
r1
...
1
...
38 21 00 01 !addi r1,r1,1
code:
38 20 00 01 !li r1,1
7c 20 0b 78 !mr r0,r1
2
Donnerstag, 15. August 13

30. CPU Instructions
Register Value
r0
r1
...
1
2
...
38 21 00 01 !addi r1,r1,1
code:
38 20 00 01 !li r1,1
7c 20 0b 78 !mr r0,r1
Donnerstag, 15. August 13

31. Register Value
r0
r1
...
1
2
...
38 21 00 01 !addi r1,r1,1
code:
38 20 00 01 !li r1,1
7c 20 0b 78 !mr r0,r1
Different ISAs
Donnerstag, 15. August 13

32. Different ISAs
Register Value
r0
r1
...
1
2
...
38 21 00 01 !addi r1,r1,1
code:
38 20 00 01 !li r1,1
7c 20 0b 78 !mr r0,r1
Register Value
eax
ebx
...
0
0
...
83 c3 01 ! add $0x1,%ebx
code:
bb 01 00 00 00! mov $0x1,%ebx
89 d8 ! mov %ebx,%eax
Donnerstag, 15. August 13

33. Different ISAs
Register Value
r0
r1
...
1
2
...
38 21 00 01 !addi r1,r1,1
code:
38 20 00 01 !li r1,1
7c 20 0b 78 !mr r0,r1
Register Value
eax
ebx
...
0
0
...
83 c3 01 ! add $0x1,%ebx
code:
bb 01 00 00 00! mov $0x1,%ebx
89 d8 ! mov %ebx,%eax
Donnerstag, 15. August 13

34. Different ISAs
Register Value
r0
r1
...
1
2
...
38 21 00 01 !addi r1,r1,1
code:
38 20 00 01 !li r1,1
7c 20 0b 78 !mr r0,r1
Register Value
eax
ebx
...
0
1
...
83 c3 01 ! add $0x1,%ebx
code:
bb 01 00 00 00! mov $0x1,%ebx
89 d8 ! mov %ebx,%eax
Donnerstag, 15. August 13

35. Different ISAs
Register Value
r0
r1
...
1
2
...
38 21 00 01 !addi r1,r1,1
code:
38 20 00 01 !li r1,1
7c 20 0b 78 !mr r0,r1
Register Value
eax
ebx
...
1
1
...
83 c3 01 ! add $0x1,%ebx
code:
bb 01 00 00 00! mov $0x1,%ebx
89 d8 ! mov %ebx,%eax
Donnerstag, 15. August 13

36. Different ISAs
Register Value
r0
r1
...
1
2
...
38 21 00 01 !addi r1,r1,1
code:
38 20 00 01 !li r1,1
7c 20 0b 78 !mr r0,r1
Register Value
eax
ebx
...
1
2
...
83 c3 01 ! add $0x1,%ebx
code:
bb 01 00 00 00! mov $0x1,%ebx
89 d8 ! mov %ebx,%eax
Donnerstag, 15. August 13

37. Different ISAs
Register Value
r0
r1
...
1
2
...
38 21 00 01 !addi r1,r1,1
code:
38 20 00 01 !li r1,1
7c 20 0b 78 !mr r0,r1
Register Value
eax
ebx
...
1
2
...
83 c3 01 ! add $0x1,%ebx
code:
bb 01 00 00 00! mov $0x1,%ebx
89 d8 ! mov %ebx,%eax
Donnerstag, 15. August 13

38. Converting code
Donnerstag, 15. August 13

39. Converting code
Donnerstag, 15. August 13

40. Converting code
Donnerstag, 15. August 13

41. Converting code
Donnerstag, 15. August 13

42. Converting code
Donnerstag, 15. August 13

43. Converting code
Donnerstag, 15. August 13

44. Converting code
Donnerstag, 15. August 13

45. Converting code
Donnerstag, 15. August 13

46. Converting code
Donnerstag, 15. August 13

47. Converting code
Donnerstag, 15. August 13

48. TCG
TCG
Donnerstag, 15. August 13

49. TCG
TCG
Donnerstag, 15. August 13

50. TCG
TCG
Donnerstag, 15. August 13

51. TCG micro-ops
38 21 00 01 !addi r1,r1,1
Donnerstag, 15. August 13

52. TCG micro-ops
38 21 00 01 !addi r1,r1,1
Donnerstag, 15. August 13

53. TCG micro-ops
tcg_gen_addi_tl(cpu_gpr[rD(ctx->opcode)], cpu_gpr[rA(ctx->opcode)], simm);
38 21 00 01 !addi r1,r1,1
Donnerstag, 15. August 13

