#LyX 1.4.2 created this file. For more info see http://www.lyx.org/
\lyxformat 245
\begin_document
\begin_header
\textclass report
\begin_preamble
\usepackage[pdftitle={PTLsim User's Guide and Reference},colorlinks=true,linkcolor=blue,anchorcolor=blue,citecolor=blue,urlcolor=blue]{hyperref}
\end_preamble
\language english
\inputencoding auto
\fontscheme times
\graphics default
\paperfontsize 12
\spacing single
\papersize letterpaper
\use_geometry true
\use_amsmath 1
\cite_engine basic
\use_bibtopic false
\paperorientation portrait
\leftmargin 1in
\topmargin 1in
\rightmargin 1in
\bottommargin 1in
\headheight 0in
\headsep 0in
\footskip 0.25in
\secnumdepth 3
\tocdepth 3
\paragraph_separation skip
\defskip medskip
\quotes_language english
\papercolumns 1
\papersides 1
\paperpagestyle default
\tracking_changes false
\output_changes true
\end_header

\begin_body

\begin_layout Standard
\noindent
\align center

\series bold
\size huge
\InsetSpace ~

\end_layout

\begin_layout Standard
\begin_inset VSpace vfill
\end_inset


\end_layout

\begin_layout Standard
\noindent
\align center

\family sans
\series bold
\size giant
PTLsim User's Guide and Reference
\end_layout

\begin_layout Standard
\noindent
\align center

\size huge
\emph on
The Anatomy of an x86-64 Out of Order
\newline
Superscalar Microprocessor
\end_layout

\begin_layout Standard
\begin_inset VSpace bigskip
\end_inset


\end_layout

\begin_layout Standard
\noindent
\align center

\size largest
Matt T.
 Yourst
\newline

\family typewriter
\size large
<yourst@yourst.com>
\end_layout

\begin_layout Standard
\noindent
\align center
Revision 20070317
\newline

\series bold
\emph on
Second Edition
\end_layout

\begin_layout Standard
\begin_inset VSpace vfill
\end_inset


\end_layout

\begin_layout Standard
\noindent
\align center
The latest version of PTLsim and this document are always available at:
\family sans
\series bold
\size largest

\newline

\newline
www.ptlsim.org
\end_layout

\begin_layout Standard
\begin_inset VSpace bigskip
\end_inset


\end_layout

\begin_layout Standard
\noindent
\align center
\begin_inset Formula $\copyright$
\end_inset

 2007 Matt T.
 Yourst 
\family typewriter
\size small
<yourst@yourst.com>
\family default
\size default
.
\end_layout

\begin_layout Standard
\noindent
\align center
The PTLsim software and manual are free software;
\newline
they are licensed under
 the GNU General Public License version 2.
\end_layout

\begin_layout Standard
\begin_inset LatexCommand \tableofcontents{}

\end_inset


\end_layout

\begin_layout Part
\begin_inset LatexCommand \label{part:Introduction}

\end_inset

PTLsim User's Guide
\end_layout

\begin_layout Chapter
Introducing PTLsim
\end_layout

\begin_layout Section
Introducing PTLsim
\end_layout

\begin_layout Standard

\series bold
PTLsim
\series default
 is a state of the art cycle accurate microprocessor simulator and virtual
 machine for the x86 and x86-64 instruction sets.
 PTLsim models a modern superscalar out of order x86-64 compatible processor
 core at a configurable level of detail ranging from full-speed native execution
 on the host CPU all the way down to RTL level models of all key pipeline
 structures.
 In addition, the complete cache hierarchy, memory subsystem and supporting
 hardware devices are modeled with true cycle accuracy.
 PTLsim supports the full x86-64 instruction set of the Pentium 4+, Athlon
 64 and similar machines with all extensions (x86-64, SSE/SSE2/SSE3, MMX,
 x87).
 It is currently the only tool available to the public to support true cycle
 accurate modeling of real x86 microarchitectures.
\end_layout

\begin_layout Standard
PTLsim is very different from most cycle accurate simulators.
 Because it runs directly on the same platform it is simulating (an x86
 or x86-64 machine, typically running Linux), it is able to switch in and
 out of full out of order simulation mode and native x86 or x86-64 mode
 at any time completely transparent to the running user code.
 This lets users quickly profile a small section of the user code without
 the overhead of emulating the uninteresting parts, and enables automatic
 debugging by finding the divergence point between a real reference machine
 and the simulation.
\end_layout

\begin_layout Standard
PTLsim comes in two flavors.
 The classic version runs any 32-bit or 64-bit single threaded userspace
 Linux application.
 We have successfully run a wide array of programs under PTLsim, from typical
 benchmarks to graphical applications and network servers.
\end_layout

\begin_layout Standard
PTLsim/X runs on the bare hardware and integrates with Xen hypervisor, allowing
 it to provide full system x86-64 simulation, multi-processor and multi-threadin
g support (SMT and multi-core models), checkpoints, cycle accurate virtual
 device timing models, deterministic time dilation, and much more, all without
 sacrificing the speed and accuracy inherent in PTLsim's design.
 PTLsim/X makes it possible to run any Xen-compatible operating system under
 simulation; we have successfully booted arbitrary Linux distributions and
 industry standard applications and benchmarks under PTLsim/X.
\end_layout

\begin_layout Standard
Compared to competing simulators, PTLsim provides extremely high performance
 even when running in full cycle accurate out of order simulation mode.
 Through extensive tuning, cache profiling and the use of x86 specific accelerat
ed vector operations and instructions, PTLsim significantly cuts simulation
 time compared to traditional research simulators.
 Even with its optimized core, PTLsim still allows a significant amount
 of flexibility for easy experimentation through the use of optimized C++
 template classes and libraries suited to synchronous logic design.
\end_layout

\begin_layout Section
History
\end_layout

\begin_layout Standard
PTLsim was designed and developed by Matt T.
 Yourst 
\family typewriter
\size footnotesize
<yourst@yourst.com>
\family default
\size default
 with its beginnings dating back to 2001.
 The main PTLsim code base, including the out of order processor model,
 has been in active development since 2003 and has been used extensively
 by our processor design research group at the State University of New York
 at Binghamton in addition to hundreds of major universities, industry research
 labs and several well known microprocessor vendors.
\end_layout

\begin_layout Standard
PTLsim is not related to other legacy simulators.
 It is our hope that PTLsim will help microprocessor researchers move to
 a contemporary and widely used instruction set (x86 and x86-64) with readily
 available hardware implementations.
 This will provide a new option for researchers stuck with simulation tools
 supporting only the Alpha or MIPS based instruction sets, both of which
 have since been discontinued on real commercially available hardware (making
 co-simulation impossible) with an uncertain future in up to date compiler
 toolchains.
\end_layout

\begin_layout Standard
The PTLsim software and this manual are free software, licensed under the
 GNU General Public License version 2.
\end_layout

\begin_layout Chapter
Getting Started
\end_layout

\begin_layout Section
Documentation Map
\end_layout

\begin_layout Standard
This manual has been divided into several parts:
\end_layout

\begin_layout Itemize
Part 
\begin_inset LatexCommand \ref{part:Introduction}

\end_inset

 introduces PTLsim, reviews the x86 architecture, and describes PTLsim's
 implementation of x86 in terms of uops, microcode and internal structures.
\end_layout

\begin_layout Itemize
Part 
\begin_inset LatexCommand \ref{sec:PTLsimClassic}

\end_inset

 describes the use and implementation of userspace PTLsim.
\end_layout

\begin_deeper
\begin_layout Itemize
If you simply want to 
\emph on
use
\emph default
 PTLsim, this part starts with an easy to follow 
\series bold
tutorial
\end_layout

\end_deeper
\begin_layout Itemize
Part 
\begin_inset LatexCommand \ref{sec:PTLsimFullSystem}

\end_inset

 describes the use and implementation of full system PTLsim/X.
\end_layout

\begin_deeper
\begin_layout Itemize
If you simply want to 
\emph on
use
\emph default
 full system PTLsim/X, this part starts with an easy to follow 
\series bold
tutorial
\end_layout

\end_deeper
\begin_layout Itemize
Part 
\begin_inset LatexCommand \ref{part:OutOfOrderModel}

\end_inset

 details the design and implementation of the PTLsim out of order superscalar
 core model
\end_layout

\begin_deeper
\begin_layout Itemize
Read this part if you want to understand and modify PTLsim's out of order
 core.
\end_layout

\end_deeper
\begin_layout Itemize
Part 
\begin_inset LatexCommand \ref{part:Appendices}

\end_inset

 is a reference manual for the PTLsim internal uop instruction set, the
 performance monitoring events the simulator supports and a variety of other
 technical information.
\end_layout

\begin_layout Section
Additional Resources
\end_layout

\begin_layout Standard
The latest version of PTLsim and this document are always available at the
 PTLsim web site:
\end_layout

\begin_layout Quote

\family sans
\series bold
\size large
http://www.ptlsim.org
\end_layout

\begin_layout Chapter
PTLsim Architecture
\end_layout

\begin_layout Chapter
\begin_inset LatexCommand \label{sec:PTLsimCodeBase}

\end_inset

PTLsim Code Base
\end_layout

\begin_layout Section
Code Base Overview
\end_layout

\begin_layout Standard
PTLsim is written in C++ with extensive use of x86 and x86-64 inline assembly
 code.
 It must be compiled with gcc on a Linux 2.6 based x86 or x86-64 machine.
 The C++ variant used by PTLsim is known as Embedded C++.
 Essentially, we only use the features found in C, but add templates, classes
 and operator overloading.
 Other C++ features such as hidden side effects in constructors, exception
 handling, RTTI, multiple inheritance, virtual methods (in most cases),
 thread local storage and so on are forbidden since they cannot be adequately
 controlled in the embedded 
\begin_inset Quotes eld
\end_inset

bare hardware
\begin_inset Quotes erd
\end_inset

 environment in which PTLsim runs, and can result in poor performance.
 We have our own standard template library, SuperSTL, that must be used
 in place of the C++ STL.
\end_layout

\begin_layout Standard
Even though the PTLsim code base is very large, it is well organized and
 structured for extensibility.
 The following section is an overview of the source files and subsystems
 in PTLsim:
\end_layout

\begin_layout Itemize

\series bold
PTLsim Core Subsystems:
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size small
ptlsim.cpp
\family default
\series default
\size default
 and 
\family typewriter
\series bold
\size small
ptlsim.h
\family default
\series default
\size default
 are responsible for general top-level PTLsim tasks and starting the appropriate
 simulation core code.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
uopimpl.cpp
\family default
\series default
\size default
 contains implementations of all uops and their variations.
 PTLsim implements most ALU and floating point uops in assembly language
 so as to leverage the exact semantics and flags generated by real x86 instructi
ons, since most PTLsim uops are so similar to the equivalent x86 instructions.
 When compiled on a 32-bit system, some of the 64-bit uops must be emulated
 using slower C++ code.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
ptlhwdef.cpp
\family default
\series default
\size default
 and 
\family typewriter
\series bold
\size small
ptlhwdef.h
\family default
\series default
\size default
 define the basic uop encodings, flags and registers.
 The tables of uops might be interesting to see how a modern x86 processor
 is designed at the microcode level.
 The basic format is discussed in Section 
\begin_inset LatexCommand \ref{sec:UopIntro}

\end_inset

; all uops are documented in Section 
\begin_inset LatexCommand \ref{sec:UopReference}

\end_inset

.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
seqcore.cpp
\family default
\series default
\size default
 implements the sequential in-order core.
 This is a strictly functional core, without data caches, branch prediction
 and so forth.
 Its purpose is to provide fast execution of the raw uop stream and debugging
 of issues with the decoder, microcode or virtual hardware rather than a
 specific core model.
\end_layout

\end_deeper
\begin_layout Itemize

\series bold
Decoder, Microcode and Basic Block Cache:
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size small
decode-core.cpp 
\family default
\series default
\size default
coordinates the translation from x86 and x86-64 into uops, maintains the
 basic block cache and handles self modifying code, invalidation and other
 x86 specific complexities.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
decode-fast.cpp
\family default
\series default
\size default
 decodes the subset of the x86 instruction set used by 95% of all instructions
 with four or fewer uops.
 It should be considered the 
\begin_inset Quotes eld
\end_inset

fast path
\begin_inset Quotes erd
\end_inset

 decoder in a hardware microprocessor.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
decode-complex.cpp
\family default
\series default
\size default
 decodes complex instructions into microcode, and provides most of the assists
 (microcode subroutines) required by x86 machines.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
decode-sse.cpp
\family default
\series default
\size default
 decodes all SSE, SSE2, SSE3 and MMX instructions
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
decode-x87.cpp
\family default
\series default
\size default
 decodes x87 floating point instructions and provides the associated microcode
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
decode.h
\family default
\series default
\size default
 contains definitions of the above functions and classes.
\end_layout

\end_deeper
\begin_layout Itemize

\series bold
Out Of Order Core:
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size small
ooocore.cpp
\family default
\series default
\size default
 is the out of order simulator control logic.
 The microarchitectural model implemented by this simulator is the subject
 of Part 
\begin_inset LatexCommand \ref{part:OutOfOrderModel}

\end_inset

.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
ooopipe.cpp
\family default
\series default
\size default
 implements the discrete pipeline stages (frontend and backend) of the out
 of order model.
\end_layout

\begin_layout Itemize

\series bold
oooexec.cpp
\series default
 implements all functional units, load/store units and issue queue and replay
 logic
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
ooocore.h
\family default
\series default
\size default
 defines most of the configurable parameters for the out of order core not
 intrinsic to the PTLsim uop instruction set itself.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
dcache.cpp
\family default
\series default
\size default
 and 
\family typewriter
\series bold
\size small
dcache.h
\family default
\series default
\size default
 contain the data cache model.
 At present the full L1/L2/L3/mem hierarchy is modeled, along with miss
 buffers, load fill request queues, ITLB/DTLB and bus interfaces.
 The cache hierarchy is very flexible configuration wise; it is described
 further in Section 
\begin_inset LatexCommand \ref{sec:CacheHierarchy}

\end_inset

.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
branchpred.cpp
\family default
\series default
\size default
 and 
\family typewriter
\series bold
\size small
branchpred.h
\family default
\series default
\size default
 is the branch predictor.
 By default, this is set up as a hybrid bimodal and history based predictor
 with various customizable parameters.
\end_layout

\end_deeper
\begin_layout Itemize

\series bold
Linux Hosted Kernel Interface:
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size small
kernel.cpp
\family default
\series default
\size default
 and 
\family typewriter
\series bold
\size small
kernel.h
\family default
\series default
\size default
 is where all the virtual machine "black magic" takes place to let PTLsim
 transparently switch between simulation and native mode and 32-bit/64-bit
 mode (or only 32-bit mode on a 32-bit x86 machine).
 In general you should not need to touch this since it is very Linux kernel
 specific and works at a level below the standard C/C++ libraries.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
lowlevel-64bit.S
\family default
\series default
\size default
 contains 64-bit startup and context switching code.
 PTLsim execution starts here if run on an x86-64 system.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
lowlevel-32bit.S
\family default
\series default
\size default
 contains 32-bit startup and context switching code.
 PTLsim execution starts here if run on a 32-bit x86 system.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
injectcode.cpp
\family default
\series default
\size default
 is compiled into the 32-bit and 64-bit code injected into the target process
 to map the 
\family typewriter
\size small
ptlsim
\family default
\size default
 binary and pass control to it.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
loader.h
\family default
\series default
\size default
 is used to pass information to the injected boot code.
\end_layout

\end_deeper
\begin_layout Itemize

\series bold
PTLsim/X Bare Hardware and Xen Interface:
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size small
ptlxen.cpp
\family default
\series default
\size default
 brings up PTLsim on the bare hardware, dispatches traps and interrupts,
 virtualizes Xen hypercalls, communicates via DMA with the PTLsim monitor
 process running in the host domain 0 and otherwise serves as the kernel
 of PTLsim's own mini operating system.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
ptlxen-memory.cpp
\family default
\series default
\size default
 is responsible for all page based memory operations within PTLsim.
 It manages PTLsim's own internal page tables and its physical memory map,
 and services page table walks, parts of the x86 microcode and memory-related
 Xen hypercalls.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
ptlxen-events.cpp
\family default
\series default
\size default
 provides all interrupt (VIRQ) and event handling, manages PTLsim's time
 dilation technology, and provides all time and event related hypercalls.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
ptlxen-common.cpp
\family default
\series default
\size default
 provides common functions used by both PTLsim itself and PTLmon.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
ptlxen.h
\family default
\series default
\size default
 provides inline functions and defines related to full system PTLsim/X.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
ptlmon.cpp
\family default
\series default
\size default
 provides the PTLsim monitor process, which runs in domain 0 and interfaces
 with the PTLsim hypervisor code inside the target domain to allow it to
 communicate with the outside world.
 It uses a client/server architecture to forward control commands to PTLsim
 using DMA and Xen hypercalls.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
xen-types.h
\family default
\series default
\size default
 contains Xen-specific type definitions
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
ptlsim-xen-hypervisor.diff
\family default
\series default
\size default
 and 
\family typewriter
\series bold
\size small
ptlsim-xen-tools.diff
\family default
\series default
\size default
 are patches that must be applied to the Xen hypervisor source tree and
 the Xen userspace tools, respectively, to allow PTLsim to be injected into
 domains.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
ptlxen.lds
\family default
\series default
\size default
 and 
\family typewriter
\series bold
\size small
ptlmon.lds
\family default
\series default
\size default
 are linker scripts used to lay out the memory image of PTLsim and PTLmon.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
lowlevel-64bit-xen.S
\family default
\series default
\size default
 contains the PTLsim/X boot code, interrupt handling and exception handling
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
ptlctl.cpp
\family default
\series default
\size default
 is a utility used within a domain under simulation to control PTLsim
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
ptlcalls.h
\family default
\series default
\size default
 provides a library of functions used by code within the target domain to
 control PTLsim.
\end_layout

\end_deeper
\begin_layout Itemize

\series bold
Support Subsystems:
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size small
superstl.h
\family default
\series default
\size default
, 
\family typewriter
\series bold
\size small
superstl.cpp
\family default
\series default
\size default
 and 
\family typewriter
\series bold
\size small
globals.h
\family default
\series default
\size default
 implement various standard library functions and classes as an alternative
 to C++ STL.
 These libraries also contain a number of features very useful for bit manipulat
ion.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
logic.h
\family default
\series default
\size default
 is a library of C++ templates for implementing synchronous logic structures
 like associative arrays, queues, register files, etc.
 It has some very clever features like 
\family typewriter
\size small
FullyAssociativeArray8bit
\family default
\size default
, which uses x86 SSE vector instructions to associatively match and process
 ~16 byte-sized tags every cycle.
 These classes are fully parameterized and useful for all kinds of simulations.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
mm.cpp
\family default
\series default
\size default
 is the PTLsim custom memory manager.
 It provides extremely fast memory allocation functions based on multi-threaded
 slab caching (the same technique used inside Linux itself) and extent allocatio
n, along with a traditional physical page allocator.
 The memory manager also provides PTLsim's garbage collection system, used
 to discard unused or least recently used objects when allocations fail.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
mathlib.cpp
\family default
\series default
\size default
 and 
\family typewriter
\series bold
\size small
mathlib.h
\family default
\series default
\size default
 provide standard floating point functions suitable for embedded systems
 use.
 These are used heavily as part of the x87 microcode.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
klibc.cpp
\family default
\series default
\size default
 and 
\family typewriter
\series bold
\size small
klibc.h
\family default
\series default
\size default
 provide standard libc-like library functions suitable for use on the bare
 hardware
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
syscalls.cpp
\family default
\series default
\size default
 and 
\family typewriter
\series bold
\size small
syscalls.h
\family default
\series default
\size default
 declare all Linux system call stubs.
 This is also used by PTLsim/X, which emulates some Linux system calls to
 make porting easier.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
config.cpp
\family default
\series default
\size default
 and 
\family typewriter
\series bold
\size small
config.h
\family default
\series default
\size default
 manage the parsing of configuration options for each user program.
 This is a general purpose library used by both PTLsim itself and the userspace
 tools (PTLstats, etc)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
datastore.cpp
\family default
\series default
\size default
 and 
\family typewriter
\series bold
\size small
datastore.h
\family default
\series default
\size default
 manage the PTLsim statistics data store file structure.
\end_layout

\end_deeper
\begin_layout Itemize

\series bold
Userspace Tools:
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size small
ptlstats.cpp
\family default
\series default
\size default
 is a utility for printing and analyzing the statistics data store files
 in various human readable ways.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
dstbuild
\family default
\series default
\size default
 is a Perl script used to parse stats.h and generate the datastore template
 (Section 
\begin_inset LatexCommand \ref{sec:StatisticsInfrastructure}

\end_inset

)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
makeusage.cpp
\family default
\series default
\size default
 is used to capture the usage text (help screen) for linking into PTLsim
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
cpuid.cpp
\family default
\series default
\size default
 is a utility program to show various data returned by the x86 
\family typewriter
\size small
cpuid
\family default
\size default
 instruction.
 Run it under PTLsim for a surprise.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
glibc.cpp
\family default
\series default
\size default
 contains miscellaneous userspace functions
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
ptlcalls.c
\family default
\series default
\size default
 and 
\family typewriter
\series bold
\size small
ptlcalls.h
\family default
\series default
\size default
 are optionally compiled into user programs to let them switch into and
 out of simulation mode on their own.
 The 
\family typewriter
\series bold
\size small
ptlcalls.o
\family default
\series default
\size default
 file is typically linked with Fortran programs that can't use regular C
 header files.
\end_layout

\end_deeper
\begin_layout Section
Common Libraries and Logic Design APIs
\end_layout

\begin_layout Standard
PTLsim includes a number of powerful C++ templates, macros and functions
 not found anywhere else.
 This section attempts to provide an overview of these structures so that
 users of PTLsim will use them instead of trying to duplicate work we've
 already done.
\end_layout

\begin_layout Subsection
General Purpose Macros
\end_layout

\begin_layout Standard
The file 
\family typewriter
\size small
globals.h
\family default
\size default
 contains a wide range of very useful definitions, functions and macros
 we have accumulated over the years, including:
\end_layout

\begin_layout Itemize
Basic data types used throughout PTLsim (e.g.
 
\family typewriter
\size footnotesize
W64
\family default
\size default
 for 64-bit words, 
\family typewriter
\size footnotesize
Waddr
\family default
\size default
 for words the same size as pointers, and so on)
\end_layout

\begin_layout Itemize
Type safe C++ template based functions, including 
\family typewriter
\size footnotesize
min
\family default
\size default
, 
\family typewriter
\size footnotesize
max
\family default
\size default
, 
\family typewriter
\size footnotesize
abs
\family default
\size default
, 
\family typewriter
\size footnotesize
mux
\family default
\size default
, etc.
\end_layout

\begin_layout Itemize
Iterator macros (
\family typewriter
\size footnotesize
foreach
\family default
\size default
) 
\end_layout

\begin_layout Itemize
Template based metaprogramming functions including 
\family typewriter
\size footnotesize
lengthof
\family default
\size default
 (finds the length of any static array), 
\family typewriter
\size footnotesize
offsetof 
\family default
\size default
(offset of member in structure), 
\family typewriter
\size footnotesize
baseof
\family default
\size default
 (member to base of structure), and 
\family typewriter
\size footnotesize
log2
\family default
\size default
 (takes the base-2 log of any constant at compile time)
\end_layout

\begin_layout Itemize
Floor, ceiling and masking functions for integers and powers of two (
\family typewriter
\size footnotesize
floor
\family default
\size default
, 
\family typewriter
\size footnotesize
trunc
\family default
\size default
, 
\family typewriter
\size footnotesize
ceil
\family default
\size default
, 
\family typewriter
\size footnotesize
mask
\family default
\size default
, 
\family typewriter
\size footnotesize
floorptr
\family default
\size default
, 
\family typewriter
\size footnotesize
ceilptr
\family default
\size default
, 
\family typewriter
\size footnotesize
maskptr
\family default
\size default
, 
\family typewriter
\size footnotesize
signext
\family default
\size default
, etc)
\end_layout

\begin_layout Itemize
Bit manipulation macros (
\family typewriter
\size footnotesize
bit
\family default
\size default
, 
\family typewriter
\size footnotesize
bitmask
\family default
\size default
, 
\family typewriter
\size footnotesize
bits
\family default
\size default
, 
\family typewriter
\size footnotesize
lowbits
\family default
\size default
, 
\family typewriter
\size footnotesize
setbit
\family default
\size default
, 
\family typewriter
\size footnotesize
clearbit
\family default
\size default
, 
\family typewriter
\size footnotesize
assignbit
\family default
\size default
).
 Note that the 
\family typewriter
\size footnotesize
bitvec
\family default
\size default
 template (see below) should be used in place of these macros wherever it
 is more convenient.
\end_layout

\begin_layout Itemize
Comparison functions (
\family typewriter
\size footnotesize
aligned
\family default
\size default
, 
\family typewriter
\size footnotesize
strequal
\family default
\size default
, 
\family typewriter
\size footnotesize
inrange
\family default
\size default
, 
\family typewriter
\size footnotesize
clipto
\family default
\size default
)
\end_layout

\begin_layout Itemize
Modulo arithmetic (
\family typewriter
\size footnotesize
add_index_modulo
\family default
\size default
, 
\family typewriter
\size footnotesize
modulo_span
\family default
\size default
, et al)
\end_layout

\begin_layout Itemize
Definitions of basic x86 SSE vector functions (e.g.
 
\family typewriter
\size footnotesize
x86_cpu_pcmpeqb 
\family default
\size default
et al)
\end_layout

\begin_layout Itemize
Definitions of basic x86 assembly language functions (e.g.
 
\family typewriter
\size footnotesize
x86_bsf64
\family default
\size default
 et al)
\end_layout

\begin_layout Itemize
A full suite of bit scanning functions (
\family typewriter
\size footnotesize
lsbindex
\family default
\size default
, 
\family typewriter
\size footnotesize
msbindex
\family default
\size default
, 
\family typewriter
\size footnotesize
popcount
\family default
\size default
 et al)
\end_layout

\begin_layout Itemize
Miscellaneous functions (
\family typewriter
\size footnotesize
arraycopy
\family default
\size default
, 
\family typewriter
\size footnotesize
setzero
\family default
\size default
, etc)
\end_layout

\begin_layout Subsection
Super Standard Template Library (SuperSTL)
\end_layout

\begin_layout Standard
The Super Standard Template Library (SuperSTL) is an internal C++ library
 we use internally in lieu of the normal C++ STL for various technical and
 preferential reasons.
 While the full documentation is in the comments of 
\family typewriter
\size small
superstl.h
\family default
\size default
 and 
\family typewriter
\size small
superstl.cpp
\family default
\size default
, the following is a brief list of its features:
\end_layout

\begin_layout Itemize
I/O stream classes familiar from Standard C++, including 
\family typewriter
\size footnotesize
istream
\family default
\size default
 and 
\family typewriter
\size footnotesize
ostream
\family default
\size default
.
 Unique to SuperSTL is how the comma operator (
\begin_inset Quotes eld
\end_inset

,
\begin_inset Quotes erd
\end_inset

) can be used to separate a list of objects to send to or from a stream,
 in addition to the usual C++ insertion operator (
\begin_inset Quotes eld
\end_inset

<<
\begin_inset Quotes erd
\end_inset

).
\end_layout

\begin_layout Itemize
To read and write binary data, the 
\family typewriter
\size small
idstream
\family default
\size default
 and 
\family typewriter
\size small
odstream
\family default
\size default
 classes should be used instead.
\end_layout

\begin_layout Itemize
String buffer (
\family typewriter
\size footnotesize
stringbuf
\family default
\size default
) class for composing strings in memory the same way they would be written
 to or read from an 
\family typewriter
\size footnotesize
ostream
\family default
\size default
 or 
\family typewriter
\size footnotesize
istream
\family default
\size default
.
\end_layout

\begin_layout Itemize
String formatting classes (
\family typewriter
\size footnotesize
intstring
\family default
\size default
, 
\family typewriter
\size footnotesize
hexstring
\family default
\size default
, 
\family typewriter
\size footnotesize
padstring
\family default
\size default
, 
\family typewriter
\size footnotesize
bitstring
\family default
\size default
, 
\family typewriter
\size footnotesize
bytemaskstring
\family default
\size default
, 
\family typewriter
\size footnotesize
floatstring
\family default
\size default
) provide a wrapper around objects to exercise greater control of how they
 are printed.
\end_layout

\begin_layout Itemize
Array (
\family typewriter
\size footnotesize
array
\family default
\size default
) template class represents a fixed size array of objects.
 It is essentially a simple but very fast wrapper for a C-style array.
\end_layout

\begin_layout Itemize
Bit vector (
\family typewriter
\size footnotesize
bitvec
\family default
\size default
) is a heavily optimized and rewritten version of the Standard C++ 
\family typewriter
\size footnotesize
bitset
\family default
\size default
 class.
 It supports many additional operations well suited to logic design purposes
 and emphasizes extremely fast branch free code.
\end_layout

\begin_layout Itemize
Dynamic Array (
\family typewriter
\size footnotesize
dynarray
\family default
\size default
) template class provides for dynamically sized arrays, stacks and other
 such structures, similar to the Standard C++ 
\family typewriter
\size small
valarray
\family default
\size default
 class.
\end_layout

\begin_layout Itemize
Linked list node (
\family typewriter
\size footnotesize
listlink
\family default
\size default
) template class forms the basis of double linked list structures in which
 a single pointer refers to the head of the list.
\end_layout

\begin_layout Itemize
Queue list node (
\family typewriter
\size small
queuelink
\family default
\size default
) template class supports more operations than 
\family typewriter
\size small
listlink
\family default
\size default
 and can serve as both a node in a list and a list head/tail header.
\end_layout

\begin_layout Itemize
Index reference (
\family typewriter
\size small
indexref
\family default
\size default
) is a smart pointer which compresses a full pointer into an index into
 a specific structure (made unique by the template parameters).
 This class behaves exactly like a pointer when referenced, but takes up
 much less space and may be faster.
 The 
\family typewriter
\size small
indexrefnull
\family default
\size default
 class adds support for storing null pointers, which 
\family typewriter
\size small
indexref
\family default
\size default
 lacks.
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
Hashtable
\family default
\size default
 class is a general purpose chaining based hash table with user configurable
 key hashing and management via add-on template classes.
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
SelfHashtable
\family default
\size default
 class is an optimized hashtable for cases where objects contain their own
 keys.
 Its use is highly recommended instead of 
\family typewriter
\size footnotesize
Hashtable
\family default
\size default
.
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
ChunkList
\family default
\size default
 class maintains a linked list of small data items, but packs many of these
 items into a chunk, then chains the chunks together.
 This is the most cache-friendly way of maintaining variable length lists.
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
CRC32
\family default
\size default
 calculation class is useful for hashing
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
CycleTimer
\family default
\size default
 is useful for timing intervals with sub-nanosecond precision using the
 CPU cycle counter (discussed in Section 
\begin_inset LatexCommand \ref{sec:Timing}

\end_inset

).
\end_layout

\begin_layout Subsection
Logic Standard Template Library (LogicSTL)
\end_layout

\begin_layout Standard
The Logic Standard Template Library (LogicSTL) is an internally developed
 add-on to SuperSTL which supports a variety of structures useful for modeling
 sequential logic.
 Some of its primitives may look familiar to Verilog or VHDL programmers.
 While the full documentation is in the comments of 
\family typewriter
\size small
logic.h
\family default
\size default
, the following is a brief list of its features:
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
latch
\family default
\size default
 template class works like any other assignable variable, but the new value
 only becomes visible after the 
\family typewriter
\size footnotesize
clock()
\family default
\size default
 method is called (potentially from a global clock chain).
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
Queue
\family default
\size default
 template class implements a general purpose fixed size queue.
 The queue supports various operations from both the head and the tail,
 and is ideal for modeling queues in microprocessors.
\end_layout

\begin_layout Itemize
Iterators for 
\family typewriter
\size footnotesize
Queue
\family default
\size default
 objects such as 
\family typewriter
\size footnotesize
foreach_forward
\family default
\size default
, 
\family typewriter
\size footnotesize
foreach_forward_from
\family default
\size default
, 
\family typewriter
\size footnotesize
foreach_forward_after
\family default
\size default
, 
\family typewriter
\size footnotesize
foreach_backward
\family default
\size default
, 
\family typewriter
\size footnotesize
foreach_backward_from
\family default
\size default
, 
\family typewriter
\size footnotesize
foreach_backward_before
\family default
\size default
.
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
HistoryBuffer
\family default
\size default
 maintains a shift register of values, which when combined with a hash function
 is useful for implementing predictor histories and the like.
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
FullyAssociativeTags
\family default
\size default
 template class is a general purpose array of associative tags in which
 each tag must be unique.
 This class uses highly efficient matching logic and supports pseudo-LRU
 eviction, associative invalidation and direct indexing.
 It forms the basis for most associative structures in PTLsim.
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
FullyAssociativeArray
\family default
\size default
 pairs a 
\family typewriter
\size footnotesize
FullyAssociativeTags
\family default
\size default
 object with actual data values to form the basis of a cache.
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
AssociativeArray 
\family default
\size default
divides a 
\family typewriter
\size footnotesize
FullyAssociativeArray
\family default
\size default
 into sets.
 In effect, this class can provide a complete cache implementation for a
 processor.
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
LockableFullyAssociativeTags
\family default
\size default
, 
\family typewriter
\size footnotesize
LockableFullyAssociativeArray
\family default
\size default
 and 
\family typewriter
\size footnotesize
LockableAssociativeArray
\family default
\size default
 provide the same services as the classes above, but support locking lines
 into the cache.
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
CommitRollbackCache
\family default
\size default
 leverages the 
\family typewriter
\size footnotesize
LockableFullyAssociativeArray
\family default
\size default
 class to provide a cache structure with the ability to roll back all changes
 made to memory (not just within this object, but everywhere) after a checkpoint
 is made.
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
FullyAssociativeTags8bit
\family default
\size default
 and 
\family typewriter
\size footnotesize
FullyAssociativeTags16bit
\family default
\size default
 work just like 
\family typewriter
\size footnotesize
FullyAssociativeTags
\family default
\size default
, except that these classes are dramatically faster when using small 8-bit
 and 16-bit tags.
 This is possible through the clever use of x86 SSE vector instructions
 to associatively match and process 16 8-bit tags or 8 16-bit tags every
 cycle.
 In addition, these classes support features like removing an entry from
 the middle of the array while compacting entries around it in constant
 time.
 These classes should be used in place of 
\family typewriter
\size small
FullyAssociativeTags
\family default
\size default
 whenever the tags are small enough (i.e.
 almost all tags except for memory addresses).
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
FullyAssociativeTagsNbitOneHot
\family default
\size default
 is similar to 
\family typewriter
\size footnotesize
FullyAssociativeTagsNbit
\family default
\size default
, but the user must guarantee that all tags are unique.
 This property is used to perform extremely fast matching even with long
 tags (32+ bits).
 The tag data is striped across multiple SSE vectors and matched in parallel,
 then a clever adaptation of the sum-of-absolute-differences SSE instruction
 is used to extract the single matching element (if any) in O(1) time.
\end_layout

\begin_layout Subsection
Miscellaneous Code
\end_layout

\begin_layout Standard
The out of order simulator, ooocore.h, contains several reusable classes,
 including:
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
IssueQueue
\family default
\size default
 template class can be used to implement all kinds of broadcast based issue
 queues
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
StateList
\family default
\size default
 and 
\family typewriter
\size footnotesize
ListOfStateLists
\family default
\size default
 is useful for collecting various lists that objects can be on into one
 structure.
\end_layout

\begin_layout Chapter
\begin_inset LatexCommand \label{part:x86andUops}

\end_inset

x86 Instructions and Micro-Ops (uops)
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:UopIntro}

\end_inset

Micro-Ops (uops) and TransOps
\end_layout

\begin_layout Standard
PTLsim presents to the target code a full implementation of the x86 and
 x86-64 instruction set (both 32-bit and 64-bit modes), including most user
 and kernel level instructions supported by the Intel Pentium 4 and AMD
 K8 microprocessors (i.e.
 all standard instructions, SSE/SSE2, x86-64 and most of x87 FP).
 At the present stage of development, the vast majority of all userspace
 and 32-bit/64-bit privileged instructions are supported.
\end_layout

\begin_layout Standard
The x86 instruction set is based on the two-operand CISC concept of load-and-com
pute and load-compute-store.
 However, all modern x86 processors (including PTLsim) do not directly execute
 complex x86 instructions.
 Instead, these processors translate each x86 instruction into a series
 of micro-operations (
\emph on
uops
\emph default
) very similar to classical load-store RISC instructions.
 Uops can be executed very efficiently on an out of order core, unlike x86
 instructions.
 In PTLsim, uops have three source registers and one destination register.
 They may generate a 64-bit result and various x86 status flags, or may
 be loads, stores or branches.
\end_layout

