vCPU Shortcut Candidates

vCPU Shortcut Candidates

Reviewed: November 1, 2026. Fork source: b7140848 (full SHA b71408480a3a979a9c584663e1d1f400904c8bb7). Latest stable checked: v0.8.136-0-g458730bf5373, September 30, source 458730bf5373f1f0d027450fef7443e3af7a3ae1. GitHub state, branch recommendation, source presence and release availability are separate facts. See current status and release versus main.

Current lifecycle and scope

The seven individual proposals in the historical catalog remain research directions; the blanket claim that no vCPU shortcut is implemented is obsolete. Merged #296 generates the hard-FPU FNSTSW AX result with preserved architectural FP checkpoints. That narrow x87 status-word path does not implement native reciprocal estimates, general SSE arithmetic, helper-wide x87 retention, FP-control retention, REP chunks, a Win64 ABI/register expansion, or comparison flag capture.

The #296 path is present in main translator source; it is later than the checked September 30 stable release and is main only at this review. The x86 hard-FPU control and this one status-word lowering do not establish ARM hard-FPU correctness.

Related work	GitHub state	Current disposition / next action	Main / stable availability
#317 precise same-page stores	Open	SKIPPED/HOLD: recover original self-page/SmartXX reproducer; current PGR2/Conker scenes have zero eligible events.	Unmerged; absent / absent
#320 AArch64 ordering	Open	Admission-policy defects repaired on branch; native capable/pre-LRCPC ARM ordering and emitted-code qualification missing.	Unmerged; absent / absent
#321 ARM hard FPU	Open	Incorrect conversion/rounding/exception and default-on-without-GUI-rollback defects remain; softfloat fallbacks and correct admission precede activation.	Unmerged; absent / absent
#351 optional X3 identification	Open	QUALIFY title, HOLD body: qtest/build checks pass; original launch/probe recovery, native/resource and XISO qualification missing. Separate from CPU throughput.	Unmerged; absent / absent
#296 hard-FPU FNSTSW AX	Merged	Narrow status-word lowering; preserve its checkpoint and fallback contract.	Present / absent

See current research actions for exact branch heads and research/retirement for delivery limits. No new instruction counts or performance campaign were run for this page refresh. The original source-specific observations below must be rechecked before implementing a proposal on today’s source.

Historical candidate analysis — September 2026

The original source review is preserved below at 322986f4c5502b3fa887a9605ac8cd88e9b2c579. “Current” in that analysis refers to that revision; the current lifecycle above takes precedence.

Lifecycle indexes: Implemented · Researched · Unproven

Status: Source-validated investigation catalog; no proposal on this page is implemented or qualified.

Reviewed source: 322986f4c5502b3fa887a9605ac8cd88e9b2c579

Scope: Guest x86/SSE instruction expansion, hard-x87 translation state, host floating-point control, and repeated string-memory execution.

This page validates the vCPU proposals from the September 14, 2026 audit against the current fork and applies the Wiki's narrower definition of a shortcut:

A shortcut bypasses work performed by a maintained, more general route because a narrow host capability, state invariant, memory admission, or behavior tradeoff says the general route is unnecessary for this operation.

A faster instruction sequence is not automatically a shortcut. A larger host-register budget and a different flag-capture sequence may be worthwhile backend optimizations, but neither bypasses a general emulation route under an assumption.

Validation result

Candidate	Applies to current code?	Real shortcut?	Intended behavior	Disposition
Native Reciprocal Estimates	Yes	Yes — host-ISA/helper bypass	Approximate guest result; investigate hardware resemblance	High-priority experiment after dynamic instruction counts
Helper-Aware x87 Cache Retention	Yes	Yes — canonical-state flush bypass	Intended equivalent for explicitly audited helpers	Strongest avoidable fork-specific interaction
Native SSE Arithmetic	Yes	Yes — helper/SoftFloat bypass	Equivalent only if FP environment and edge semantics are reproduced; otherwise explicit approximation	Start with a tiny register-register instruction subset
Floating-Point Control-State Retention	Yes	Yes — redundant LDMXCSR bypass	Intended equivalent for audited boundaries	Test independently from x87-cache retention
REP MOVS RAM Chunks	Yes	Yes — per-element memory path bypass	Intended equivalent for a narrowly admitted span	High engineering risk; begin with forward non-overlapping RAM
Windows XMM Register Budget	Yes, on Win64	No	Structural backend optimization	Measure spill pressure before changing JIT entry/exit ABI
x87 Comparison Flag Capture	Yes	No	Instruction-selection/code-size optimization	Small microbenchmark after execution frequency is known

Why these are stronger than source-level check removal

The applicable shortcuts attack dynamic expansion:

flowchart LR
    A[Small guest operation] --> B[Translation decision]
    B --> C[Helper call or general memory route]
    C --> D[State materialization]
    C --> E[ABI transition]
    C --> F[Per-lane or per-element work]
    D --> G[Reload / control-state setup]
    E --> G
    F --> G
    G --> H[Continue guest execution]

Loading

The candidate route must remove one of those dynamic layers rather than merely making a source-level permission check prettier.

A source branch evaluated once while translating a block is not automatically a runtime hot path. The investigation must pair:

1. guest instruction identity and execution count;
2. emitted helper calls, memory checks, spills, conversions, or control loads;
3. host samples inside the generated block;
4. fixed guest progress and retail behavior.

