A Language Approach to Fine-Grained Microarchitectural Observation

Analyzing, understanding, and validating the performance of modern processors present significant challenges. These stem from two primary issues. First, it is difficult to construct “performance tests” that can test precisely scoped hypotheses about microarchitectural behavior. Second, it is difficult to make sense of performance measurements: hardware teams see too many low-level events that they struggle to map back to the tested programs, and software developers and security researchers can only observe coarse-grained performance counters. This paper addresses both challenges with a unified programming language approach that we prototype in a framework named HT.

To overcome the test-construction problem, our insight is that a broad range of microarchitectural effects are triggered by a specific software address layout. We introduce a DSL that enables specifying desired microarchitectural effects of a program through specifying its address layout, separately from its functional behavior. This separation is achieved using an SMT solver to compute a suitable instruction and data layout.

To overcome the observability challenge, we systematically link high-level software patterns down to raw hardware simulation outputs. We introduce flexible event-tracing constructs designed to construct custom, multi-cycle higher-level events from (single-cycle) low-level event logs, effectively acting as the bridge that connects software execution patterns to low-level hardware events.

We demonstrate HT’s utility on XiangShan, a production-grade open-source RISC-V processor, through three case studies: analyzing the performance impact of the Zicond RISC-V extension, reproducing subtle microarchitectural attacks, and characterizing the branch prediction behavior of Lua, an interpreted language.