QEMU TCG gains Intel APX support for x86 emulation

Paolo Bonzini has posted a 17-patch update that implements Intel Advanced Performance Extensions (APX) in QEMU’s x86 Tiny Code Generator (TCG) emulator.

APX doubles the number of general-purpose registers available to 64-bit code (r0 through r31) and adds new encodings such as the REX2 prefix, three-operand forms of many legacy instructions, and opcodes including CFCMOV, PUSH2, POP2, CCMP, CTEST, and JMPABS. Bonzini’s stated goal was less APX for its own sake than early infrastructure for EVEX decoding, without absorbing the full complexity of AVX-512, while nudging QEMU’s decoder to match what Intel CPUs actually accept.

The work extends the TCG register file, teaches the decoder about REX2 and EVEX map 4, rejects illegal prefix combinations (for example REX2 followed by 0x0F, or REX2 on XSAVE-family instructions), and saves and restores APX state through XSAVE/XRSTOR. It also repairs the earlier clash between APX and MPX feature bits and collapses PUSH2/POP2 to a single 128-bit memory access.

Testing against Zhao Liu’s apx-test suite turned up several concrete bugs that the patches fix: MUL/IMUL/DIV/IDIV hitting an overly strict assertion, INC/DEC rejecting a legitimate 0x66 prefix, missing zero-upper behavior on CMOV/CFCMOV, a conflict between IMUL’s sign-extension path and the zero-upper modifier, and a missing register-to-register path for MOVBE. Chang Seok Bae of Intel reviewed several of the changes.

The final patch lets TCG advertise the APXF CPUID feature. Bonzini measured roughly half a percent larger binaries and about one percent fewer TCG ops; host assembly grew slightly because existing optimizers already emitted code similar to the new NDD and NF forms.