Config-Grounded Microarch Reference Sheet

This page is the single quantitative table set for the GPSIMD core. Every microarch number a reimplementer needs — the vector width, the eight register files and their widths/depths, the FLIX format/slot/length geometry, the functional-unit and coprocessor inventory, the core-local memory map (IRAM / DataRAM), the MPU entry count, the pipeline depth, and the load/store and fetch widths — is read straight out of the shipped Cairo configuration and pinned here with the exact symbol / offset / header token it comes from and a confidence tag. Where a number drives a reimplementation decision, the row says how.

The companion page Core Identity & Configuration owns the identity constants (ConfigName = Xm_ncore2gp, uarchName = Cairo, arch = Xtensa24, TargetHWVersion = NX1.1.4, SWToolsRelease = RI-2022.9, the ConfigKeys); this page does not restate them — it cross-links them and stays on the microarch quantities derived from the config. The deep encoding mechanics live on FLIX Bundle-Decoding Methodology and The Eight Register Files; this sheet is the dense roll-up you keep open while reimplementing.

Two grounding sources are used, and they are kept distinct:

• ncore2gp-params — the Tensilica processor-generator parameter text (tools/ncore2gp/config/ncore2gp-params) and its generated header xtensa/config/core-isa.h. These are the config of record: a key = value text the build emitted. Cited as param:<key> / core-isa.h:<MACRO>.
• libisa-core.so — the shipped TIE-generated ISA DB library (tools/ncore2gp/config/libisa-core.so, ELF64, not stripped, 9,690,712 bytes). Its config getters and .data.rel.ro tables are the machine-readable form the disassembler and ISS consume. Cited as <symbol> @ 0x<addr>.

Every getter immediate, table byte, and header token below was re-read from those two artifacts this pass — objdump -d on the getter bodies, objdump -s on the raw table bytes, rg on the two config texts. No external or vendor source tree was consulted; this is binary/config-derived prose only. [HIGH/OBSERVED] throughout except where a row is tagged otherwise.

GOTCHA — the .data.rel.ro VMA↔file-offset delta is 0x200000 in this binary. The regfiles/funcUnits tables live in .data.rel.ro (VMA base 0x67bb00, file 0x47bb00); .rodata (where length_table, formats, slots, and all the string pools sit) is VMA == file-offset. Before objdump -s-ing a .data.rel.ro struct, subtract 0x200000; .rodata needs no adjustment. Measured with readelf -SW libisa-core.so this pass.

1. Top-line microarch identity (one row each)

These are the headline scalars. The identity tokens (Cairo, Xtensa24, NX1.1.4) are on identity-config.md; repeated here only as the microarch-shaping quantities they imply.

The single most consequential scalar is 512-bit vec: it is the SIMD register width, the load/store width, and (×32 lanes of 16 bit) the SIMD16 factor — three independent config tokens (XCHAL_VISION_SIMD16, the vec regfile num_bits, LoadStoreWidth) that all agree on 512.

2. The eight register files

num_regfiles is 8 — the getter body is mov $0x8,%eax; ret at num_regfiles @ 0x3b5c20, re-disassembled this pass. The authoritative table is regfiles @ 0x74a800 (.data.rel.ro, file 0x54a800), stride 56 bytes (the regfile_name accessor computes rdi*64 − rdi*8 = rdi*56). Each entry is {name, shortname, package, num_bits, num_entries, num_callee_saved, flags, ctype, coproc}. Two files are core/scalar (AR, BR); six are the Vision-Q7 SIMD coprocessor files. Every width/count below is read byte-exact from the raw objdump -s of the table this pass.

[HIGH/OBSERVED] on every cell. Raw-byte spot-checks this pass: vec @ 0x74a888 reads 00 02 00 00 (num_bits = 0x200 = 512) 20 00 00 00 (num_entries = 0x20 = 32); wvec @ 0x74a930 reads 00 06 00 00 (0x600 = 1536) 04 00 00 00; gvr @ 0x74a9a0 reads 00 02 00 00 (512) 08 00 00 00 (8) and flags = 0x0d. The bytes after entry 7 (0x74a9d8+) are zero — confirming exactly 8 entries, consistent with the num_regfiles = 8 getter.