54. TCG micro-ops
tcg_gen_addi_tl(cpu_gpr[rD(ctx->opcode)], cpu_gpr[rA(ctx->opcode)], simm);
38 21 00 01 !addi r1,r1,1
Donnerstag, 15. August 13

55. TCG micro-ops
tcg_gen_addi_tl(cpu_gpr[rD(ctx->opcode)], cpu_gpr[rA(ctx->opcode)], simm);
38 21 00 01 !addi r1,r1,1
Donnerstag, 15. August 13

56. TCG micro-ops
tcg_gen_addi_tl(cpu_gpr[rD(ctx->opcode)], cpu_gpr[rA(ctx->opcode)], simm);
38 21 00 01 !addi r1,r1,1
Donnerstag, 15. August 13

57. TCG micro-ops
tcg_gen_addi_tl(cpu_gpr[rD(ctx->opcode)], cpu_gpr[rA(ctx->opcode)], simm);
38 21 00 01 !addi r1,r1,1
Donnerstag, 15. August 13

58. TCG micro-ops
tcg_gen_addi_tl(cpu_gpr[rD(ctx->opcode)], cpu_gpr[rA(ctx->opcode)], simm);
38 21 00 01 !addi r1,r1,1
83 c3 01 ! add $0x1,%ebx
Donnerstag, 15. August 13

59. TCG micro-ops
7c 22 18 96 !mulhw r1,r2,r3
Donnerstag, 15. August 13

60. TCG micro-ops
7c 22 18 96 !mulhw r1,r2,r3
Donnerstag, 15. August 13

61. TCG micro-ops
t0 = tcg_temp_new_i64();
t1 = tcg_temp_new_i64();
tcg_gen_ext32s_tl(t0, cpu_gpr[rA(ctx->opcode)]);
tcg_gen_ext32s_tl(t1, cpu_gpr[rB(ctx->opcode)]);
tcg_gen_mul_i64(t0, t0, t1);
tcg_gen_shri_i64(cpu_gpr[rD(ctx->opcode)], t0, 32);
tcg_temp_free_i64(t0);
tcg_temp_free_i64(t1);
7c 22 18 96 !mulhw r1,r2,r3
Donnerstag, 15. August 13

62. TCG micro-ops
t0 = tcg_temp_new_i64();
t1 = tcg_temp_new_i64();
tcg_gen_ext32s_tl(t0, cpu_gpr[rA(ctx->opcode)]);
tcg_gen_ext32s_tl(t1, cpu_gpr[rB(ctx->opcode)]);
tcg_gen_mul_i64(t0, t0, t1);
tcg_gen_shri_i64(cpu_gpr[rD(ctx->opcode)], t0, 32);
tcg_temp_free_i64(t0);
tcg_temp_free_i64(t1);
7c 22 18 96 !mulhw r1,r2,r3
Donnerstag, 15. August 13

63. TCG micro-ops
t0 = tcg_temp_new_i64();
t1 = tcg_temp_new_i64();
tcg_gen_ext32s_tl(t0, cpu_gpr[rA(ctx->opcode)]);
tcg_gen_ext32s_tl(t1, cpu_gpr[rB(ctx->opcode)]);
tcg_gen_mul_i64(t0, t0, t1);
tcg_gen_shri_i64(cpu_gpr[rD(ctx->opcode)], t0, 32);
tcg_temp_free_i64(t0);
tcg_temp_free_i64(t1);
7c 22 18 96 !mulhw r1,r2,r3
Donnerstag, 15. August 13

64. TCG micro-ops
t0 = tcg_temp_new_i64();
t1 = tcg_temp_new_i64();
tcg_gen_ext32s_tl(t0, cpu_gpr[rA(ctx->opcode)]);
tcg_gen_ext32s_tl(t1, cpu_gpr[rB(ctx->opcode)]);
tcg_gen_mul_i64(t0, t0, t1);
tcg_gen_shri_i64(cpu_gpr[rD(ctx->opcode)], t0, 32);
tcg_temp_free_i64(t0);
tcg_temp_free_i64(t1);
7c 22 18 96 !mulhw r1,r2,r3
Donnerstag, 15. August 13