\begin_layout Standard
The x86 instruction decoding process initially generates translated uops
 (
\emph on
transops
\emph default
), which have a slightly different structure than the true uops used in
 the processor core.
 Specifically, sources and destinations are represented as un-renamed architectu
ral registers (or special temporary register numbers), and a variety of
 additional information is attached to each uop only needed during the renaming
 and retirement process.
 TransOps (represented by the 
\family typewriter
\size small
TransOp
\family default
\size default
 structure) consist of the following:
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
som
\family default
\size default
: Start of Macro-Op.
 Since x86 instructions may consist of multiple transops, the first transop
 in the sequence has its 
\family typewriter
\size small
som
\family default
\size default
 bit set to indicate this.
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
eom
\family default
\size default
: End of Macro-Op.
 This bit is set for the last transop in a given x86 instruction (which
 may also be the first uop for single-uop instructions)
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
bytes
\family default
\size default
: Number of bytes in the corresponding x86 instruction (1-15).
 The same 
\family typewriter
\size footnotesize
bytes
\family default
\size default
 field value is present in all uops comprising an x86 instruction.
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
opcode
\family default
\size default
: the uop (not x86) opcode
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
size
\family default
\size default
: the effective operation size (0-3, for 1/2/4/8 bytes)
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
cond
\size small
:
\family default
\size default
 the x86 condition code for branches, selects, sets, etc.
 For loads and stores, this field is reused to specify unaligned access
 information as described later.
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
setflags
\family default
\size default
: subset of the x86 flags set by this uop (see Section 
\begin_inset LatexCommand \ref{sub:FlagsManagement}

\end_inset

)
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
internal
\family default
\size default
: set for certain microcode operations.
 For instance, loads and stores marked internal access on-chip registers
 or buffers invisible to x86 code (e.g.
 machine state registers, segmentation caches, floating point constant tables,
 etc).
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
rd
\family default
\size default
, 
\family typewriter
\size footnotesize
ra
\family default
\size default
, 
\family typewriter
\size footnotesize
rb
\family default
\size default
, 
\family typewriter
\size footnotesize
rc
\family default
\size default
: the architectural source and destination registers (see Section 
\begin_inset LatexCommand \ref{sub:RegisterRenaming}

\end_inset

)
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
extshift
\family default
\size default
: shift amount (0-3 bits) used for shifted adds (x86 memory addressing and
 LEA).
 The 
\family typewriter
\size footnotesize
rc
\family default
\size default
 operand is shifted left by this amount.
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
cachelevel
\family default
\size default
: used for prefetching and non-temporal loads and stores
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
rbimm
\family default
\size default
 and 
\family typewriter
\size footnotesize
rcimm
\family default
\size default
: signed 64-bit immediates for the rb and rc operands.
 These are selected by specifying the special constant 
\family typewriter
\size footnotesize
REG_imm
\family default
\size default
 in the 
\family typewriter
\size footnotesize
rb
\family default
\size default
 and 
\family typewriter
\size footnotesize
rc
\family default
\size default
 fields, respectively.
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
riptaken
\family default
\size default
: for branches only, the 64-bit target RIP of the branch if it were taken.
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
ripseq
\family default
\size default
: for branches only, the 64-bit sequential RIP of the branch if it were
 not taken.
\end_layout

\begin_layout Standard
Appendix 
\begin_inset LatexCommand \ref{sec:UopReference}

\end_inset

 describes the semantics and encoding of all uops supported by the PTLsim
 processor model.
 The following is an overview of the common features of these uops and how
 they are used to synthesize specific x86 instructions.
\end_layout

\begin_layout Section
Load-Execute-Store Operations
\end_layout

\begin_layout Standard
Simple integer and floating point operations are fairly straightforward
 to decode into loads, stores and ALU operations; a typical load-op-store
 ALU operation will consist of a load to fetch one operand, the ALU operation
 itself, and a store to write the result.
 The instruction set also implements a number of important but complex instructi
ons with bizarre semantics; typically the translator will synthesize and
 inject into the uop stream up to 8 uops for more complex instructions.
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:OperationSizes}

\end_inset

Operation Sizes
\end_layout

\begin_layout Standard
Most x86-64 instructions can operate on 8, 16, 32 or 64 bits of a given
 register.
 For 8-bit and 16-bit operations, only the low 8 or 16 bits of the destination
 register are actually updated; 32-bit and 64-bit operations are zero extended
 as with RISC architectures.
 As a result, a dependency on the old destination register may be introduced
 so merging can be performed.
 Fortunately, since x86 features destructive overwrites of the destination
 register (i.e.
 the 
\family typewriter
\size footnotesize
rd
\family default
\size default
 and 
\family typewriter
\size footnotesize
ra
\family default
\size default
 operands are the same), the 
\family typewriter
\size small
ra
\family default
\size default
 operand is generally already a dependency.
 Thus, the PTLsim uop encoding reserves 2 bits to specify the operation
 size; the low bits of the new result are automatically merged with the
 old destination value (in 
\family typewriter
\size footnotesize
ra
\family default
\size default
) as part of the ALU logic.
 This applies to the 
\family typewriter
\size small
mov
\family default
\size default
 uop as well, allowing operations like 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
mov al,bl
\family default
\size default

\begin_inset Quotes erd
\end_inset

 in one uop.
 Loads do not support this mode, so loads into 8-bit and 16-bit registers
 must be followed by a separate 
\family typewriter
\size footnotesize
mov
\family default
\size default
 uop to truncate and merge the loaded value into the old destination properly.
 Fortunately this is not necessary when the load-execute form is used with
 8-bit and 16-bit operations.
\end_layout

\begin_layout Standard
The x86 ISA defines some bizarre byte operations as a carryover from the
 ancient 8086 architecture; for instance, it is possible to address the
 second byte of many integer registers as a separate register (i.e.
 as 
\family typewriter
\size footnotesize
ah
\family default
\size default
, 
\family typewriter
\size footnotesize
bh
\family default
\size default
, 
\family typewriter
\size footnotesize
ch
\family default
\size default
, 
\family typewriter
\size footnotesize
dh
\family default
\size default
).
 The 
\family typewriter
\size footnotesize
mask
\family default
\size default
 uop is used for handling this rare but important set of operations.
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sub:FlagsManagement}

\end_inset

Flags Management and Register Renaming
\end_layout

\begin_layout Standard
Many x86 arithmetic instructions modify some or all of the processor's numerous
 status and condition flag bits, but only 5 are relevant to normal execution:
 Zero, Parity, Sign, Overflow, Carry.
 In accordance with the well-known 
\begin_inset Quotes eld
\end_inset

ZAPS rule
\begin_inset Quotes erd
\end_inset

, any instruction that updates any of the Z/P/S flags updates all three
 flags, so in reality only three flag entities need to be tracked: ZPS,
 O, F (
\begin_inset Quotes eld
\end_inset

ZAPS
\begin_inset Quotes erd
\end_inset

 also includes an Auxiliary flag not accessible by most modern user instructions
; it is irrelevant to the discussion below).
\end_layout

\begin_layout Standard
The x86 flag update semantics can hamper out of order execution, so we use
 a simple and well known solution.
 The 5 flag bits are attached to each result and physical register (along
 with 
\emph on
invalid
\emph default
 and 
\emph on
waiting
\emph default
 bits used by some cores); these bits are then consumed along with the actual
 result value by any consumers that also need to access the flags.
 It should be noted that not all uops generate all the flags as well as
 a 64-bit result, and some uops only generate flags and no result data.
 
\end_layout

\begin_layout Standard
The register renaming mechanism is aware of these semantics, and tracks
 the latest x86 instruction in program order to update each set of flags
 (ZAPS, C, O); this allows branches and other flag consumers to directly
 access the result with the most recent program-ordered flag updates yet
 still allows full out of order scheduling.
 To do this, x86 processors maintain three separate rename table entries
 for the ZAPS, CF, OF flags in addition to the register rename table entry,
 any or all of which may be updated when uops are renamed.
 The 
\family typewriter
\size small
TransOp
\family default
\size default
 structure for each uop has a 3-bit 
\family typewriter
\size small
setflags
\family default
\size default
 field filled out during decoding in accordance with x86 semantics; the
 
\family typewriter
\size small
SETFLAG_ZF
\family default
\size default
, 
\family typewriter
\size small
SETFLAG_CF
\family default
\size default
, 
\family typewriter
\size small
SETFLAG_OF
\family default
\size default
 bits in this field are used to determine which of the ZPS, O, F flag subsets
 to rename.
\end_layout

\begin_layout Standard
As mentioned above, any consumer of the flags needs to consult at most three
 distinct sources: the last ZAPS producer, the Carry producer and the Overflow
 producer.
 This conveniently fits into PTLsim's three-operand uop semantics.
 Various special uops access the flags associated with an operand rather
 than the 64-bit operand data itself.
 Branches always take two flag sources, since in x86 this is enough to evaluate
 any possible condition code combination (the 
\family typewriter
\size footnotesize
cond_code_to_flag_regs
\family default
\size default
 array provides this mapping).
\end_layout

\begin_layout Standard
Various ALU instructions consume only the flags part of a source physical
 register; these include 
\family typewriter
\size footnotesize
addc
\family default
\size default
 (add with carry), 
\family typewriter
\size footnotesize
rcl
\size small
/
\size footnotesize
rcr 
\family default
\size default
(rotate carry), 
\family typewriter
\size footnotesize
sel.
\emph on
cc
\family default
\size default
\emph default
 (select for conditional moves) and so on.
 Finally, the 
\family typewriter
\size footnotesize
collcc
\family default
\size default
 uop takes three operands (the latest producer of the ZAPS, CF and OF flags)
 and merges the flag components of each operand into a single flag set as
 its result.
\end_layout

\begin_layout Standard
PTLsim also provides compound compare-and-branch uops (
\family typewriter
\size footnotesize
br.sub.cc
\family default
\size default
 and 
\family typewriter
\size footnotesize
br.and.cc
\family default
\size default
); these are currently used mostly in microcode, but a core could dynamically
 merge 
\family typewriter
\size footnotesize
CMP
\family default
\size default
 or 
\family typewriter
\size footnotesize
TEST
\family default
\size default
 and 
\family typewriter
\size footnotesize
Jcc
\family default
\size default
 instructions into these uops; this is exactly what the Intel Core 2 and
 a few research processors already do.
\end_layout

\begin_layout Section
x86-64
\end_layout

\begin_layout Standard
The 64-bit x86-64 instruction set is a fairly straightforward extension
 of the 32-bit IA-32 (x86) instruction set.
 The x86-64 ISA was introduced by AMD in 2000 with its K8 microarchitecture;
 the same instructions were subsequently plagiarized by Intel under a different
 name (
\begin_inset Quotes eld
\end_inset

EM64T
\begin_inset Quotes erd
\end_inset

) several years later.
 In addition to extending all integer registers and ALU datapaths to 64
 bits, x86-64 also provides a total of 16 integer general purpose registers
 and 16 SSE (vector floating and fixed point) registers.
 It also introduced several 64-bit address space simplifications, including
 RIP-relative addressing and corresponding new addressing modes, and eliminated
 a number of legacy features from 64-bit mode, including segmentation, BCD
 arithmetic, some byte register manipulation, etc.
 Limited forms of segmentation are still present to allow thread local storage
 and mark code segments as 64-bit.
 In general, the encoding of x86-64 and x86 are very similar, with 64-bit
 mode adding a one byte REX prefix to specify additional bits for source
 and destination register indexes and effective address size.
 As a result, both variants can be decoded by similar decoding logic into
 a common set of uops.
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sub:UnalignedLoadsAndStores}

\end_inset

Unaligned Loads and Stores
\end_layout

\begin_layout Standard
Compared to RISC architectures, the x86 architecture is infamous for its
 relatively widespread use of unaligned memory operations; any implementation
 must efficiently handle this scenario.
 Fortunately, analysis shows that unaligned accesses are rarely in the performan
ce intensive parts of a modern program (with the exception of certain media
 processing algorithms).
 Once a given load or store is known to frequently have an unaligned address,
 it can be preemptively split into two aligned loads or stores at decode
 time.
 PTLsim does this by initially causing all unaligned loads and stores to
 raise an 
\family typewriter
\size footnotesize
UnalignedAccess
\family default
\size default
 internal exception, forcing a pipeline flush.
 At this point, the special 
\family typewriter
\size footnotesize
unaligned
\family default
\size default
 bit is set for the problem load or store uop in its translated basic block
 representation.
 The next time the offending uop is encountered, it will be split into two
 parts very early in the pipeline.
\end_layout

\begin_layout Standard
PTLsim includes special uops to handle loads and stores split into two in
 this manner.
 The 
\family typewriter
\size footnotesize
ld.lo
\family default
\size default
 uop rounds down its effective address 
\begin_inset Formula $\left\lfloor A\right\rfloor $
\end_inset

 to the nearest 64-bit boundary and performs the load.
 The 
\family typewriter
\size footnotesize
ld.hi
\family default
\size default
 uop rounds up to 
\begin_inset Formula $\left\lceil A+8\right\rceil $
\end_inset

, performs another load, then takes as its third rc operand the first (
\family typewriter
\size footnotesize
ld.lo
\family default
\size default
) load's result.
 The two loads are concatenated into a 128-bit word and the final unaligned
 data is extracted.
 Stores are handled in a similar manner, with 
\family typewriter
\size footnotesize
st.lo
\family default
\size default
 and 
\family typewriter
\size footnotesize
st.hi
\family default
\size default
 rounding down and up to store parts of the unaligned value in adjacent
 64-bit blocks.
 Depending on the core model, these unaligned load or store pairs access
 separate store buffers for each half as if they were independent.
\end_layout

\begin_layout Section
Repeated String Operations
\end_layout

\begin_layout Standard
The x86 architecture allows for repeated string operations, including block
 moves, stores, compares and scans.
 The iteration count of these repeated operations depends on a combination
 of the 
\family typewriter
\size footnotesize
rcx
\family default
\size default
 register and the flags set by the repeated operation (e.g.
 compare).
 To translate these instructions, PTLsim treats the 
\family typewriter
\size footnotesize
rep xxx
\family default
\size default
 instruction as a single basic block; any basic block in progress before
 the repeat instruction is terminated and the repeat is decoded as a separate
 basic block.
 To handle the unusual case where the repeat count is zero, a check uop
 (see below) is inserted at the top of the loop to protect against this
 case; PTLsim simply bypasses the offending block if the check fails.
\end_layout

\begin_layout Section
Checks and SkipBlocks
\end_layout

\begin_layout Standard
PTLsim includes special uops (
\family typewriter
\size footnotesize
chk.and.cc
\family default
\size default
, 
\family typewriter
\size footnotesize
chk.sub.cc
\family default
\size default
) that compare two values or condition codes and cause a special internal
 exception if the result is true.
 The 
\family typewriter
\size footnotesize
SkipBlock
\family default
\size default
 internal exception generated by these uops tells the core to literally
 annul all uops in this instruction, dynamically turning it into a nop.
 As described above, this is useful for string operations where a zero count
 causes all of the instruction's side effects to be annulled.
 Similarly, the 
\family typewriter
\size footnotesize
AssistCheck
\family default
\size default
 internal exception dynamically turns the instruction into an assist, for
 those cases where certain rare conditions may require microcode intervention
 more complex than can be inlined into the decoded instruction stream.
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:ShiftRotateProblems}

\end_inset

Shifts and Rotates
\end_layout

\begin_layout Standard
The shift and rotate instructions have some of the most bizarre semantics
 in the entire x86 instruction set: they may or may not modify a subset
 of the flags depending on the rotation count operand, which we may not
 even know until the instruction issues.
 For fixed shifts and rotates, these semantics can be preserved by the uops
 generated, however variable rotations are more complex.
 The 
\family typewriter
\size footnotesize
collcc
\family default
\size default
 uop is put to use here to collect all flags; the collected result is then
 fed into the shift or rotate uop as its 
\family typewriter
\size footnotesize
rc
\family default
\size default
 operand; the uop then replicates the precise x86 behavior (including rotates
 using the carry flag) according to its input operands.
\end_layout

\begin_layout Section
SSE Support
\end_layout

\begin_layout Standard
PTLsim provides full support for SSE and SSE2 vector floating point and
 fixed point, in both scalar and vector mode.
 As is done in the AMD K8 and Pentium 4, each SSE operation on a 128-bit
 vector is split into two 64-bit halves; each half (possibly consisting
 of a 64-bit load and one or more FPU operations) is scheduled independently.
 Because SSE instructions do not set flags like x86 integer instructions,
 architectural state management can be restricted to the 16 128-bit SSE
 registers (represented as 32 paired 64-bit registers).
 The 
\family typewriter
\size footnotesize
mxcsr
\family default
\size default
 (media extensions control and status register) is represented as an internal
 register that is only read and written by serializing microcode; since
 the exception and status bits are 
\begin_inset Quotes eld
\end_inset

sticky
\begin_inset Quotes erd
\end_inset

 (i.e.
 only set, never cleared by hardware), this has no effect on out of order
 execution.
 The processor's floating point units can operate in either 64-bit IEEE
 double precision mode or on two parallel 32-bit single precision values.
\end_layout

\begin_layout Standard
PTLsim also includes a variety of vector integer uops used to construct
 SSE2/MMX operations, including packed arithmetic and shuffles.
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sub:x87-Floating-Point}

\end_inset

x87 Floating Point
\end_layout

\begin_layout Standard
The legacy x87 floating point architecture is the bane of all x86 processor
 vendors' existence, largely because its stack based nature makes out of
 order processing so difficult.
 While there are certainly ways of translating stack based instruction sets
 into flat addressing for scheduling purposes, we do not do this.
 Fortunately, following the Pentium III and AMD Athlon's introduction, x87
 is rapidly headed for planned obsolescence; most major applications released
 within the last few years now use SSE instructions for their floating point
 needs either exclusively or in all performance critical parts.
 To this end, even Intel has relegated x86 support on the Pentium 4 and
 Core 2 to a separate low performance legacy unit, and AMD has restricted
 x87 use in 64-bit mode.
 For this reason, PTLsim translates legacy x87 instructions into a serialized,
 program ordered and emulated form; the hardware does not contain any x87-style
 80-bit floating point registers (all floating point hardware is 32-bit
 and 64-bit IEEE compliant).
 We have noticed little to no performance problem from this approach when
 examining typical binaries, which rarely if ever still use x87 instructions
 in compute-intensive code.
\end_layout

\begin_layout Section
Floating Point Unavailable Exceptions
\end_layout

\begin_layout Standard
The x86 architecture specifies a mode in which all floating point operations
 (SSE and x87) will trigger a Floating Point Unavailable exception (
\family typewriter
\size footnotesize
EXCEPTION_x86_fpu_not_avail
\family default
\size default
, vector 0x7) if the 
\family typewriter
\size footnotesize
TS
\family default
\size default
 (task switched) bit in control register 
\family typewriter
\size footnotesize
CR0
\family default
\size default
 is set.
 This allows the kernel to defer saving the floating point registers and
 state of the previously scheduled thread until that state is actually modified,
 thus speeding up context switches.
 PTLsim supports this feature by requiring any commits to the floating point
 state (SSE XMM registers, x87 registers or any floating point related control
 or status registers) to check the 
\family typewriter
\size footnotesize
uop.is_sse
\family default
\size default
 and 
\family typewriter
\size footnotesize
uop.is_x87
\family default
\size default
 bits in the uop.
 If either of these is set, the pipeline must be flushed and redirected
 into the kernel so it can save the FPU state.
\end_layout

\begin_layout Section
Assists
\end_layout

\begin_layout Standard
Some operations are too complex to inline directly into the uop stream.
 To perform these instructions, a special uop (
\family typewriter
\size footnotesize
brp
\family default
\size default
: branch private) is executed to branch to an 
\emph on
assist
\emph default
 function implemented in microcode.
 In PTLsim, some assist functions are implemented as regular C/C++ or assembly
 language code when they interact with the rest of the virtual machine.
 Examples of instructions requiring assists include system calls, interrupts,
 some forms of integer division, handling of rare floating point conditions,
 CPUID, MSR reads/writes, various x87 operations, any serializing instructions,
 etc.
 These are listed in the 
\family typewriter
\size footnotesize
ASSIST_xxx
\family default
\size default
 enum found in 
\family typewriter
\size footnotesize
decode.h
\family default
\size default
.
\end_layout

\begin_layout Standard
Prior to entering an assist, uops are generated to load the 
\family typewriter
\size footnotesize
REG_selfrip
\family default
\size default
 and 
\family typewriter
\size footnotesize
REG_nextrip
\family default
\size default
 internal registers with the RIP of the instruction itself and the RIP after
 its last byte, respectively.
 This lets the assist microcode correctly update RIP before returning, or
 signal a fault on the instruction if needed.
 Several other assist related registers, including 
\family typewriter
\size footnotesize
REG_ar1
\family default
\size default
, 
\family typewriter
\size footnotesize
REG_ar2
\family default
\size default
, 
\family typewriter
\size footnotesize
REG_ar3
\family default
\size default
, are used to store parameters passed to the assist.
 These registers are not architecturally visible, but must be renamed and
 separately maintained by the core as if they were part of the user-visible
 state.
\end_layout

\begin_layout Standard
While the exact behavior depends on the core model (out of order, SMT, sequentia
l, etc), generally when the processor fetches an assist (
\family typewriter
\size footnotesize
brp
\family default
\size default
 uop), the frontend pipeline is stalled and execution waits until the 
\family typewriter
\size footnotesize
brp
\family default
\size default
 commits, at which point an assist function within PTLsim is called.
 This is necessary because assists are not subject to the out of order execution
 mechanism; they directly update the architectural registers on their own.
 In a real processor there are slightly more efficient ways of doing this
 without flushing the pipeline, however in PTLsim assists are sufficiently
 rare that the performance impact is negligible and this approach significantly
 reduces complexity.
 For the out of order core, the exact mechanism used is described in Section
 
\begin_inset LatexCommand \ref{sec:PipelineFlushesAndBarriers}

\end_inset

.
\end_layout

\begin_layout Chapter
\begin_inset LatexCommand \label{sec:BasicBlockCache}

\end_inset

Decoder Architecture and Basic Block Cache
\end_layout

\begin_layout Section
Basic Block Cache
\end_layout

\begin_layout Standard
As described in Section 
\begin_inset LatexCommand \ref{sec:UopIntro}

\end_inset

, x86 instructions are decoded into transops prior to actual execution by
 the core.
 To achieve high performance, PTLsim maintains a 
\emph on
basic block cache
\emph default
 (BB cache) containing the program ordered translated uop (
\emph on
transop
\emph default
) sequence for previously decoded basic blocks in the program.
 Each basic block (
\family typewriter
\size footnotesize
BasicBlock
\family default
\size default
 structure) consists of up to 64 uops and is terminated by either a control
 flow operation (conditional, unconditional, indirect branch) or a barrier
 operation, i.e.
 a microcode assist (including system calls and serializing instructions).
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:RIPVirtPhys}

\end_inset

Identifying Basic Blocks
\end_layout

\begin_layout Standard
In a userspace only simulator, the RIP of a basic block's entry point (plus
 a few other attributes described below) serves to uniquely identify that
 basic block, and can be used as a key in accessing the basic block cache.
 In a full system simulator, the BB cache must be indexed by much more than
 just the virtual address, because of potential virtual page aliasing and
 the need to persistently cache translations across context switches.
 The following fields, in the 
\emph on
RIPVirtPhys
\emph default
 structure, are required to correctly access the BB cache in any full system
 simulator or binary translation system (128 bits total):
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
rip:
\family default
\size default
 Virtual address of first instruction in BB (48 bits), since embedded RIP-relati
ve constants and branch encodings depend on this.
 Modern OS's map shared libraries and binaries at the same addresses every
 time, so translation caching remains effective across runs.
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
mfnlo:
\family default
\size default
 MFN (Machine Frame Number, i.e.
 physical page frame number) of first byte in BB (28 bits), since we need
 to handle self modifying code invalidations based on physical addresses
 (because of possible virtual page aliasing in multiple page tables)
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
mfnhi:
\family default
\size default
 MFN of last byte in BB (28 bits), since a single x86 basic block can span
 up to two pages.
 In pathological cases, it is possible to create two page tables that both
 map the same MFN X at virtual address V, but map different MFNs at virtual
 address V+4096.
 If an instruction crosses this page boundary, the meaning of the instruction
 bytes on the second page will be different; hence we must take into account
 both physical pages to look up the correct translation.
\end_layout

\begin_layout Itemize
Context info (up to 24 bits), since the uops generated depend on the current
 CPU mode and CS descriptor settings
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\size footnotesize
use64:
\family default
\size default
 32-bit or 64-bit mode? (encoding differences)
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
kernel:
\family default
\size default
 Kernel or user mode?
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
df:
\family default
\size default
 EFLAGS status (direction flag, etc)
\end_layout

\begin_layout Itemize
Other info (e.g.
 segmentation assumptions, etc.)
\end_layout

\end_deeper
\begin_layout Standard
The basic block cache is always indexed using an 
\family typewriter
\size footnotesize
RIPVirtPhys
\family default
\size default
 structure instead of a simple RIP.
 To do this, the 
\family typewriter
\size footnotesize
RIPVirtPhys.rip
\family default
\size default
 field is set to the desired RIP, then 
\family typewriter
\size footnotesize
RIPVirtPhys.update(ctx)
\family default
\size default
 is called to translate the virtual address onto the two physical page MFNs
 it could potentially span (assuming the basic block crosses two pages).
\end_layout

\begin_layout Standard
Notice that the other attribute bits (
\family typewriter
\size footnotesize
use64
\family default
\size default
, 
\family typewriter
\size footnotesize
kernel
\family default
\size default
, 
\family typewriter
\size footnotesize
df
\family default
\size default
) mean that two distinct basic blocks may be decoded from the exact same
 RIP on the same physical page(s), yet the uops in each translated basic
 block will be different because the two basic blocks were translated in
 a different context (relative to these attribute bits).
 This is especially important for x86 string move/compare/store/load/scan
 instructions (
\family typewriter
\size footnotesize
MOVSB
\family default
\size default
, 
\family typewriter
\size footnotesize
CMPSB
\family default
\size default
, 
\family typewriter
\size footnotesize
STOSB
\family default
\size default
, 
\family typewriter
\size footnotesize
LODSB
\family default
\size default
, 
\family typewriter
\size footnotesize
SCASB
\family default
\size default
), since the correct increment constants depend on the state of the direction
 flag in the context in which the BB was used.
 Similarly, if a user program tries to decode a supervisor-only opcode,
 code to call the general protection fault handler will be produced instead
 of the real uops produced only in kernel mode.
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:InvalidTranslations}

\end_inset

Invalid Translations
\end_layout

\begin_layout Standard
The 
\family typewriter
\size footnotesize
BasicBlockCache.translate(ctx, rvp)
\family default
\size default
 function 
\emph on
always
\emph default
 returns a 
\family typewriter
\size footnotesize
BasicBlock
\family default
\size default
 object, even if the specified RIP was on an invalid page or some of the
 instruction bytes were invalid.
 When decoding cannot continue for some reason, the decoder simply outputs
 a microcode branch to one of the following assists:
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
ASSIST_INVALID_OPCODE
\family default
\size default
 when the opcode or instruction operands are invalid relative to the current
 context.
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
ASSIST_EXEC_PAGE_FAULT
\family default
\size default
 when the specified RIP falls on an invalid page.
 This means a page is marked as not present in the current page table at
 the time of decoding, or the page is present but has its NX (no execute)
 bit set in the page table entry.
 The 
\family typewriter
\size footnotesize
EXEC_PAGE_FAULT
\family default
\size default
 assist is also generated when the page containing the RIP itself is valid,
 but part of an instruction extends beyond that page onto an invalid page.
 The decoder tries to decode as many instruction bytes as possible, but
 will insert an 
\family typewriter
\size footnotesize
EXEC_PAGE_FAULT
\family default
\size default
 assist whenever it determines, based on the bytes already decoded, that
 the remainder of the instruction would fall on the invalid page.
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
ASSIST_GP_FAULT
\family default
\size default
 when attempting to decode a restricted kernel-only opcode while running
 in user mode.
\end_layout

\begin_layout Standard
Before redirecting execution to the kernel's exception handler, the 
\family typewriter
\size footnotesize
EXEC_PAGE_FAULT
\family default
\size default
 microcode verifies that the page in question is still invalid.
 This avoids a spurious page fault in the case where an instruction was
 originally decoded on an invalid page, but the page tables were updated
 after the translation was first made such that the page is now valid.
 When this is the case, all bogus basic blocks on the page (which were decoded
 into a call to 
\family typewriter
\size footnotesize
EXEC_PAGE_FAULT
\family default
\size default
) must be invalidated, allowing a correct translation to be made now that
 the page is valid.
 The page at the virtual address after the page in question may also need
 to be invalidated in the case where some instruction bytes cross the page
 boundary.
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:SelfModifyingCode}

\end_inset

Self Modifying Code
\end_layout

\begin_layout Standard
In x86 processors, the translation process is considerably more complex,
 because of self modifying code (SMC) and its variants.
 Specifically, the instruction bytes of basic blocks that have already been
 translated and cached may be overwritten; these old translations must be
 discarded.
 The x86 architecture guarantees that all code modifications will be visible
 immediately after the instruction making the modification; unlike other
 architectures, no 
\begin_inset Quotes eld
\end_inset

instruction cache flush
\begin_inset Quotes erd
\end_inset

 operation is provided.
 Several kinds of SMC must be handled correctly:
\end_layout

\begin_layout Itemize
Classical SMC: stores currently in the pipeline overwrite other instructions
 that have already been fetched into the pipeline and even speculatively
 executed out of order;
\end_layout

\begin_layout Itemize
Indirect SMC: stores write to a page on which previously translated code
 used to reside, but that page is now being reused for unrelated data or
 new code.
 This case frequently arises in operating system kernels when pages are
 swapped in and out from disk.
\end_layout

\begin_layout Itemize
Cross-modifying SMC: in a multiprocessor system, one processor overwrites
 instructions that are currently in the pipeline on some other core.
 The x86 standard is ambiguous here; technically no pipeline flush and invalidat
e is required; instead, the cache coherence mechanism and software mutexes
 are expected to prevent this case.
\end_layout

\begin_layout Itemize
External SMC: an external device uses direct memory access (DMA) to overwrite
 the physical DRAM page containing previously translated code.
 In theory, this can happen while the affected instructions are in the pipeline,
 but in practice no operating system would ever allow this.
 However, we still must invalidate any translations on the target page to
 prevent them from being looked up far in the future.
\end_layout

\begin_layout Standard
To deal with all these forms of SMC, PTLsim associates a 
\begin_inset Quotes eld
\end_inset

dirty
\begin_inset Quotes erd
\end_inset

 bit with every physical page (this is unrelated to the 
\begin_inset Quotes eld
\end_inset

dirty
\begin_inset Quotes erd
\end_inset

 bit in user-visible page table entries).
 Whenever the first uop in an x86 instruction (i.e.
 the 
\begin_inset Quotes eld
\end_inset

SOM
\begin_inset Quotes erd
\end_inset

, start-of-macro-op uop) commits, the current context is used to translate
 its RIP into the physical page MFN on which it resides, as described in
 Section 
\begin_inset LatexCommand \ref{sec:RIPVirtPhys}

\end_inset

.
 If the instruction's length in bytes causes it to overlap onto a second
 page, that high MFN is also looked up (using the virtual address 
\emph on
rip
\emph default
 + 4096).
 If the dirty bits for either the low or high MFN are set, this means the
 instruction bytes may have been modified sometime after the time they were
 last translated and added to the basic block cache.
 In this case, the pipeline must be flushed, and all basic blocks on the
 target MFN (and possibly the overlapping high MFN) must be invalidated
 before clearing the dirty bit.
 Technically the RIP-to-physical translation would be done in the instruction
 fetch stage in most core models, then simply stored as an 
\family typewriter
\size footnotesize
RIPVirtPhys
\family default
\size default
 structure inside the uop until commit time.
\end_layout

\begin_layout Standard
The dirty bit can be set by several events.
 Obviously any store uops will set the dirty bit (thus handling the classical,
 indirect and cross-modifying cases), but notice that this bit is not checked
 again until the first uop in the 
\emph on
next
\emph default
 x86 instruction.
 This behavior is required because it is perfectly legal for an x86 store
 to overwrite its own instruction bytes, but this does not become visible
 until the same instruction executes a second time (otherwise an infinite
 loop of invalidations would occur).
 Microcoded x86 instructions implemented by PTLsim itself set dirty bits
 when their constituent internal stores commit.
 Finally, DMA transfers and external writes also set the dirty bit of any
 pages touched by the DMA operation.
\end_layout

\begin_layout Standard
The dirty bit is only cleared when all translated basic blocks are invalidated
 on a given page, and it remains clear until the first write to that page.
 However, no action is taken when additional basic blocks are decoded from
 a page already marked as dirty.
 This may seem counterintuitive, but it is necessary to avoid deadlock:
 if the page were invalidated and retranslated at fetch time, future stages
 in a long pipeline could potentially still have references to unrelated
 basic blocks on the page being invalidated.
 Hence, all invalidations are checked and processed only at commit time.
\end_layout

\begin_layout Standard
Other binary translation based software and hardware 
\begin_inset LatexCommand \cite{TransmetaPatent.TBit,VMware,QEMU,Simics,SimNow}

\end_inset

 have special mechanisms for write protecting physical pages, such that
 when a page with translations is first written by stores or DMA, the system
 immediately invalidates all translations on that page.
 Unfortunately, this scheme has a number of disadvantages.
 First, patents cover its implementation 
\begin_inset LatexCommand \cite{TransmetaPatent.SelfRevalTrans,TransmetaPatent.SubPageTBit,TransmetaPatent.TBit}

\end_inset

, which we would like to avoid.
 In addition, our design eliminates forced invalidations when the kernel
 frees up a page containing code that's immediately overwritten with normal
 user data (a very common pattern according to our studies).
 If that page is never executed again, any translations from it will be
 discarded in the background by the LRU mechanism, rather than interrupting
 execution to invalidate translations that will never be used again anyway.
 Fortunately, true classical SMC is very rare in modern x86 code, in large
 part because major microprocessors have slapped a huge penalty on its use
 (particularly in the case of the Pentium 4 and Transmeta processors, both
 of which store translated uops in a cache similar to PTLsim's basic block
 cache).
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:BasicBlockReclaim}

\end_inset

Memory Management of the Basic Block Cache
\end_layout

\begin_layout Standard
The PTLsim memory manager (in 
\family typewriter
\size footnotesize
mm.cpp
\family default
\size default
, see Section 
\begin_inset LatexCommand \ref{sec:MemoryManager}

\end_inset

 for details) implements a reclaim mechanism in which other subsystems register
 functions that get called when an allocation fails.
 The basic block cache registers a callback, 
\family typewriter
\size footnotesize
bbcache_reclaim()
\family default
\size default
 and 
\family typewriter
\size footnotesize
BasicBlockCache::reclaim()
\family default
\size default
, to invalidate and free basic blocks when PTLsim runs out of memory.
\end_layout

\begin_layout Standard
The algorithm used to do this is a pseudo-LRU design.
 Every basic block has a 
\family typewriter
\size footnotesize
lastused
\family default
\size default
 field that gets updated with the current cycle number whenever 
\family typewriter
\size footnotesize
BasicBlock::use(sim_cycle)
\family default
\size default
 is called (for instance, in the fetch stage of a core model).
 The reclaim algorithm goes through all basic blocks and calculates the
 oldest, average and newest 
\family typewriter
\size footnotesize
lastused
\family default
\size default
 cycles.
 The second pass then invalidates any basic blocks that fall below this
 average cycle; typically around half of all basic blocks fall in the least
 recently used category.
 This strategy has proven very effective in freeing up a large amount of
 space without discarding currently hot basic blocks.
\end_layout

\begin_layout Standard
Each basic block also has a reference counter, 
\family typewriter
\size footnotesize
refcount
\family default
\size default
, to record how many pointers or references to that basic block currently
 exist anywhere inside PTLsim (especially in the pipelines of core models).
 The 
\family typewriter
\size footnotesize
BasicBlock::acquire()
\family default
\size default
 and 
\family typewriter
\size footnotesize
release()
\family default
\size default
 methods adjust this counter.
 Core models should acquire a basic block once for every uop in the pipeline
 within that basic block; the basic block is released as uops commit or
 are annulled.
 Since basic blocks may be speculatively translated in the fetch stage of
 core models, this guarantees that live basic blocks currently in flight
 are never freed until they actually leave the pipeline.
\end_layout

\begin_layout Chapter
PTLsim Support Subsystems
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:UopImplementations}

\end_inset

Uop Implementations
\end_layout

\begin_layout Standard
PTLsim provides implementations for all uops in the 
\family typewriter
\size footnotesize
uopimpl.cpp
\family default
\size default
 file.
 C++ templates are combined with gcc's smart inline assembler type selection
 constraints to translate all possible permutations (sizes, condition codes,
 etc) of each uop into highly optimized code.
 In many cases, a real x86 instruction is used at the core of each corresponding
 uop's implementation; code after the instruction just captures the generated
 x86 condition code flags, rather than having to manually emulate the same
 condition codes ourselves.
 The code implementing each uop is then called from elsewhere in the simulator
 whenever that uop must be executed.
 Note that loads and stores are implemented elsewhere, since they are too
 dependent on the specific core model to be expressed in this generic manner.
\end_layout

\begin_layout Standard
An additional optimization, called 
\emph on
synthesis
\emph default
, is also used whenever basic blocks are translated.
 Each uop in the basic block is mapped to the address of a native PTLsim
 function in 
\family typewriter
\size footnotesize
uopimpl.cpp
\family default
\size default
 implementing the semantics of that uop; this function pointer is stored
 in the 
\family typewriter
\size footnotesize
synthops[]
\family default
\size default
 array of the 
\family typewriter
\size footnotesize
BasicBlock
\family default
\size default
 structure.
 This saves us from having to use a large jump table later on, and can map
 uops to pre-compiled templates that avoid nearly all further decoding of
 the uop during execution.
\end_layout