Source-backed findings

Approximate reciprocal instructions currently use mathematical helpers

target/i386/ops_sse.h implements packed reciprocal and reciprocal-square-root through lane-wise floating-point division and, for reciprocal square root, square root. The helper declarations in target/i386/tcg/ops_sse_header.h.inc confirm that packed and scalar forms enter helper routes.

That makes native RCPPS/RSQRTPS emission a genuine bypass of helper dispatch and lane-wise calculation. It is not bit-equivalent: the supplied native probe already produced a different result for 1.0f, so this begins as an explicit approximation/hardware-fidelity investigation.

Every generated helper currently triggers the x86 basic-block epilogue

Generic call generation in tcg/tcg.c invokes gen_bb_epilogue() before emitting a helper call. The x86 translator implementation of that hook calls gen_flush_fp(). The flush materializes cached x87 values and resets flcr_set.

At the same time, helpers such as cc_compute_all, cc_compute_c, and cc_compute_nz are declared with TCG_CALL_NO_RWG_SE and take their values directly rather than an environment pointer. That supplies a concrete narrow class for an experiment: an audited helper that neither needs canonical x87 state nor changes the host FP control environment.

Guest SSE floating arithmetic still uses helper declarations

The current SSE helper header declares packed and scalar add, sub, mul, div, min, max, and sqrt helper families. Integer SIMD is not the target; many integer operations already map through vector generation. The opportunity is the remaining guest floating-point helper path.

FP cache invalidation and FP control invalidation are currently coupled

gen_flcr() is labeled TODO: Oversynchronized. gen_flush_fp() always resets flcr_set, and the x86 host backend implements the control setup as a scratch store followed by LDMXCSR.

That coupling is a real shortcut seam: after an audited helper or boundary, the translator may need to materialize architectural values without necessarily needing to forget that host control state remains suitable.

REP MOVS already loops in translated code, but retains per-element memory work

The current instruction emitter routes MOVS through gen_repz(..., gen_movs). The proposed shortcut is therefore not “avoid a dispatcher return for every byte.” It is narrower and more credible: admit a safe ordinary-RAM chunk, perform one host bulk operation, and commit exactly the completed guest progress.

What is not a shortcut

More Win64 XMM registers

Current Win64 allocation exposes XMM0–XMM5 in the allocation order, reserves XMM5 as TCG_TMP_VEC, and explicitly reserves XMM6–XMM15 because the JIT does not preserve the ABI's nonvolatile registers. Saving a selected set at the C-to-JIT boundary could reduce spills, but this is an allocation-resource trade—not a bypass of a correct general route.

LAHF/SETcc instead of PUSHF/POP

The native x87 comparison emitter currently uses COMISS/COMISD, PUSHF, and POP; the consumer needs only CF, PF, and ZF (0x45). Replacing the stack round-trip with LAHF or SETcc is normal instruction selection. It may still lose because of RAX/AH constraints or extra moves.

Shared investigation artifact: vCPU instruction-expansion report

Before implementing several of these at once, create a report that maps hot guest instructions to the host code that actually executes:

Field	Purpose
Guest PC and code identity	Prevents unrelated blocks from being combined
Block execution count	Weights emitted work by dynamic use
Guest instruction classes	Locates reciprocal, SSE, x87, and string workloads
Generated helper calls by identity	Shows which transitions are actually present
Cached x87 values live at each helper	Quantifies avoidable flush work
st80f, ld80f, and LDMXCSR counts	Exposes conversion and control-state expansion
Allocator spills/reloads by value type	Tests the Win64 register-budget hypothesis
Memory fast/slow-path events	Tests REP-span opportunity
Host samples mapped to generated blocks	Separates execution cost from emitted-code size

Use an optimized Release binary with a matching DWARF artifact. Diagnostic counters may classify the path, but the performance candidate must return to an uninstrumented Release build.

Required proof for a shortcut

flowchart TD
    A[Identify exact general route] --> B[Measure eligible dynamic uses]
    B --> C[State the assumption]
    C --> D[Implement candidate and retained reference]
    D --> E[Prove emitted work actually disappeared]
    E --> F[Violate assumption deliberately]
    F --> G{Reference/fallback or declared approximation behaves correctly?}
    G -->|No| H[Reject or narrow admission]
    G -->|Yes| I[Release ABBA/BAAB and correctness gates]

Loading

Every experiment needs counters for opportunities, candidate entries, reference entries, rejected reasons, and fallbacks. A zero-entry candidate is not a neutral result; it means the workload did not test the proposal.

Recommended order

1. Native reciprocal estimates — smallest concrete operation substitution, but count dynamic use first.
2. Helper-aware x87 cache retention — strongest current fork-specific avoidable interaction.
3. FP control-state retention — measure separately so savings are not double-counted.
4. Native SSE arithmetic — start with register-register add/multiply/subtract and explicit FP policy.
5. REP MOVS RAM chunks — only after a narrow memory-admission/fault-progress design exists.
6. Win64 XMM register budget — proceed only if spill counters justify C-to-JIT save/restore traffic.
7. x87 flag capture — keep as a focused assembly benchmark, not a high-level project.

Related pages

• Hot-Path Shortcuts
• Performance Optimization Catalog
• CPU & vCPU Execution
• Debugging Lag & Hot-Path Analysis
• Debugging Tools & Commands
• Using Hot-Path Shortcuts