65. TCG micro-ops
t0 = tcg_temp_new_i64();
t1 = tcg_temp_new_i64();
tcg_gen_ext32s_tl(t0, cpu_gpr[rA(ctx->opcode)]);
tcg_gen_ext32s_tl(t1, cpu_gpr[rB(ctx->opcode)]);
tcg_gen_mul_i64(t0, t0, t1);
tcg_gen_shri_i64(cpu_gpr[rD(ctx->opcode)], t0, 32);
tcg_temp_free_i64(t0);
tcg_temp_free_i64(t1);
7c 22 18 96 !mulhw r1,r2,r3
Donnerstag, 15. August 13

66. TCG helper
7c 41 00 34 !cntlzw r1,r2
Donnerstag, 15. August 13

67. TCG helper
7c 41 00 34 !cntlzw r1,r2
gen_helper_cntlzw(cpu_gpr[rA(ctx->opcode)], cpu_gpr[rS(ctx->opcode)]);
Donnerstag, 15. August 13

68. TCG helper
7c 41 00 34 !cntlzw r1,r2
gen_helper_cntlzw(cpu_gpr[rA(ctx->opcode)], cpu_gpr[rS(ctx->opcode)]);
Donnerstag, 15. August 13

69. TCG helper
7c 41 00 34 !cntlzw r1,r2
gen_helper_cntlzw(cpu_gpr[rA(ctx->opcode)], cpu_gpr[rS(ctx->opcode)]);
Donnerstag, 15. August 13

70. TCG helper
7c 41 00 34 !cntlzw r1,r2
gen_helper_cntlzw(cpu_gpr[rA(ctx->opcode)], cpu_gpr[rS(ctx->opcode)]);
Donnerstag, 15. August 13

71. TCG helper
7c 41 00 34 !cntlzw r1,r2
gen_helper_cntlzw(cpu_gpr[rA(ctx->opcode)], cpu_gpr[rS(ctx->opcode)]);
Donnerstag, 15. August 13

72. TCG helper
7c 41 00 34 !cntlzw r1,r2
gen_helper_cntlzw(cpu_gpr[rA(ctx->opcode)], cpu_gpr[rS(ctx->opcode)]);
e8 e3 df 00 00 callq helper_cntlzw
Donnerstag, 15. August 13

73. TCG helper
7c 41 00 34 !cntlzw r1,r2
gen_helper_cntlzw(cpu_gpr[rA(ctx->opcode)], cpu_gpr[rS(ctx->opcode)]);
e8 e3 df 00 00 callq helper_cntlzw
target_ulong helper_cntlzw (target_ulong t)
{
return __builtin_clz(t);
}
Donnerstag, 15. August 13

74. Executing Code
Donnerstag, 15. August 13

75. Translation Blocks
Donnerstag, 15. August 13

76. Translation Blocks
Donnerstag, 15. August 13

77. Translation Blocks
Donnerstag, 15. August 13

78. Translation Blocks
code
Donnerstag, 15. August 13

79. Translation Blocks
0:!38 20 00 01 !li r1,1
4:!7c 20 0b 78 !mr r0,r1
8:!38 21 00 01 !addi r1,r1,1
Donnerstag, 15. August 13

80. Translation Blocks
0:!38 20 00 01 !li r1,1
4:!7c 20 0b 78 !mr r0,r1
8:!38 21 00 01 !addi r1,r1,1
c:!2c 01 00 02 !cmpwi r1,2
10:!41 82 ff f0 !beq+ 0x0
Donnerstag, 15. August 13

81. Translation Blocks
0:!38 20 00 01 !li r1,1
4:!7c 20 0b 78 !mr r0,r1
8:!38 21 00 01 !addi r1,r1,1
c:!2c 01 00 02 !cmpwi r1,2
10:!41 82 ff f0 !beq+ 0x0
Donnerstag, 15. August 13

82. Translation Blocks
0:!38 20 00 01 !li r1,1
4:!7c 20 0b 78 !mr r0,r1
8:!38 21 00 01 !addi r1,r1,1
c:!2c 01 00 02 !cmpwi r1,2
10:!41 82 ff f0 !beq+ 0x0
Donnerstag, 15. August 13

83. Translation Blocks
0:!38 20 00 01 !li r1,1
4:!7c 20 0b 78 !mr r0,r1
8:!38 21 00 01 !addi r1,r1,1
c:!2c 01 00 02 !cmpwi r1,2
10:!41 82 ff f0 !beq+ 0x0
Donnerstag, 15. August 13