\begin_layout Section
Configuration Parser
\end_layout

\begin_layout Standard
PTLsim supports a wide array of command line or scriptable configuration
 options, described in Section 
\begin_inset LatexCommand \ref{sec:ConfigurationOptions}

\end_inset

.
 The configuration parser engine (used by both PTLsim itself and utilities
 like PTLstats) is in 
\family typewriter
\size footnotesize
config.cpp
\family default
\size default
 and 
\family typewriter
\size footnotesize
config.h
\family default
\size default
.
 For PTLsim itself, each option is declared in three places:
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
ptlsim.h
\family default
\size default
 declares the 
\family typewriter
\size footnotesize
PTLsimConfig
\family default
\size default
 structure, which is available from anywhere as the 
\family typewriter
\size footnotesize
config
\family default
\size default
 global variable.
 The fields in this structure must be of one of the following types: 
\family typewriter
\size footnotesize
W64
\family default
\size default
 (64-bit integer), 
\family typewriter
\size footnotesize
double
\family default
\size default
 (floating point), 
\family typewriter
\size footnotesize
bool
\family default
\size default
 (on/off boolean), or 
\family typewriter
\size footnotesize
stringbuf
\family default
\size default
 (for text parameters).
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
ptlsim.cpp
\family default
\size default
 declares the 
\family typewriter
\size footnotesize
PTLsimConfig::reset()
\family default
\size default
 function, which sets each option to its default value.
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
ptlsim.cpp
\family default
\size default
 declares the 
\family typewriter
\size footnotesize
ConfigurationParser<PTLsimConfig>::setup()
\family default
\size default
 template function, which registers all options with the configuration parser.
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:MemoryManager}

\end_inset

Memory Manager
\end_layout

\begin_layout Subsection
Memory Pools
\end_layout

\begin_layout Standard
PTLsim uses its own custom memory manager for all allocations, given its
 specialized constraints (particularly for PTLsim/X, which runs on the bare
 hardware).
 The PTLsim memory manager (in 
\family typewriter
\size footnotesize
mm.cpp
\family default
\size default
) uses three key structures.
\end_layout

\begin_layout Standard
The 
\emph on
page allocator 
\emph default
allocates spans of one or more virtually contiguous pages.
 In userspace-only PTLsim, the page allocator doesn't really exist: it simply
 calls 
\family typewriter
\size footnotesize
mmap()
\family default
\size default
 and 
\family typewriter
\size footnotesize
munmap()
\family default
\size default
, letting the host kernel do the actual allocation.
 In the full system PTLsim/X, the page allocator actually works with physical
 pages and is based on the extent allocator (see below).
 The 
\family typewriter
\size footnotesize
ptl_alloc_private_pages()
\family default
\size default
 and 
\family typewriter
\size footnotesize
ptl_free_private_pages()
\family default
\size default
 functions should be used to directly allocate page-aligned memory (or individua
l pages) from this pool.
\end_layout

\begin_layout Standard
The 
\emph on
general allocator
\emph default
 uses the 
\family typewriter
\size footnotesize
ExtentAllocator
\family default
\size default
 template class to allocate large objects (greater than page sized) from
 a pool of free extents.
 This allocator automatically merges free extents and can find a matching
 free block in O(1) time for any allocation size.
 The general allocator obtains large chunks of memory (typically 64 KB at
 once) from the page allocator, then sub-divides these extents into individual
 allocations.
\end_layout

\begin_layout Standard
The 
\emph on
slab allocator
\emph default
 maintains a pool of page-sized 
\begin_inset Quotes eld
\end_inset

slabs
\begin_inset Quotes erd
\end_inset

 from which fixed size objects are allocated.
 Each page only contains objects of one size; a separate slab allocator
 handles each size from 16 bytes up to 1024 bytes, in 16-byte increments.
 The allocator provides extremely fast allocation performance for object
 oriented programs in which many objects of a given size are allocated.
 The slab allocator also allocates one page at a time from the global page
 allocator.
 However, it maintains a pool of empty pages to quickly satisfy requests.
 This is the same architecture used by the Linux kernel to satisfy memory
 requests.
\end_layout

\begin_layout Standard
The 
\family typewriter
\size footnotesize
ptl_mm_alloc()
\family default
\size default
 function intelligently decides from which of the two allocators (general
 or slab) to allocate a given sized object, based on the size in bytes,
 object type and caller.
 The standard 
\family typewriter
\size footnotesize
new
\family default
\size default
 operator
\family typewriter
\size footnotesize
 and malloc()
\family default
\size default
 both use this function.
 Similarly, the 
\family typewriter
\size footnotesize
ptl_mm_free()
\family default
\size default
 function frees memory.
 PTLsim uses a special bitmap to track which pages are slab allocator pages;
 if a pointer falls within a slab, the slab deallocator is used; otherwise
 the general allocator is used to free the extent.
\end_layout

\begin_layout Subsection
Garbage Collection and Reclaim Mechanism
\end_layout

\begin_layout Standard
The memory manager implements a garbage collection mechanism with which
 other subsystems register reclaim functions that get called when an allocation
 fails.
 The 
\family typewriter
\size footnotesize
ptl_mm_register_reclaim_handler()
\family default
\size default
 function serves this role.
 Whenever an allocation fails, the reclaim handlers are called in sequence,
 followed by an extent cleanup pass, before retrying the allocation.
 This process repeats until the allocation succeeds or an abort threshold
 is reached.
\end_layout

\begin_layout Standard
The reclaim function gets passed two parameters: the size in bytes of the
 failed allocation, and an 
\emph on
urgency
\emph default
 parameter.
 If 
\emph on
urgency
\emph default
 is 0, the subsystem registering the callback should do everything in its
 power to free all memory it owns.
 Otherwise, the subsystem should progressively trim more and more unused
 memory with each call (and increasing urgency).
 
\emph on
Under no circumstances
\emph default
 is a reclaim handler allowed to allocate 
\emph on
any
\emph default
 additional memory! Doing so will create an infinite loop; the memory manager
 will detect this and shut down PTLsim if it is attempted.
\end_layout

\begin_layout Chapter
\begin_inset LatexCommand \label{sec:StatisticsInfrastructure}

\end_inset

Statistics Collection and Analysis
\end_layout

\begin_layout Section
PTLsim Statistics Data Store
\end_layout

\begin_layout Subsection
Introduction
\end_layout

\begin_layout Standard
PTLsim maintains a huge number of statistical counters and data points during
 the simulation process, and can optionally save this data to a file by
 using the 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
-stats
\family default
\size default
 
\emph on
filename
\emph default

\begin_inset Quotes erd
\end_inset

 configuration option.
 The data store is a binary file format used to efficiently capture large
 quantities of statistical information for later analysis.
 This file format supports storing multiple regular or triggered snapshots
 of all counters.
 Snapshots can be subtracted, averaged and extensively manipulated, as will
 be described later on.
\end_layout

\begin_layout Standard
PTLsim makes it trivial to add new performance counters to the statistics
 data tree.
 All counters are defined in 
\family typewriter
\size footnotesize
stats.h
\family default
\size default
 as a tree of nested structures; the top-level 
\family typewriter
\size footnotesize
PTLsimStats
\family default
\size default
 structure is mapped to the global variable 
\family typewriter
\size footnotesize
stats
\family default
\size default
, so counters can be directly updated from within the code by simple increments,
 e.g.
 
\family typewriter
\size footnotesize
stats.xxx.yyy.zzz.countername++
\family default
\size default
.
 Every node in the tree can be either a 
\family typewriter
\size footnotesize
struct
\family default
\size default
, 
\family typewriter
\size footnotesize
W64 
\family default
\size default
(64-bit integer), 
\family typewriter
\size footnotesize
double
\family default
\size default
 (floating point) or 
\family typewriter
\size footnotesize
char
\family default
\size default
 (string) type; arrays of these types are also supported.
 In addition, various attributes, described below, can be attached to each
 node or counter to specify more complex semantics, including histograms,
 labeled arrays, summable nodes and so on.
\end_layout

\begin_layout Standard
PTLsim comes with a special script, 
\family typewriter
\size footnotesize
dstbuild
\family default
\size default
 (
\begin_inset Quotes eld
\end_inset

data store template builder
\begin_inset Quotes erd
\end_inset

) that parses 
\family typewriter
\size footnotesize
stats.h
\family default
\size default
 and constructs a binary representation (a 
\begin_inset Quotes eld
\end_inset

template
\begin_inset Quotes erd
\end_inset

) describing the structure; this template data is then compiled into PTLsim.
 Every time PTLsim creates a statistics file, it first writes this template,
 followed by the raw 
\family typewriter
\size footnotesize
PTLsimStats
\family default
\size default
 records and an index of those records by name.
 In this way, the complete data store tree can be reconstructed at a later
 time even if the original 
\family typewriter
\size footnotesize
stats.h
\family default
\size default
 or PTLsim version that created the file is unavailable.
 This scheme is analogous to the separation of XML schemas (the template)
 from the actual XML data (the stats records), but in our case the template
 and data is stored in binary format for efficient parsing.
\end_layout

\begin_layout Standard
We suggest using the data store mechanism to store 
\emph on
all
\emph default
 statistics generated by your additions to PTLsim, since this system has
 built-in support for snapshots, checkpointing and structured easy to parse
 data (unlike simply writing values to a text file).
 It is further suggested that only raw values be saved, rather than doing
 computations in the simulator itself - leave the analysis to PTLstats after
 gathering the raw data.
 If some limited computations do need to be done before writing each statistics
 record, PTLsim will call the PTLsimMachine::update_stats() virtual method
 to allow your model a chance to do so before writing the counters.
\end_layout

\begin_layout Subsection
\begin_inset LatexCommand \label{sec:StatisticsNodeAttributes}

\end_inset

Node Attributes
\end_layout

\begin_layout Standard
After each node or counter is declared, one of several special C++-style
 
\begin_inset Quotes eld
\end_inset

//
\begin_inset Quotes erd
\end_inset

 comments can be used to specify 
\emph on
attributes
\emph default
 for that node:
\end_layout

\begin_layout Itemize

\family typewriter
\size small
struct Name { // rootnode:
\end_layout

\begin_deeper
\begin_layout Standard
The node is at the root of the statistics tree (typically this only applies
 to the PTLsimStats structure itself)
\end_layout

\end_deeper
\begin_layout Itemize

\family typewriter
\size small
struct Name { // node: summable
\end_layout

\begin_deeper
\begin_layout Standard
All subnodes and counters under this node are assumed to total 100% of whatever
 quantity is being measured.
 This attribute tells PTLstats to print percentages next to the raw values
 in this subtree for easier viewing.
\end_layout

\end_deeper
\begin_layout Itemize

\family typewriter
\size small
W64 name[arraysize]; // histo: 
\emph on
min
\emph default
 
\emph on
max
\emph default
 
\emph on
stride
\end_layout

\begin_deeper
\begin_layout Standard
Specifies that the array of counters forms a 
\emph on
histogram
\emph default
, i.e.
 each slot in the array represents the number of occurrences of one event
 out of a mutually exclusive set of events.
 The 
\emph on
min
\emph default
 parameter specifies the meaning of the first slot (array element 0), while
 the 
\emph on
max
\emph default
 parameter specifies the meaning of the last slot (array element 
\emph on
arraysize
\emph default
-1).
 The 
\emph on
stride
\emph default
 parameter specifies how many events are counted into every slot (typically
 this is 1).
\end_layout

\begin_layout Standard
For example, let's say you want to measure the frequency distribution of
 the number of consumers of each instruction's result, where the maximum
 number of possible consumers is 256.
 You could specify this as:
\end_layout

\begin_layout Quote

\family typewriter
\size small
W64 consumers[64+1]; // histo: 0 256 4
\end_layout

\begin_layout Standard
This histogram has a logical range of 0 to 256, but is divided into 65 slots.
 Because the 
\emph on
stride
\emph default
 parameter is 4, any consumer counts from 0 to 3 increment slot 0, counts
 from 4 to 7 increment slot 1, and so on.
 When you update this counter array from inside the model, you should do
 so as follows:
\end_layout

\begin_layout Quote

\family typewriter
\size small
stats.xxx.yyy.consumers[min(n / 4, 64)]++;
\end_layout

\end_deeper
\begin_layout Itemize

\family typewriter
\size small
W64 name[arraysize]; // label: namearray
\end_layout

\begin_deeper
\begin_layout Standard
Specifies that the array of counters is a histogram of named, mutually exclusive
 events, rather than simply raw numbers (as with the 
\emph on
histo
\emph default
 attribute).
 The 
\emph on
namearray
\emph default
 must be the name of an array of 
\emph on
arraysize
\emph default
 strings, with one entry per event.
\end_layout

\begin_layout Standard
For example, let's say you want to measure the frequency distribution of
 uop types PTLsim is executing.
 If there are OPCLASS_COUNT, you could declare the following:
\end_layout

\begin_layout Quote

\family typewriter
\size small
W64 opclass[OPCLASS_COUNT]; // label: opclass_names
\end_layout

\begin_layout Standard
In some header file included by 
\family typewriter
\size small
stats.h
\family default
\size default
, you need to declare the actual array of slot labels:
\end_layout

\begin_layout Quote

\family typewriter
\size small
static const char* opclass_names[OPCLASS_COUNT] = {
\begin_inset Quotes erd
\end_inset

logic
\begin_inset Quotes erd
\end_inset

, 
\begin_inset Quotes erd
\end_inset

addsub
\begin_inset Quotes erd
\end_inset

, 
\begin_inset Quotes erd
\end_inset

addsubc
\begin_inset Quotes erd
\end_inset

, ...};
\end_layout

\end_deeper
\begin_layout Subsection
\begin_inset LatexCommand \label{sec:StatisticsOptions}

\end_inset

Configuration Options
\end_layout

\begin_layout Standard
PTLsim supports several options related to the statistics data store:
\end_layout

\begin_layout Itemize

\family typewriter
\size small
-stats 
\emph on
filename
\end_layout

\begin_deeper
\begin_layout Standard
Specify the filename to which statistics data is written.
 In reality, two files are created: 
\emph on
filename 
\emph default
contains the template and snapshot index, while 
\emph on
filename.data 
\emph default
contains the raw data.
\end_layout

\end_deeper
\begin_layout Itemize

\family typewriter
\size small
-snapshot-cycles 
\emph on
N
\end_layout

\begin_deeper
\begin_layout Standard
Creates a snapshot every N simulation cycles, numbered consecutively starting
 from 0.
 Without this option, only one snapshot, named 
\family typewriter
\size small
final
\family default
\size default
, is created at the end of the simulation run.
\end_layout

\end_deeper
\begin_layout Itemize

\family typewriter
\size small
-snapshot-now 
\emph on
name
\end_layout

\begin_deeper
\begin_layout Standard
Creates a snapshot named 
\emph on
name
\emph default
 at the current point in the simulation.
 This can be used to asynchronously take a look at a simulation in progress.
 
\emph on
This option is only available in PTLsim/X.
\end_layout

\end_deeper
\begin_layout Section
PTLstats: Statistics Analysis and Graphing Tools
\end_layout

\begin_layout Standard
The 
\series bold
\emph on
PTLstats
\series default
\emph default
 program is used to analyze the statistics data store files produced by
 PTLsim.
 PTLstats will first extract the template stored in all data store files,
 and will then parse the statistics records into a flexible tree format
 that can be manipulated by the user.
 The following is an example of one node in the statistics tree, as printed
 by PTLstats:
\end_layout

\begin_layout LyX-Code

\size small
dcache {
\end_layout

\begin_layout LyX-Code

\size small
  store {
\end_layout

\begin_layout LyX-Code

\size small
    issue (total 68161716) {
\end_layout

\begin_layout LyX-Code

\size small
    [ 29.7% ] replay (total 20218780) {
\end_layout

\begin_layout LyX-Code

\size small
    [  0.0% ] sfr_addr_not_ready = 0;
\end_layout

\begin_layout LyX-Code

\size small
    [ 16.8% ] sfr_data_and_data_to_store_not_ready = 3405878;
\end_layout

\begin_layout LyX-Code

\size small
    [ 11.8% ] sfr_data_not_ready = 2379338;
\end_layout

\begin_layout LyX-Code

\size small
    [ 23.4% ] sfr_addr_and_data_to_store_not_ready = 4740838;
\end_layout

\begin_layout LyX-Code

\size small
    [ 24.5% ] sfr_addr_and_data_not_ready = 4951888;
\end_layout

\begin_layout LyX-Code

\size small
    [ 23.4% ] sfr_addr_and_data_and_data_to_store_not_ready = 4740838;
\end_layout

\begin_layout LyX-Code

\size small
  }
\end_layout

\begin_layout LyX-Code

\size small
  [  0.0% ] exception = 30429;
\end_layout

\begin_layout LyX-Code

\size small
  [  7.9% ] ordering = 5404592;
\end_layout

\begin_layout LyX-Code

\size small
  [ 62.4% ] complete = 42507854;
\end_layout

\begin_layout LyX-Code

\size small
  [  0.0% ] unaligned = 61;
\end_layout

\begin_layout LyX-Code

\size small
}
\end_layout

\begin_layout Standard
Notice how PTLstats will automatically sum up all entries in certain branches
 of the tree to provide the user with a breakdown by percentages of the
 total for that subtree in addition to the raw values.
 This is achieved using the 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size small
// node: summable
\family default
\size default

\begin_inset Quotes erd
\end_inset

 attribute as described in Section 
\begin_inset LatexCommand \ref{sec:StatisticsNodeAttributes}

\end_inset

.
\end_layout

\begin_layout Standard
Here is an example of a labeled histogram, produced using the 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size small
// label: xxx
\family default
\size default

\begin_inset Quotes erd
\end_inset

 attribute described in Section 
\begin_inset LatexCommand \ref{sec:StatisticsNodeAttributes}

\end_inset

:
\end_layout

\begin_layout LyX-Code

\size small
size[4] = {
\end_layout

\begin_layout LyX-Code

\size small
  ValRange: 3209623 90432573
\end_layout

\begin_layout LyX-Code

\size small
  Total:   107190122
\end_layout

\begin_layout LyX-Code

\size small
  Thresh:     10720
\end_layout

\begin_layout LyX-Code

\size small
  [  6.2% ]        0  6686971 1 (byte)
\end_layout

\begin_layout LyX-Code

\size small
  [  6.4% ]        1  6860955 2 (word)
\end_layout

\begin_layout LyX-Code

\size small
  [ 84.4% ]        2 90432573 4 (dword)
\end_layout

\begin_layout LyX-Code

\size small
  [  3.0% ]        3  3209623 8 (qword)
\end_layout

\begin_layout LyX-Code

\size small
};
\end_layout

\begin_layout Section
Snapshot Selection
\end_layout

\begin_layout Standard
The basic syntax of the PTLstats command is 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size small
ptlstats -
\family default
\size default
\emph on
options
\emph default
 
\emph on
filename
\emph default

\begin_inset Quotes erd
\end_inset

.
 If no options are specified, PTLstats prints out the entire statistics
 tree from its root, relative to the 
\family typewriter
\size small
final
\family default
\size default
 snapshot.
\end_layout

\begin_layout Standard
To select a specific snapshot, use the following option:
\end_layout

\begin_layout LyX-Code

\family typewriter
\size small
ptlstats 
\series bold
-snapshot 
\family default
\series default
\emph on
name-or-number
\family typewriter
\series bold
\emph default
 
\family default
\series default
...
\end_layout

\begin_layout Standard
Snapshots may be specified by name or number.
\end_layout

\begin_layout Standard
It may be desirable to examine the difference in statistics 
\emph on
between
\emph default
 two snapshots, for instance to subtract out the counters at the starting
 point of a given run or after a warmup period.
 The 
\family typewriter
\size small
-subtract
\family default
\size default
 option provides this facility, for example:
\end_layout

\begin_layout LyX-Code

\family typewriter
\size small
ptlstats 
\family default
-snapshot
\family typewriter
\series bold
 
\family default
\series default
\emph on
final
\family typewriter
\series bold
\emph default
 
\family default
-subtract
\series default
 
\emph on
startpoint
\emph default
 ...
\end_layout

\begin_layout Section
Working with Statistics Trees: Collection, Averaging and Summing
\end_layout

\begin_layout Standard
To select a specific subtree of interest, use the syntax of the following
 example:
\end_layout

\begin_layout LyX-Code

\family typewriter
\size small
ptlstats 
\series bold
-snapshot 
\series default
final
\series bold
 -collect
\series default
 /ooocore/dcache/load example1.stats example2.stats ...
\end_layout

\begin_layout Standard
This will print out the subtree 
\family typewriter
\size small
/ooocore/dcache/load
\family default
\size default
 in the snapshot named 
\family typewriter
\size small
final
\family default
\size default
 (the default snapshot) for each of the named statistics files 
\family typewriter
\size small
example1.stats
\family default
\size default
, 
\family typewriter
\size small
example2.stats
\family default
\size default
 and so on.
 Multiple files are generally used to examine a specific subnode across
 several benchmarks.
\end_layout

\begin_layout Standard
Subtrees or individual statistics can also be summed and averaged across
 many files, using the 
\family typewriter
\series bold
\size small
-collectsum
\family default
\series default
\size default
 or 
\family typewriter
\series bold
\size small
-collectaverage
\family default
\series default
\size default
 commands in place of 
\family typewriter
\size small
-collect
\family default
\size default
.
\end_layout

\begin_layout Section
Traversal and Printing Options
\end_layout

\begin_layout Standard
The 
\family typewriter
\series bold
\size small
-maxdepth
\family default
\series default
\size default
 option is useful for limiting the depth (in nodes) PTLstats will descend
 into the specified subtree.
 This is appropriate when you want to summarize certain classes of statistics
 printed as percentages of the whole, yet don't want a breakdown of every
 sub-statistic.
\end_layout

\begin_layout Standard
The 
\family typewriter
\series bold
\size small
-percent-of-toplevel
\family default
\series default
\size default
 option changes the way percentages are displayed.
 By default, percentages are calculated by dividing the total value of each
 node by the total of its immediate parent node.
 When 
\family typewriter
\size small
-percent-of-toplevel
\family default
\size default
 is enabled, the divisor becomes the total of the entire subtree, possibly
 going back several levels (i.e.
 back to the highest level node marked with the 
\emph on
summable
\emph default
 attribute), rather than each node's immediate parent.
\end_layout

\begin_layout Section
Table Generation
\end_layout

\begin_layout Standard
PTLstats provides a facility to easily generate R-row by C-column data tables
 from a set of R benchmarks run with C different sets of parameters.
 Tables can be output in a variety of formats, including plain text with
 tab or space delimiters (suitable for import into a spreadsheet), LaTeX
 (for direct insertion into research reports) or HTML.
 To generate a table, use the following syntax:
\end_layout

\begin_layout LyX-Code

\size small
ptlstats 
\series bold
-table 
\series default
/final/summary/cycles -rows gzip,gcc,perlbmk,mesa -cols small,large,huge
 -table-pattern "%row/ptlsim.stats.%col"
\end_layout

\begin_layout Standard
In this example, the benchmarks (
\begin_inset Quotes eld
\end_inset

gzip
\begin_inset Quotes erd
\end_inset

, 
\begin_inset Quotes eld
\end_inset

gcc
\begin_inset Quotes erd
\end_inset

, 
\begin_inset Quotes eld
\end_inset

perlbmk
\begin_inset Quotes erd
\end_inset

, 
\begin_inset Quotes eld
\end_inset

mesa
\begin_inset Quotes erd
\end_inset

) will form the rows of the table, while three trials done for each benchmark
 (
\begin_inset Quotes eld
\end_inset

small
\begin_inset Quotes erd
\end_inset

, 
\begin_inset Quotes eld
\end_inset

large
\begin_inset Quotes erd
\end_inset

, 
\begin_inset Quotes eld
\end_inset

huge
\begin_inset Quotes erd
\end_inset

) will be listed in the columns.
 The row and column names will be combined using the pattern 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size small
%row/ptlsim.stats.%col
\family default
\size default

\begin_inset Quotes eld
\end_inset

 to generate statistics data store filenames like 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size small
gzip/ptlsim.stats.small
\family default
\size default

\begin_inset Quotes erd
\end_inset

.
 PTLstats will then load the data store for each benchmark and trial combination
 to create the table.
\end_layout

\begin_layout Standard
Notice that you must create your own scripts, or manually run each benchmark
 and trial with the desired PTLsim options, plus 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size small
-stats ptlsim.stats.
\emph on
trialname
\family default
\size default
\emph default

\begin_inset Quotes erd
\end_inset

.
 PTLstats will only report these results in table form; it will not actually
 run any benchmarks.
\end_layout

\begin_layout Standard
The 
\family typewriter
\series bold
\size small
-tabletype
\family default
\series default
\size default
 option specifies the data format of the table: 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size small
text
\family default
\size default

\begin_inset Quotes erd
\end_inset

 (plain text with space delimiters, suitable for import into a spreadsheet),
 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size small
latex
\family default
\size default

\begin_inset Quotes erd
\end_inset

 (LaTeX format, useful for directly inserting into research reports), or
 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size small
html
\family default
\size default

\begin_inset Quotes erd
\end_inset

 (HTML format for web pages).
\end_layout

\begin_layout Standard
The 
\begin_inset Quotes eld
\end_inset


\family typewriter
\series bold
\size small
-scale-relative-to-col
\series default
 
\emph on
N
\family default
\size default
\emph default

\begin_inset Quotes erd
\end_inset

 option forces PTLstats to compute the percentage of increase or decrease
 for each cell relative to the corresponding row in some other reference
 column 
\emph on
N
\emph default
.
 This is useful when running a 
\begin_inset Quotes eld
\end_inset

baseline
\begin_inset Quotes erd
\end_inset

 case, to be displayed as a raw value (usually the cycle count, 
\family typewriter
\size small
/final/summary/cycles
\family default
\size default
) in column 0, while all other experimental cases are displayed as a percentage
 increase (fewer cycles, for a positive percentage) or percentage decrease
 (negative value) relative to this first column (
\emph on
N
\emph default
 = 0).
\end_layout

\begin_layout Subsection
Bargraph Generation
\end_layout

\begin_layout Standard
In addition to creating tables, PTLstats can directly create colorful graphs
 (in Scalable Vector Graphics (SVG) format) from a set of benchmarks (specified
 by the 
\family typewriter
\size small
-rows
\family default
\size default
 option) and trials of each benchmark (specified by the 
\family typewriter
\size small
-cols
\family default
\size default
 option).
 For instance, to plot the total number of cycles taken over a set of benchmarks
, each run under different PTLsim configurations, use the following example:
\end_layout

\begin_layout LyX-Code

\size small
ptlstats 
\series bold
-bargraph 
\series default
/final/summary/cycles -rows gzip,gcc,perlbmk,mesa -cols small,large,huge
 -table-pattern "%row/ptlsim.stats.%col"
\end_layout

\begin_layout Standard
In this case, groups of three bars (for the trials 
\begin_inset Quotes eld
\end_inset

small
\begin_inset Quotes erd
\end_inset

, 
\begin_inset Quotes eld
\end_inset

large
\begin_inset Quotes erd
\end_inset

, 
\begin_inset Quotes eld
\end_inset

huge
\begin_inset Quotes erd
\end_inset

) appear for each benchmark.
\end_layout

\begin_layout Standard
The graph's layout can be extensively customized using the options 
\family typewriter
\size small
-title
\family default
\size default
, 
\family typewriter
\size small
-width
\family default
\size default
, 
\family typewriter
\size small
-height
\family default
\size default
.
\end_layout

\begin_layout Standard
Inkscape (http://www.inkscape.org) is an excellent vector graphics system
 for editing and formatting SVG files generated by PTLstats.
\end_layout

\begin_layout Section
Histogram Generation
\end_layout

\begin_layout Standard
Certain array nodes in the statistics tree can be tagged as 
\begin_inset Quotes eld
\end_inset

histogram
\begin_inset Quotes erd
\end_inset

 nodes by using the 
\family typewriter
\size small
histo:
\family default
\size default
 or 
\family typewriter
\size small
label:
\family default
\size default
 attributes, as described in Section 
\begin_inset LatexCommand \ref{sec:StatisticsNodeAttributes}

\end_inset

.
 For instance, the 
\family typewriter
\size small
ooocore/frontend/consumer-count
\family default
\size default
 node in the out-of-order core is a histogram node.
 PTLstats can directly create graphs (in Scalable Vector Graphics (SVG)
 format) for these special nodes, using the 
\family typewriter
\series bold
\size small
-histogram
\family default
\series default
\size default
 option:
\end_layout

\begin_layout LyX-Code

\size small
ptlstats 
\series bold
-histogram 
\series default
/ooocore/frontend/consumer-count > example.svg
\end_layout

\begin_layout Standard
The histogram's layout can be extensively customized using the options 
\family typewriter
\size small
-title
\family default
\size default
, 
\family typewriter
\size small
-width
\family default
\size default
, 
\family typewriter
\size small
-height
\family default
\size default
.
 In addition, the 
\family typewriter
\size small
-percentile
\family default
\size default
 option is useful for controlling the displayed data range by excluding
 data under the Nth percentile.
 The 
\family typewriter
\size small
-logscale
\family default
\size default
 and 
\family typewriter
\size small
-logk
\family default
\size default
 options can be used to apply a log scale (instead of a linear scale) to
 the histogram bars.
 The syntax of these options can be obtained by running 
\family typewriter
\size small
ptlstats
\family default
\size default
 without arguments.
\end_layout

\begin_layout Chapter
Benchmarking Techniques
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:TriggerMode}

\end_inset

Trigger Mode and other PTLsim Calls From User Code
\end_layout

\begin_layout Standard
PTLsim optionally allows user code to control the simulator mode through
 the 
\family typewriter
\size small
ptlcall_xxx()
\family default
\size default
 family of functions found in 
\family typewriter
\size small
ptlcalls.h
\family default
\size default
 when trigger mode is enabled (
\family typewriter
\size small
-trigger
\family default
\size default
 configuration option).
 This file should be included by any PTLsim-aware user programs; these programs
 must be recompiled to take advantage of these features.
 Amongst the functions provided by 
\family typewriter
\size small
ptlcalls.h
\family default
\size default
 are:
\end_layout

\begin_layout Itemize

\family typewriter
\size small
ptlcall_switch_to_sim()
\family default
\size default
 is only available while the program is executing in native mode.
 It forces PTLsim to regain control and begin simulating instructions as
 soon as this call returns.
\end_layout

\begin_layout Itemize

\family typewriter
\size small
ptlcall_switch_to_native()
\family default
\size default
 stops simulation and returns to native execution, effectively removing
 PTLsim from the loop.
\end_layout

\begin_layout Itemize

\family typewriter
\size small
ptlcall_marker()
\family default
\size default
 simply places a user-specified marker number in the PTLsim log file
\end_layout

\begin_layout Itemize

\family typewriter
\size small
ptlcall_capture_stats()
\family default
\size default
 adds a new statistics data store snapshot at the time it is called.
 You can pass a string to this function to name your snapshot, but all names
 must be unique.
\end_layout

\begin_layout Itemize

\family typewriter
\size small
ptlcall_nop()
\family default
\size default
 does nothing but test the call mechanism.
\end_layout

\begin_layout Standard
In userspace PTLsim, these calls work by forcing execution to code on a
 
\begin_inset Quotes eld
\end_inset

gateway page
\begin_inset Quotes erd
\end_inset

 at a specific fixed address (
\family typewriter
\size small
0x1000
\family default
\size default
 currently); PTLsim will write the appropriate call gate code to this page
 depending on whether the process is in native or simulated mode.
 In native mode, the call gate page typically contains a 64-to-64-bit or
 32-to-64-bit far jump into PTLsim, while in simulated mode it contains
 a reserved x86 opcode interpreted by the x86 decoder as a special kind
 of system call.
 If PTLsim is built on a 32-bit only system, no mode switch is required.
\end_layout

\begin_layout Standard
In full system PTLsim/X, the x86 opcodes used to implement these calls are
 directly handled by the PTLsim/X hypervisor as if they were actually part
 of the native x86 instruction set.
\end_layout

\begin_layout Standard
Generally these calls are used to perform 
\begin_inset Quotes eld
\end_inset

intelligent benchmarking
\begin_inset Quotes erd
\end_inset

: the 
\family typewriter
\size small
ptlcall_switch_to_sim()
\family default
\size default
 call is made at the top of the main loop of a benchmark after initialization,
 while the 
\family typewriter
\size small
ptlcall_switch_to_native()
\family default
\size default
 call is inserted after some number of iterations to stop simulation after
 a representative subset of the code has completed.
 This intelligent approach is far better than the blind 
\begin_inset Quotes eld
\end_inset

sample for N million cycles after S million startup cycles
\begin_inset Quotes erd
\end_inset

 approach used by most researchers.
\end_layout

\begin_layout Standard
Fortran programs will have to actually link in the 
\family typewriter
\size small
ptlcalls.o
\family default
\size default
 object file, since they cannot include C header files.
 The function names that should be used in the Fortran code remain the same
 as those from the 
\family typewriter
\size small
ptlcalls.h
\family default
\size default
 header file.
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:IPCNotes}

\end_inset

Notes on Benchmarking Methodology and 
\begin_inset Quotes eld
\end_inset

IPC
\begin_inset Quotes erd
\end_inset


\end_layout

\begin_layout Standard
The x86 instruction set requires some different benchmarking techniques
 than classical RISC ISAs.
 In particular, 
\series bold
uIPC (Micro-Instructions per Cycle) a NOT a good measure of performance
 for an x86 processor.

\series default
 Because one x86 instruction may be broken up into numerous uops, it is
 never appropriate to compare IPC figures for committed x86 instructions
 per clock with IPC values from a RISC machine.
 Furthermore, different x86 implementations use varying numbers of uops
 per x86 instruction as a matter of encoding, so even comparing the uop
 based IPC between x86 implementations or RISC-like machines is inaccurate.
\end_layout

\begin_layout Standard
Users are strongly advised to use relative performance measures instead.
 Comparing the total simulated cycle count required to complete a given
 benchmark between different simulator configurations is much more appropriate
 than IPC with the x86 instruction set.
 An example would be 
\begin_inset Quotes eld
\end_inset

the baseline took 100M cycles, while our improved system took 50M cycles,
 for a 2x improvement
\begin_inset Quotes erd
\end_inset

.
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:SimulationWarmupPeriods}

\end_inset

Simulation Warmup Periods
\end_layout

\begin_layout Standard
In some simulators, it is possible to quickly skip through a specific number
 of instructions before starting to gather statistics, to avoid including
 initialization code in the statistics.
 In PTLsim, this is neither necessary nor desirable.
 Because PTLsim directly executes your program on the host CPU until it
 switches to cycle accurate simulation mode, there is no way to count instructio
ns in this manner.
 
\end_layout

\begin_layout Standard
Many researchers have gotten in the habit of blindly skipping a large number
 of instructions in benchmarks to avoid profiling initialization code.
 However, this is not a very intelligent policy: different benchmarks have
 different startup times until the top of the main loop is reached, and
 it is generally evident from the benchmark source code where that point
 should be.
 Therefore, PTLsim supports 
\series bold
trigger points:
\series default
 by inserting a special function call (
\family typewriter
\size footnotesize
ptlcall_switch_to_sim
\family default
\size default
) within the benchmark source code and recompiling, the 
\family typewriter
\size footnotesize
-trigger
\family default
\size default
 PTLsim option can be used to run the code on the host CPU until the trigger
 point is reached.
 If the source code is unavailable, the 
\family typewriter
\size footnotesize
-startrip 
\emph on
0xADDRESS
\family default
\size default
\emph default
 option will start full simulation only at a specified address (e.g.
 function entry point).
 
\end_layout

\begin_layout Standard
If you want to warm up the cache and branch predictors prior to starting
 statistics collection, combine the 
\family typewriter
\size footnotesize
-trigger
\family default
\size default
 option with the 
\family typewriter
\size footnotesize
-snapshot-cycles 
\emph on
N
\family default
\size default
\emph default
 option, to start full simulation at the top of the benchmark's main loop
 (where the trigger call is), but only start gathering statistics 
\emph on
N
\emph default
 cycles later, after the processor is warmed up.
 Remember, since the trigger point is placed 
\emph on
after
\emph default
 all initialization code in the benchmark, in general it is only necessary
 to use 10-20 million cycles of warmup time before taking the first statistics
 snapshot.
 In this time, the caches and branch predictor will almost always be completely
 overwritten many times.
 This approach significantly speeds up the simulation without any loss of
 accuracy compared to the "fast simulation" mode provided by other simulators.
 
