Coordinating Functional and Timing models

[Pat]

Hello,

Sniper seems to fall in the category of direct-execution as far as the taxonomy of simulators goes. DBT (Pin) is instrumenting the simulated binary and the instruction opcode, address etc. are passed onto the timing model. I would like to know if it is possible to control the binary execution based on events in the timing model. In other words, can program path be altered from the timing model. An example scenario would be as follows:

Suppose I want to model soft errors in branch target buffer. At a random time, I change the index in the modeled BTB to point to instruction X instead of instruction Y. The simulated binary would go to instruction X by default. But can I drive the execution on the host to instruction Y? How correct would this be?

-Pat

[Trevor Carlson]

Pat,

Sniper’s branch prediction models determine hit/miss status for each branch, but they do not direct Sniper to execute down the wrong path. Instead, Sniper uses interval modeling to along with the front-end refill penalty (branch misprediction penalty in Sniper) to model branch penalties during program execution. What this means is that we do not simulate the memory accesses and other updates that happen underneath a mispredicted branch. We find this to be a relatively safe trade-off when branch mispredictions are low.

Now, you could corrupt the BTB in Sniper’s branch predictor, and the result would (probably) be an increase in the branch misprediction rate. What you wouldn’t see is what happened in the processor before the misprediction was determined (the extra memory accesses, etc.).

Depending on what you want to do, Sniper might be a good fit for your research, but it might not be. If you need to see what is going on in detail at that time, you might need to move to a more accurate cycle-level simulator. Double check the simulator’s source, as even some cycle-level simulators might not model this very accurately.

Trevor

--
--
--
You received this message because you are subscribed to the Google
Groups "Sniper simulator" group.
To post to this group, send email to snip...@googlegroups.com
To unsubscribe from this group, send email to
snipersim+...@googlegroups.com
For more options, visit this group at
http://groups.google.com/group/snipersim?hl=en

---
You received this message because you are subscribed to the Google Groups "Sniper simulator" group.
To unsubscribe from this group and stop receiving emails from it, send an email to snipersim+...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Pat]

Trevor,

My question is more general. The BTB part was something that I could think of as an example. The broader question is how easy/safe it is to control the host program execution from the timing model. Spin-loops is another example. If I have some custom contention management in my modeled core which should reduce the number of spins, I would want to control the host program execution so that reduced number of instructions are passed onto the timing model for cycle-evaluation. 

-Pat

[Wim Heirman]

Pat,

You can affect the functional part of the application, as you can from any Pintool. E.g. use PIN_ExecuteAt to redirect control flow, or PIN_SafeCopy to modify memory contents. Sniper's Pin front-end is located in the sources in sniper/pin/* so that's where you could add this code.

Two tings to keep in mind:

- Instructions are sent from the functional side to the timing side in basic block chunks. You can only change control flow at the end of a basic block, else the timing model will get confused. (There may be some code left to do it per-instruction, at some performance cost, but allowing you jump out of the middle of basic blocks. If that's what you need I can look up where this code is.)

- There is a queue (up to several basic blocks) between the functional and timing parts. The branch predictor is ran immediately when the branch is functionally executed, and you can use its prediction to affect control flow (the (mis)prediction itself is queued together with the instruction, and will affect timing later). But other events such as ROB stalls are only known much later so you cannot use that information in the pintool.

Regards,

Wim

[Ian Xu]

My research needs approximate the same requirement. May I ask for more specific details on the "queue" between the functional and timing parts, such as what files contain the queue (up to several basic blocks) you just mentioned?