Three quantities a reimplementer hard-codes from this table:

• vec = 512 b × 32 is the SIMD datapath. A reimplemented decoder sizes a v operand field at 5 bits (log2 32) inside every slot it appears in.
• wvec = 1536 b × 4 is the wide accumulator the quad/paired integer MACs write (ivp_mulnx16, ivp_mulpnx16); a wv operand is 2 bits (log2 4). 1536 = 3 × 512, the widening readout width.
• gvr = 512 b × 8 is the SuperGather descriptor file (gr operand = 3 bits); its count of 8 is independently the GS_GatherRegs = 8 ScatterGather param (§6).

NOTE — num_callee_saved = 0 for all eight files. Every register file in this config is caller-saved (the +0x20 field is zero in all 8 rows). A reimplemented ABI/context-save layer spills nothing on a call boundary by regfile convention; the windowed AR file uses the Xtensa register-window rotation instead. [HIGH/OBSERVED]

QUIRK — gvr carries flag bit 0x08 (flags 0x0d vs 0x05 on the other seven). The bit is real and unique to gvr; its meaning (a "global / state" attribute, consistent with the gsr ctype and the SuperGather descriptor role) is [MED/INFERRED] — there is no flag-name table in the binary to decode it. The width/count/ctype of gvr are [HIGH/OBSERVED]; only the flag-bit semantics are inferred.

2.1 Register operand field widths (derived)

The FLIX slot operand-field width for each register class is ceil(log2(count)), the bits a slot needs to name one register of that file. A reimplemented field extractor uses these directly:

[HIGH/OBSERVED] on the widths (they equal log2 count); the bit positions are [HIGH/OBSERVED] per slot from the field-get thunks. Full FLIX outside the address-window: the AR file is 64 entries but FLIX slots compress to a 4-bit a0..a15 subset (the standard Xtensa FLIX AR-compression) — outside FLIX, base/scalar formats reach all 64 via 6-bit fields.

3. Register-file views (BR sub-views)

num_regfile_views is 4 (mov $0x4,%eax; ret @ num_regfile_views @ 0x3b5d50). The table is regfile_views @ 0x74a780, stride 32 bytes (regfile_view_name computes rdi*32), entry {name, parent, num_bits, ctype}. All four are narrowed views of the single BR boolean file — there are no views over any SIMD file.

[HIGH/OBSERVED]. A reimplementer treats these as alternate operand encodings of the same silicon (the 16×1-bit BR file), not as four extra register files. The libisa introspection ABI (xtensa_isa_num_regfiles) reports 12 — that count is 8 regfiles + 4 views flattened into one namespace; the canonical microarch count is 8 files + 4 views, not 12. Do not double-count the views as silicon.

4. FLIX format / slot / length geometry

The VLIW encoding is FLIX — 14 formats, 46 slots, 7 length-class outcomes collapsing to 4 distinct byte-lengths {2, 3, 8, 16}. All three counts are byte-verified getter immediates this pass. The full decode mechanics (the format_decoder predicate ladder, the per-slot gather thunks, the worked oracle-validated example) are on FLIX Bundle-Decoding Methodology; this section is the quantitative roll-up.