\end_layout

\begin_layout Standard
In PTLstats, use the 
\family typewriter
\size footnotesize
-subtract
\family default
\size default
 option to make sure the final statistics don't include the warmup period
 before the first snapshot.
 To subtract the final snapshot from snapshot 0 (the first snapshot after
 the warmup period), use a command similar to the following:
\end_layout

\begin_layout LyX-Code

\size footnotesize
ptlstats -subtract 0 ptlsim.stats
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:SequentialMode}

\end_inset

Sequential Mode
\end_layout

\begin_layout Standard
PTLsim supports 
\emph on
sequential mode
\emph default
, in which instructions are run on a simple, in-order processor model (in
 
\family typewriter
\size footnotesize
seqcore.cpp
\family default
\size default
) without accounting for cache misses, branch mispredicts and so forth.
 This is much faster than the out of order model, but is obviously slower
 than native execution.
 The purpose of sequential mode is mainly to aid in testing the x86 to uop
 decoder, microcode functions and RTL-level uop implementation code.
 It may also be useful for gathering certain statistics on the instruction
 mix and count without running a full simulation.
\end_layout

\begin_layout Standard

\emph on
NOTE: 
\emph default
Sequential mode is 
\emph on
not
\emph default
 intended as a 
\begin_inset Quotes eld
\end_inset

warmup mode
\begin_inset Quotes erd
\end_inset

 for branch predictors and caches.
 If you want this behavior, use statistical snapshot deltas as described
 in Section 
\begin_inset LatexCommand \ref{sec:SimulationWarmupPeriods}

\end_inset

.
 
\end_layout

\begin_layout Standard
Sequential mode is enabled by specifying the 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
-core seq
\family default
\size default

\begin_inset Quotes erd
\end_inset

 option.
 It has no other core-specific options.
\end_layout

\begin_layout Part
\begin_inset LatexCommand \label{sec:PTLsimClassic}

\end_inset

PTLsim Classic: Userspace Linux Simulation
\end_layout

\begin_layout Chapter
Getting Started with PTLsim
\end_layout

\begin_layout Standard

\emph on
NOTE:
\emph default
 This part of the manual is relevant only if you are using the classic userspace
-only version of PTLsim.
 If you are looking for the full system SMP/SMT version, PTLsim/X, please
 skip this entire part and read Part 
\begin_inset LatexCommand \ref{sec:PTLsimFullSystem}

\end_inset

 instead.
\end_layout

\begin_layout Section
Building PTLsim
\end_layout

\begin_layout Standard
Prerequisites:
\end_layout

\begin_layout Itemize
PTLsim can be built on 
\series bold
both 64-bit x86-64 machines
\series default
 (AMD Athlon 64 / Opteron / Turion, Intel Pentium 4 with EM64T and Intel
 Core 2) 
\series bold
as well as ordinary 32-bit x86 systems
\series default
.
 In either case, your system must support SSE2 instructions; all modern
 CPUs made in the last few years (such as Pentium 4 and Athlon 64) support
 this, but older CPUs (Pentium III and earlier) specifically do 
\emph on
not
\emph default
 support PTLsim.
\end_layout

\begin_layout Itemize
If built for x86-64, PTLsim will run both 64-bit and 32-bit programs automatical
ly.
 If built on a 32-bit Linux distribution and compiler, PTLsim only supports
 ordinary x86 programs and will typically be slower than the 64-bit build
\series bold
,
\series default
 even on 32-bit user programs.
\end_layout

\begin_layout Itemize
PTLsim runs on any recent Linux 2.6 based distribution.
\end_layout

\begin_layout Itemize
We have successfully built PTLsim with gcc 3.3, 3.4.x and 4.1.x+ (gcc 4.0.x has
 documented bugs affecting some of our code).
\end_layout

\begin_layout Standard
Quick Start Steps:
\end_layout

\begin_layout Itemize
Download PTLsim from our web site (
\family typewriter
\size footnotesize
http://www.ptlsim.org/download.php
\family default
\size default
).
 We recommend starting with the 
\begin_inset Quotes eld
\end_inset

stable
\begin_inset Quotes erd
\end_inset

 version, since this contains all the files you need and can be updated
 later if desired.
\end_layout

\begin_layout Itemize
Unpack 
\family typewriter
\size footnotesize
ptlsim-2006xxxx-rXXX.tar.gz
\family default
\size default
 to create the 
\family typewriter
\size footnotesize
ptlsim
\family default
\size default
 directory.
\end_layout

\begin_layout Itemize
Run 
\family typewriter
\size footnotesize
make
\family default
\size default
.
\end_layout

\begin_deeper
\begin_layout Itemize
The Makefile will detect your platform and automatically compile the correct
 version of PTLsim (32-bit or 64-bit).
\end_layout

\end_deeper
\begin_layout Section
\begin_inset LatexCommand \label{sec:RunningPTLsim}

\end_inset

Running PTLsim
\end_layout

\begin_layout Standard
PTLsim invocation is very simple: after compiling the simulator and making
 sure the 
\family typewriter
\size small
ptlsim
\family default
\size default
 executable is in your path, simply run:
\end_layout

\begin_layout Quote

\family typewriter
\size footnotesize
ptlsim
\size small
\InsetSpace ~

\family default
\size default
 
\emph on
full-path-to-executable
\emph default
 
\emph on
arguments...
\end_layout

\begin_layout Standard
PTLsim reads configuration options for running various user programs by
 looking for a configuration file named 
\family typewriter
\size footnotesize
/home/
\emph on
username
\emph default
/.ptlsim/
\emph on
path/to/program/executablename
\emph default
.conf
\family default
\size default
.
 To set options for each program, you'll need to create a directory of the
 form 
\family typewriter
\size footnotesize
/home/
\emph on
username
\emph default
/.ptlsim
\family default
\size default
 and make sub-directories under it corresponding to the full path to the
 program.
 For example, to configure 
\family typewriter
\size footnotesize
/bin/ls
\family default
\size default
 you'll need to run "
\family typewriter
\size footnotesize
mkdir /home/
\emph on
username
\emph default
/.ptlsim/bin
\family default
\size default

\begin_inset Quotes erd
\end_inset

 and then edit "
\family typewriter
\size footnotesize
/home/
\emph on
username
\emph default
/.ptlsim/bin/ls.conf
\family default
\size default
" with the appropriate options.
 For example, try putting the following in 
\family typewriter
\size footnotesize
ls.conf
\family default
\size default
 as described:
\end_layout

\begin_layout Quote

\family typewriter
\size footnotesize
-logfile ptlsim.log -loglevel 9 -stats ls.stats -stopinsns 10000
\end_layout

\begin_layout Standard
Then run:
\end_layout

\begin_layout Quote

\family typewriter
\size footnotesize
ptlsim /bin/ls -la
\end_layout

\begin_layout Standard
PTLsim should display its system information banner, then the output of
 simulating the directory listing.
 With the options above, PTLsim will simulate 
\family typewriter
\size footnotesize
/bin/ls
\family default
\size default
 starting at the first x86 instruction in the dynamic linker's entry point,
 run until 10000 x86 instructions have been committed, and will then switch
 back to native mode (i.e.
 the user code will run directly on the real processor) until the program
 exits.
 During this time, it will compile an extensive log of the state of every
 micro-operation executed by the processor and will save it to 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
ptlsim.log
\family default
\size default

\begin_inset Quotes erd
\end_inset

 in the current directory.
 It will also create 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
ls.stats
\family default
\size default

\begin_inset Quotes erd
\end_inset

, a binary file containing snapshots of PTLsim's internal performance counters.
 The 
\family typewriter
\size footnotesize
ptlstats
\family default
\size default
 program (Chapter 
\begin_inset LatexCommand \ref{sec:StatisticsInfrastructure}

\end_inset

) can be used to print and analyze these statistics by running 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
ptlstats ls.stats
\family default
\size default

\begin_inset Quotes erd
\end_inset

.
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:ConfigurationOptions}

\end_inset

Configuration Options
\end_layout

\begin_layout Standard
PTLsim supports a variety of options in the configuration file of each program;
 you can run 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
ptlsim
\family default
\size default

\begin_inset Quotes erd
\end_inset

 without arguments to get a full list of these options.
 The following sections only list the most useful options, rather than every
 possible option.
\end_layout

\begin_layout Standard
The configuration file can also contain comments (starting with 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
#
\family default
\size default

\begin_inset Quotes erd
\end_inset

 at any point on a line) and blank lines; the first non-comment line is
 used as the active configuration.
\end_layout

\begin_layout Standard
PTLsim supports multiple models of various microprocessor cores; the 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
-core
\family default
\size default
 
\emph on
corename
\emph default

\begin_inset Quotes erd
\end_inset

 option can be used to choose a specific core.
 The default core is 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
ooo
\family default
\size default

\begin_inset Quotes erd
\end_inset

, the dynamically scheduled out of order superscalar core described in great
 detail in Part 
\begin_inset LatexCommand \ref{part:OutOfOrderModel}

\end_inset

.
 PTLsim also comes with a simple sequential in-order core, 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
seq
\family default
\size default

\begin_inset Quotes erd
\end_inset

.
 It is most useful for debugging decoding and microcode issues rather than
 actual performance profiling.
\end_layout

\begin_layout Section
Logging Options
\end_layout

\begin_layout Standard
PTLsim can log all simulation events to a log file, or can be instructed
 to log only a subset of these events, starting and stopping at various
 points:
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
-logfile
\family default
\size default
 
\emph on
filename
\end_layout

\begin_deeper
\begin_layout Standard
Specifies the file to which log messages will be written.
\end_layout

\end_deeper
\begin_layout Itemize

\family typewriter
\size footnotesize
-loglevel
\family default
\size default
 
\emph on
level
\end_layout

\begin_deeper
\begin_layout Standard
Selects a subset of the events that will be logged:
\end_layout

\begin_layout Itemize
0 disables logging
\end_layout

\begin_layout Itemize
1 displays only critical events (such as system calls and state changes)
\end_layout

\begin_layout Itemize
2-3 displays less critical simulator-wide events
\end_layout

\begin_layout Itemize
4 displays major events within the core itself (like pipeline flushes, basic
 block decodes, etc)
\end_layout

\begin_layout Itemize
6 displays 
\emph on
all
\emph default
 events that occur within each pipeline stage of the core every cycle
\end_layout

\begin_layout Itemize
99 displays every possible event.
 This will create massive log files!
\end_layout

\end_deeper
\begin_layout Itemize

\family typewriter
\size footnotesize
-startlog
\family default
\size default
 
\emph on
cycle
\end_layout

\begin_deeper
\begin_layout Standard
Starts logging only after 
\emph on
cycle
\emph default
 cycles have elapsed from the start of the simulation.
\end_layout

\end_deeper
\begin_layout Itemize

\family typewriter
\size footnotesize
-startlogrip
\family default
\size default
 
\emph on
rip
\end_layout

\begin_deeper
\begin_layout Standard
Starts logging only after the first time the instruction at 
\emph on
rip
\emph default
 is decoded or executed.
 This is mutually exclusive with 
\family typewriter
\size footnotesize
-startlog
\family default
\size default
.
\end_layout

\end_deeper
\begin_layout Section
\begin_inset LatexCommand \label{sec:EventLogRingBuffer}

\end_inset

Event Log Ring Buffer
\end_layout

\begin_layout Standard
PTLsim also maintains an event log ring buffer.
 Every time the core takes some action (for instance, dispatching an instruction
, executing a store, committing a result or annulling each uop after an
 exception), it writes that event to a circular buffer that contains (by
 default) the last 32768 events in chronological order (oldest to newest).
 This is extremely useful for debugging in cases where you want to 
\begin_inset Quotes eld
\end_inset

look backwards in time
\begin_inset Quotes erd
\end_inset

 from the point where a specific but unknown 
\begin_inset Quotes eld
\end_inset

bad
\begin_inset Quotes erd
\end_inset

 event occurred, but cannot leave logging at e.g.
 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
-loglevel 99
\family default
\size default

\begin_inset Quotes erd
\end_inset

 enabled all the time (because it is far too slow and space consuming).
\end_layout

\begin_layout Standard
The event log ring buffer must be enabled via the 
\family typewriter
\size footnotesize
-ringbuf
\family default
\size default
 option.
 This is disabled by default since it exacts a 25-40% performance overhead
 (but this is much better than the 10000%+ overhead of full logging).
\end_layout

\begin_layout Standard
PTLsim will always print the ring buffer to the log file whenever:
\end_layout

\begin_layout Itemize
Any 
\family typewriter
\size footnotesize
assert
\family default
\size default
 statement fails within the out of order simulator core;
\end_layout

\begin_layout Itemize
Any fatal exception occurs;
\end_layout

\begin_layout Itemize
At user-specified points, by inserting 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
core.eventlog.print(logfile);
\family default
\size default

\begin_inset Quotes erd
\end_inset

 anywhere within the code;
\end_layout

\begin_layout Itemize
Whenever the 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
-ringbuf-trigger-rip
\family default
\size default
 
\emph on
rip
\emph default

\begin_inset Quotes erd
\end_inset

 option is used to specify a specific trigger RIP.
 When the last uop at this RIP is committed, the ring buffer is printed,
 exposing all events that happened over the past few thousand cycles (going
 backwards in time from the cycle in which the trigger instruction committed)
\end_layout

\begin_layout Itemize
The event log ring buffer is automatically enabled whenever 
\family typewriter
\size footnotesize
-loglevel
\family default
\size default
 is 6 or higher; in this case all events are logged to the logfile after
 every cycle.
\end_layout

\begin_layout Section
Simulation Start Points
\end_layout

\begin_layout Standard
Normally PTLsim starts in simulation mode at the first instruction in the
 target program (or the Linux dynamic linker, assuming the program is dynamicall
y linked).
 It may be desirable to skip time-consuming initialization parts of the
 program, using one of two methods.
\end_layout

\begin_layout Standard
The 
\family typewriter
\size footnotesize
-startrip
\family default
\size default
 
\emph on
rip
\emph default
 option places a breakpoint at 
\emph on
rip
\emph default
, then immediately switches to native mode until that breakpoint is hit,
 at which point PTLsim begins simulation.
\end_layout

\begin_layout Standard
Alternatively, if the source code to the program is available, it may be
 recompiled with call(s) to a special function, 
\family typewriter
\size footnotesize
ptlcall_switch_to_sim()
\family default
\size default
, provided in 
\family typewriter
\size footnotesize
ptlcalls.h
\family default
\size default
.
 PTLsim is then started with the 
\family typewriter
\size footnotesize
-trigger
\family default
\size default
 option, which switches it to native mode until the first call to the 
\family typewriter
\size footnotesize
ptlcall_switch_to_sim()
\family default
\size default
 function, at which point simulation begins.
 This function, and other special code that can be used within the target
 program, is described in Section 
\begin_inset LatexCommand \ref{sec:TriggerMode}

\end_inset

.
\end_layout

\begin_layout Section
Simulation Stop Points
\end_layout

\begin_layout Standard
By default, PTLsim continues executing in simulation mode until the target
 program exits on its own.
 However, typically programs are profiled for a fixed number of committed
 x86 instructions, or until a specific point is reached, so as to ensure
 an identical span of instructions is executed on every trial, without waiting
 for the entire program to finish.
 The following options support this behavior:
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
-stopinsns
\family default
\size default
 
\emph on
insns
\emph default
 will stop the simulation after 
\emph on
insns
\emph default
 x86 instructions have committed.
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
-stop
\family default
\size default
 
\emph on
cycles
\emph default
 stops after 
\emph on
cycles
\emph default
 cycles have been simulated.
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
-stoprip
\family default
\size default
 
\emph on
rip
\emph default
 stops after the instruction at rip is decoded and executed the first time.
\end_layout

\begin_layout Standard
PTLsim will normally switch back to native mode after finishing simulation.
 If the program should be terminated instead, the 
\family typewriter
\size footnotesize
-exitend
\family default
\size default
 option will do so.
\end_layout

\begin_layout Standard
The node is at the root of the statistics tree (typically this only applies
 to the PTLsimStats structure itself)
\end_layout

\begin_layout Section
Statistics Collection
\end_layout

\begin_layout Standard
PTLsim supports the collection of a wide variety of statistics and counters
 as it simulates your code, and can make regular or triggered snapshots
 of the counters.
 Chapter 
\begin_inset LatexCommand \ref{sec:StatisticsInfrastructure}

\end_inset

 describes this support, while Section 
\begin_inset LatexCommand \ref{sec:StatisticsOptions}

\end_inset

 documents the configuration options associated with statistics collection,
 including 
\family typewriter
\size footnotesize
-stats
\family default
\size default
, 
\family typewriter
\size footnotesize
-snapshot-cycles
\family default
\size default
, 
\family typewriter
\size footnotesize
-snapshot-now
\family default
\size default
.
\end_layout

\begin_layout LyX-Code

\end_layout

\begin_layout LyX-Code

\end_layout

\begin_layout Chapter
\begin_inset LatexCommand \label{sec:PTLsimInternals}

\end_inset

PTLsim Classic Internals
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:Injection}

\end_inset

Low Level Startup and Injection
\end_layout

\begin_layout Standard

\emph on
Note:
\emph default
 This section deals with the internal operation of the PTLsim low level
 code, independent of the out of order simulation engine.
 If you are only interested in modifying the simulator itself, you can skip
 this section.
\end_layout

\begin_layout Standard

\emph on
Note:
\emph default
 This section does not apply to the full system PTLsim/X; please see the
 corresponding sections in Part 
\begin_inset LatexCommand \ref{sec:PTLsimFullSystem}

\end_inset

 instead.
\end_layout

\begin_layout Subsection
\begin_inset LatexCommand \label{sub:Injection-On-x86-64}

\end_inset

Startup on x86-64
\end_layout

\begin_layout Standard
PTLsim is a very unusual Linux program.
 It does its own internal memory management and threading without help from
 the standard libraries, injects itself into other processes to take control
 of them, and switches between 32-bit and 64-bit mode within a single process
 image.
 For these reasons, it is very closely tied to the Linux kernel and uses
 a number of undocumented system calls and features only available in late
 2.6 series kernels.
 
\end_layout

\begin_layout Standard
PTLsim always starts and runs as a 64-bit process even when running 32-bit
 threads; it context switches between modes as needed.
 The statically linked 
\family typewriter
\size small
ptlsim
\family default
\size default
 executable begins executing at 
\family typewriter
\size small
ptlsim_preinit_entry
\family default
\size default
 in 
\family typewriter
\size small
lowlevel-64bit.S
\family default
\size default
.
 This code calls 
\family typewriter
\size small
ptlsim_preinit()
\family default
\size default
 in 
\family typewriter
\size small
kernel.cpp
\family default
\size default
 to set up our custom memory manager and threading environment before any
 standard C/C++ functions are used.
 After doing so, the normal 
\family typewriter
\size small
main()
\family default
\size default
 function is invoked.
\end_layout

\begin_layout Standard
The 
\family typewriter
\size small
ptlsim
\family default
\size default
 binary can run in two modes.
 If executed from the command line as a normal program, it starts up in
 
\emph on
inject
\emph default
 mode.
 Specifically, 
\family typewriter
\size small
main()
\family default
\size default
 in 
\family typewriter
\size small
ptlsim.cpp
\family default
\size default
 checks if the 
\family typewriter
\size small
inside_ptlsim
\family default
\size default
 variable has been set by 
\family typewriter
\size small
ptlsim_preinit_entry
\family default
\size default
, and if not, PTLsim enters inject mode.
 In this mode, 
\family typewriter
\size small
ptlsim_inject()
\family default
\size default
 in 
\family typewriter
\size small
kernel.cpp
\family default
\size default
 is called to effectively inject the 
\family typewriter
\size small
ptlsim
\family default
\size default
 binary into another process and pass control to it before even the dynamic
 linker gets to load the program.
 In 
\family typewriter
\size small
ptlsim_inject()
\family default
\size default
, the PTLsim process is forked and the child is placed under the parent's
 control using 
\family typewriter
\size small
ptrace()
\family default
\size default
.
 The child process then uses 
\family typewriter
\size small
exec()
\family default
\size default
 to start the user program to simulate (this can be either a 32-bit or 64-bit
 program).
 
\end_layout

\begin_layout Standard
However, the user program starts in the stopped state, allowing 
\family typewriter
\size small
ptlsim_inject()
\family default
\size default
 to use 
\family typewriter
\size small
ptrace()
\family default
\size default
 and related functions to inject either 32-bit or 64-bit boot loader code
 directly into the user program address space, overwriting the entry point
 of the dynamic linker.
 This code, derived from 
\family typewriter
\size small
injectcode.cpp
\family default
\size default
 (specifically compiled as 
\family typewriter
\size small
injectcode-32bit.o
\family default
\size default
 and 
\family typewriter
\size small
injectcode-64bit.o
\family default
\size default
) is completely position independent.
 Its sole function is to map the rest of 
\family typewriter
\size small
ptlsim
\family default
\size default
 into the user process address space at virtual address 
\family typewriter
\size small
0x70000000
\family default
\size default
 and set up a special 
\family typewriter
\size small
LoaderInfo
\family default
\size default
 structure to allow the master PTLsim process and the user process to communicat
e.
 The boot code also restores the old code at the dynamic linker entry point
 after relocating itself.
 Finally, 
\family typewriter
\size small
ptlsim_inject()
\family default
\size default
 adjusts the user process registers to start executing the boot code instead
 of the normal program entry point, and resumes the user process.
\end_layout

\begin_layout Standard
At this point, the PTLsim image injected into the user process exists in
 a bizarre environment: if the user program is 32 bit, the boot code will
 need to switch to 64-bit mode before calling the 64-bit PTLsim entrypoint.
 Fortunately x86-64 and the Linux kernel make this process easy, despite
 never being used by normal programs: a regular far jump switches the current
 code segment descriptor to 
\family typewriter
\size small
0x33
\family default
\size default
, effectively switching the instruction set to x86-64.
 For the most part, the kernel cannot tell the difference between a 32-bit
 and 64-bit process: as long as the code uses 64-bit system calls (i.e.
 
\family typewriter
\size small
syscall
\family default
\size default
 instruction instead of 
\family typewriter
\size small
int 0x80
\family default
\size default
 as with 32-bit system calls), Linux assumes the process is 64-bit.
 There are some subtle issues related to signal handling and memory allocation
 when performing this trick, but PTLsim implements workarounds to these
 issues.
\end_layout

\begin_layout Standard
After entering 64-bit mode if needed, the boot code passes control to PTLsim
 at 
\family typewriter
\size small
ptlsim_preinit_entry
\family default
\size default
.
 The 
\family typewriter
\size small
ptlsim_preinit()
\family default
\size default
 function checks for the special 
\family typewriter
\size small
LoaderInfo
\family default
\size default
 structure on the stack and in the ELF header of PTLsim as modified by the
 boot code; if these structures are found, PTLsim knows it is running inside
 the user program address space.
 After setting up memory management and threading, it captures any state
 the user process was initialized with.
 This state is used to fill in fields in the global 
\family typewriter
\size small
ctx
\family default
\size default
 structure of class 
\family typewriter
\size small
CoreContext
\family default
\size default
: various floating point related fields and the user program entry point
 and original stack pointer are saved away at this point.
 If PTLsim is running inside a 32-bit process, the 32-bit arguments, environment
 and kernel auxiliary vector array (auxv) need to be converted to their
 64-bit format for PTLsim to be able to parse them from normal C/C++ code.
 Finally, control is returned to 
\family typewriter
\size small
main()
\family default
\size default
 to allow the simulator to start up normally.
\end_layout

\begin_layout Subsection
Startup on 32-bit x86
\end_layout

\begin_layout Standard
The PTLsim startup process on a 32-bit x86 system is essentially a streamlined
 version of the process above (Section 
\begin_inset LatexCommand \ref{sub:Injection-On-x86-64}

\end_inset

), since there is no need for the same PTLsim binary to support both 32-bit
 and 64-bit user programs.
 The injection process is very similar to the case where the user program
 is always a 32-bit program.
\end_layout

\begin_layout Section
Simulator Startup
\end_layout

\begin_layout Standard
In 
\family typewriter
\size footnotesize
kernel.cpp
\family default
\size default
, the 
\family typewriter
\size footnotesize
main()
\family default
\size default
 function calls 
\family typewriter
\size footnotesize
init_config()
\family default
\size default
 to read in the user program specific configuration as described in Sections
 
\begin_inset LatexCommand \ref{sec:RunningPTLsim}

\end_inset

 and 
\begin_inset LatexCommand \ref{sec:ConfigurationOptions}

\end_inset

, then starts up the various other simulator subsystems.
 If one of the 
\family typewriter
\size footnotesize
-excludeld
\family default
\size default
 or 
\family typewriter
\size footnotesize
-startrip
\family default
\size default
 options were given, a breakpoint is inserted at the RIP address where the
 user process should switch from native mode to simulation mode (this may
 be at the dynamic linker entry point by default).
\end_layout

\begin_layout Standard
Finally, 
\family typewriter
\size footnotesize
switch_to_native_restore_context()
\family default
\size default
 is called to restore the state that existed before PTLsim was injected
 into the process and return to the dynamic linker entry point.
 This may involve switching from 64-bit back to 32-bit mode to start executing
 the user process natively as discussed in Section 
\begin_inset LatexCommand \ref{sec:Injection}

\end_inset

.
\end_layout

\begin_layout Standard
After native execution reaches the inserted breakpoint thunk code, the code
 performs a 32-to-64-bit long jump back into PTLsim, which promptly restores
 the code underneath the inserted breakpoint thunk.
 At this point, the 
\family typewriter
\size footnotesize
switch_to_sim()
\family default
\size default
 function in 
\family typewriter
\size footnotesize
kernel.cpp
\family default
\size default
 is invoked to actually begin the simulation.
 This is done by calling 
\family typewriter
\size footnotesize
simulate()
\family default
\size default
 in 
\family typewriter
\size footnotesize
ptlsim.cpp
\family default
\size default
.
\end_layout

\begin_layout Standard
At some point during simulation, the user program or the configuration file
 may request a switch back to native mode for the remainder of the program.
 In this case, the 
\family typewriter
\size footnotesize
switch_to_native_restore_context()
\family default
\size default
 function gets called to save the statistics data store, map the PTLsim
 internal state back to the x86 compatible external state and return to
 the 32-bit or 64-bit user code, effectively removing PTLsim from the loop.
\end_layout

\begin_layout Standard
While the real PTLsim user process is running, the original PTLsim injector
 process simply waits in the background for the real user program with PTLsim
 inside it to terminate, then returns its exit code.
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:AddressSpaceSimulation}

\end_inset

Address Space Simulation
\end_layout

\begin_layout Standard
PTLsim maintains the 
\family typewriter
\size footnotesize
AddressSpace
\family default
\size default
 class as global variable 
\family typewriter
\size footnotesize
asp
\family default
\size default
 (see 
\family typewriter
\size footnotesize
kernel.cpp
\family default
\size default
) to track the attributes of each page within the virtual address space.
 When compiled for x86-64 systems, PTLsim uses Shadow Page Access Tables
 (SPATs), which are essentially large two-level bitmaps.
 Since pages are 4096 bytes in size, each 64 kilobyte chunk of the bitmap
 can track 2 GB of virtual address space.
 In each SPAT, each top level array entry points to a chunk mapping 2 GB,
 such that with 131072 top level pointers, the full 48 bit virtual address
 space can typically be mapped with under a megabyte of SPAT chunks, assuming
 the address space is sparse.
\end_layout

\begin_layout Standard
When compiled for 32-bit x86 systems, each SPAT is just a 128 KByte bitmap,
 with one bit for each of the 1048576 4 KB pages in the 4 GB address space.
\end_layout

\begin_layout Standard
In the AddressSpace structure, there are separate SPAT tables for readable
 pages (
\family typewriter
\size footnotesize
readmap
\family default
\size default
 field), writable pages (
\family typewriter
\size footnotesize
writemap
\family default
\size default
 field) and executable pages (
\family typewriter
\size footnotesize
execmap
\family default
\size default
 field).
 Two additional SPATs, 
\family typewriter
\size footnotesize
dtlbmap
\family default
\size default
 and 
\family typewriter
\size footnotesize
itlbmap
\family default
\size default
, are used to track which pages are currently mapped by the simulated translatio
n lookaside buffers (TLBs); this is discussed further in Section 
\begin_inset LatexCommand \ref{sec:TranslationLookasideBuffers}

\end_inset

.
\end_layout

\begin_layout Standard
When running in native mode, PTLsim cannot track changes to the process
 memory map made by native calls to 
\family typewriter
\size footnotesize
mmap()
\family default
\size default
, 
\family typewriter
\size footnotesize
munmap()
\family default
\size default
, etc.
 Therefore, at every switch from native to simulation mode, the 
\family typewriter
\size footnotesize
resync_with_process_maps()
\family default
\size default
 function is called.
 This function parses the 
\family typewriter
\size footnotesize
/proc/self/maps
\family default
\size default
 metafile maintained by the kernel to build a list of all regions mapped
 by the current process.
 Using this list, the SPATs are rebuilt to reflect the current memory map.
 This is absolutely critical for correct operation, since during simulation,
 speculative loads and stores will only read and write memory if the appropriate
 SPAT indicates the address is accessible to user code.
 If the SPATs become out of sync with the real memory map, PTLsim itself
 may crash rather than simply marking the offending load or store as invalid.
 The 
\family typewriter
\size footnotesize
resync_with_process_maps()
\family default
\size default
 function (or more specifically, the 
\family typewriter
\size footnotesize
mqueryall()
\family default
\size default
 helper function) is fairly kernel version specific since the format of
 
\family typewriter
\size footnotesize
/proc/self/maps
\family default
\size default
 has changed between Linux 2.6.x kernels.
 New kernels may require updating this function.
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:DebuggingHints}

\end_inset

Debugging Hints
\end_layout

\begin_layout Standard
When adding or modifying PTLsim, bugs will invariably crop up.
 Fortunately, PTLsim provides a trivial way to find the location of bugs
 which silently corrupt program execution.
 Since PTLsim can transparently switch between simulation and native mode,
 isolating the divergence point between the simulated behavior and what
 a real reference machine would do can be done through binary search.
 The 
\family typewriter
\size footnotesize
-stopinsns
\family default
\size default
 configuration option can be set to stop simulation before the problem occurs,
 then incremented until the first x86 instruction to break the program is
 determined.
\end_layout

\begin_layout Standard
The out of order simulator (
\family typewriter
\size footnotesize
ooocore.cpp
\family default
\size default
) includes extensive debugging and integrity checking assertions.
 These may be turned off by default for improved performance, but they can
 be easily re-enabled by defining the 
\family typewriter
\size footnotesize
ENABLE_CHECKS
\family default
\size default
 symbol at the top of 
\family typewriter
\size footnotesize
ooocore.cpp
\family default
\size default
, 
\family typewriter
\size footnotesize
ooopipe.cpp
\family default
\size default
 and 
\family typewriter
\size footnotesize
oooexec.cpp
\family default
\size default
.
 Additional check functions are in the code but commented out; these may
 be used as well.
\end_layout

\begin_layout Standard
You can also debug PTLsim with 
\family typewriter
\size small
gdb
\family default
\size default
, although the process is non-standard due to PTLsim's co-simulation architectur
e:
\end_layout

\begin_layout Itemize
Start PTLsim on the target program like normal.
 Notice the 
\family typewriter
\size footnotesize
Thread 
\emph on
N
\emph default
 is running in XX-bit mode
\family default
\size default
 message printed at startup: this is the PID you will be debugging, not
 the 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size small
ptlsim
\family default
\size default

\begin_inset Quotes erd
\end_inset

 process that may also be running.
\end_layout

\begin_layout Itemize
Start GDB and type 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
attach 12345
\family default
\size default

\begin_inset Quotes erd
\end_inset

 if 
\emph on
12345
\emph default
 was the PID listed above
\end_layout

\begin_layout Itemize
Type 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
symbol-file ptlsim
\family default
\size default

\begin_inset Quotes erd
\end_inset

 to load the PTLsim internal symbols (otherwise gdb only knows about the
 benchmark code itself).
 You should specify the full path to the PTLsim executable here.
\end_layout

\begin_layout Itemize
You're now debugging PTLsim.
 If you run the 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size small
bt
\family default
\size default

\begin_inset Quotes erd
\end_inset

 command to get a backtrace, it should show the PTLsim functions starting
 at address 0x70000000.
\end_layout

\begin_layout Standard
If the backtrace does not display enough information, go to the 
\family typewriter
\size footnotesize
Makefile
\family default
\size default
 and enable the "no optimization" options (the "-O0" line instead of "-O99")
 since that will make more debugging information available to you.
\end_layout

\begin_layout Standard
The 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
-pause-at-startup
\family default
\size default
 
\emph on
seconds
\emph default

\begin_inset Quotes erd
\end_inset

 configuration option may be useful here, to give you time to attach with
 a debugger before starting the simulation.
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:Timing}

\end_inset

Timing Issues
\end_layout

\begin_layout Standard
PTLsim uses the 
\family typewriter
\size footnotesize
CycleTimer
\family default
\size default
 class extensively to gather data about its own performance using the CPU's
 timestamp counter.
 At startup in 
\family typewriter
\size small
superstl.cpp
\family default
\size default
, the CPU's maximum frequency is queried from the appropriate Linux kernel
 sysfs node (if available) or from 
\family typewriter
\size small
/proc/cpuinfo
\family default
\size default
 if not.
 Processors which dynamically scale their frequency and voltage in response
 to load (like all Athlon 64 and K8 based AMD processors) require special
 handling.
 It is assumed that the processor will be running at its maximum frequency
 (as reported by sysfs) or a fixed frequency (as reported by 
\family typewriter
\size small
/proc/cpuinfo
\family default
\size default
) throughout the majority of the simulation time; otherwise the timing results
 will be bogus.
\end_layout

\begin_layout Section
External Signals and PTLsim
\end_layout

\begin_layout Standard
PTLsim can be forced to switch between native mode and sequential mode by
 sending it standard Linux-style signals from the command line.
 If your program is called 
\begin_inset Quotes eld
\end_inset

myprogram
\begin_inset Quotes erd
\end_inset

, start it under PTLsim and run this command from another terminal:
\end_layout

\begin_layout LyX-Code

\size footnotesize
killall -XCPU 
\emph on
myprogram
\end_layout

\begin_layout Standard
This will force PTLsim to switch between native mode and simulation mode,
 depending on its current mode.
 It will print a message to the console and the logfile when you do this.
 The initial mode (native or simulation) is determined by the presence of
 the 
\family typewriter
\size footnotesize
-trigger
\family default
\size default
 option: with 
\family typewriter
\size footnotesize
-trigger
\family default
\size default
, the program starts in native mode until the trigger point (if any) is
 reached.
\end_layout

\begin_layout Part

\series bold
\size huge
\begin_inset LatexCommand \label{sec:PTLsimFullSystem}

\end_inset

PTLsim/X: Full System SMP/SMT Simulation
\end_layout

\begin_layout Chapter
Background
\end_layout

\begin_layout Section
Virtual Machines and Full System Simulation
\end_layout

\begin_layout Standard
Full system simulation and virtualization has been around since the dawn
 of computers.
 Typically 
\emph on
virtual machine
\emph default
 software is used to run 
\emph on
guest
\emph default
 operating systems on a physical 
\emph on
host
\emph default
 system, such that the guest believes it is running directly on the bare
 hardware.
 Modern full system simulators in the x86 world can be roughly divided into
 two groups (this paper does not consider systems for other instruction
 sets).
\end_layout

\begin_layout Standard

\emph on
Hypervisors
\emph default
 execute most unprivileged instructions on the native CPU at full speed,
 but trap privileged instructions used by the operating system kernel, where
 they are emulated by hypervisor software so as to maintain isolation between
 virtual machines and make the virtual machine nearly indistinguishable
 from the real CPU.
 In some cases (particularly on x86), additional software techniques are
 needed to fully hide the hypervisor from the guest OS.
\end_layout

\begin_layout Itemize

\emph on
Xen
\emph default
 
\begin_inset LatexCommand \cite{Xen2Overview,Xen3,XenCambridge,XenIntroWiki,XenPerformance,XenSource}

\end_inset

 represents the current state of the art in this field; it will be described
 in great detail later on.
\end_layout

\begin_layout Itemize

\emph on
VMware
\emph default
 
\begin_inset LatexCommand \cite{VMware}

\end_inset

 is a very well known commercial product that allows unmodified x86 operating
 systems to run inside a virtual machine.
 Because the x86 instruction set is not fully virtualizable, VMware must
 employ x86-to-x86 binary translation techniques on kernel code (but not
 user mode code) to make the virtual CPU indistinguishable from the real
 CPU for compatibility reasons.
 These translations are typically cached in a hidden portion of the guest
 address space to improve performance compared to simply interpreting sensitive
 x86 instructions.
 While this approach is sophisticated and effective, it exacts a heavy performan
ce penalty on I/O intensive workloads 
\begin_inset LatexCommand \cite{XenPerformance}

\end_inset

.
 Interestingly, the latest microprocessors from Intel and AMD include hardware
 features (Intel VT 
\begin_inset LatexCommand \cite{Intel-VT}

\end_inset

, AMD SVM 
\begin_inset LatexCommand \cite{AMD-SVM}

\end_inset

) to eliminate the binary translation and patching overhead.
 Xen fully supports these technologies to allow running Windows and other
 OS's at full speed, while VMware has yet to include full support.
\end_layout

\begin_deeper
\begin_layout Standard
VMware comes in two flavors.
 ESX is a true hypervisor that boots on the bare hardware underneath the
 first guest OS.
 GSX and Workstation use a userspace frontend process containing all virtual
 device drivers and the binary translator, while the 
\emph on
vmmon
\emph default
 kernel module (open source in the Linux version) handles memory virtualization
 and context switching tasks similar to Xen.
\end_layout

\end_deeper
\begin_layout Itemize
Several other products, including Virtual PC and Parallels, provide features
 similar to VMware using similar technology.
\end_layout

\begin_layout Standard
Unlike hypervisors, 
\emph on
simulators
\emph default
 perform cycle accurate execution of x86 instructions using interpreter
 software, without running any guest instructions on the native CPU.
\end_layout

\begin_layout Itemize

\emph on
Bochs
\emph default
 
\begin_inset LatexCommand \cite{Bochs}

\end_inset

 is the most well known open source x86 simulator; it is considered to be
 a nearly RTL (register transfer language) level description of every x86
 behavior from legacy 16-bit features up through modern x86-64 instructions.