84. Translation Blocks
Donnerstag, 15. August 13

85. Translation Blocks
Donnerstag, 15. August 13

86. Translation Blocks
Donnerstag, 15. August 13

87. Translation Blocks
Donnerstag, 15. August 13

88. Translation Blocks
Donnerstag, 15. August 13

89. Translation Blocks
code
Donnerstag, 15. August 13

90. TB Chaining
Donnerstag, 15. August 13

91. TB Chaining
Donnerstag, 15. August 13

92. TB Chaining
Donnerstag, 15. August 13

93. TB Chaining
Donnerstag, 15. August 13

94. TB Chaining
Donnerstag, 15. August 13

95. TB Chaining
Donnerstag, 15. August 13

96. TB Chaining
Donnerstag, 15. August 13

97. TB Chaining
Donnerstag, 15. August 13

98. TB optimization
38 20 00 01 !li r1,1
38 21 00 02 !addi r1,r1,2
38 20 00 09 !li r1,9
Donnerstag, 15. August 13

99. TB optimization
38 20 00 01 !li r1,1
38 21 00 02 !addi r1,r1,2
38 20 00 09 !li r1,9
Donnerstag, 15. August 13

100. TB optimization
38 20 00 01 !li r1,1
38 21 00 02 !addi r1,r1,2
38 20 00 09 !li r1,9
Donnerstag, 15. August 13

101. TB optimization
38 20 00 01 !li r1,1
38 21 00 02 !addi r1,r1,2
38 20 00 09 !li r1,9
Donnerstag, 15. August 13

102. TB optimization
38 20 00 01 !li r1,1
38 21 00 02 !addi r1,r1,2
38 20 00 09 !li r1,9
Donnerstag, 15. August 13

103. TB optimization
38 20 00 01 !li r1,1
C HELPER: r1=output, no input
38 20 00 09 !li r1,9
Donnerstag, 15. August 13

104. TB optimization
38 20 00 01 !li r1,1
C HELPER: r1=output, no input
38 20 00 09 !li r1,9
Donnerstag, 15. August 13

105. TB optimization
38 20 00 01 !li r1,1
C HELPER: r1=output, no input
38 20 00 09 !li r1,9
PURE
Donnerstag, 15. August 13

106. TB optimization
38 20 00 01 !li r1,1
C HELPER: r1=output, no input
38 20 00 09 !li r1,9
PURE
Donnerstag, 15. August 13

107. TB optimization
38 20 00 01 !li r1,1
C HELPER: r1=output, no input
38 20 00 09 !li r1,9
Donnerstag, 15. August 13

108. TB optimization
38 20 00 01 !li r1,1
C HELPER: r1=output, no input
38 20 00 09 !li r1,9
CONST
Donnerstag, 15. August 13

109. TB optimization
38 20 00 01 !li r1,1
C HELPER: r1=output, no input
38 20 00 09 !li r1,9
CONST
Donnerstag, 15. August 13

110. TB optimization
38 20 00 01 !li r1,1
C HELPER: r1=output, no input
38 20 00 09 !li r1,9
CONST
Donnerstag, 15. August 13

111. Donnerstag, 15. August 13

112. ✔
Donnerstag, 15. August 13

113. Linux Program
Linux-user emulation
Donnerstag, 15. August 13

114. Linux Program
Linux-user emulation
Donnerstag, 15. August 13

115. Linux Program
Linux-user emulation
Donnerstag, 15. August 13

116. Linux Program
Linux-user emulation
Donnerstag, 15. August 13

117. Full system
Donnerstag, 15. August 13

118. Full system
Donnerstag, 15. August 13

119. Full system
Donnerstag, 15. August 13

120. Full system
Donnerstag, 15. August 13

121. Full system
Donnerstag, 15. August 13

122. Full system
Donnerstag, 15. August 13

123. Full system
Donnerstag, 15. August 13

124. Full system
Donnerstag, 15. August 13

125. Full system
Donnerstag, 15. August 13

126. Full system
Donnerstag, 15. August 13

127. Full system
Donnerstag, 15. August 13

128. Future Development
• Computer Systems Lab, Institute of
Information Science @ Taiwan
• Uli’s optimizations
Donnerstag, 15. August 13

129. Conclusion
• QEMU is very versatile
• A lot of areas for improvement
• Join in and hack away!
Donnerstag, 15. August 13