The 14 formats partition into 3 scalar (one slot each), 8 wide (16 byte / 4–5 slots), and 3 narrow (8 byte / 2–4 slots). The per-format roster and slot count, byte-exact from the table:

Slot-count census: 1+1+1+4+5+4+4+5+4+4+4+3+2+4 = 46 = num_slots — the 46 cross-checks the getter. The two 5-slot formats (F3, F11) are the maximum-issue layouts; F4/F11 carry no store slot (dual-load / ALU-heavy specializations). The Fn numbering has real gaps (no F5/F8/F9/F10). For the byte-3 sub-format decode (why six op0==0xF formats are 16 bytes despite the static op0-only macro saying 8) see flix-decoding §2/§4. [HIGH/OBSERVED]

The four byte-lengths and the length_table (the b3lo == 0 row literal bytes 03 03 03 03 03 03 03 03 02 02 02 02 02 02 10 08 = {3×8, 2×6, 16, 8}, re-read this pass) drive the one sweep-advance decision: a reimplemented linear decoder advances the cursor by length_table[(( byte3 & 0xF) << 4) | (byte0 & 0xF)], never by op0 alone.

4.1 The co-issue ceiling — 1 + 1 is the sound bound

A FLIX format declares up to 5 slots, but the question a scheduler asks is how many operations co-issue per functional unit per cycle. The functional-unit reservation that would answer this — the MODULE_SCHEDULE per-port matrices — is empty in this config (no per-port reservation table is populated). With the reservation data absent, the sound, non-speculative bound is the structural one the format itself states: per the single XT_LOADSTORE_UNIT with num_copies = 2 (§5), at most two memory ops (the LdSt + Ld slots of a wide format) and the format's Mul + ALU slots co-issue — i.e. 1 load/store-class op + 1 of each other class per slot the format declares, capped by the 2 load/store unit copies. Do not infer a tighter per-cycle throughput than the format roster + the 2 LSU copies allow; the empty MODULE_SCHEDULE means a per-port hazard model is not recoverable from this corpus, so the 1+1 co-issue ceiling (two memory slots, one per other class) is the ceiling to encode. [HIGH/OBSERVED on the slot rosters and the 2 LSU copies; the absence of a tighter per-port model is OBSERVED-negative — MODULE_SCHEDULE is empty.]

5. Functional-unit & coprocessor inventory

The config declares exactly one functional unit and exactly one coprocessor — both getter immediates and both table bodies re-read byte-exact this pass.

The funcUnits table is stride-16 (funcUnit_name does shl $0x4), and only entry 0 is populated — the bytes after it (0x74a9d0+) are zero. The coprocs table is likewise stride-16 with one populated entry. So a reimplementation models one coprocessor (Vision, the IVP32 SIMD package, CP1) and one shared functional unit (XT_LOADSTORE_UNIT) with two copies — the 2 copies are exactly why a wide FLIX format can present two memory slots (LdSt + Ld) that co-issue (§4.1). [HIGH/OBSERVED]

NOTE — the single coprocessor governs CPENABLE. XCHAL_HAVE_CP = 1 and XCHAL_CP_MAXCFG = 7 (core-isa.h), but only CP1 = Vision is populated; a reimplemented CPENABLE model needs exactly one coprocessor-enable bit (CP1). All six SIMD register files (§2) bind to this one coprocessor. [HIGH/OBSERVED]

The ISA is stock Cadence — num_opcodes is 1534 (0x5fe @ num_opcodes @ 0x3b61d0), zero of which are user-defined (every opcode belongs to a Tensilica package; xt_ivp32 = 1072 of them). There is no bespoke AWS TIE opcode group; the GPSIMD-custom layer is firmware + host-side routing, not new silicon opcodes. Two further DB scalars verified this pass: num_states = 81 (0x51), num_sysregs = 34 (0x22), num_protos = 3484 (0xd9c).

6. SuperGather geometry

SuperGather (XCHAL_HAVE_SUPERGATHER = 1) is the headline Q7 gather/scatter engine; its geometry is config-pinned and drives the gvr/b32_pr register counts.

The 8 gather registers = the gvr file count (§2), and the gather op carries exactly one hidden state operand (the FAST9/SuperGather select state). The elementsPerCycle = 32 is the throughput a reimplemented gather model assumes: one 512-bit vec worth of gathered bytes per cycle. [HIGH/OBSERVED]

7. Core-local memory geometry (IRAM / DataRAM + the address map)

The Q7 core has one instruction RAM and one data RAM, both 64 KiB, at fixed core-local virtual addresses. This is the core-local address map — distinct from the NeuronCore-level SBUF/PSUM SoC map (which is reached over the AXI aperture; see the glossary's SBUF/PSUM entry and Memory Model).