\emph on
 Bochs
\emph default
 is very useful for the functional validation of real x86 microprocessors,
 but it is very slow (around 5-10 MHz equivalent) and is not useful for
 implementing cycle accurate models of modern uop-based out of order x86
 processors (for instance, it does not model caches, memory latency, functional
 units and so on).
\end_layout

\begin_layout Itemize

\emph on
QEMU
\emph default
 
\begin_inset LatexCommand \cite{QEMU}

\end_inset

 is similar in purpose to VMware, but unlike VMware, it supports multiple
 CPU host and guest architectures (PowerPC, SPARC, ARM, etc).
 QEMU uses binary translation technology similar to VMware to hide the hyperviso
r's presence from the guest kernel.
 However, due to its cross platform design, both kernel and user code is
 passed through x86-to-x86 binary translation (even on x86 platforms) and
 stored in a translation cache.
 Interestingly, Xen uses a substantial amount of QEMU code to model common
 hardware devices when running unmodified operating systems like Windows,
 but Xen still uses its own hardware-assisted technology to actually achieve
 virtualization.
 QEMU supports a proprietary hypervisor module to add VMware's and Xen's
 ability to run user mode code natively on the CPU to reduce the performance
 penalty; hence it is also in the hypervisor category.
\end_layout

\begin_layout Itemize

\emph on
Simics
\emph default
 
\begin_inset LatexCommand \cite{Simics}

\end_inset

 is a commercial simulation suite for modeling both the functional aspects
 of various x86 processors (including vendor specific extensions) as well
 as user-designed plug-in models of real hardware devices.
 It is used extensively in industry for modeling new hardware and drivers,
 as well as firmware level debugging.
 Like QEMU, Simics uses x86-to-x86 binary translation to instrument code
 at a very low level while achieving good performance (though noticeably
 slower than a hypervisor provides).
 Unlike QEMU, Simics is fully extensible and supports a huge range of real
 hardware models, but it is not possible to add cycle accurate simulation
 features below the x86 instruction level, making it less useful to microarchite
cts (both because of technical considerations as well as its status as a
 closed source product).
\end_layout

\begin_layout Itemize

\emph on
SimNow
\emph default
 
\begin_inset LatexCommand \cite{SimNow}

\end_inset

 is an AMD simulation tool used during the design and validation of AMD's
 x86-64 hardware.
 Like Simics, it is a functional simulator only, but it models a variety
 of AMD-built hardware devices.
 SimNow uses x86-to-x86 binary translation technology similar to Simics
 and QEMU to achieve good performance.
 Because SimNow does not provide cycle accurate timing data, AMD uses its
 own TSIM trace-based simulator, derived from the K8 RTL, to do actual validatio
n and timing studies.
 SimNow is available for free to the public, albeit as closed source.
\end_layout

\begin_layout Standard
All of these tools share one common disadvantage: they are unable to model
 execution at a level below the granularity of x86 instructions, making
 them unsuitable to microarchitects.
 PTLsim/X seeks to fill this void by allowing extremely detailed uop-level
 cycle accurate simulation of x86 and x86-64 microprocessor cores, while
 simultaneously delivering all the performance benefits of true native-mode
 hypervisors like Xen, selective binary translation based hypervisors like
 VMware and QEMU, and the detailed hardware modeling capabilities of Bochs
 and Simics.
\end_layout

\begin_layout Section
Xen Overview
\end_layout

\begin_layout Standard
Xen 
\begin_inset LatexCommand \cite{Xen3,Xen2Overview,XenCambridge,XenIntroWiki,XenPerformance,XenSource}

\end_inset

 is an open source x86 virtual machine monitor, also known as a 
\emph on
hypervisor
\emph default
.
 Each virtual machine is called a 
\begin_inset Quotes eld
\end_inset

domain
\begin_inset Quotes erd
\end_inset

, where domain 0 is privileged and accesses all hardware devices using the
 standard drivers; it can also create and directly manipulate other domains.
 Guest domains typically do not have hardware access do not have this access;
 instead, they relay requests back to domain 0 using Xen-specific virtual
 device drivers.
 Each guest can have up to 32 VCPUs (virtual CPUs).
 Xen itself is loaded into a reserved region of physical memory before loading
 a Linux kernel as domain 0; other operating systems can run in guest domains.
 Xen is famous for having essentially zero overhead due to its unique and
 well planned design; it's possible to run a normal workstation or server
 under Xen with full native performance.
\end_layout

\begin_layout Standard
Under Xen's 
\begin_inset Quotes eld
\end_inset

paravirtualized
\begin_inset Quotes erd
\end_inset

 mode, the guest OS runs on an architecture nearly identical to x86 or x86-64,
 but a few small changes (critical to preserving native performance levels)
 must be made to low-level kernel code, similar in scope to adding support
 for a new type of system chipset or CPU manufacturer (e.g.
 instead of an AMD x86-64 on an nVidia chipset, the kernel would need to
 support a Xen-extended x86-64 CPU on a Xen virtual 
\begin_inset Quotes eld
\end_inset

chipset
\begin_inset Quotes erd
\end_inset

).
 These changes mostly concern page tables and the interrupt controller:
\end_layout

\begin_layout Itemize
Paging is always enabled, and any physical pages (called 
\begin_inset Quotes eld
\end_inset

machine frame numbers
\begin_inset Quotes erd
\end_inset

, or MFNs) used to form a page table must be marked read-only (a.k.a.
 
\begin_inset Quotes eld
\end_inset

pinned
\begin_inset Quotes erd
\end_inset

) everywhere.
 Since the processor can only access a physical page if it's referenced
 by some page table, Xen can guarantee memory isolation between domains
 by forcing the guest kernel to replace any writes to page table pages with
 special 
\emph on
mmu_update()
\emph default
 hypercalls (a.k.a.
 system calls into Xen itself).
 Xen makes sure each update points to a page owned by the domain before
 updating the page table.
 This approach has essentially zero performance loss since the guest kernel
 can read its own page tables without any further indirections (i.e.
 the page tables point to the actual physical addresses), and hypercalls
 are only needed for batched updates (e.g.
 validating a new page table after a 
\emph on
fork()
\emph default
 requires only a single hypercall).
\end_layout

\begin_deeper
\begin_layout Itemize
Xen also supports
\emph on
 pseudo-physical
\emph default
 pages, which are consecutively numbered from 0 to some maximum (i.e.
 65536 for a 256 MB domain).
 This is required because most kernels (including Linux and Windows) do
 not support 
\begin_inset Quotes eld
\end_inset

sparse
\begin_inset Quotes erd
\end_inset

 (discontiguous) physical memory ranges very well (remember that every domain
 can still address every physical page, including those of other domains
 - it just can't access all of them).
 Xen provides pseudo-to-machine (P2M) and machine-to-pseudo (M2P) tables
 to do this mapping.
 However, the physical page tables still continue to reference physical
 addresses and are fully visible to the guest kernel; this is just a convenience
 feature.
\end_layout

\begin_layout Itemize
Xen can save an entire domain to disk, then restore it later starting at
 that checkpoint.
 Since Xen tracks every read-only page that's part of some page table, it
 can restore domains even if the original physical pages are now used by
 something else: it automatically remaps all MFNs in every page table page
 it knows about (but the guest kernel must never store machine page numbers
 outside of page table pages - it's the same concept as in garbage collection,
 where pointers must only reside in the obvious places).
\end_layout

\begin_layout Itemize
Xen can migrate running domains between machines by tracking which physical
 pages become dirty as the domain executes.
 Xen uses 
\emph on
shadow page tables
\emph default
 for this: it makes copy-on-write duplicates of the domain's page tables,
 and presents these internal tables to the CPU, while the guest kernel still
 thinks it's using the original page tables.
 Once the migration is complete, the shadow page tables are merged back
 into the real page tables (as with a save and restore) and the domain continues
 as usual.
\end_layout

\begin_layout Itemize
The memory allocation of each domain is elastic: the domain can give any
 free pages back to Xen via the 
\begin_inset Quotes eld
\end_inset

balloon
\begin_inset Quotes erd
\end_inset

 mechanism; these pages can then be re-assigned to other domains that need
 more memory (up to a per-domain limit).
\end_layout

\begin_layout Itemize
Domains can share some of their pages with other domains using the 
\emph on
grant mechanism.

\emph default
 This is used for zero-copy network and disk I/O between domain 0 and guest
 domains.
\end_layout

\end_deeper
\begin_layout Itemize
Interrupts are delivered using an 
\emph on
event channel
\emph default
 mechanism, which is functionally identical to the IO-APIC hardware on the
 bare CPU (essentially it's a 
\begin_inset Quotes eld
\end_inset

Xen APIC
\begin_inset Quotes erd
\end_inset

 instead of the Intel and AMD models already supported by the guest kernel).
 Xen sets up a 
\emph on
shared info
\emph default
 page containing bit vectors for masked and pending interrupts (just like
 an APIC's memory mapped registers), and lets the guest kernel register
 an event handler function.
 Xen then does an upcall to this function whenever a virtual interrupt arrives;
 the guest kernel manipulates the mask and pending bits to ensure race-free
 notifications.
 Xen automatically maps physical IRQs on the APIC to event channels in domain
 0, plus it adds its own virtual interrupts (for the usual timer and a Xen-speci
fic notification port; use 
\emph on
cat /proc/interrupts
\emph default
 on a Linux system under Xen to see this).
 When the guest domain has multiple VCPUs, interprocessor interrupts (IPIs)
 are done through the Xen event controller in a manner identical to hardware
 IPIs.
\end_layout

\begin_deeper
\begin_layout Itemize
Xen is unique in that PCI devices can be assigned to any domain, so for
 instance each guest domain could have its own dedicated PCI network card
 and disk controller - there's no need to relay requests back to domain
 0 in this configuration, although it only works with hardware that supports
 IOMMU virtualization (otherwise it's a security risk, since DMA can be
 used to bypass Xen's page table protections).
\end_layout

\end_deeper
\begin_layout Itemize
Xen provides the guest with additional timers, so it can be aware of both
 
\begin_inset Quotes eld
\end_inset

wall clock
\begin_inset Quotes erd
\end_inset

 time as well as execution time (since there may be gaps in the latter as
 other domains use the CPU); this lets it provide a smooth interactive experienc
e in a way systems like VMware cannot.
 The timers are delivered as virtual interrupt events.
\end_layout

\begin_layout Itemize
All other features of the paravirtualized architecture perfectly match x86.
 The guest kernel can still use most x86 privileged instructions, such as
 
\emph on
rdmsr
\emph default
, 
\emph on
wrmsr
\emph default
, and control register updates (which Xen transparently intercepts and validates
), and in domain 0, it can access I/O ports, memory mapped I/O, the normal
 x86 segmentation (GDT and LDT) and interrupt mechanisms (IDT), etc.
 This makes it possible to run a normal Linux distribution, with totally
 unmodified drivers and software, at full native speed (we do just this
 on all our development workstations and servers).
 Benchmarks 
\begin_inset LatexCommand \cite{XenPerformance}

\end_inset

 have shown Xen to have ~2-3% performance decrease relative to a traditional
 Linux kernel, where as VMware and similar solutions yield a 20-70% decrease
 under heavy I/O.
\end_layout

\begin_layout Standard
Xen also supports 
\begin_inset Quotes eld
\end_inset

HVM
\begin_inset Quotes erd
\end_inset

 (hardware virtual machine) mode, which is equivalent to what VMware 
\begin_inset LatexCommand \cite{VMware}

\end_inset

, QEMU 
\begin_inset LatexCommand \cite{QEMU}

\end_inset

, Bochs 
\begin_inset LatexCommand \cite{Bochs}

\end_inset

 and similar systems provide: nearly perfect emulation of the x86 architecture
 and some standard peripherals.
 The advantage is that an uncooperative guest OS never knows it's running
 in a virtual machine: Windows XP and Mac OS X have been successfully run
 inside Xen in this mode.
 Unfortunately, this mode has a well known performance cost, even when Xen
 leverages the specialized hardware support for full virtualization in newer
 Intel 
\begin_inset LatexCommand \cite{Intel-VT}

\end_inset

 and AMD 
\begin_inset LatexCommand \cite{AMD-SVM}

\end_inset

 chips.
 The overhead comes from the requirement that the hypervisor still trap
 and emulate all sensitive instructions, whereas paravirtualized guests
 can intelligently batch together requests in one hypercall and can avoid
 virtual device driver overhead.
\end_layout

\begin_layout Chapter
Getting Started with PTLsim/X
\end_layout

\begin_layout Standard

\emph on
NOTE:
\emph default
 This part of the manual is relevant only if you are using the full-system
 PTLsim/X.
 If you are looking for the userspace-only version, please skip this entire
 part and read Part 
\begin_inset LatexCommand \ref{sec:PTLsimClassic}

\end_inset

 instead.
\end_layout

\begin_layout Standard

\series bold
\emph on
WARNING:
\series default
\emph default
 PTLsim/X assumes fairly high level of familiarity with both the Linux kernel
 and Xen.
 If you have never compiled your own Linux kernel or if you are not yet
 running Xen or are unsure how to create and use domains, 
\series bold
STOP NOW
\series default
 and become familiar with Xen itself before attempting to use PTLsim/X.
 The following sections all assume you are familiar with Xen, at least from
 a system administration perspective.
\end_layout

\begin_layout Section
Building PTLsim/X
\end_layout

\begin_layout Standard

\series bold
Prerequisites:
\end_layout

\begin_layout Itemize
PTLsim/X requires a 
\series bold
modern 64-bit x86-64 machine
\series default
.
 This means an AMD Athlon 64 / Opteron / Turion or an Intel Pentium 4 (specifica
lly with EM64T) or Intel Core 2
\series bold
.
 
\series default
We do 
\emph on
not 
\emph default
plan to offer a 32-bit version of PTLsim/X due to the technical deficiencies
 in 32-bit x86 that make it difficult to properly implement a full system
 simulator with all of PTLsim's features.
 Besides, 64-bit hardware is now the standard (in some cases the only option)
 from all the major x86 processor vendors and is very affordable.
\end_layout

\begin_layout Itemize
The 64-bit requirement 
\emph on
only
\emph default
 applies to the host system running PTLsim/X.
 Inside the virtual machine, you are still free to use standard 32-bit Linux
 distributions, applications and so forth under PTLsim/X
\end_layout

\begin_layout Itemize
PTLsim/X assumes you have root access to your machine.
 The PTLsim/X hypervisor runs below Linux itself, so you must use a Xen
 compatible kernel in domain 0 (more on this later).
\end_layout

\begin_layout Itemize
We 
\emph on
highly recommend
\emph default
 you use a Linux distribution already designed to work with Xen 3.x.
 We use SuSE 10.2 and highly recommend it; most other distributions now support
 Xen.
 This requirement only applies to domain 0 - the virtual machines you'll
 be running can use any distribution and do not even need to know about
 Xen at all (other than the kernel, which much support Xen hypercalls and
 block/network drivers).
\end_layout

\begin_layout Itemize
aWe have successfully built PTLsim/X with gcc 3.4.x and 4.1.x+ (gcc 4.0.x has
 documented bugs affecting some of our code).
\end_layout

\begin_layout Standard

\series bold
Quick Start Steps:
\end_layout

\begin_layout Standard
All files listed below can be downloaded from 
\family typewriter
\size footnotesize
http://www.ptlsim.org/download.php
\family default
\size default
.
\end_layout

\begin_layout Enumerate

\series bold
Set up Xen with PTLsim/X extensions:
\end_layout

\begin_deeper
\begin_layout Itemize

\series bold
Download 
\series default
our modified Xen source tree (
\family typewriter
\size footnotesize
xen-ptlsim-rXXXXX.tar.bz2
\family default
\size default
) from 
\family typewriter
\size footnotesize
http://www.ptlsim.org/download.php
\family default
\size default
.
 This is the easiest way to make sure you have the correct PTLsim-compatible
 version of Xen with all patches pre-applied.
\end_layout

\begin_deeper
\begin_layout Itemize
We also provide 
\family typewriter
\size footnotesize
ptlsim-xen-hypervisor.diff
\family default
\size default
 in case you want to manually apply the patches to a development version
 of Xen; the patches are fairly simple and can be adapted as needed.
\end_layout

\end_deeper
\begin_layout Itemize

\series bold
Build and install
\series default
 both the Xen hypervisor and the userspace Xen tools:
\end_layout

\begin_deeper
\begin_layout Itemize
In 
\family typewriter
\size footnotesize
xen-unstable.hg/xen
\family default
\size default
, run 
\family typewriter
\size footnotesize
make
\family default
\size default
, and copy the 
\family typewriter
\size footnotesize
xen
\family default
\size default
 binary to your boot volume
\end_layout

\begin_layout Itemize
In 
\family typewriter
\size footnotesize
xen-unstable.hg/tools
\family default
\size default
, run 
\family typewriter
\size footnotesize
make
\family default
\size default
, then run 
\family typewriter
\size footnotesize
make install
\family default
\size default
.
\end_layout

\end_deeper
\begin_layout Itemize

\series bold
Download
\series default
 our sample kernel and modules (
\family typewriter
\size footnotesize
linux-2.6.20-mtyrel-64bit-xen.tar.bz2
\family default
\size default
) and extract in the root directory to create 
\family typewriter
\size footnotesize
/lib/modules/2.6.20-mtyrel-64bit-xen/....
\end_layout

\begin_deeper
\begin_layout Itemize
This is a SMP kernel based on 2.6.20 with the Xen patches maintained by SuSE
 Linux.
 The complete source is in 
\family typewriter
\size footnotesize
linux-2.6.20-mtyrel-64bit-xen-source.tar.gz
\family default
\size default
, if you want to recompile it.
\end_layout

\begin_layout Itemize
This is just a sample kernel we use - PTLsim/X should work even if you use
 the Xen-compatible kernel shipped with your Linux distribution of choice.
 However, we recommend you run this same kernel in domain 0 as well as in
 the target domain under simulation, simply because we know it works correctly
 and has all the latest Xen patches.
\end_layout

\end_deeper
\begin_layout Itemize

\series bold
Reboot
\series default
, and make sure the PTLsim/X extensions to Xen are actually running: 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
cat /sys/hypervisor/properties/capabilities
\family default
\size default

\begin_inset Quotes erd
\end_inset

 should list 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
ptlsim
\family default
\size default

\begin_inset Quotes erd
\end_inset

.
\end_layout

\end_deeper
\begin_layout Enumerate

\series bold
Set up sample virtual machine and disk images:
\end_layout

\begin_deeper
\begin_layout Itemize

\series bold
Download
\series default
 our pre-configured 256 MB disk image (
\family typewriter
\size footnotesize
ptlsim.img.bz2
\family default
\size default
) and uncompress with bunzip2.
 The sample scripts below expect this file to be in 
\family typewriter
\size footnotesize
/project/ptlsim/ptlsim.img
\family default
\size default
.
\end_layout

\begin_deeper
\begin_layout Itemize
We recommend placing this disk image on a local hard disk rather than NFS.
 It will not mount correctly over NFS unless the 
\family typewriter
\size footnotesize
no_root_squash
\family default
\size default
 NFS option is used.
\end_layout

\end_deeper
\begin_layout Itemize
You have already downloaded our Xen-compatible kernel above.
\end_layout

\begin_layout Itemize
Download the Xen configuration file (
\family typewriter
\size footnotesize
ptlvm
\family default
\size default
) and put it in 
\family typewriter
\size footnotesize
/etc/xen/ptlvm
\family default
\size default
.
 By default, this configuration file specifies a 128 MB example domain using
 the kernel and disk image above as the root filesystem.
\end_layout

\begin_layout Itemize
Make sure you can create this domain 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
xm create ptlvm -c
\family default
\size default

\begin_inset Quotes erd
\end_inset

.
 You should get a console with the text 
\begin_inset Quotes eld
\end_inset

Welcome to the PTLsim Demo Machine
\begin_inset Quotes erd
\end_inset

.
\end_layout

\end_deeper
\begin_layout Enumerate

\series bold
Setup PTLsim itself:
\end_layout

\begin_deeper
\begin_layout Itemize
Download the stable version of PTLsim from our web site (in 
\family typewriter
\size footnotesize
ptlsim-2007xxxx-rXXX.tar.gz
\family default
\size default
) and unpack this file to create the 
\family typewriter
\size footnotesize
ptlsim
\family default
\size default
 directory.
\end_layout

\begin_layout Itemize
Edit the PTLsim 
\family typewriter
\size footnotesize
Makefile
\family default
\size default
 and uncomment the 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
PTLSIM_HYPERVISOR=1
\family default
\size default

\begin_inset Quotes erd
\end_inset

 line to enable PTLsim/X support.
\end_layout

\begin_layout Itemize
Run 
\family typewriter
\size footnotesize
make
\family default
\size default
.
\end_layout

\begin_deeper
\begin_layout Itemize
If the build process complains about missing header files, make sure 
\family typewriter
\size footnotesize
/usr/include/xen
\family default
\size default
 is a symlink to 
\family typewriter
\size footnotesize
/project/xen-unstable.hg/tools/libxc/xen
\family default
\size default
 (or wherever you put the PTLsim-modified 
\family typewriter
\size footnotesize
xen-unstable.hg
\family default
\size default
 tree you downloaded).
 Delete 
\family typewriter
\size footnotesize
/usr/include/xen
\family default
\size default
 beforehand if needed.
\end_layout

\end_deeper
\end_deeper
\begin_layout Section
\begin_inset LatexCommand \label{sec:RunningPTLsim}

\end_inset

Running PTLsim
\end_layout

\begin_layout Standard
PTLsim is run in domain 0 as root, for instance by using the 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
sudo ptlsim ...
\family default
\size default

\begin_inset Quotes erd
\end_inset

 command.
 The 
\family typewriter
\size footnotesize
-domain
\emph on
 N
\family default
\size default
\emph default
 option is used to specify the domain to access.
 The following scenarios show by example how this is done.
\end_layout

\begin_layout Section
Booting Linux under PTLsim
\end_layout

\begin_layout Standard
In the following examples, we will assume the Xen configuration for the
 target domain is in the text file 
\family typewriter
\size footnotesize
/etc/xen/ptlvm
\family default
\size default
.
 Edit 
\family typewriter
\size footnotesize
/etc/xen/ptlvm
\family default
\size default
 as needed, based on the example downloaded above.
\end_layout

\begin_layout Standard
Start your domain as follows:
\end_layout

\begin_layout LyX-Code

\size footnotesize
sudo xm create domainname --paused
\end_layout

\begin_layout LyX-Code

\size footnotesize
sudo xm list
\end_layout

\begin_layout LyX-Code

\size footnotesize
sudo xm console domainname
\end_layout

\begin_layout Standard
The 
\family typewriter
\size footnotesize
--paused
\family default
\size default
 option tells Xen to pause the domain as soon as it's created, so we can
 run the entire boot process under PTLsim.
\end_layout

\begin_layout Standard
The 
\family typewriter
\size footnotesize
xm list
\family default
\size default
 command will print the domain ID assigned to 
\family typewriter
\size footnotesize
ptlvm
\family default
\size default
.
 On our test machine, the output looks like:
\end_layout

\begin_layout LyX-Code

\size footnotesize
yourst [typhoon /project/ptlsim] sudo xm create ptlvm --paused; sudo xm
 list; sudo xm console ptlvm;
\end_layout

\begin_layout LyX-Code

\size footnotesize
Using config file "ptlvm".
\end_layout

\begin_layout LyX-Code

\size footnotesize
Started domain ptlvm
\end_layout

\begin_layout LyX-Code

\size footnotesize
Name                                      ID Mem(MiB) VCPUs State   Time(s)
\end_layout

\begin_layout LyX-Code

\size footnotesize
Domain-0                                   0     1877     2 r-----    137.9
\end_layout

\begin_layout LyX-Code

\size footnotesize
ptlvm                                     21      128     1 --p---     
 0.0
\end_layout

\begin_layout Standard
You may also want to give the PTLsim domain a low priority; otherwise it
 may cause the system to respond slowly.
 This can be done by adding:
\end_layout

\begin_layout LyX-Code

\size footnotesize
sudo xm sched-credit -d 
\emph on
ptlvm
\emph default
 -w 16
\end_layout

\begin_layout Standard
Open another console and start PTLsim on this domain (using the domain ID
 
\begin_inset Quotes eld
\end_inset

21
\begin_inset Quotes erd
\end_inset

 given in the example above):
\end_layout

\begin_layout LyX-Code

\size footnotesize
sudo ./ptlsim -domain 21 -logfile ptlsim.log -native
\end_layout

\begin_layout Standard
The resulting output:
\end_layout

\begin_layout LyX-Code

\size footnotesize
//
\end_layout

\begin_layout LyX-Code

\size footnotesize
//  PTLsim: Cycle Accurate x86-64 Full System Simulator
\end_layout

\begin_layout LyX-Code

\size footnotesize
//  Copyright 1999-2006 Matt T.
 Yourst <yourst@yourst.com>
\end_layout

\begin_layout LyX-Code

\size footnotesize
//
\end_layout

\begin_layout LyX-Code

\size footnotesize
//  Revision 165 (2006-09-15)
\end_layout

\begin_layout LyX-Code

\size footnotesize
//  Built Oct  8 2006 02:49:42 on tidalwave.lab.ptlsim.org using gcc-4.1
\end_layout

\begin_layout LyX-Code

\size footnotesize
//  Running on typhoon.lab.ptlsim.org
\end_layout

\begin_layout LyX-Code

\size footnotesize
//
\end_layout

\begin_layout LyX-Code

\end_layout

\begin_layout LyX-Code

\size footnotesize
Processing -domain 21 -logfile ptlsim.log -native
\end_layout

\begin_layout LyX-Code

\size footnotesize
System Information:
\end_layout

\begin_layout LyX-Code

\size footnotesize
  Running on hypervisor version xen-3.0-x86_64-ptlsim
\end_layout

\begin_layout LyX-Code

\size footnotesize
  Xen is mapped at virtual address 0xffff800000000000
\end_layout

\begin_layout LyX-Code

\size footnotesize
  PTLsim is running across 1 VCPUs:
\end_layout

\begin_layout LyX-Code

\size footnotesize
    VCPU 0: 2202 MHz
\end_layout

\begin_layout LyX-Code

\size footnotesize
Memory Layout:
\end_layout

\begin_layout LyX-Code

\size footnotesize
  System:                 524208 pages,    2096832 KB
\end_layout

\begin_layout LyX-Code

\size footnotesize
  Domain:                  32768 pages,     131072 KB
\end_layout

\begin_layout LyX-Code

\size footnotesize
  PTLsim reserved:          8192 pages,      32768 KB
\end_layout

\begin_layout LyX-Code

\size footnotesize
  Page Tables:               275 pages,       1100 KB
\end_layout

\begin_layout LyX-Code

\size footnotesize
  PTLsim image:              407 pages,       1628 KB
\end_layout

\begin_layout LyX-Code

\size footnotesize
  Heap:                     7510 pages,      30040 KB
\end_layout

\begin_layout LyX-Code

\size footnotesize
  Stack:                     256 pages,       1024 KB
\end_layout

\begin_layout LyX-Code

\size footnotesize
Interfaces:
\end_layout

\begin_layout LyX-Code

\size footnotesize
  PTLsim page table:      282898
\end_layout

\begin_layout LyX-Code

\size footnotesize
  Shared info mfn:          4056
\end_layout

\begin_layout LyX-Code

\size footnotesize
  Shadow shinfo mfn:      295164
\end_layout

\begin_layout LyX-Code

\size footnotesize
  PTLsim hostcall:                event channel    3
\end_layout

\begin_layout LyX-Code

\size footnotesize
  PTLsim upcall:                  event channel    4
\end_layout

\begin_layout LyX-Code

\end_layout

\begin_layout LyX-Code

\size footnotesize
  Switched to native mode
\end_layout

\begin_layout Standard
Back in the Xen console for the domain, you'll see the familiar Linux boot
 messages:
\end_layout

\begin_layout LyX-Code

\size footnotesize
Bootdata ok (command line is  nousb noide root=/dev/hda1 xencons=ttyS console=tt
yS0)
\end_layout

\begin_layout LyX-Code

\size footnotesize
Linux version 2.6.18-mtyrel-k8-64bit-xen (yourst@tidalwave) (gcc version 4.1.0
 (SUSE Linux)) #2 Sun Oct 8 02:29:10 EDT 2006
\end_layout

\begin_layout LyX-Code

\size footnotesize
BIOS-provided physical RAM map:
\end_layout

\begin_layout LyX-Code

\size footnotesize
 Xen: 0000000000000000 - 0000000008800000 (usable)
\end_layout

\begin_layout LyX-Code

\size footnotesize
No mptable found.
\end_layout

\begin_layout LyX-Code

\size footnotesize
Built 1 zonelists.
  Total pages: 34816
\end_layout

\begin_layout LyX-Code

\size footnotesize
Kernel command line:  nousb noide root=/dev/hda1 xencons=ttyS console=ttyS0
\end_layout

\begin_layout LyX-Code

\size footnotesize
Initializing CPU#0
\end_layout

\begin_layout LyX-Code

\size footnotesize
PID hash table entries: 1024 (order: 10, 8192 bytes)
\end_layout

\begin_layout LyX-Code

\size footnotesize
Xen reported: 2202.808 MHz processor.
\end_layout

\begin_layout LyX-Code

\size footnotesize
Console: colour dummy device 80x25
\end_layout

\begin_layout LyX-Code

\size footnotesize
Dentry cache hash table entries: 32768 (order: 6, 262144 bytes)
\end_layout

\begin_layout LyX-Code

\size footnotesize
Inode-cache hash table entries: 16384 (order: 5, 131072 bytes)
\end_layout

\begin_layout LyX-Code

\size footnotesize
Software IO TLB disabled
\end_layout

\begin_layout LyX-Code

\size footnotesize
Memory: 123180k/139264k available (2783k kernel code, 7728k reserved, 959k
 data, 184k init)
\end_layout

\begin_layout LyX-Code

\size footnotesize
Calibrating delay using timer specific routine..
 4407.14 BogoMIPS (lpj=2203570)
\end_layout

\begin_layout LyX-Code

\size footnotesize
...
\end_layout

\begin_layout LyX-Code

\size footnotesize
NET: Registered protocol family 1
\end_layout

\begin_layout LyX-Code

\size footnotesize
NET: Registered protocol family 17
\end_layout

\begin_layout LyX-Code

\size footnotesize
VFS: Mounted root (ext2 filesystem) readonly.
\end_layout

\begin_layout LyX-Code

\end_layout

\begin_layout LyX-Code

\size footnotesize
Welcome to the PTLsim demo machine!
\end_layout

\begin_layout LyX-Code

\end_layout

\begin_layout LyX-Code

\size footnotesize
root [ptlsim /] cat /proc/cpuinfo
\end_layout

\begin_layout Standard
You'll notice how we specified the 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
-native
\family default
\size default

\begin_inset Quotes erd
\end_inset

 option to speed up the boot process by running all code on the real CPU
 rather than PTLsim's synthetic CPU model.
 Booting Linux within PTLsim is slow since the kernel often executes several
 billion instructions before finally presenting a command line.
\end_layout

\begin_layout Section
Running Simulations: PTLctl
\end_layout

\begin_layout Standard
At this point, we would like to start an actual simulation run.
 For purposes of illustration, this run is composed of three actions:
\end_layout

\begin_layout Itemize
Simulate 100 million x86 instructions using PTLsim's out of order superscalar
 model
\end_layout

\begin_layout Itemize
Simulate another 100 million using PTLsim's sequential model.
 The sequential model is much faster than the out of order superscalar model,
 so it's useful for testing and debugging functional issues, as well as
 simply interacting with the domain.
 However, it does not collect any cycle accurate timing data.
 Section 
\begin_inset LatexCommand \ref{sec:SequentialMode}

\end_inset

 gives more information on the sequential model.
\end_layout

\begin_layout Itemize
Return to native mode
\end_layout

\begin_layout Standard
In the first example, we will start this run from within the running domain
 using 
\family typewriter
\size footnotesize
ptlctl
\family default
\size default
 (PTLsim controller), a program supplied with PTLsim.
 PTLctl is actually an example program showing the use of PTLsim hypercalls
 (
\begin_inset Quotes eld
\end_inset

PTL calls
\begin_inset Quotes erd
\end_inset

), special x86 instructions that can be used to control a domain's own simulatio
n.
 More information on the PTLcall API is in Section 
\begin_inset LatexCommand \ref{sec:PTLcallsFullSystem}

\end_inset

.
\end_layout

\begin_layout Standard
To conduct this simulation, the 
\family typewriter
\size footnotesize
ptlctl 
\family default
\size default
command is used 
\emph on
within
\emph default
 the running virtual machine (by typing it at the domain's console); it
 is not run on the host system at all:
\end_layout

\begin_layout LyX-Code

\size footnotesize
root [ptlsim /] 
\series bold
tar zc usr lib | tar ztv > /tmp/allfiles.txt &
\end_layout

\begin_layout LyX-Code

\size footnotesize
[1] 775
\end_layout

\begin_layout LyX-Code

\size footnotesize
root [ptlsim /] 
\series bold
ptlctl
\series default
 
\series bold
-core ooo -stopinsns 100m -run : -core seq -stopinsns 200m -run : -native
\end_layout

\begin_layout LyX-Code

\size footnotesize
Sending flush and command list to PTLsim hypervisor:
\end_layout

\begin_layout LyX-Code

\size footnotesize
  -core ooo -stopinsns 100m -run
\end_layout

\begin_layout LyX-Code

\size footnotesize
  -core seq -stopinsns 200m -run
\end_layout

\begin_layout LyX-Code

\size footnotesize
  -native
\end_layout

\begin_layout LyX-Code

\size footnotesize
PTLsim returned rc 0
\end_layout

\begin_layout LyX-Code

\size footnotesize
root [ptlsim /] 
\end_layout

\begin_layout Standard
The first command simply runs several CPU-intensive multi-threaded processes
 in the background for simulation purposes (in this case, compressing and
 uncompressing files in the virtual machine's filesystem).
\end_layout

\begin_layout Standard
The second 
\family typewriter
\size footnotesize
ptlctl
\family default
\size default
 command submits the three simulation actions to PTLsim, separated by colons
 (
\begin_inset Quotes eld
\end_inset


\family typewriter
\series bold
\size footnotesize
:
\family default
\series default
\size default

\begin_inset Quotes erd
\end_inset

).
\end_layout

\begin_layout Standard
At the PTLsim console, the following output is produced (the cycle counters
 will update regularly):
\end_layout

\begin_layout LyX-Code

\size footnotesize
...
\end_layout

\begin_layout LyX-Code

\size footnotesize
Breakout request received from native mode
\end_layout

\begin_layout LyX-Code

\size footnotesize
  Switched to simulation mode
\end_layout

\begin_layout LyX-Code

\size footnotesize
Returned from switch to native: now back in sim
\end_layout

\begin_layout LyX-Code

\size footnotesize
Processing -core ooo -stopinsns 100m -run
\end_layout

\begin_layout LyX-Code

\size footnotesize
  Completed       75258330 cycles,      100000000 commits:    461819 cycles/sec,
    795201, insns/sec
\end_layout

\begin_layout LyX-Code

\size footnotesize
Processing -core seq -stopinsns 200m -run
\end_layout

\begin_layout LyX-Code

\size footnotesize
  Completed      200000000 cycles,      200000000 commits:   6941302 cycles/sec,
   6941302, insns/sec
\end_layout

\begin_layout LyX-Code

\size footnotesize
Processing -native
\end_layout

\begin_layout LyX-Code

\size footnotesize
  Switched to native mode
\end_layout

\begin_layout Standard
Notice how the command list is always terminated by a final simulation action
 (in this case, 
\family typewriter
\size footnotesize
-native
\family default
\size default
).
 If the command list only had one simulation run with a fixed duration,
 once that simulation ended, the domain would freeze, since PTLsim would
 pause until another command arrived.
 However, since the domain is frozen, the next command would 
\emph on
never
\emph default
 arrive: there is no way to execute the 
\family typewriter
\size footnotesize
ptlctl
\family default
\size default
 program a second time if the domain is stopped.
 To avoid this sort of deadlock, 
\family typewriter
\size footnotesize
ptlctl 
\family default
\size default
lets the user atomically submit batches of multiple commands as shown ahove.
\end_layout

\begin_layout Standard
This powerful capability allows 
\begin_inset Quotes eld
\end_inset

self-directed
\begin_inset Quotes erd
\end_inset

 simulation scripts (i.e.
 standard shell scripts), in which 
\family typewriter
\size footnotesize
ptlctl 
\family default
\size default
is run immediately before starting a benchmark program, then 
\family typewriter
\size footnotesize
ptlctl 
\family default
\size default
is run again after the program exits to end the simulation and switch back
 to native mode.
\end_layout

\begin_layout Section
PTLsim/X Options
\end_layout

\begin_layout Standard
In Section 
\begin_inset LatexCommand \ref{sec:ConfigurationOptions}

\end_inset

, the configuration options common to both userspace PTLsim and full system
 PTLsim/X wer listed.
 PTLsim/X also introduces a number of special options only applicable to
 full system simulation:
\end_layout

\begin_layout Standard
Actions:
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
-run
\end_layout

\begin_deeper
\begin_layout Standard
Start a simulation run, using the core model specified by the 
\family typewriter
\size footnotesize
-core
\family default
\size default
 option (the default core is 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
ooo
\family default
\size default

\begin_inset Quotes erd
\end_inset

).
\end_layout

\end_deeper
\begin_layout Itemize

\family typewriter
\size footnotesize
-stop
\end_layout

\begin_deeper
\begin_layout Standard
Stop the simulation run currently in progress, and wait for further commands.
 This is generally issued from another console window.
\end_layout

\end_deeper
\begin_layout Itemize

\family typewriter
\size footnotesize
-native
\end_layout

\begin_deeper
\begin_layout Standard
Switch the domain to native mode.
\end_layout

\end_deeper
\begin_layout Itemize

\family typewriter
\size footnotesize
-kill
\end_layout

\begin_deeper
\begin_layout Standard
Kill the domain.
 This is equivalent to 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
xm destroy
\family default
\size default

\begin_inset Quotes erd
\end_inset

, but it also allows PTLsim to perform cleanup actions and flush all files
 before exiting.
\end_layout

\end_deeper
\begin_layout Section
\begin_inset LatexCommand \label{sec:LiveConfigurationUpdates}

\end_inset

Live Updates of Configuration Options
\end_layout

\begin_layout Standard
PTLsim/X provides the ability to send commands and modify configuration
 options in the running simulation from another console on the host system.
 This is different from how the 
\family typewriter
\size footnotesize
ptlctl
\family default
\size default
 program is used inside the target domain to script simulations: in this
 case, the commands are submitted asynchronously from the host system.
\end_layout

\begin_layout Standard
For instance, 
\end_layout

\begin_layout LyX-Code

\size footnotesize
sudo ptlsim -native -domain 21
\end_layout

\begin_layout Standard
will immediately switch the target domain back to native mode.
\end_layout

\begin_layout Standard
To reset the log level in the middle of a simulation run, use the following:
\end_layout

\begin_layout LyX-Code

\series bold
\size footnotesize
sudo ptlsim -domain 21 -loglevel 99 : -run
\end_layout

\begin_layout LyX-Code

\size footnotesize
ptlsim: Sending request '-domain 12 -loglevel 99 : -run' to domain 12...OK
\end_layout

\begin_layout Standard
(This is an example only! Using 
\family typewriter
\size footnotesize
-loglevel 99
\family default
\size default
 will create huge log files).
\end_layout

\begin_layout Standard
Most options (such as 
\family typewriter
\size footnotesize
-loglevel
\family default
\size default
, 
\family typewriter
\size footnotesize
-stoprip
\family default
\size default
, etc.) can be updated at any time in this manner.
\end_layout

\begin_layout Standard
To end a simulation currently in progress, use this:
\end_layout

\begin_layout LyX-Code

\size footnotesize
sudo ptlsim -domain 21 -kill
\end_layout

\begin_layout Standard
This will force PTLsim to cleanly exit.
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:CommandScripts}

\end_inset

Command Scripts
\end_layout

\begin_layout Standard
PTLsim supports 
\emph on
command scripts
\emph default
, in which a file containing a list of commands is passed on the PTLsim
 command line as follows:
\end_layout

\begin_layout LyX-Code

\size footnotesize
sudo ./ptlsim -domain 
\emph on
N
\emph default
 @ptlvm.cmd
\end_layout

\begin_layout Standard
where 
\family typewriter
\size footnotesize
ptlvm.cmd
\family default
\size default
 (specified following the 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
@
\family default
\size default

\begin_inset Quotes erd
\end_inset

 operator) contains the example lines:
\end_layout

\begin_layout LyX-Code

\size footnotesize
# Configuration options:
\end_layout

\begin_layout LyX-Code

\size footnotesize
-logfile ptlsim.log -loglevel 4 -stats ptlsim.stats -snapshot-cycles 10m
\end_layout

\begin_layout LyX-Code

\size footnotesize
# Run the simulation
\end_layout

\begin_layout LyX-Code

\size footnotesize
-core seq -run -stopinsns 20m
\end_layout

\begin_layout LyX-Code

\size footnotesize
-core ooo -run -stopinsns 100m
\end_layout

\begin_layout LyX-Code

\size footnotesize
-native      # All done (switch to native mode)
\end_layout

\begin_layout Standard
These commands are executed by PTLsim one at a time, waiting until the previous
 command completes before starting the next.
 Notice the use of comments (starting with 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
#
\family default
\size default

\begin_inset Quotes erd
\end_inset

), and how configuration options can be spread across lines if desired.
 This mode is very useful for specifying breakpoints using 
\family typewriter
\size footnotesize
-stoprip
\family default
\size default
 and similar options; when the target RIP is reached, the simulation stops
 and the next command in the command list is executed.
\end_layout

\begin_layout Standard
Command scripts can be nested (i.e.
 a script can itself include other scripts using 
\family typewriter
\size footnotesize
@scriptname
\family default
\size default
).
 When multiple commands are given on the command line separated by colons
 (
\begin_inset Quotes eld
\end_inset


\family typewriter
\series bold
\size footnotesize
:
\family default
\series default
\size default

\begin_inset Quotes erd
\end_inset

), any 
\family typewriter
\size footnotesize
@scriptname
\family default
\size default
 clauses are processed after all other commands on the command line.
\end_layout

\begin_layout Section
Working with Checkpoints
\end_layout

\begin_layout Standard
Xen provides the ability to capture the state of a domain into a 
\emph on
checkpoint file
\emph default
 stored on disk.
 PTLsim can leverage this capability to start simulation from a checkpoint,
 avoiding the need to go through the entire boot process, and allowing precisely
 reproducable results across multiple simulation runs.
\end_layout

\begin_layout Standard
To create a checkpoint, boot the domain in native mode without PTLsim running,
 and bring the domain to the point where you would like to begin simulation.
 Then, in another console, run:
\end_layout

\begin_layout LyX-Code

\size footnotesize
sudo xm save ptlvm /tmp/ptlvm.img
\end_layout

\begin_layout LyX-Code

\size footnotesize
Started domain ptlvm
\end_layout

\begin_layout Standard
To restore the domain to that checkpoint, run:
\end_layout

\begin_layout LyX-Code

\size footnotesize
sudo xm restore /tmp/ptlvm.img --paused
\end_layout

\begin_layout LyX-Code

\size footnotesize
sudo xm list
\end_layout

\begin_layout LyX-Code

\size footnotesize
sudo xm console ptlvm
\end_layout

\begin_layout Standard
PTLsim can then be started in the normal manner, by specifying 
\family typewriter
\size footnotesize
-domain X
\family default
\size default
 (according to the output of 
\family typewriter
\size footnotesize
xm list
\family default
\size default
).
 If the checkpoint was made while the domain waited for input (e.g.
 at a shell command line), you may have to press a few keys to get any response
 from its console.
\end_layout

\begin_layout Standard
To exit PTLsim, use 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
sudo ptlsim -kill -domain X
\family default
\size default

\begin_inset Quotes erd
\end_inset

 from another console.
 To abort PTLsim immediately, use Ctrl+C on the ptlsim process, then type
 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
xm kill ptlvm
\family default
\size default

\begin_inset Quotes erd
\end_inset

 to destroy the domain.
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:TimeDilation}

\end_inset

The Nature of Time
\end_layout

\begin_layout Standard
Full system simulation poses some difficult philosophical questions about
 the nature of time itself and the relativistic phenomenon of 
\begin_inset Quotes eld
\end_inset

time dilation
\begin_inset Quotes erd
\end_inset

.
 Specifically, if a simulator runs X times slower than the native CPU, both
 external interrupts and timer interrupts should theoretically be generated
 X times slower than in the real world.
 This is critical for obtaining accurate simulation results: for events
 like network traffic, if a real network device fed interrupts into the
 domain in realtime, and the simulator injected these interrupts into the
 simulation at the same rate, they would appear to arrive thousands of times
 faster than any physical network interface could deliver them.
 This can easily result in a livelock situation not possible in a real machine;
 at the very least it will deliver misleading performance results.
\end_layout

\begin_layout Standard
On the other hand, interacting with a domain running at the 
\begin_inset Quotes eld
\end_inset

correct
\begin_inset Quotes erd
\end_inset

 rate according to its own simulated clock can be unpleasant for users.
 For instance, if the 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
sleep 1
\family default
\size default

\begin_inset Quotes erd
\end_inset

 command is run in a Linux domain under PTLsim, instead of sleeping for
 1 second of wall clock time (as perceived by the user), the domain will
 wait until 1 billion cycles have been fully simulated (assuming the simulated
 processor frequency is 1 GHz).
 This is because PTLsim keys interrupt delivery and all timers to the simulated
 cycle number in which the interrupt should arrive (based on the core clock
 frequency).
 In addition to being annoying, this behavior will massively confuse network
 applications that rely on precise timing information: a TCP/IP endpoint
 outside the domain will not expect packets to arrive thousands of times
 slower than its own realtime clock expects, resulting in retransmissions
 and timeouts that would never occur if both endpoints were inside the same
 
\begin_inset Quotes eld
\end_inset

time dilated
\begin_inset Quotes erd
\end_inset

 domain.
\end_layout

\begin_layout Standard
Rather than attempt to solve this philosophical dilemma, PTLsim allows users
 to choose the options that best suit their simulation accuracy needs.
 The following options control the notion of time inside the simulation:
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
-corefreq 
\emph on
Hz
\end_layout

\begin_deeper
\begin_layout Standard
Specify the CPU core frequency (in Hz) reported to the domain.
 To specify a 2.4 GHz core, use 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
-corefreq 2400m
\family default
\size default

\begin_inset Quotes erd
\end_inset

.
 This option is used to calculate the number of cycles between timer interrupts,
 as described below.
\end_layout

\begin_layout Standard

\emph on
NOTE:
\emph default
 If you plan on switching the domain between simulation and native mode,
 we strongly recommend avoiding this option, to allow the host machine frequency
 to match the simulated frequency.
\end_layout

\end_deeper
\begin_layout Itemize

\family typewriter
\size footnotesize
-timerfreq 
\emph on
Hz
\end_layout

\begin_deeper
\begin_layout Standard
Specify the timer interrupt frequency in interrupts per second.
 By default, 100 interrupts per second are used, since this is the standard
 for Linux kernels.
\end_layout

\begin_layout Standard

\series bold
\emph on
Hint:
\series default
\emph default
 if keyboard interaction with the domain seems slow or sluggish, this is
 because Linux only flushes console buffers to the screen at every clock
 tick.
 Specifying 
\family typewriter
\size footnotesize
-timerfreq 1000
\family default
\size default
 will greatly improve interactive response at the expense of more interrupt
 overhead.
\end_layout

\end_deeper
\begin_layout Itemize

\family typewriter
\size footnotesize
-pseudo-rtc
\end_layout

\begin_deeper
\begin_layout Standard
By default, the realtime clock reported to the domain is the current time
 of day.
 This option forces the clock to reset to whatever time the domain's checkpoint
 (if any) was created.
 This may allow better cycle accurate reproducibility of random number generator
s, for instance.
\end_layout

\end_deeper
\begin_layout Itemize

\family typewriter
\size footnotesize
-realtime
\end_layout

\begin_deeper
\begin_layout Standard
PTLsim normally delivers all interrupts at the time dilated rate, as described
 above.
 While this provides the most realistic simulation accuracy, it may be undesirab
le for some applications, particularly in networking.
 The 
\family typewriter
\size footnotesize
-realtime
\family default
\size default
 option delivers external interrupts to the domain as soon as they arrive
 at PTLsim's interrupt handler; they are not deferred.
 The realtime clock reported to the domain is also not dilated; it is locked
 to the current wall clock time.
 This option does not affect the timer interrupt frequency; use the 
\family typewriter
\size footnotesize
-timerfreq
\family default
\size default
 option to directly manipulate this.
\end_layout

\end_deeper
\begin_layout Itemize

\family typewriter
\size footnotesize
-maskints
\end_layout

\begin_deeper
\begin_layout Standard
Do not allow 
\emph on
any
\emph default
 external interrupts or events to reach the domain; only the timer interrupt
 is delivered at the specified rate by PTLsim.
 This mode is necessary to provide guaranteed reproducable cycle accurate
 behavior across runs; it eliminates almost all non-deterministic events
 (like outside device interrupts) from the simulation.
 However, it is not very practical, since disk and network access is impossible
 in this mode (since the Xen disk and network drivers could never wake up
 the domain when data arrives).
 This mode is most useful for debugging starting at a checkpoint, or when
 using a ramdisk with pre-scripted boot actions.
\end_layout

\end_deeper
\begin_layout Section
Other Options
\end_layout

\begin_layout Standard
PTLsim/X has a few additional options related to full system simulation:
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
-reservemem 
\emph on
M
\end_layout

\begin_deeper
\begin_layout Standard
Reserves 
\emph on
M
\emph default
 megabytes of physical memory for PTLsim and its translation cache.
 The default is 32 MB; the valid range is from 16 MB to 512 MB.
 See Chapter 
\begin_inset LatexCommand \ref{sec:PTLsimXArchitectureDetails}

\end_inset

 for details.
\end_layout

\end_deeper
\begin_layout Standard
All other options in Section 
\begin_inset LatexCommand \ref{sec:ConfigurationOptions}

\end_inset

 (unless otherwise noted) are common to both userspace PTLsim and full system
 PTLsim/X.
\end_layout

\begin_layout Chapter
\begin_inset LatexCommand \label{sec:PTLsimXArchitectureDetails}

\end_inset

PTLsim/X Architecture Details
\end_layout

\begin_layout Standard
The following sections provide insight into the internal architecture of
 full system PTLsim/X, and how a simulator is built to run on the bare hardware.
 It is not necessary to understand this information to work with or customize
 machine models in PTLsim, but it may still be fascinating to those working
 with the low level infrastructure components.
\end_layout

\begin_layout Section
Basic PTLsim/X Components
\end_layout

\begin_layout Standard
PTLsim/X works in a conceptually similar manner to the normal userspace
 PTLsim: the simulator is 
\begin_inset Quotes eld
\end_inset

injected
\begin_inset Quotes erd
\end_inset

 into the target user process address space and effectively becomes the
 CPU executing the process.
 PTLsim/X extends this concept, but instead of a process, the core PTLsim
 code runs on the bare hardware and accesses the same physical memory pages
 owned by the guest domain.
 Similarly, each VCPU is 
\begin_inset Quotes eld
\end_inset

collapsed
\begin_inset Quotes erd
\end_inset

 into a context structure within PTLsim when simulation begins; each context
 is then copied back onto the corresponding physical CPU context(s) when
 native mode is entered.
\end_layout

\begin_layout Standard
PTLsim/X consists of three primary components: the modified Xen hypervisor,
 the PTLsim monitor process, and the PTLsim core.
\end_layout

\begin_layout Subsection
Xen Modifications
\end_layout

\begin_layout Standard
The Xen hypervisor requires some modifications to work with PTLsim.
 Specifically, several new major hypercalls were added:
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
XEN_DOMCTL_contextswap 
\family default
\size default
atomically swaps all context information in all VCPUs of the target domain,
 saving the old context and writing in a new context.
 In addition to per-VCPU data (including all registers and page tables),
 the shared info page is also swapped.
 This is done as a hypercall so as to eliminate race conditions between
 the hypervisor, PTLsim monitor process in domain 0 and the target domain.
 The domain is first de-scheduled from all physical CPUs in the host system,
 the old context is saved, the new context is validated and written, and
 finally the paused domain wakes up to the new context.
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
MMUEXT_GET_GDT_TEMPLATE
\family default
\size default
 gets the x86 global descriptor table (GDT) page Xen transparently maps
 into the 
\family typewriter
\size footnotesize
FIRST_RESERVED_GDT_PAGE gdt_frames[]
\family default
\size default
 slot.
 PTLsim needs this data to properly resolve segment references.
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
MMUEXT_QUERY_PAGES
\family default
\size default
 queries the page type and reference count of a given guest MFN.
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
VCPUOP_set_breakout_insn_action
\family default
\size default
 tells the hypervisor about a special 
\emph on
breakout instruction
\emph default
.
 This is a normally undefined x86 instruction that the 
\family typewriter
\size footnotesize
ptlctl
\family default
\size default
 program (and PTL calls from user code) can use to request services from
 PTLsim.
 The hypervisor uses the x86 invalid opcode trap to intercept this instruction,
 and in response it may perform several actions, including pausing the domain
 and sending an interrupt to domain 0 for the PTLsim monitor process to
 receive.
 This is the mechanism by which a domain operating in native mode can request
 a switch back into simulation mode.
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
VCPUOP_set_timestamp_bias 
\family default
\size default
is used to virtualize the processor timestamp counter (TSC) read by the
 x86 
\family typewriter
\size footnotesize
rdtsc
\family default
\size default
 instruction.
 This support is needed to ensure a seamless transition between simulation
 mode and native mode without the target domain noticing any cycles are
 missing.
 Since PTLsim runs much slower than the native CPU, a negative bias must
 be applied to the TSC to provide timing continuity when returning to native
 mode.
 The hypervisor will trap 
\family typewriter
\size footnotesize
rdtsc
\family default
\size default
 instructions and emulate them when a bias is in effect.
\end_layout

\begin_layout Standard
These changes are provided by 
\family typewriter
\size footnotesize
ptlsim-xen-hypervisor.diff
\family default
\size default
 as described in the installation instructions.
\end_layout

\begin_layout Subsection
PTLsim Monitor (PTLmon)
\end_layout

\begin_layout Standard
The PTLsim monitor (
\emph on
ptlmon.cpp
\emph default
) is a normal Linux program that runs in domain 0 with root privileges.
 After connecting to the specified domain, it increases the domain's memory
 reservation so as to reserve a range of physical pages for PTLsim (by default,
 32 MB of physical memory).
 PTLmon maps all these reserved pages into its own address space, and loads
 the real PTLsim core code into these pages.
 The PTLsim core is linked separately as 
\emph on
ptlxen.bin
\emph default
, but is then linked as a binary object into the final self-contained 
\emph on
ptlsim
\emph default
 executable.
 PTLmon then builds page tables to map PTLsim space into the target domain.
 Finally, PTLmon fills in various other fields in the boot info page (including
 a pointer to the 
\emph on
Context
\emph default
 structures (a modified version of Xen's 
\emph on
vcpu_context_t
\emph default
) holding the interrupted guest's state for each of its VCPUs), prepares
 the initial registers and page tables to map PTLsim's code, then unmaps
 all PTLsim reserved pages except for the first few pages (as shown in Table
 
\begin_inset LatexCommand \ref{table:MemLayout}

\end_inset

).
 This is required since the monitor process cannot have writable references
 to any of PTLsim's pages or PTLsim may not be able to pin those pages as
 page table pages.
 At this point, PTLmon atomically restarts the domain inside PTLsim using
 the new 
\family typewriter
\size footnotesize
contextswap
\family default
\size default
 hypercall.
 The old context of the domain is thus available for PTLsim to use and update
 via simulation.
\end_layout

\begin_layout Standard
PTLmon also sets up two event channels: the 
\emph on
hostcall
\emph default
 channel and the 
\emph on
upcall
\emph default
 channel.
 PTLsim notifies the monitor process in domain 0 via the 
\emph on
hostcall
\emph default
 event channel whenever it needs to access the outside world.
 Specifically, PTLsim will fill in the 
\emph on
bootpage.hostreq
\emph default
 structure with parameters to a standard Linux system calls, and will place
 any larger buffers in the 
\emph on
transfer page
\emph default
 (see Table 
\begin_inset LatexCommand \ref{table:MemLayout}

\end_inset

) visible to both PTLmon and PTLsim itself.
 PTLsim will then notify the 
\emph on
hostcall
\emph default
 channel's port.
 The domain 0 kernel will then forward this notification to PTLmon, which
 will do the system call on PTLsim's behalf (while PTLsim remains blocked
 in the 
\family typewriter
\size footnotesize
synchronous_host_call()
\family default
\size default
 function).
 PTLmon will then notify the hostcall port in the opposite direction (waking
 up PTLsim) when the system call is complete.
 This is very similar to a remote procedure call, but using shared memory.
 It allows PTLsim to use standard system calls (e.g.
 for reading and writing log files) without modification, yet remains suitable
 for a bare-metal embedded environment.
\end_layout

\begin_layout Standard
PTLmon can also use the 
\emph on
upcall
\emph default
 channel to interrupt PTLsim, for instance to switch between native and
 simulation mode, trigger a snapshot, or request that PTLsim update its
 internal parameters.
 The PTLmon process sets up a socket in 
\family typewriter
\size footnotesize
/tmp/ptlsim-domain-XXX
\family default
\size default
 and waits for requests on this socket.
 The user can then run the 
\family typewriter
\size footnotesize
ptlsim
\family default
\size default
 command again, which will connect to this socket and tell the main monitor
 process for the domain to enqueue a text string (usually the command line
 parameters to 
\family typewriter
\size footnotesize
ptlsim
\family default
\size default
) and send an interrupt to PTLsim on the 
\emph on
upcall
\emph default
 channel.
 In response, PTLsim uses the 
\family typewriter
\size footnotesize
ACCEPT_UPCALL
\family default
\size default
\emph on
 
\emph default
hostcall to read the enqueued command line, then parses it and acts on any
 listed actions or parameter updates.
\end_layout

\begin_layout Standard
It should be noted that this design allows live configuration updates, as
 described in Section 
\begin_inset LatexCommand \ref{sec:LiveConfigurationUpdates}

\end_inset

.
\end_layout

\begin_layout Section
PTLsim Core
\end_layout

\begin_layout Standard
PTLsim runs directly on the 
\begin_inset Quotes eld
\end_inset

bare metal
\begin_inset Quotes erd
\end_inset

 and has no access to traditional OS services except through the DMA and
 interrupt based host call requests described above.
 Execution begins in 
\emph on
ptlsim_init()
\emph default
 in 
\emph on
ptlxen.cpp
\emph default
.
 PTLsim first sets up its internal memory management (page pool, slab allocator,
 extent allocator in 
\emph on
mm.cpp
\emph default
 as described in Section 
\begin_inset LatexCommand \ref{sec:MemoryManager}

\end_inset

) using the initial page tables created by PTLmon in conjunction with the
 modified Xen hypervisor.
 PTLsim owns the virtual address space range starting at 
\family typewriter
\size footnotesize
0xffffff0000000000
\family default
\size default
 (i.e.
 x86-64 PML4 slot 510, of 
\begin_inset Formula $2^{39}$
\end_inset

 bytes).
 This memory is mapped to the physical pages reserved for PTLsim.
 The layout is shown in Table 
\begin_inset LatexCommand \ref{table:MemLayout}

\end_inset

 (assuming 32 MB is allocated for PTLsim):
\end_layout

\begin_layout Standard
\align center
\begin_inset Float table
wide false
sideways false
status open

\begin_layout Caption
\begin_inset LatexCommand \label{table:MemLayout}

\end_inset

Memory Layout for PTLsim Space
\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="15" columns="3">
<features>
<column alignment="right" valignment="top" leftline="true" width="0">
<column alignment="right" valignment="top" leftline="true" width="0">
<column alignment="left" valignment="top" leftline="true" rightline="true" width="0">
<row topline="true" bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
Page
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
Size
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" rightline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
Description
\end_layout

\end_inset
</cell>
</row>
<row topline="true">
<cell multicolumn="1" alignment="center" valignment="top" topline="true" leftline="true" rightline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
(Pages below this point are shared by PTLmon in domain 0 and PTLsim in the
 target domain)
\end_layout

\end_inset
</cell>
<cell multicolumn="2" alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\end_layout

\end_inset
</cell>
<cell multicolumn="2" alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\end_layout

\end_inset
</cell>
</row>
<row topline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
0
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
4K
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" rightline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
Boot info page and ptlxen.bin ELF header (see 
\emph on
xc_ptlsim.h
\emph default
 and 
\emph on
ptlxen.h
\emph default
 for the structures)
\end_layout

\end_inset
</cell>
</row>
<row topline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
1
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
4K
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" rightline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
Hypercall entry points (filled in by Xen)
\end_layout

\end_inset
</cell>
</row>
<row topline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
2
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
4K
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" rightline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
Shared info page for the domain
\end_layout

\end_inset
</cell>
</row>
<row topline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
3
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
4K
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
Shadow shared info page (as seen by guest)
\end_layout

\end_inset
</cell>
</row>
<row topline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
4
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
4K
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" rightline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
Transfer page (for DMA between PTLmon in dom0 and target)
\end_layout

\end_inset
</cell>
</row>
<row topline="true" bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
5
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
128K
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" rightline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
32 VCPU Context structure pages
\end_layout

\end_inset
</cell>
</row>
<row topline="true">
<cell multicolumn="1" alignment="center" valignment="top" topline="true" leftline="true" rightline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
(Pages below this point are private to PTLsim in the target domain)
\end_layout

\end_inset
</cell>
<cell multicolumn="2" alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\end_layout

\end_inset
</cell>
<cell multicolumn="2" alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\end_layout

\end_inset
</cell>
</row>
<row topline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
37
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
~2M
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
PTLsim binary
\end_layout

\end_inset
</cell>
</row>
<row topline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
-
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
~28M
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
PTLsim heap (page pool, slab allocator, extent allocator)
\end_layout

\end_inset
</cell>
</row>
<row topline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
-
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
~256K
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" rightline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
PTLsim stack
\end_layout

\end_inset
</cell>
</row>
<row topline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
...
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
~64K
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
Page tables mapping 32 MB PTLsim space
\end_layout

\end_inset
</cell>
</row>
<row topline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
...
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
~1MB
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
Page tables (level 1) mapping all physical pages (reserved but not filled
 in)
\end_layout

\end_inset
</cell>
</row>
<row topline="true" bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
(32MB)
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
~64K
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
Higher level page tables (levels 4/3/2) pointing to other tables
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\end_inset


\end_layout

\begin_layout Standard
Starting at virtual address 
\family typewriter
\size footnotesize
0xfffffe0000000000
\family default
\size default
 (i.e.
 x86-64 PML4 slot 508, of 
\begin_inset Formula $2^{40}$
\end_inset

 bytes), space is reserved to map all physical memory pages (MFNs) belonging
 to the guest domain.
 This mapping is sparse, since only a subset of the physical pages are accessibl
e by the guest.
 When PTLsim is first injected into a domain, this space starts out empty.
 As various parts of PTLsim attempt to access physical addresses, PTLsim's
 internal page fault handler will map physical pages into this space.
 Normally all pages are mapped as writable, however Xen may not allow writable
 mappings to some types of pinned pages (L1/L2/L3/L4 page table pages, GDT
 pages, etc.).
 Therefore, if the writable mapping fails, PTLsim tries to map the page
 as read only.
 PTLsim monitors memory management related hypercalls as they are simulated
 and remaps physical pages as read-only or writable if and when they are
 pinned or unpinned, respectively.
 When PTLsim switches back to native mode, it quickly unmaps all guest pages,
 since we cannot hold writable references to any pages the guest kernel
 may later attempt to pin as page table pages.
 This unmapping is done very quickly by simply clearing all present bits
 in the physical map's L2 page table page; the PTLsim page fault handler
 will re-establish the L2 entries as needed.
\end_layout

\begin_layout Section
Implementation Details
\end_layout

\begin_layout Subsection
\begin_inset LatexCommand \label{sub:FullSystemPageTranslation}

\end_inset

Page Translation
\end_layout

\begin_layout Standard
The Xen-x86 architecture always has paging enabled, so PTLsim uses a simulated
 TLB for all virtual-to-physical translations.
 Each TLB entry has x86 accessed and dirty bits; whenever these bits transition
 from 0 to 1, PTLsim must walk the page table tree and actually update the
 corresponding PTE's accessed and/or dirty bit.
 Since page table pages are mapped read-only, our modified 
\emph on
update_mmu
\emph default
 hypercall is used to do this.
 TLB misses are serviced in the normal x86 way: the page tables are walked
 starting from the MFN in CR3 until the page is resolved.
 This is done by the 
\family typewriter
\size footnotesize
Context.virt_to_pte()
\family default
\size default
 method, which returns the L1 page table entry (PTE) providing the physical
 address and accumulated permissions (x86 has specific rules for deriving
 the effective writable/executable/supervisor permissions for each page).
 Internally, the 
\family typewriter
\size footnotesize
page_table_walk()
\family default
\size default
 function actually follows the page table tree, but PTLsim maintains a small
 16-entry direct mapped cache (like a TLB) to accelerate repeated translations
 (this is not related to any true TLB maintained by specific cores).
 The 
\family typewriter
\size footnotesize
pte_to_ptl_virt()
\family default
\size default
 function then translates the PTE and original virtual address into a pointer
 PTLsim can actually access (inside PTLsim's mapping of the domain's physical
 memory pages).
 The software TLB is also flushed under the normal x86 conditions (
\family typewriter
\size footnotesize
MOV CR3
\family default
\size default
, 
\family typewriter
\size footnotesize
WBINVD
\family default
\size default
, 
\family typewriter
\size footnotesize
INVLPG
\family default
\size default
, and Xen hypercalls like 
\family typewriter
\size footnotesize
MMUEXT_NEW_BASE_PTR
\family default
\size default
).
 Presently TLB support is in 
\family typewriter
\size footnotesize
dcache.cpp
\family default
\size default
; the features above are incorporated into this TLB.
 In addition, 
\family typewriter
\size footnotesize
Context.copy_from_user()
\family default
\size default
 and 
\family typewriter
\size footnotesize
Context.copy_to_user()
\family default
\size default
 functions are provided to walk the page tables and copy user data to or
 from a buffer inside PTLsim.
\end_layout

\begin_layout Standard
In 32-bit versions of Xen, the x86 protection ring mechanism is used to
 allow the guest kernel to run at ring 1 while guest userspace runs in ring
 3; this allows the 
\begin_inset Quotes eld
\end_inset

supervisor
\begin_inset Quotes erd
\end_inset

 bit in PTEs to retain its traditional meaning.
 However, in its effort to clean up legacy ISA features, x86-64 has no concept
 of privilege rings (other than user/supervisor) or segmentation.
 This means the supervisor bit in PTEs is never set (only Xen internal pages
 not accessible to guest domains have this bit set).
 Instead, Xen puts the kernel in a separate address space from user mode;
 the top-level L4 page table page for kernel mode points to both kernel-only
 and user pages.
 Fortunately, Xen uses TLB global bits and other x86-64 features to avoid
 much of the context switch overhead from this approach.
 PTLsim does not have to worry about this detail during virtual-to-PTE translati
ons: it just follows the currently active page table based on physical addresses
 only.
\end_layout

\begin_layout Subsection
Exceptions
\end_layout

\begin_layout Standard
Under Xen, the 
\family typewriter
\size footnotesize
set_trap_table()
\family default
\size default
 hypercall is used to specify an array of pointers to exception handlers;
 this is equivalent to the x86 LIDT (load interrupt descriptor table) instructio
n.
 Whenever we switch from native mode to simulation mode, PTLmon copies this
 array back into the 
\family typewriter
\size footnotesize
Context.idt[]
\family default
\size default
 array.
 Whenever PTLsim detects an exception during simulation, it accesses 
\family typewriter
\size footnotesize
Context.idt[vector_id]
\family default
\size default
 to determine where the pipeline should be restarted (CS:RIP).
 In the case of page faults, the simulated CR2 is loaded with the faulting
 virtual address.
 It then constructs a stack frame equivalent to Xen's structure (i.e.
 
\family typewriter
\size footnotesize
iret_context
\family default
\size default
) at the stack segment and pointer stored in 
\family typewriter
\size footnotesize
Context.kernel_sp
\family default
\size default
 (previously set by the 
\family typewriter
\size footnotesize
stack_switch()
\family default
\size default
 hypercall, which replaces the legacy x86 TSS structure update).
 Finally, PTLsim propagates the page fault to the selected guest handler
 by redirecting the pipeline.
 This is essentially the same work performed within Xen by the 
\family typewriter
\size footnotesize
create_bounce_frame()
\family default
\size default
 function, 
\family typewriter
\size footnotesize
do_page_fault()
\family default
\size default
 (or its equivalent) and 
\family typewriter
\size footnotesize
propagate_page_fault()
\family default
\size default
 (or its equivalent); all the same boundary conditions must be handled.
\end_layout

\begin_layout Subsection
System Calls and Hypercalls
\end_layout

\begin_layout Standard
On 64-bit x86-64, the 
\family typewriter
\size footnotesize
syscall
\family default
\size default
 instruction has a different meaning depending on the context in which it
 is executed.
 If executed from userspace, 
\emph on
syscall
\emph default
 arranges for execution to proceed directly to the guest kernel system call
 handler (in 
\family typewriter
\size footnotesize
Context.syscall_rip
\family default
\size default
).
 This is done by the 
\family typewriter
\size footnotesize
assist_syscall()
\family default
\size default
 microcode handler.
 A similar process occurs when a 32-bit application uses 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
int 0x80
\family default
\size default

\begin_inset Quotes erd
\end_inset

 to make system calls, but in this case, 
\family typewriter
\size footnotesize
Context.propagate_x86_exception()
\family default
\size default
 is used to redirect execution to the trap handler registered for that virtual
 software interrupt.
\end_layout

\begin_layout Standard
If executed from kernel space, the 
\family typewriter
\size footnotesize
syscall
\family default
\size default
 instruction is interpreted as a hypercall into Xen itself.
 PTLsim emulates all Xen hypercalls.
 In many simple cases, PTLsim handles the hypercall all by itself, for instance
 by simply updating its internal tables.
 In other cases, the hypercall can safely be passed down to Xen without
 corrupting PTLsim's internal state.
 We must be very careful as to which hypercalls are passed through: for
 instance, before updating the page table base, we must ensure the new page
 table still maps PTLsim and the physical address space before we allow
 Xen to update the hardware page table base.
 These cases are all documented in the comments of 
\family typewriter
\size footnotesize
handle_xen_hypercall()
\family default
\size default
\emph on
.
\end_layout

\begin_layout Standard
Note that the definition of 
\begin_inset Quotes eld
\end_inset

user mode
\begin_inset Quotes erd
\end_inset

 and 
\begin_inset Quotes eld
\end_inset

kernel mode
\begin_inset Quotes erd
\end_inset

 is maintained by Xen itself: from the CPU's viewpoint, both modes are technical
ly userspace and run in ring 3.
\end_layout

\begin_layout Standard
An interesting issue arises when PTLsim passes hypercalls through to Xen:
 some buffers provided by the guest kernel may reside in virtual memory
 not mapped by PTLsim.
 Normally PTLsim avoids this problem by copying any guest buffers into its
 own address space using 
\family typewriter
\size footnotesize
Context.copy_from_user()
\family default
\size default
, then copying the results back after the hypercall.
 However, to avoid future complexity, PTLsim currently switches its own
 page tables every time the guest requests a page table switch, such that
 Xen can see all guest kernel virtual memory as well as PTLsim itself.
 Obviously this means PTLsim injects its two top-level page table slots
 into every guest top level page table.
 For multi-processor simulation, PTLsim needs to swap in the target VCPU's
 page table base whenever it forwards a hypercall that depends on virtual
 addresses.
\end_layout

\begin_layout Subsection
Event Channels
\end_layout

\begin_layout Standard
Xen delivers outside events, virtual interrupts, IPIs, etc.
 to the domain just like normal, except they are redirected to a special
 PTLsim upcall handler stub (in 
\family typewriter
\size footnotesize
lowlevel-64bit-xen.S
\family default
\size default
).
 The handler checks which events are pending, and if any events (other than
 the PTLsim hostcall and upcall events) are pending, it sets a flag so the
 guest's event handler is invoked the next time through the main loop.
 This process is equivalent to exception handling in terms of the stack
 frame setup and call/return sequence: the simulated pipeline is simply
 redirected to the handler address.
 It should be noted that the PTLsim handler does not set or clear any mask
 bits in the shared info page, since it's the (emulated) guest OS code that
 should actually be doing this, not PTLsim.
 The only exception is when the event in question is on the hostcall port
 or the upcall port; then PTLsim handles the event itself and never notifies
 the guest.
\end_layout

\begin_layout Subsection
Privileged Instruction Emulation
\end_layout

\begin_layout Standard
Xen lets the guest kernel execute various privileged instructions, which
 it then traps and emulates with internal hypercalls.
 These are the same as in Xen's arch/x86/traps.c: CLTS (FPU task switches),
 MOV from CR0-CR4 (easy to emulate), MOV to and from DR0-DR7 (get or set
 debug registers), RDMSR and WRMSR (mainly to set segment bases).
 PTLsim decodes and executes these instructions on its own, just like any
 other x86 instruction.
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:PTLcallsFullSystem}

\end_inset

PTLcalls
\end_layout

\begin_layout Standard
PTLsim defines the special x86 opcode 
\family typewriter
\size footnotesize
0x0f37
\family default
\size default
 as a breakout opcode.
 It is undefined in the normal x86 instruction set, but when executed by
 any code running under PTLsim, it can be used to enqueue commands for PTLsim
 to execute.
\end_layout

\begin_layout Standard
The 
\family typewriter
\size footnotesize
ptlctl
\family default
\size default
 program uses this facility to switch from native mode to simulation mode
 as follows.
 Whenever PTLsim is about to switch back to native mode, it uses the 
\family typewriter
\size footnotesize
VCPUOP_set_breakout_insn_action
\family default
\size default
 to specify the opcode bytes to intercept.
 When the hypervisor sees an invalid instruction matching 
\family typewriter
\size footnotesize
0x0f37
\family default
\size default
, it freezes the domain and sends an event channel notification to domain
 0.
 This event channel is read by PTLmon, which then uses the 
\family typewriter
\size footnotesize
contextswap
\family default
\size default
 hypercall to switch back into PTLsim inside the domain.
 PTLsim then processes whatever command caused the switch back into simulation
 mode.
\end_layout

\begin_layout Standard
While executing 
\emph on
within 
\emph default
simulation mode, this is not necessary: since PTLsim is in complete control
 of the execution of each x86 instruction, it simply defines microcode to
 handle 
\family typewriter
\size footnotesize
0x0f37
\family default
\size default
 instead of triggering an invalid opcode exception.
 This microcode branches into PTLsim, which uses the 
\family typewriter
\size footnotesize
PTLSIM_HOST_INJECT_UPCALL
\family default
\size default
 hostcall to add the command(s) to the command queue.
 The queue is maintained inside PTLmon so as to ensure synchronization between
 commands coming from the host and commands from within the domain arriving
 via PTLcalls.
 The queue is typically flushed before adding new commands in this manner:
 otherwise, it would be impossible to get immediate results using 
\family typewriter
\size footnotesize
ptlctl
\family default
\size default
.
\end_layout

\begin_layout Standard
All PTL calls are defined in 
\family typewriter
\size footnotesize
ptlcalls.h
\family default
\size default
, which simply collects the call's arguments and executes opcode 
\family typewriter
\size footnotesize
0x0f37
\family default
\size default
 as if it were a normal x86 
\family typewriter
\size footnotesize
syscall
\family default
\size default
 instruction:
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
ptlcall_multi_enqueue(const char* list[], size_t length)
\family default
\size default
 enqueues a list of commands to process in sequence
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
ptlcall_multi_flush(const char* list[], size_t length)
\family default
\size default
 flushes the queue before adding the commands
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
ptlcall_single_enqueue(const char* command)
\family default
\size default
 adds one command to the end of the queue
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
ptlcall_single_flush(const char* command)
\family default
\size default
 immediately flushes the queue and processes the specified command
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
ptlcall_nop()
\family default
\size default
 is a simple no-operation command used to get PTLsim's attention
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
ptlcall_version()
\family default
\size default
 returns version information about the running PTLsim hypervisor.
\end_layout

\begin_layout Standard
The 
\family typewriter
\size footnotesize
ptlcall
\family default
\size default
 opcode 
\family typewriter
\size footnotesize
0x0f37
\family default
\size default
 can be executed from both user mode and kernel mode, since it may be desirable
 to switch simulation options from a userspace program.
 This would be impossible if 
\family typewriter
\size footnotesize
wrmsr 
\family default
\size default
(the traditional method) were used to effect PTLsim operations.
\end_layout

\begin_layout Section
Event Trace Mode
\end_layout

\begin_layout Standard
In Section 
\begin_inset LatexCommand \ref{sec:TimeDilation}

\end_inset

, we discussed the philosophical question of how to accurately model the
 timing of external events when cycle accurate simulation runs thousands
 of times slower than the outside world expects.
 To solve this problem, PTLsim/X offers 
\emph on
event trace
\emph default
 mode.
\end_layout

\begin_layout Standard
First, the user saves a checkpoint of the target domain, then instructs
 PTLsim to enter 
\emph on
event record
\emph default
 mode.
 The domain is then used interactively in native mode at full speed, for
 instance by starting benchmarks and waiting for their completion.
 In the background, PTLsim taps Xen's trace buffers to write any events
 delivered to the domain into an event trace file.
 