Sources: core-isa.h:XCHAL_NUM_INSTRAM = 1 / XCHAL_NUM_DATARAM = 1; XCHAL_INSTRAM0_{VADDR=0x0, SIZE=65536}; XCHAL_DATARAM0_{VADDR=0x80000, SIZE=65536, BANKS=4}; param:InstRAM0Latency = 3, param:DataRAM0Latency = 4; param:ISSDataRAMInfo = [ 0x10000 0x00080000 512 … ] (size, base, access-width), param:ISSInstRAMInfo = [ 0x10000 0x00000000 256 … ]; param:ISSDataRAMBanks = 4, param:ISSDataRAMSubBanks = 8. [HIGH/OBSERVED]

The core-local address map a reimplementer pins:

NOTE — there is no data cache; the I-cache is the only cache. DataCacheBytes = 0 (XCHAL_DCACHE_SIZE = 0); the I-cache is 16 KiB, 4-way, 64-byte lines, 2 banks (param:InstCacheBytes = 16384 / WayCount = 4 / LineBytes = 64 / Banks = 2; core-isa.h:XCHAL_ICACHE_SIZE = 16384). A reimplemented memory model treats data accesses as uncached RAM/AXI and models only the I-cache. The L1S/L1V/L2/DataCache config blocks are all zero. [HIGH/OBSERVED]

NOTE — iDMA: one channel, 64-byte max descriptor. param:iDMA = 1, iDMANumChannels = 1, iDMAMaxDescriptorSize = 64 (core-isa.h:XCHAL_IDMA_DESC_SIZE = 64), iDMAMaxOutstandingReq = 32, iDMAAddrWidth = 32. Only DataRAM0 is iDMA-capable (XCHAL_DATARAM0_HAVE_IDMA = 1; IRAM is not). [HIGH/OBSERVED]

8. MPU (memory-protection unit)

The core has an MPU, not an MMU (XCHAL_HAVE_MPU = 1, MMU configured = 0). The entry counts are config-pinned.

The two background map entries (the reset-time default protection map) are, byte-exact from param:MPU:

So a reimplemented protection model exposes 16 software-writable foreground MPU entries at 4 KiB granularity, over a 2-entry background map that splits the 4 GiB space in half with identical rights. [HIGH/OBSERVED]. (PMPPMA[configured] = 0 — no separate PMP/PMA block.)

9. Pipeline depth

The pipeline depth is config-stated two ways, on two different axes — keep them distinct.

The 15-stage figure is the ISA DB's xtensa_isa_num_pipe_stages (the per-opcode latency tables the cycle-accurate ISS consumes); it is [MED/OBSERVED] here because it is read through the libisa introspection ABI rather than re-disassembled to a single immediate this pass. The B=3 / E=4 / M=5 / W=6 figures are the ISS's own coarse pipe-stage parameters, read byte-exact from ncore2gp-params — these are the stages the value-lane model uses, not the silicon's full 15-stage depth. A reimplemented timing model uses the 15-stage figure for latency; the B/E/M/W stages only matter to match the ISS oracle's coarse model.

GOTCHA — cycle/latency modeling is license-gated. The full pipeline/latency behavior lives in the cycle-accurate ISS (libcas-core.so), whose retirement path hits an AUTH::check_iss_licenses gate without a FlexNet key — so the per-stage cycle counts behind the 15-stage depth are a closable-with-license wall. The structural depth (15 stages) and the value semantics (via libfiss-base.so) are recoverable; the timing numbers are not. See the glossary ISS entries. [HIGH/OBSERVED on the structural figures; the cycle counts are behind the license wall.]