\begin_inset Quotes eld
\end_inset

Events
\begin_inset Quotes erd
\end_inset

 refer to any time-dependent outside stimulus delivered to the domain, such
 as interrupts (i.e.
 Xen event channel notifications) and DMA traffic (i.e.
 the full contents of any grant pages from network or disk I/O transferred
 into the domain).
 Each event is timestamped with the relative cycle number (timestamp counter)
 in which it was delivered, rather than the wall clock time.
 When the benchmarks are done, the trace mode is terminated and recording
 stops.
\end_layout

\begin_layout Standard
The user then restores the domain from the checkpoint and re-injects PTLsim,
 but this time PTLsim reads the event trace file, rather than responding
 to any outside events Xen may deliver to the domain while in simulation
 mode.
 Whenever the timestamp of the event at the head of the trace file matches
 the current simulation cycle, that event is injected into the domain.
 PTLsim does this by setting the appropriate pending bits in the shared
 info page, and then simulates an upcall to the domain's shared info handler
 (i.e.
 by restarting the simulated pipeline at that RIP).
 Since the event channels used by PTLsim and those of the target domain
 may interfere, PTLsim maintains a shadow shared info page that's updated
 instead; whenever the simulated load/store pipeline accesses the real shared
 info page's physical address, the shadow page is used in its place.
 In addition, the wall clock time fields in the shadow shared info page
 are regularly updated by dividing the simulated cycle number by the native
 CPU clock frequency active during the record mode (since the guest OS will
 have recorded this internally in many places).
\end_layout

\begin_layout Standard
This scheme does require some extra software support, since we need to be
 able to identify which pages the outside source has overwritten with incoming
 data (i.e.
 as in a virtual DMA).
 The console I/O page is actually a guest page that domain 0 maps in 
\emph on
xenconsoled
\emph default
; this is easy to identify and capture.
 The network and block device pages are typically grant pages; the domain
 0 Linux device drivers must be modified to let PTLsim know what pages will
 be overwritten by outside sources.
\end_layout

\begin_layout Section
Multiprocessor Support
\end_layout

\begin_layout Standard
PTLsim/X is designed from the ground up to support multiple VCPUs per domain.
 The 
\family typewriter
\size footnotesize
contextof(vcpuid)
\family default
\size default
 function returns the Context structure allocated for each VCPU; this structure
 is passed to all functions and assists dealing with the domain.
 It is the responsibility of each core (e.g.
 sequential core, out of order core, user-designed cores, etc.) to update
 the appropriate context structure according to its own design.
\end_layout

\begin_layout Standard
VCPUs may choose to block by executing an appropriate hypercall (
\family typewriter
\size footnotesize
sched_block
\family default
\size default
, 
\family typewriter
\size footnotesize
sched_yield
\family default
\size default
, etc.), typically suspending execution until an event arrives.
 PTLsim cores can simulate this by checking the 
\family typewriter
\size footnotesize
Context.running
\family default
\size default
 field; if zero, the corresponding VCPU is blocked and no instructions should
 be processed until the 
\family typewriter
\size footnotesize
running
\family default
\size default
 flag becomes set, such as when an event arrives.
 In realtime mode (where Xen relays real events like timer interrupts back
 to the simulated CPU), events and upcalls may be delivered to other VCPUs
 than the first VCPU which runs PTLsim; in this case, PTLsim must check
 the pending bitmap in the shared info page and simulate upcalls within
 the appropriate VCPU context (i.e.
 whichever VCPU context has its 
\family typewriter
\size footnotesize
upcall_pending
\family default
\size default
 bit set).
\end_layout

\begin_layout Standard
Some Xen hypercalls must only be executed on the VCPU to which the hypercall
 applies.
 In cases where PTLsim cannot emulate the hypercall on its own internal
 state (and defer the actual hypercall until switching back to native mode),
 the Xen hypervisor has been modified to support an explicit 
\emph on
vcpu
\emph default
 parameter, allowing the first VCPU (which always runs PTLsim itself) to
 execute the required action on behalf of other VCPUs.
\end_layout

\begin_layout Standard
For simultaneous multithreading support, PTLsim is designed to run the simulatio
n entirely on the first VCPU, while putting the other VCPUs in an idle loop.
 This is required because there's no easy way to parallelize an SMT core
 model across multiple simulation threads.
 In theory, a multi-core simulator could in fact be parallelized in this
 way, but it would be very difficult to reproduce cycle accurate behavior
 and debug deadlocks with asynchronous simulations running in different
 threads.
 For these reasons, currently PTLsim itself is single threaded in simulation
 mode, even though it simulates multiple virtual cores or threads.
\end_layout

\begin_layout Standard
Cache coherence is the responsibility of each core model.
 By default, PTLsim uses the 
\begin_inset Quotes eld
\end_inset

instant visibility
\begin_inset Quotes erd
\end_inset

 model, in which all VCPUs can have read/write copies of cache lines and
 all stores appear on all other VCPUs the instant they commit.
 More complex MOESI-compliant policies can be implemented on top of this
 basic framework, by stalling simulated VCPUs until cache lines travel across
 an interconnect network.
\end_layout

\begin_layout Part
\begin_inset LatexCommand \label{part:OutOfOrderModel}

\end_inset

Out of Order Processor Model
\end_layout

\begin_layout Chapter
\begin_inset LatexCommand \label{sec:OutOfOrderFeatures}

\end_inset

Introduction
\end_layout

\begin_layout Section
Out Of Order Core Features
\end_layout

\begin_layout Standard
PTLsim completely models a modern out of order x86-64 compatible processor,
 cache hierarchy and key devices with true cycle accurate simulation.
 The basic microarchitecture of this model is a combination of design features
 from the Intel Pentium 4, AMD K8 and Intel Core 2, but incorporates some
 ideas from IBM Power4/Power5 and Alpha EV8.
 The following is a summary of the characteristics of this processor model:
\end_layout

\begin_layout Itemize
The simulator directly fetches pre-decoded micro-operations (Section 
\begin_inset LatexCommand \ref{sec:FetchStage}

\end_inset

) but can simulate cache accesses as if x86 instructions were being decoded
 on fetch
\end_layout

\begin_layout Itemize
Branch prediction is configurable; PTLsim currently includes various models
 including a hybrid g-share based predictor, bimodal predictors, saturating
 counters, etc.
\end_layout

\begin_layout Itemize
Register renaming takes into account x86 quirks such as flags renaming (Section
 
\begin_inset LatexCommand \ref{sub:FlagsManagement}

\end_inset

)
\end_layout

\begin_layout Itemize
Front end pipeline has configurable number of cycles to simulate x86 decoding
 or other tasks; this is used for adjusting the branch mispredict penalty
\end_layout

\begin_layout Itemize
Unified physical and architectural register file maps both in-flight uops
 as well as committed architectural register values.
 Two rename tables (speculative and committed register rename tables) are
 used to track which physical registers are currently mapped to architectural
 registers.
\end_layout

\begin_layout Itemize
Unified physical register file for both integer and floating point values.
\end_layout

\begin_layout Itemize
Operands are read from the physical register file immediately before issue.
 Unlike in some microprocessors, PTLsim does not do speculative scheduling:
 the schedule and register read loop is assumed to take one cycle.
\end_layout

\begin_layout Itemize
Issue queues based on a collapsing design use broadcast based matching to
 wake up instructions.
\end_layout

\begin_layout Itemize
Clustered microarchitecture is highly configurable, allowing multi-cycle
 latencies between clusters and multiple issue queues within the same logical
 cluster.
\end_layout

\begin_layout Itemize
Functional units, mapping of functional units to clusters, issue ports and
 issue queues and uop latencies are all configurable.
\end_layout

\begin_layout Itemize
Speculation recovery from branch mispredictions and load/store aliasing
 uses the forward walk method to recover the rename tables, then annuls
 all uops after and optionally including the mis-speculated uop.
\end_layout

\begin_layout Itemize
Replay of loads and stores after store to load forwarding and store to store
 merging dependencies are discovered.
\end_layout

\begin_layout Itemize
Stores may issue even before data to store is known; the store uop is replayed
 when all operands arrive.
\end_layout

\begin_layout Itemize
Load and store queues use partial chunk address matching and store merging
 for high performance and easy circuit implementation.
\end_layout

\begin_layout Itemize
Prediction of load/store aliasing to avoid mis-speculation recovery overhead.
\end_layout

\begin_layout Itemize
Prediction and splitting of unaligned loads and stores to avoid mis-speculation
 overhead
\end_layout

\begin_layout Itemize
Commit unit supports stalling until all uops in an x86 instruction are complete,
 to make x86 instruction commitment atomic
\end_layout

\begin_layout Standard
The PTLsim model is fully configurable in terms of the sizes of key structures,
 pipeline widths, latency and bandwidth and numerous other features.
\end_layout

\begin_layout Section
Processor Contexts
\end_layout

\begin_layout Standard
PTLsim uses the concept of a 
\emph on
VCPU
\emph default
 (virtual CPU) to represent one user-visible microprocessor core (or a hardware
 thread if a SMT machine is being modeled).
 The 
\family typewriter
\size footnotesize
Context
\family default
\size default
 structure (defined in 
\family typewriter
\size footnotesize
ptlhwdef.h
\family default
\size default
) maintains all per-VCPU state in PTLsim: this includes both user-visible
 architectural registers (in the 
\family typewriter
\size footnotesize
Context.commitarf[]
\family default
\size default
 array) as well as all per-core control registers and internal state information.
 
\family typewriter
\size footnotesize
Context
\family default
\size default
 only contains general x86-visible context information; specific machine
 models must maintain microarchitectural state (like physical registers
 and so forth) in their own internal structures.
\end_layout

\begin_layout Standard
The 
\family typewriter
\size footnotesize
contextof(
\emph on
N
\emph default
)
\family default
\size default
 macro is used to return the 
\family typewriter
\size footnotesize
Context
\family default
\size default
 object for a specific VCPU, numbered 0 to 
\family typewriter
\size footnotesize
contextcount
\family default
\size default
-1.
 In userspace-only PTLsim, there is only one context, 
\family typewriter
\size footnotesize
contextof(0)
\family default
\size default
.
 In full system PTLsim/X, there may be up to 32 (i.e.
 
\family typewriter
\size footnotesize
MAX_CONTEXTS
\family default
\size default
) separate contexts (VCPUs).
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:MachineCoreClassHierarchy}

\end_inset

PTLsim Machine/Core/Thread Class Hierarchy
\end_layout

\begin_layout Standard
PTLsim easily supports user defined plug-in machine models.
 Two of these models, the out of order core (
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
ooo
\family default
\size default

\begin_inset Quotes erd
\end_inset

) and the sequential in-order core (
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
seq
\family default
\size default

\begin_inset Quotes erd
\end_inset

) ship with PTLsim; others can be easily added by users.
 PTLsim implements several C++ classes used to build simulation models by
 dividing a virtual machine into CPU sockets, cores and threads.
\end_layout

\begin_layout Standard
The 
\family typewriter
\size footnotesize
PTLsimMachine
\family default
\size default
 class is at the root of the hierarchy.
 Every simulation model must subclass 
\family typewriter
\size footnotesize
PTLsimMachine
\family default
\size default
 and define its virtual methods.
 Adding a machine model to PTLsim is very simple: simply define one instance
 of your machine class in a source file included in the Makefile.
 For instance, assuming 
\family typewriter
\size footnotesize
XYZMachine
\family default
\size default
 subclasses 
\family typewriter
\size footnotesize
PTLsimMachine
\family default
\size default
 and will be called 
\begin_inset Quotes eld
\end_inset

xyz
\begin_inset Quotes erd
\end_inset

:
\end_layout

\begin_layout LyX-Code

\size footnotesize
XyzMachine xyzmodel(
\begin_inset Quotes eld
\end_inset

xyz
\begin_inset Quotes erd
\end_inset

);
\end_layout

\begin_layout Standard
The constructor for 
\family typewriter
\size footnotesize
XyzMachine
\family default
\size default
 will be called by PTLsim after all other subsystems are brought up.
 It should use the 
\family typewriter
\size footnotesize
addmachine(
\begin_inset Quotes eld
\end_inset


\emph on
name
\emph default

\begin_inset Quotes erd
\end_inset

)
\family default
\size default
 static method to register the core model's name with PTLsim, so it can
 be specified using the 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
-core 
\emph on
xyz
\family default
\size default
\emph default

\begin_inset Quotes erd
\end_inset

 option.
\end_layout

\begin_layout Standard
The machine models included with PTLsim (namely, 
\family typewriter
\size footnotesize
OutOfOrderMachine
\family default
\size default
 and 
\family typewriter
\size footnotesize
SequentialMachine
\family default
\size default
) have been placed in their own C++ namespace.
 When adding your own core, copy the example source file(s) to new names
 and adjust the namespace specifiers to a new name to avoid clashes.
 You should be able to link any number of machine models defined in this
 manner into PTLsim all at once.
\end_layout

\begin_layout Standard
The 
\family typewriter
\size footnotesize
PTLsimMachine::init()
\family default
\size default
 method is called to initialize each machine model the first time it is
 used.
 This function is responsible for dividing the 
\family typewriter
\size footnotesize
\emph on
contextcount
\family default
\size default
\emph default
 contexts up into sockets, cores and threads, depending entirely on the
 machine model's design and any configuration options specified by the 
\family typewriter
\size footnotesize
config
\family default
\size default
 parameter.
\end_layout

\begin_layout Standard

\family typewriter
\size footnotesize
PTLsimMachine::run()
\family default
\size default
 is called to actually run the simulation; more details will be given on
 this later.
\end_layout

\begin_layout Standard

\family typewriter
\size footnotesize
PTLsimMachine::update_stats()
\family default
\size default
 is described in Section 
\begin_inset LatexCommand \ref{sec:StatisticsInfrastructure}

\end_inset

.
\end_layout

\begin_layout Standard

\family typewriter
\size footnotesize
PTLsimMachine::dump_state()
\family default
\size default
 is called to aid debugging whenever an assertion fails, the simulator accesses
 a null pointer or invalid address, or from anywhere else it may be useful.
\end_layout

\begin_layout Chapter
Out Of Order Core Overview
\end_layout

\begin_layout Standard
The out of order core is spread across several source files:
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
ooocore.cpp
\family default
\size default
 contains control logic, the definition of the 
\family typewriter
\size footnotesize
OutOfOrderMachine
\family default
\size default
 class and its functions (see Section 
\begin_inset LatexCommand \ref{sec:MachineCoreClassHierarchy}

\end_inset

), the top-level pipeline control functions, all event printing logic (Section
 
\begin_inset LatexCommand \ref{sec:OutOfOrderCoreEventLogRingBuffer}

\end_inset

) and miscellaneous code.
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
ooopipe.cpp
\family default
\size default
 contains all pipeline stages, except for execution stages and functional
 units.
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
oooexec.cpp
\family default
\size default
 contains the functional units, load/store unit, issue queues, replay control
 and exception handling.
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
ooocore.h
\family default
\size default
 defines all structures and lists easy to configure parameters.
\end_layout

\begin_layout Standard
The 
\family typewriter
\size footnotesize
OutOfOrderMachine
\family default
\size default
 structure is divided into an array of one or more 
\family typewriter
\size footnotesize
OutOfOrderCore
\family default
\size default
 structures (by default, one per VCPU).
 The 
\family typewriter
\size footnotesize
OutOfOrderMachine::init()
\family default
\size default
 function creates 
\family typewriter
\size footnotesize
\emph on
contextcount
\family default
\size default
\emph default
 cores and binds one per-VCPU 
\family typewriter
\size footnotesize
Context
\family default
\size default
 structure to each core.
 The 
\family typewriter
\size footnotesize
init()
\family default
\size default
 function is declared in 
\family typewriter
\size footnotesize
ooocore.h
\family default
\size default
, since some user configurable state is set up at this point.
\end_layout

\begin_layout Standard
The 
\family typewriter
\size footnotesize
OutOfOrderMachine::run()
\family default
\size default
 function first flushes the pipeline in each core, using 
\family typewriter
\size footnotesize
core.flush_pipeline()
\family default
\size default
 to copy state from the corresponding 
\family typewriter
\size footnotesize
Context
\family default
\size default
 structure into the physical register file and other per-core structures
 (see Section 
\begin_inset LatexCommand \ref{sec:PipelineFlushesAndBarriers}

\end_inset

 for details).
\end_layout

\begin_layout Standard
The 
\family typewriter
\size footnotesize
run()
\family default
\size default
 function then enters a loop with one iteration per simulated cycle:
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
update_progress()
\family default
\size default
 prints the current performance information (cycles, committed instructions
 and simulated cycles/second) to the console and/or log file.
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
inject_events()
\family default
\size default
 injects any pending interrupts and outside events into the processor; these
 will be processed at the next x86 instruction boundary.
 This function only applies to full system PTLsim/X.
\end_layout

\begin_layout Itemize
The 
\family typewriter
\size footnotesize
OutOfOrderCore::runcycle()
\family default
\size default
 function is called for each core in sequence, to step its entire state
 machine forward by one cycle (see below for details).
 If a given core is blocked (i.e.
 paused while waiting for some outside event), its Context.running field
 is zero; in this case, the core's 
\family typewriter
\size footnotesize
handle_interrupt()
\family default
\size default
 method may be called to wake it up (see below).
\end_layout

\begin_layout Itemize
Any global structures (like memory controllers or interconnect networks)
 are clocked by one cycle using their respective 
\family typewriter
\size footnotesize
clock()
\family default
\size default
 methods.
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
check_for_async_sim_break()
\family default
\size default
 checks if the user has requested the simulation stop or switch back to
 native mode.
 This function only applies to full system PTLsim/X.
\end_layout

\begin_layout Itemize
The global cycle counter and other counters are incremented.
\end_layout

\begin_layout Standard
The 
\family typewriter
\size footnotesize
OutOfOrderCore::runcycle()
\family default
\size default
 function is where the majority of the work in PTLsim's out of order model
 occurs.
 This function, in ooocore.cpp, runs one cycle in the core by calling functions
 to implement each pipeline stage, the per-core data caches and other clockable
 structure.
 If the core's commit stage just encountered a special event (e.g.
 barrier, microcode assist request, exception, interrupt, etc.), the appropriate
 action is taken at the cycle boundary.
\end_layout

\begin_layout Standard
In the following chapters, we describe every pipeline stage and structure
 in detail.
\end_layout

\begin_layout Standard
Every structure in the out of order model can obtain a reference to its
 parent 
\family typewriter
\size footnotesize
OutOfOrderCore
\family default
\size default
 structure by calling its own 
\family typewriter
\size footnotesize
getcore() 
\family default
\size default
method.
 Similarly, 
\family typewriter
\size footnotesize
getcore().ctx
\family default
\size default
 returns a reference to the 
\family typewriter
\size footnotesize
Context 
\family default
\size default
structure for that core.
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:OutOfOrderCoreEventLogRingBuffer}

\end_inset

Event Log Ring Buffer
\end_layout

\begin_layout Standard
Section 
\begin_inset LatexCommand \ref{sec:EventLogRingBuffer}

\end_inset

 describes PTLsim's event log ring buffer system, in which the simulator
 can log all per-cycle events to a circular ring buffer when the 
\family typewriter
\size footnotesize
-ringbuf
\family default
\size default
 option is given.
 The ring buffer can help developers look backwards in time from when an
 undesirable event occurs (for instance, as specified by 
\family typewriter
\size footnotesize
-ringbuf-trigger-rip
\family default
\size default
), allowing much easier debugging and experimentation.
\end_layout

\begin_layout Standard
In the out of order core, the 
\family typewriter
\size footnotesize
EventLog
\family default
\size default
 structure provides this ring buffer.
 The buffer consists of an array of 
\family typewriter
\size footnotesize
OutOfOrderCoreEvent
\family default
\size default
 structures (in 
\family typewriter
\size footnotesize
ooocore.h
\family default
\size default
); each structure contains a fixed header with subject information common
 to all events (e.g.
 the cycle, uuid, RIP, uop, ROB slot, and so forth), plus a union with sub-struc
tures for each possible event type.
 The actual events are listed in an enum above this structure.
\end_layout

\begin_layout Standard
The 
\family typewriter
\size footnotesize
EventLog
\family default
\size default
 class has various functions for quickly adding certain types of events
 and filling in their special fields.
 Specifically, calling one of the 
\family typewriter
\size footnotesize
EventLog::add()
\family default
\size default
 functions allocates a new record in the ring buffer and returns a pointer
 to it, allowing additional event-specific fields to be filled in if needed.
 The usage of these functions is very straightforward and documented by
 example in the various out of order core source files.
\end_layout

\begin_layout Standard
In 
\family typewriter
\size footnotesize
ooocore.cpp
\family default
\size default
, the 
\family typewriter
\size footnotesize
OutOfOrderCoreEvent::print()
\family default
\size default
 method lists all event types and gives code to nicely format the recorded
 event data.
 The 
\family typewriter
\size footnotesize
eventlog.print()
\family default
\size default
 function prints every event in the ring buffer; this function can be called
 from anywhere an event backtrace is needed.
\end_layout

\begin_layout Chapter
Fetch Stage
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:FetchStage}

\end_inset

Instruction Fetching and the Basic Block Cache
\end_layout

\begin_layout Standard
As described in Section 
\begin_inset LatexCommand \ref{sec:UopIntro}

\end_inset

, x86 instructions are decoded into transops prior to actual execution by
 the out of order core.
 Some processors do this translation as x86 instructions are fetched from
 an L1 instruction cache, while others use a trace cache to store pre-decoded
 uops.
 PTLsim takes a middle ground to allow maximum simulation flexibility.
 Specifically, the Fetch stage accesses the L1 instruction cache and stalls
 on cache misses as if it were fetching several variable length x86 instructions
 per cycle.
 However, actually decoding x86 instructions into uops over and over again
 during simulation would be extraordinarily slow.
\end_layout

\begin_layout Standard
Therefore, for 
\emph on
simulation purposes only
\emph default
, the out of order model uses the PTLsim 
\emph on
basic block cache
\emph default
.
 The basic block cache, described in Chapter 
\begin_inset LatexCommand \ref{sec:BasicBlockCache}

\end_inset

, stores pre-decoded uops for each basic block, and is indexed using the
 
\family typewriter
\size footnotesize
RIPVirtPhys
\family default
\size default
 structure, consisting of the RIP virtual address, several context-dependent
 flags and the physical page(s) spanned by the basic block (in PTLsim/X
 only).
\end_layout

\begin_layout Standard
During the fetch process (implemented in the 
\family typewriter
\size footnotesize
OutOfOrderCore::fetch()
\family default
\size default
 function in 
\family typewriter
\size footnotesize
ooopipe.cpp
\family default
\size default
), PTLsim looks up the current RIP to fetch from (
\family typewriter
\size footnotesize
fetchrip
\family default
\size default
), uses the current context to construct a full 
\family typewriter
\size footnotesize
RIPVirtPhys
\family default
\size default
 key, then uses this key to query the basic block cache.
 If the basic block has never been decoded before, 
\family typewriter
\size footnotesize
bbcache.translate()
\family default
\size default
 is used to do this now.
 This is all done by the 
\family typewriter
\size footnotesize
fetch_or_translate_basic_block()
\family default
\size default
 function.
\end_layout

\begin_layout Standard
Technically speaking, the cached basic blocks contain 
\emph on
transops
\emph default
, rather than uops: as explained in Section 
\begin_inset LatexCommand \ref{sec:UopIntro}

\end_inset

, each transop gets transformed into a true uop after it is renamed in the
 rename stage.
 In the following discussion, the term uop is used interchangeably with
 transop.
\end_layout

\begin_layout Section
Fetch Queue
\end_layout

\begin_layout Standard
Each transop fetched into the pipeline is immediately assigned a monotonically
 increasing 
\emph on
uuid
\emph default
 (universally unique identifier) to uniquely track it for debugging and
 statistical purposes.
 The fetch unit attaches additional information to each transop (such as
 the uop's uuid and the 
\family typewriter
\size footnotesize
RIPVirtPhys
\family default
\size default
 of the corresponding x86 instruction) to form a 
\family typewriter
\size footnotesize
FetchBufferEntry
\family default
\size default
 structure.
 This fetch buffer is then placed into the fetch queue (
\family typewriter
\size footnotesize
fetchq
\family default
\size default
) assuming it isn't full (if it is, the fetch stage stalls).
 As the fetch unit encounters transops with their EOM (end of macro-op)
 bit set, the fetch RIP is advanced to the next x86 instruction according
 to the instruction length stored in the SOM transop.
\end_layout

\begin_layout Standard
Branch uops trigger the branch prediction mechanism (Section 
\begin_inset LatexCommand \ref{sec:BranchPrediction}

\end_inset

) used to select the next fetch RIP.
 Based on various information encoded in the branch transop and the next
 RIP 
\emph on
after
\emph default
 the x86 instruction containing the branch, the 
\family typewriter
\size footnotesize
branchpred.predict()
\family default
\size default
 function is used to redirect fetching.
 If the branch is predicted not taken, the sense of the branch's condition
 code is inverted and the transop's 
\family typewriter
\size footnotesize
riptaken
\family default
\size default
 and 
\family typewriter
\size footnotesize
ripseq
\family default
\size default
 fields are swapped; this ensures all branches are considered correct only
 if taken.
 Indirect branches (jumps) have their 
\family typewriter
\size footnotesize
riptaken
\family default
\size default
 field overwritten by the predicted target address.
\end_layout

\begin_layout Standard
PTLsim models the instruction cache by using the 
\family typewriter
\size footnotesize
caches.probe_icache()
\family default
\size default
 function to probe the cache with the physical address of the current 
\emph on
fetch window
\emph default
.
 Most modern x86 processors fetch aligned 16-byte or 32-byte blocks of bytes
 into the decoder and try to pick out 3 or 4 x86 instructions per cycle.
 Since PTLsim uses the basic block cache, it does not actually decode anything
 at this point, but it still attempts to pick out up to 4 uops (or whatever
 limit is specified in 
\family typewriter
\size footnotesize
ooocore.h
\family default
\size default
) within the current 16-byte window around the fetch RIP; switching to a
 new window must occur in the next cycle.
 The instruction cache is only probed when switching fetch windows.
\end_layout

\begin_layout Standard
If the instruction cache indicates a miss, or the ITLB misses, the 
\family typewriter
\size footnotesize
waiting_for_icache_fill
\family default
\size default
 variable is set, and the fetch unit remains stalled in subsequent cycles
 until the cache subsystem calls the 
\family typewriter
\size footnotesize
OutOfOrderCoreCacheCallbacks::icache_wakeup()
\family default
\size default
 callback registered by the core.
 The core's interactions with the cache subsystem will be described in great
 detail later on.
\end_layout

\begin_layout Chapter
Frontend and Key Structures
\end_layout

\begin_layout Section
Resource Allocation
\end_layout

\begin_layout Standard
During the Allocate stage, PTLsim dequeues uops from the fetch queue, ensures
 all resources needed by those uops are free, and assigns resources to each
 uop as needed.
 These resources include Reorder Buffer (ROB) slots, physical registers
 and load store queue (LSQ) entries.
 In the event that the fetch queue is empty or any of the ROB, physical
 register file, load queue or store queue is full, the allocation stage
 stalls until some resources become available.
\end_layout

\begin_layout Section
Reorder Buffer Entries
\end_layout

\begin_layout Standard
The Reorder Buffer (ROB) in the PTLsim out of order model works exactly
 like a traditional ROB: as a queue, entries are allocated from the tail
 and committed from the head.
 Each 
\family typewriter
\size small
ReorderBufferEntry
\family default
\size default
 structure is the central tracking structure for uops in the pipeline.
 This structure contains a variety of fields including:
\end_layout

\begin_layout Itemize
The decoded uop (
\family typewriter
\size small
uop
\family default
\size default
 field).
 This is the fully decoded 
\family typewriter
\size small
TransOp
\family default
\size default
 augmented with fetch-related information like the uop's UUID, RIP and branch
 predictor information as described in the Fetch stage (Section 
\begin_inset LatexCommand \ref{sec:FetchStage}

\end_inset

).
\end_layout

\begin_layout Itemize
Current state of the ROB entry and uop (
\family typewriter
\size small
current_state_list
\family default
\size default
; see below)
\end_layout

\begin_layout Itemize
Pointers to the physical register (
\family typewriter
\size small
physreg
\family default
\size default
), LSQ entry (
\family typewriter
\size small
lsq
\family default
\size default
) and other resources allocated to the uop
\end_layout

\begin_layout Itemize
Pointers to the three physical register operands to the uop, as well as
 a possible store dependency used in replay scheduling (described later)
\end_layout

\begin_layout Itemize
Various cycle counters and related fields for simulating progress through
 the pipeline
\end_layout

\begin_layout Subsection
ROB States
\end_layout

\begin_layout Standard
Each ROB entry and corresponding uop can be in one of a number of states
 describing its progress through the simulator state machine.
 ROBs are linked into linked lists according to their current state; these
 lists are named 
\family typewriter
\size footnotesize
rob_
\family default
\size default
\emph on
statename
\family typewriter
\size footnotesize
\emph default
_list
\family default
\size default
.
 The 
\family typewriter
\size footnotesize
current_state_list
\family default
\size default
 field specifies the list the ROB is currently on.
 ROBs can be moved between states using the 
\family typewriter
\size footnotesize
ROB::changestate(
\emph on
statelist
\emph default
)
\family default
\size default
 method.
 The specific states will be described below as they are encountered.
\end_layout

\begin_layout Standard

\series bold
\emph on
NOTE:
\series default
\emph default
 the terms 
\begin_inset Quotes eld
\end_inset

ROB entry
\begin_inset Quotes erd
\end_inset

 (singular) and 
\begin_inset Quotes eld
\end_inset

uop
\begin_inset Quotes erd
\end_inset

 are used interchangeably from now on unless otherwise stated, since there
 is a 1:1 mapping between the two.
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:PhysicalRegisters}

\end_inset

Physical Registers
\end_layout

\begin_layout Subsection
Physical Registers
\end_layout

\begin_layout Standard
Physical registers are represented in PTLsim by the 
\family typewriter
\size small
PhysicalRegister
\family default
\size default
 structure.
 Physical registers store several components:
\end_layout

\begin_layout Itemize
Index of the physical register (
\family typewriter
\size small
idx
\family default
\size default
) and the physical register file id (
\family typewriter
\size small
rfid
\family default
\size default
) to which it belongs
\end_layout

\begin_layout Itemize
The actual 64-bit register data
\end_layout

\begin_layout Itemize
x86 flags: Z, P, S, O, C.
 These are discussed below in Section 
\begin_inset LatexCommand \ref{sub:FlagsManagement}

\end_inset

.
\end_layout

\begin_layout Itemize
Waiting flag (
\family typewriter
\size small
FLAG_WAIT
\family default
\size default
) for results not yet ready
\end_layout

\begin_layout Itemize
Invalid flag (
\family typewriter
\size small
FLAG_INVAL
\family default
\size default
) for ready results which encountered an exception.
 The exception code is written to the data field in lieu of the real result
\end_layout

\begin_layout Itemize
Current state of the physical register (
\family typewriter
\size small
state
\family default
\size default
)
\end_layout

\begin_layout Itemize
ROB currently owning this physical register, or architectural register mapping
 this physical register
\end_layout

\begin_layout Itemize
Reference counter for the physical register.
 This is required for reasons described in Section 
\begin_inset LatexCommand \ref{sub:PhysicalRegisterRecyclingComplications}

\end_inset

.
\end_layout

\begin_layout Subsection
Physical Register File
\end_layout

\begin_layout Standard
PTLsim uses a flexible physical register file model in which multiple physical
 register files with different sizes and properties can optionally be defined.
 Each physical register file in the 
\family typewriter
\size small
OutOfOrderCore::physregfiles[]
\family default
\size default
 array can be made accessible from one or more clusters.
 For instance, uops which execute on floating point clusters can be forced
 to always allocate a register in the floating point register file, or each
 cluster can have a dedicated register file.
\end_layout

\begin_layout Standard
Various heuristics can also be used for selecting the register file into
 which a result is placed.
 The default heuristic simply finds the first acceptable physical register
 file with a free register.
 Acceptable physical register files are those register files in which the
 uop being allocated is allowed to write its result; this is configurable
 based on clustering as described below.
 Other allocation policies, such as alternation between available register
 files and dependency based register allocation, are all possible by modifying
 the 
\family typewriter
\size small
rename()
\family default
\size default
 function where physical registers are allocated..
\end_layout

\begin_layout Standard
In each physical register file, physical register number 0 is defined as
 the 
\emph on
null register:
\emph default
 it always contains the value zero and is used as an operand anywhere the
 zero value (or no value at all) is required.
\end_layout

\begin_layout Standard
Physical register files are configured in 
\family typewriter
\size small
ooohwdef.h
\family default
\size default
.
 The 
\family typewriter
\size small
PhysicalRegisterFile[]
\family default
\size default
 array is defined to declare each register file by name, register file ID
 (RFID, from 0 to the number of register files) and size.
 The 
\family typewriter
\size small
MAX_PHYS_REG_FILE_SIZE
\family default
\size default
 parameter must be greater than the largest physical register in the processor.
\end_layout