10. Branch prediction & loop buffer (config-stated)

Two more config-pinned microarch quantities a cycle-level reimplementation needs:

[HIGH/OBSERVED]. The BTB predicts CallX/JX/zero-overhead-loops/return-jumps; the 8-entry RAS backs the windowed call/return. The 128-instruction loop buffer holds short zero-overhead loops without re-fetch.

11. Bus / interrupt scalars (config-stated)

Rounding out the config-pinned quantities; these matter for a system-level reimplementation but not for ISA decode:

[HIGH/OBSERVED]. The exception model is XEA3 with a single unified DispatchVector (numOfVectors = 0); the deep treatment of the 37 interrupts / 7 levels is on the XEA3 interrupt architecture page (cross-linked from identity-config). The PhysicalAddressWidth = 32 (§1) bounds the AXI aperture at 4 GiB.

12. Master quantity table (the one-screen roll-up)

Every value in this roll-up is [HIGH/OBSERVED] except the 15-stage pipeline depth ([MED/OBSERVED] — read through the introspection ABI, not a single re-disassembled immediate; the cycle counts behind it are license-walled) and the gvr flag-bit 0x08 semantics ([MED/INFERRED]; the width/count/role are HIGH).

13. Adversarial self-verification (re-read from the binary this pass)

Five of the strongest quantities, re-derived from the artifacts directly:

1. num_regfiles = 8 — objdump -d at 0x3b5c20 is literally b8 08 00 00 00 (mov $0x8,%eax) c3 (ret). The table at 0x74a800 has 8 populated 56-byte entries and zeros after. Confirmed.
2. vec = 512 b × 32 — raw objdump -s at 0x74a888 reads 00 02 00 00 (num_bits = 0x200 = 512) then 20 00 00 00 (num_entries = 0x20 = 32). Confirmed byte-exact.
3. num_formats = 14, num_slots = 46 — 0x3b65e0 is mov $0xe,%eax; 0x3b6510 is mov $0x2e,%eax. The 14 per-format slot counts sum to 46 (1+1+1+4+5+4+4+5+4+4+4+3+2+4). Confirmed both ways.
4. num_funcUnits = 1 / XT_LOADSTORE_UNIT / num_copies = 2 — 0x3b5bd0 is mov $0x1,%eax; funcUnits @ 0x74a9c0 reads name-ptr 0x3cd0d3 → the ASCII XT_LOADSTORE_UNIT and +8 = 02 00 00 00. num_coprocs = 1, coprocs @ 0x67bb00 → Vision, number = 1. Confirmed.
5. length_table row 0 + the four byte-lengths — objdump -s at 0x3d4100 reads 03 03 03 03 03 03 03 03 … (the b3lo == 0 row: op0 0..7 → 3, 8..D → 2, E → 0x10 = 16, F → 0x08 = 8). The four distinct lengths {2, 3, 8, 16} are the literal table values. Confirmed.

All five re-reads agree with the tables above. The .data.rel.ro delta (0x200000) was applied to the regfiles/funcUnits reads; .rodata reads (length_table, the string pools) needed none — verified with readelf -SW this pass.

14. Cross-references

• Core Identity & Configuration — the identity constants (Cairo, Xtensa24, NX1.1.4, the ConfigKeys) this sheet deliberately does not restate.
• The Eight Register Files — the per-register-file deep treatment (dbnums, the gvr-vs-tie.h discrepancy, the view semantics).
• FLIX Bundle-Decoding Methodology — the format/slot/length decode mechanics this section rolls up quantitatively.
• The FLIX VLIW Encoding — the 14-format / 46-slot / byte-3 sub-format map in full.
• ctype / coproc / funcUnit Tables — the deep treatment of the single coproc / single funcUnit / ctype tables.
• Codename ↔ Generation Cross-Walk — the per-generation identity axis (these microarch quantities are gen-invariant: one Cairo config, five gens).
• On-Chip State-Buffer (SBUF) + PSUM Bank Model — the NeuronCore-level SoC memory map (SBUF/PSUM), distinct from the §7 core-local IRAM/DataRAM map.