\begin_layout Subsection
Physical Register States
\end_layout

\begin_layout Standard
Each physical register can be in one of several states at any given time.
 For each physical register file, PTLsim maintains linked lists (the 
\family typewriter
\size small
PhysicalRegisterFile.states[
\family default
\size default
\emph on
statename
\family typewriter
\size small
\emph default
]
\family default
\size default
 lists) to track which registers are in each state.
 The 
\family typewriter
\size small
state
\family default
\size default
 field in each physical register specifies its state, and implies that the
 physical register is on the list 
\family typewriter
\size small
physregfiles[physreg.
\series bold
rfid
\series default
].states[physreg.
\series bold
state
\series default
]
\family default
\size default
.
 The valid states are:
\end_layout

\begin_layout Itemize

\series bold
\emph on
free:
\series default
\emph default
 the register is not allocated to any uop.
\end_layout

\begin_layout Itemize

\series bold
\emph on
waiting:
\series default
\emph default
 the register has been allocated to a uop but that uop is waiting to issue.
\end_layout

\begin_layout Itemize

\series bold
\emph on
bypass:
\series default
\emph default
 the uop associated with the register has issued and produced a value (or
 encountered an exception), but that value is only on the bypass network
 - it has not actually been written back yet.
 For simulation purposes only, uops immediately write their results into
 the physical register as soon as they issue, even though technically the
 result is still only on the bypass network.
 This helps simplify the simulator considerably without compromising accuracy.
\end_layout

\begin_layout Itemize

\series bold
\emph on
written:
\series default
\emph default
 the uop associated with the register has passed through the writeback stage
 and the value of the physical register is now up to date; all future consumers
 will read the uop's result from this physical register.
\end_layout

\begin_layout Itemize

\series bold
\emph on
arch:
\series default
\emph default
 the physical register is currently mapped to one of the architectural registers
; it has no associated uop currently in the pipeline
\end_layout

\begin_layout Itemize

\series bold
\emph on
pendingfree:
\series default
\emph default
 this is a special state described in Section 
\begin_inset LatexCommand \ref{sub:PhysicalRegisterRecyclingComplications}

\end_inset

.
\end_layout

\begin_layout Standard
One physical register is allocated to each uop and moved into the 
\emph on
waiting
\emph default
 state, regardless of which type of uop it is.
 For integer, floating point and load uops, the physical register holds
 the actual numerical value generated by the corresponding uop.
 Branch uops place the target RIP of the branch in a physical register.
 Store uops place the merged data to store in the register.
 Technically branches and stores do not need physical registers, but to
 keep the processor design simple, they are allocated registers anyway.
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:LoadStoreQueueEntry}

\end_inset

Load Store Queue Entries
\end_layout

\begin_layout Standard
Load Store Queue (LSQ) Entries (the 
\family typewriter
\size small
LoadStoreQueueEntry
\family default
\size default
 structure in PTLsim) are used to track additional information about loads
 and stores in the pipeline that cannot be represented by a physical register.
 Specifically, LSQ entries track:
\end_layout

\begin_layout Itemize

\series bold
Physical address
\series default
 of the corresponding load or store
\end_layout

\begin_layout Itemize

\series bold
Data
\series default
 field (64 bits) stores the loaded value (for loads) or the value to store
 (for stores)
\end_layout

\begin_layout Itemize

\series bold
Address valid 
\series default
bit flag indicates if the load or store knows its effective physical address
 yet.
 If set, the physical address field is valid.
\end_layout

\begin_layout Itemize

\series bold
Data valid 
\series default
bit flag indicates if the data field is valid.
 For loads, this is set when the data has arrived from the cache.
 For stores, this is set when the data to store becomes ready and is merged.
\end_layout

\begin_layout Itemize

\series bold
Invalid
\series default
 bit flag is set if an exception occurs in the corresponding load or store.
\end_layout

\begin_layout Standard
The 
\family typewriter
\size small
LoadStoreQueueEntry
\family default
\size default
 structure is technically a superset of a structure known as an 
\emph on
SFR
\emph default
 (Store Forwarding Register), which completely represents any load or store
 and can be passed between PTLsim subsystems easily.
 One LSQ entry is allocated to each load or store during the Allocate stage.
\end_layout

\begin_layout Standard
In real processors, the load queue (LDQ) and store queue (STQ) are physically
 separate for circuit complexity reasons.
 However, in PTLsim a unified LSQ is used to make searching operations easier.
 One additional bit flag (
\family typewriter
\size small
store
\family default
\size default
 bit) specifies whether an LSQ entry is a load or store.
\end_layout

\begin_layout Subsection
\begin_inset LatexCommand \label{sub:RegisterRenaming}

\end_inset

Register Renaming
\end_layout

\begin_layout Standard
The basic register renaming process in the PTLsim x86 model is very similar
 to classical register renaming, with the exception of the flags complications
 described in Section 
\begin_inset LatexCommand \ref{sub:FlagsManagement}

\end_inset

.
 Two versions of the register rename table (RRT) are maintained: a 
\emph on
speculative RRT
\emph default
 which is updated as uops are renamed, and a 
\emph on
commit RRT
\emph default
, which is only updated when uops successfully commit.
 Since the simulator implements a unified physical and architectural register
 file, the commit process does not actually involve any data movement between
 physical and architectural registers: only the commit RRT needs to be updated.
 The commit RRT is used only for exception and branch mispredict recovery,
 since it holds the last known good mapping of architectural to physical
 registers.
\end_layout

\begin_layout Standard
Each rename table contains 80 entries as shown in Table 
\begin_inset LatexCommand \ref{table:ArchitecturalRegisters}

\end_inset

.
 This table maps architectural registers and pseudo-registers to the most
 up to date physical registers for the following:
\end_layout

\begin_layout Itemize
16 x86-64 integer registers
\end_layout

\begin_layout Itemize
16 128-bit SSE registers (represented as separate 64-bit high and low halves)
\end_layout

\begin_layout Itemize
ZAPS, CF, OF flag sets described in Section 
\begin_inset LatexCommand \ref{sub:FlagsManagement}

\end_inset

.
 These rename table entries point to the physical register (with attached
 flags) of the most recent uop in program order to update any or all of
 the ZAPS, CF, OF flag sets, respectively.
\end_layout

\begin_layout Itemize
Various integer and x87 status registers
\end_layout

\begin_layout Itemize
Temporary pseudo-registers 
\family typewriter
\size small
temp0
\family default
\size default
-
\family typewriter
\size small
temp7
\family default
\size default
 not visible to x86 code but required to hold temporaries (e.g.
 generated addresses or value to swap in 
\family typewriter
\size small
xchg
\family default
\size default
 instructions).
\end_layout

\begin_layout Itemize
Special fixed values, e.g.
 
\family typewriter
\size small
zero
\family default
\size default
, 
\family typewriter
\size small
imm
\family default
\size default
 (value is in immediate field), 
\family typewriter
\size small
mem
\family default
\size default
 (destination of stores)
\end_layout

\begin_layout Standard
\begin_inset Float table
wide false
sideways false
status open

\begin_layout Caption
\begin_inset LatexCommand \label{table:ArchitecturalRegisters}

\end_inset

Architectural registers and pseudo-registers used for renaming.
\end_layout

\begin_layout Standard
\noindent
\align center
\begin_inset Tabular
<lyxtabular version="3" rows="11" columns="9">
<features>
<column alignment="left" valignment="top" leftline="true" width="0">
<column alignment="left" valignment="top" leftline="true" width="0">
<column alignment="left" valignment="top" leftline="true" width="0">
<column alignment="left" valignment="top" leftline="true" width="0">
<column alignment="left" valignment="top" leftline="true" width="0">
<column alignment="left" valignment="top" leftline="true" width="0">
<column alignment="left" valignment="top" leftline="true" width="0">
<column alignment="left" valignment="top" leftline="true" width="0">
<column alignment="left" valignment="top" leftline="true" rightline="true" width="0">
<row topline="true" bottomline="true">
<cell multicolumn="1" alignment="center" valignment="top" topline="true" bottomline="true" leftline="true" rightline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\size small
Architectural Registers and Pseudo-Registers
\end_layout

\end_inset
</cell>
<cell multicolumn="2" alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\end_layout

\end_inset
</cell>
<cell multicolumn="2" alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\end_layout

\end_inset
</cell>
<cell multicolumn="2" alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\end_layout

\end_inset
</cell>
<cell multicolumn="2" alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\end_layout

\end_inset
</cell>
<cell multicolumn="2" alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\end_layout

\end_inset
</cell>
<cell multicolumn="2" alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\end_layout

\end_inset
</cell>
<cell multicolumn="2" alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\end_layout

\end_inset
</cell>
<cell multicolumn="2" alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\end_layout

\end_inset
</cell>
</row>
<row topline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\size small
0
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
rax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
rcx
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
rdx
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
rbx
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
rsp
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
rbp
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
rsi
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
rdi
\end_layout

\end_inset
</cell>
</row>
<row topline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\size small
8
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
r8
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
r9
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
r10
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
r11
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
r12
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
r13
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
r14
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
r15
\end_layout

\end_inset
</cell>
</row>
<row topline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\size small
16
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
xmml0
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
xmmh0
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
xmml1
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
xmmh1
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
xmml2
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
xmmh2
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
xmml3
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
xmmh3
\end_layout

\end_inset
</cell>
</row>
<row topline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\size small
24
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
xmml4
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
xmmh4
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
xmml5
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
xmmh5
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
xmml6
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
xmmh6
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
xmml7
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
xmmh7
\end_layout

\end_inset
</cell>
</row>
<row topline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\size small
32
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
xmml8
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
xmmh8
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
xmml9
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
xmmh9
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
xmml10
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
xmmh10
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
xmml11
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
xmmh11
\end_layout

\end_inset
</cell>
</row>
<row topline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\size small
40
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
xmml12
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
xmmh12
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
xmml13
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
xmmh13
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
xmml14
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
xmmh14
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
xmml15
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
xmmh15
\end_layout

\end_inset
</cell>
</row>
<row topline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\size small
48
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
fptos
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
fpsw
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
fptags
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
fpstack
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
tr4
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
tr5
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
tr6
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
ctx
\end_layout

\end_inset
</cell>
</row>
<row topline="true" bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\size small
56
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
rip
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
flags
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
iflags
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
selfrip
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
nextrip
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
ar1
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
ar2
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
zero
\end_layout

\end_inset
</cell>
</row>
<row topline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\size small
64
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
temp0
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
temp1
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
temp2
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
temp3
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
temp4
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
temp5
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
temp6
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
temp7
\end_layout

\end_inset
</cell>
</row>
<row topline="true" bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\size small
72
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
zf
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
cf
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
of
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
imm
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
mem
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
temp8
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
temp9
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size footnotesize
temp10
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\end_inset


\end_layout

\begin_layout Standard
Once the uop's three architectural register sources are mapped to physical
 registers, these physical registers are placed in the 
\family typewriter
\size small
operands[
\family default
\size default
0,1,2
\family typewriter
\size small
]
\family default
\size default
 fields.
 The fourth operand field, 
\family typewriter
\size small
operands[
\family default
\size default
3
\family typewriter
\size small
]
\family default
\size default
, is used to hold a store buffer dependency for loads and stores; this will
 be discussed later.
 The speculative RRT entries for both the destination physical register
 and any modified flags are then overwritten.
 Finally, the ROB is moved into the 
\series bold
\emph on
frontend
\series default
\emph default
 state.
\end_layout

\begin_layout Subsection
External State
\end_layout

\begin_layout Standard
Since the rest of the simulator outside of the out of order core does not
 know about the RRTs and expects architectural registers to be in a standardized
 format, the per-core 
\family typewriter
\size footnotesize
Context
\family default
\size default
 structure is used to house the architectural register file.
 These architectural registers, including 
\family typewriter
\size footnotesize
REG_flags
\family default
\size default
 and 
\family typewriter
\size footnotesize
REG_rip
\family default
\size default
, are directly updated in program order by the out of order core as instructions
 commit.
\end_layout

\begin_layout Section
Frontend Stages
\end_layout

\begin_layout Standard
To simulate various processor frontend pipeline depths, ROBs are placed
 in the 
\emph on
frontend
\emph default
 state for a user-selectable number of cycles.
 In the 
\family typewriter
\size footnotesize
frontend()
\family default
\size default
 function, the 
\family typewriter
\size footnotesize
cycles_left
\family default
\size default
 field in each ROB is decremented until it becomes zero.
 At this point, the uop is moved to the 
\series bold
\emph on
ready_to_dispatch
\series default
\emph default
 state.
 This feature can be used to simulate various branch mispredict penalties
 by setting the 
\family typewriter
\size footnotesize
FRONTEND_STAGES
\family default
\size default
 constant.
\end_layout

\begin_layout Chapter
\begin_inset LatexCommand \label{sec:ClusterDispatchScheduleIssue}

\end_inset

Scheduling, Dispatch and Issue
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:Clustering}

\end_inset

Clustering and Issue Queue Configuration
\end_layout

\begin_layout Standard
The PTLsim out of order model can simulate an arbitrarily complex set of
 functional units grouped into 
\emph on
clusters
\emph default
.
 Clusters are specified by the 
\family typewriter
\size footnotesize
Cluster
\family default
\size default
 structure and are defined by the 
\family typewriter
\size footnotesize
clusters[]
\family default
\size default
 array in 
\family typewriter
\size footnotesize
ooocore.h
\family default
\size default
.
 Each 
\family typewriter
\size footnotesize
Cluster
\family default
\size default
 element defines the name of the cluster, which functional units belong
 to the cluster (
\family typewriter
\size footnotesize
fu_mask
\family default
\size default
 field) and the maximum number of uops that can be issued in that cluster
 each cycle (
\family typewriter
\size footnotesize
issue_width
\family default
\size default
 field)
\end_layout

\begin_layout Standard
The 
\family typewriter
\size footnotesize
intercluster_latency_map
\family default
\size default
 matrix defines the forwarding latency, in cycles, between a given cluster
 and every other cluster.
 If 
\family typewriter
\size footnotesize
intercluster_latency_map[
\family default
\size default
\emph on
A
\family typewriter
\size footnotesize
\emph default
][
\family default
\size default
\emph on
B
\family typewriter
\size footnotesize
\emph default
]
\family default
\size default
 is 
\emph on
L
\emph default
 cycles, this means that functional units in cluster 
\emph on
B
\emph default
 must wait 
\emph on
L
\emph default
 cycles after a uop 
\emph on
U
\emph default
 in cluster A completes before cluster B's functional units can issue a
 uop dependent on 
\emph on
U
\emph default
's result.
 If the latency is zero between clusters 
\emph on
A
\emph default
 and 
\emph on
B
\emph default
, producer and consumer uops in 
\emph on
A
\emph default
 and 
\emph on
B
\emph default
 can always be issued back to back in subsequent cycles.
 Hence, the diagonal of the forwarding latency matrix is always all zeros.
\end_layout

\begin_layout Standard
This clustering mechanism can be used to implement several features of modern
 microprocessors.
 First, traditional clustering is possible, in which it takes multiple additiona
l cycles to forward results between different clusters (for instance, one
 or more integer clusters and a floating point unit).
 Second, several issue queues and corresponding issue width limits can be
 defined within a given virtual cluster, for instance to sort loads, stores
 and ALU operations into separate issue queues with different policies.
 This is done by specifying an inter-cluster latency of zero cycles between
 the relevant pseudo-clusters with separate issue queues.
 Both of these uses are required to accurately model most modern processors.
\end_layout

\begin_layout Standard
There is also an equivalent 
\family typewriter
\size footnotesize
intercluster_bandwidth_map
\family default
\size default
 matrix to specify the maximum number of values that can be routed between
 any two clusters each cycle.
\end_layout

\begin_layout Standard
The 
\family typewriter
\size footnotesize
IssueQueue
\family default
\size default
 template class is used to declare issue queues; each cluster has its own
 issue queue.
 The syntax 
\family typewriter
\size footnotesize
IssueQueue<
\family default
\size default
\emph on
size
\family typewriter
\size footnotesize
\emph default
>
\family default
\size default
 
\family typewriter
\size footnotesize
issueq_
\family default
\size default
\emph on
name
\family typewriter
\size small
\emph default
;
\family default
\size default
 is used to declare an issue queue with a specific size.
 In the current implementation, the size can be from 1 to 64 slots.
 The macros 
\family typewriter
\size footnotesize
foreach_issueq()
\family default
\size default
, 
\family typewriter
\size footnotesize
sched_get_all_issueq_free_slots()
\family default
\size default
 and 
\family typewriter
\size footnotesize
issueq_operation_on_cluster_with_result()
\family default
\size default
 macros must be modified if the cluster and issue queue configuration is
 changed to reflect all available clusters; the modifications required should
 be obvious from the example code.
 These macros with switch statements are required instead of a simple array
 since the issue queues can be of different template types and sizes.
\end_layout

\begin_layout Section
Cluster Selection
\end_layout

\begin_layout Standard
The 
\family typewriter
\size footnotesize
ReorderBufferEntry::select_cluster()
\family default
\size default
 function is responsible for routing a given uop into a specific cluster
 at the time it is dispatched; uops do not switch between clusters after
 this.
\end_layout

\begin_layout Standard
Various heuristics are employed to select which cluster a given uop should
 be routed to.
 In the reference implementation provided in 
\family typewriter
\size footnotesize
ooopipe.cpp
\family default
\size default
, a weighted score is generated for each possible cluster by scanning through
 the uop's operands to determine which cluster they will be forwarded from.
 If a given operand's corresponding producer uop 
\emph on
S
\emph default
 is currently either dispatched to cluster 
\emph on
C
\emph default
 but waiting to execute or is still on the bypass network of cluster 
\emph on
C
\emph default
, then cluster 
\emph on
C
\emph default
's score is incremented.
 
\end_layout

\begin_layout Standard
The final cluster is selected as the cluster with the highest score out
 of the set of clusters which the uop can actually issue on (e.g.
 a floating point uop cannot issue on a cluster with only integer units).
 The 
\family typewriter
\size footnotesize
ReorderBufferEntry::executable_on_cluster_mask
\family default
\size default
 bitmap can be used to further restrict which clusters a uop can be dispatched
 to, for instance because certain clusters can only write to certain physical
 register files.
 This mechanism is designed to route each uop to the cluster in which the
 majority of its operands will become available at the earliest time; in
 practice it works quite well and variants of this technique are often used
 in real processors.
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:Scheduling}

\end_inset

Issue Queue Structure and Operation
\end_layout

\begin_layout Standard
PTLsim implements issue queues in the 
\family typewriter
\size footnotesize
IssueQueue
\family default
\size default
 template class using the collapsing priority queue design used in most
 modern processors.
 
\end_layout

\begin_layout Standard
As each uop is dispatched, it is placed at the end of the issue queue for
 its cluster and several associative arrays are updated to reflect which
 operands the uop is still waiting for.
 In the IssueQueue class, the 
\family typewriter
\size small
insert()
\family default
\size default
 method takes the ROB index of the uop (its 
\emph on
tag
\emph default
 in issue queue terminology), the tags (ROB indices) of its operands, and
 a map of which of the operands are ready versus waiting.
 The ROB index is inserted into an associative array, and the ROB index
 tags of any waiting operands are inserted into corresponding slots in parallel
 arrays, one array per operand (in the current implementation, up to 4 operands
 are tracked).
 If an operand was ready at dispatch time, the slot for that operand in
 the corresponding array is marked as invalid since there is no need to
 wake it up later.
 Notice that the new slot is always at the end of the issue queue array;
 this is made possible by the collapsing mechanism described below.
\end_layout

\begin_layout Standard
The issue queue maintains two bitmaps to track the state of each slot in
 the queue.
 The 
\family typewriter
\size small
valid
\family default
\size default
 bitmap indicates which slots are occupied by uops, while the 
\family typewriter
\size small
issued
\family default
\size default
 bitmap indicates which of those uops have been issued.
 Together, these two bitmaps form the state machine described in Table 
\begin_inset LatexCommand \ref{table:IssueQueueStateMachine}

\end_inset

.
\end_layout

\begin_layout Standard
\begin_inset Float table
wide false
sideways false
status open

\begin_layout Caption
\begin_inset LatexCommand \label{table:IssueQueueStateMachine}

\end_inset

Issue Queue State Machine
\end_layout

\begin_layout Standard
\noindent
\align center
\begin_inset Tabular
<lyxtabular version="3" rows="5" columns="3">
<features>
<column alignment="center" valignment="top" leftline="true" width="0">
<column alignment="center" valignment="top" leftline="true" width="0">
<column alignment="left" valignment="top" leftline="true" rightline="true" width="0">
<row topline="true" bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
Valid
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
Issued
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
Meaning
\end_layout

\end_inset
</cell>
</row>
<row topline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
0
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
0
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
Unused slot
\end_layout

\end_inset
</cell>
</row>
<row topline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
0
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
1
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
(invalid)
\end_layout

\end_inset
</cell>
</row>
<row topline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
1
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
0
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
Dispatched but waiting for operands
\end_layout

\end_inset
</cell>
</row>
<row topline="true" bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
1
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
1
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard
Issued to a functional unit but not yet completed
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\end_inset


\end_layout

\begin_layout Standard
After 
\family typewriter
\size footnotesize
insert()
\family default
\size default
 is called, the slot is placed in the dispatched state.
 As each uop completes, its tag (ROB index) is broadcast using the 
\family typewriter
\size footnotesize
broadcast()
\family default
\size default
 method to one or more issue queues accessible in that cycle.
 Because of clustering, some issue queues will receive the broadcast later
 than others; this is discussed below.
 Each slot in each of the four operand arrays is compared against the broadcast
 value.
 If the operand tag in that slot is valid and matches the broadcast tag,
 the slot (in one of the operand arrays only, not the entire issue queue)
 is invalidated to indicate it is ready and no longer waiting for further
 broadcasts.
\end_layout

\begin_layout Standard
Every cycle, the 
\family typewriter
\size footnotesize
clock()
\family default
\size default
 method uses the 
\family typewriter
\size small
valid
\family default
\size default
 and 
\family typewriter
\size small
issued
\family default
\size default
 bitmaps together with the valid bitmaps of each of the operand arrays to
 compute which issue queue slots in the dispatched state are no longer waiting
 on any of their operands.
 This bitmap of ready slots is then latched into the 
\family typewriter
\size small
allready
\family default
\size default
 bitmap.
\end_layout

\begin_layout Standard
The 
\family typewriter
\size footnotesize
issue()
\family default
\size default
 method simply finds the index of the first set bit in the 
\family typewriter
\size small
allready
\family default
\size default
 bitmap (this is the slot of the oldest ready uop in program order), marks
 the corresponding slot as issued, and returns the slot.
 The processor then selects a functional unit for the uop in that slot and
 executes it via the 
\family typewriter
\size footnotesize
ReorderBufferEntry::issue()
\family default
\size default
 method.
 After the uop has completed execution (i.e.
 it cannot possibly be replayed), the 
\family typewriter
\size footnotesize
release()
\family default
\size default
 method is called to remove the slot from the issue queue, freeing it up
 for incoming uops in the dispatch stage.
 The collapsing design of the issue queue means that the slot is not simply
 marked as invalid - all slots after it are physically shifted left by one,
 leaving a free slot at the end of the array.
 This design is relatively simple to implement in hardware and makes determining
 the oldest ready to issue uop very trivial.
\end_layout

\begin_layout Standard
Because of the collapsing mechanism, it is critical to note that the slot
 index returned by 
\family typewriter
\size footnotesize
issue()
\family default
\size default
 will become invalid after the next call to the 
\family typewriter
\size footnotesize
remove()
\family default
\size default
 method; hence, it should never be stored anywhere if a slot could be removed
 from the issue queue in the meantime.
\end_layout

\begin_layout Standard
If a uop issues but determines that it cannot actually complete at that
 time, it must be 
\emph on
replayed
\emph default
.
 The 
\family typewriter
\size footnotesize
replay()
\family default
\size default
 method clears the issued bit for the uop's issue queue slot, returning
 it to the dispatched state.
 The replay mechanism can optionally add additional dependencies such that
 the uop is only re-issued after those dependencies are resolved.
 This is important for loads and stores, which may need to add a dependency
 on a prior store queue entry after finding a matching address in the load
 or store queues.
 In rare cases, a replay may also be required when a uop is issued but no
 applicable functional units are left for it to execute on.
 The 
\family typewriter
\size footnotesize
ReorderBufferEntry::replay()
\family default
\size default
 method is a wrapper around 
\family typewriter
\size footnotesize
IssueQueue::replay()
\family default
\size default
 used to collect the operands the uop is still waiting for.
\end_layout

\begin_layout Subsection
Implementation
\end_layout

\begin_layout Standard
PTLsim uses a novel method of modeling the issue queue and other associative
 structures with small tags.
 Specifically, the 
\family typewriter
\size footnotesize
FullyAssociativeArrayTags8bit
\family default
\size default
 template class declared in 
\family typewriter
\size footnotesize
logic.h
\family default
\size default
 and used to build the issue queue makes use of the host processor's 128-bit
 vector (SSE) instructions to do massively parallel associative matching,
 masking and bit scanning on up to 16 tags every clock cycle.
 This makes it substantially faster than simulators using the naive approach
 of scanning the issue queue entries linearly.
 Similar classes in 
\family typewriter
\size small
logic.h
\family default
\size default
 support O(1) associative searches of both 8-bit and 16-bit tags; tags longer
 than this are generally more efficient if the generic 
\family typewriter
\size footnotesize
FullyAssociativeArrayTags
\family default
\size default
 using standard integer comparisons is used instead.
\end_layout

\begin_layout Standard
As a result of this high performance design, each issue queue is limited
 to 64 entries and the tags to be matched must be between 0 and 255 to fit
 in 8 bits.
 The 
\family typewriter
\size footnotesize
FullyAssociativeArrayTags16bit
\family default
\size default
 class can be used instead if longer tags are required, at the cost of reduced
 simulation performance.
 To enable this, 
\family typewriter
\size small
BIG_ROB
\family default
\size default
 must be defined in 
\family typewriter
\size small
ooohwdef.h
\family default
\size default
.
\end_layout

\begin_layout Subsection
Other Designs
\end_layout

\begin_layout Standard
It's important to remember that the issue queue design described above is
 
\emph on
one
\emph default
 possible implemention out of the many designs currently used in industry
 and research processors.
 For instance, in lieu of the collapsing design (used by the Pentium 4 and
 Power4/5/970), the AMD K8 uses a sequence number tag of the ROB and comparator
 logic to select the earliest ready instruction.
 Similarly, the Pentium 4 uses a set of bit vectors (a 
\emph on
dependency matrix
\emph default
) instead of tag broadcasts to wake up instructions.
 These other approaches may be implemented by modifying the 
\family typewriter
\size footnotesize
IssueQueue
\family default
\size default
 class as appropriate.
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:Issue}

\end_inset

Issue
\end_layout

\begin_layout Standard
The 
\family typewriter
\size footnotesize
issue()
\family default
\size default
 top-level function issues one or more instructions in each cluster from
 each issue queue every cycle.
 This function consults the 
\family typewriter
\size footnotesize
clusters[
\family default
\size default
\emph on
clusterid
\family typewriter
\size footnotesize
\emph default
].issue_width
\family default
\size default
 field defined in 
\family typewriter
\size footnotesize
ooocore.h
\family default
\size default
 to determine the maximum number of uops to issue from each cluster.
 The 
\family typewriter
\size footnotesize
issueq_operation_on_cluster_with_result(cluster, iqslot, issue())
\family default
\size default
 macro (Section 
\begin_inset LatexCommand \ref{sec:Clustering}

\end_inset

) is used to invoke the 
\family typewriter
\size small
issue()
\family default
\size default
 method of the appropriate cluster to select the earliest ready issue queue
 slot, as described in Section 
\begin_inset LatexCommand \ref{sec:Scheduling}

\end_inset

.
 
\end_layout

\begin_layout Standard
The 
\family typewriter
\size footnotesize
ReorderBufferEntry::issue()
\family default
\size default
 method of the corresponding ROB entry is then called to actually execute
 the uop.
 This method first makes sure a functional unit is available within the
 cluster that's capable of executing the uop; if not, the uop is replayed
 and re-issued again on the next cycle.
 At this point, the uop's three operands (
\family typewriter
\size footnotesize
ra
\family default
\size default
, 
\family typewriter
\size footnotesize
rb
\family default
\size default
, 
\family typewriter
\size footnotesize
rc
\family default
\size default
) are read from the physical register file.
 If any of the operands are invalid, the entire uop is marked as invalid
 with an 
\family typewriter
\size small
EXCEPTION_Propagate
\family default
\size default
 result and is not further executed.
 Otherwise, the uop is executed by calling the synthesized execute function
 for the uop (see Section 
\begin_inset LatexCommand \ref{sec:FetchStage}

\end_inset

).
\end_layout

\begin_layout Standard
Loads and stores are handled specially by calling the 
\family typewriter
\size footnotesize
issueload()
\family default
\size default
 or 
\family typewriter
\size footnotesize
issuestore()
\family default
\size default
 method.
 Since loads and stores can encounter an mis-speculation (e.g.
 when a load is erroneously issued before an earlier store to the same addresses
), the 
\family typewriter
\size footnotesize
issueload()
\family default
\size default
 and 
\family typewriter
\size footnotesize
issuestore()
\family default
\size default
 functions can return 
\family typewriter
\size footnotesize
ISSUE_MISSPECULATED 
\family default
\size default
to force all uops in program order after the mis-speculated uop to be annulled
 and sent through the pipeline again.
 Similarly, if 
\family typewriter
\size footnotesize
issueload()
\family default
\size default
 or 
\family typewriter
\size footnotesize
issuestore()
\family default
\size default
 return 
\family typewriter
\size footnotesize
ISSUE_NEEDS_REPLAY
\family default
\size default
, issuing from that cluster is aborted since the uop has been replayed in
 accordance with Section 
\begin_inset LatexCommand \ref{sec:Scheduling}

\end_inset

.
 It is important to note that loads which miss the cache are considered
 to complete successfully and do 
\emph on
not
\emph default
 require a replay; their physical register is simply marked as waiting until
 the load arrives.
 In both the mis-speculation and replay cases, no further uops from the
 cluster's issue queue are dispatched until the next cycle.
\end_layout

\begin_layout Standard
Branches are handled similar to integer and floating point operations, except
 that they may cause a mis-speculation in the event of a branch misprediction;
 this is discussed below.
\end_layout

\begin_layout Standard
If the uop caused an exception, we force it directly to the commit stage
 and not through writeback; this keeps dependencies waiting until they can
 be properly annulled by the speculation recovery logic.
 The commit stage will detect the exception and take appropriate action.
 If the exceptional uop was speculatively executed beyond a branch, it will
 never reach commit anyway since the bogus branch would have to commit before
 the exception would even become visible.
\end_layout

\begin_layout Standard

\series bold
\emph on
NOTE:
\series default
\emph default
 In PTLsim, all issued uops put their result in the uop's assigned physical
 register at the time of issue, even though the data technically does not
 appear there until writeback (i.e.
 the physical register enters the 
\emph on
written
\emph default
 state).
 This is done to simplify the simulator implementation; it is assumed that
 any data 
\begin_inset Quotes eld
\end_inset

read
\begin_inset Quotes erd
\end_inset

 from physical registers before writeback is in fact being read from the
 bypass network instead.
\end_layout

\begin_layout Chapter
\begin_inset LatexCommand \label{sec:SpeculationAndRecovery}

\end_inset

Speculation and Recovery
\end_layout

\begin_layout Section
Misspeculation Cases
\end_layout

\begin_layout Standard
PTLsim supports three speculative execution recovery mechanisms to handle
 various types of speculation failures:
\end_layout

\begin_layout Itemize

\series bold
Replay
\series default
 is for scheduling and dependency mis-predictions only.
 Replayed uops remain in the issue queue so replay is very fast but limited
 in scope.
 Replay is described extensively in Section 
\begin_inset LatexCommand \ref{sec:ClusterDispatchScheduleIssue}

\end_inset

.
\end_layout

\begin_layout Itemize

\series bold
Redispatch
\series default
 finds the slice of uops in the ROB dependent on a mis-speculated uop and
 sends only those dependent uops back to the 
\emph on
ready-to-dispatch
\emph default
 state.
 It is used for load-store aliasing recovery, value mispredictions and other
 cases where the fetched uops themselves are still valid, but their outputs
 are invalid.
\end_layout

\begin_layout Itemize

\series bold
Annulment
\series default
 removes any uops in program order after (or optionally including) a given
 uop.
 It is used for branch mispredictions and misalignment recovery.
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:Redispatch}

\end_inset

Redispatch 
\end_layout

\begin_layout Subsection
Redispatch Process
\end_layout

\begin_layout Standard
Many types of mis-speculations do not require refetching a different set
 of uops; instead, any uops dependent on a mis-speculated uop can simply
 be recirculated through the pipeline so they can re-execute and produce
 correct values.
 This process is known as 
\emph on
redispatch
\emph default
; in the baseline out of order core, it is used to recover from load-store
 aliasing (Section 
\begin_inset LatexCommand \ref{sub:AliasCheck}

\end_inset

).
\end_layout

\begin_layout Standard
When a mis-speculated ROB is detected, 
\family typewriter
\size footnotesize
ROB.redispatch_dependents()
\family default
\size default
 is called.
 This function identifies the slice of uops that consumed values (directly
 or indirectly) from the mis-speculated uop, using dependency bitmaps similar
 to those used in real processors.
 
\family typewriter
\size footnotesize
ROB.redispatch_dependents(bool inclusive)
\family default
\size default
 has an 
\emph on
inclusive
\emph default
 parameter: if false, only the dependent uops are redispatched, not including
 the mis-speculated uop.
 This is most useful for value prediction, where the correct value can be
 directly reinjected into the mis-speculated uop's physical register without
 re-executing it.
\end_layout

\begin_layout Standard
In 
\family typewriter
\size footnotesize
ROB.redispatch()
\family default
\size default
, each affected uop is placed back into the 
\family typewriter
\size footnotesize
rob_ready_to_dispatch
\size small
 
\family default
\size default
state, lways in program order.
 This helps to avoid deadlocks, since the redispatched slice is given priority
 for insertion back into the issue queue.
 The resources associated with each uop (physical register, LDQ/STQ slot,
 IQ slot, etc.) are also restored to the state they were in immediately after
 renaming, so they can be properly recirculated through the pipeline as
 if the uop never issued.
 Various other issues must also be handled, such as making sure known store-to-l
oad aliasing constraints are preserved across the redispatch so as to avoid
 infinite replay loops, and branch directions must be corrected if a mispredict
 caused a fetch unit redirection but that mispredict was in fact based on
 mis-speculated data.
\end_layout

\begin_layout Subsection
Deadlock Recovery
\end_layout

\begin_layout Standard
Redispatch can create deadlocks in cases where other unrelated uops occupy
 all the issue queue slots needed by the redispatched uops to make forward
 progress, and there is a circular dependency loop (e.g.
 on loads and stores not known at the time of the redispatch) that creates
 a chicken-and-egg problem, thus blocking forward progress.
\end_layout

\begin_layout Standard
To recover from this situation, we detect the case where no uops have been
 dispatched for 64 cycles, yet the 
\family typewriter
\size footnotesize
ready_to_dispatch
\family default
\size default
 queue still has valid uops.
 This situation very rarely happens in practice unless there is a true deadlock.
 To break up the deadlock, ideally we should only need to redispatch all
 uops occupying issue queue slots or those already waiting for dispatch
 - all others have produced a result and cannot block the issue queues again.
 However, this does not always work in pathological cases, and can sometime
 lead to repeated deadlocks.
 Since deadlocks are very infrequent, they can be resolved by just flushing
 the entire pipeline.
 This has a negligible impact on performance.
\end_layout

\begin_layout Subsection
Statistical Counters
\end_layout

\begin_layout Standard
Several statistical counters are maintained in the PTLsim statistics tree
 to measure redispatch overhead, in the 
\family typewriter
\size footnotesize
ooocore.dispatch.redispatch
\family default
\size default
 node:
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
deadlock-flushes
\family default
\size default
 measures how many times the pipeline must be flushed to resolve a deadlock.
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
trigger-uops
\family default
\size default
 measures how many uops triggered redispatching because of a misspeculation.
 This number does not count towards the statistics below.
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
dependent-uops
\family default
\size default
 is a histogram of how many uops depended on each trigger uop, not including
 the trigger uop itself.
\end_layout

\begin_layout Section
Annulment
\end_layout

\begin_layout Subsection
Branch Mispredictions
\end_layout

\begin_layout Standard
Branch mispredictions form the bulk of all mis-speculated operations.
 Whenever the actual RIP returned by a branch uop differs from the 
\family typewriter
\size footnotesize
riptaken
\family default
\size default
 field of the uop, the branch has been mispredicted.
 This means all uops after (but 
\emph on
not
\emph default
 including) the branch must be annulled and removed from all processor structure
s.
 The fetch queue (Section 
\begin_inset LatexCommand \ref{sec:FetchStage}

\end_inset

) is then reset and fetching is redirected to the correct branch target.
 However, all uops in program order before the branch are still correct
 and may continue executing.
\end_layout

\begin_layout Standard
Note that we do 
\emph on
not
\emph default
 just reissue the branch: this would be pointless, as we already know the
 correct RIP since the branch uop itself has already executed once.
 Instead, we let it writeback and commit as if it were predicted correctly.
\end_layout

\begin_layout Subsection
\begin_inset LatexCommand \label{sec:SpeculationRecovery}

\end_inset

Annulment Process
\end_layout

\begin_layout Standard
In PTLsim, the 
\family typewriter
\size footnotesize
ReorderBufferEntry::annul()
\family default
\size default
 method removes any and all ROBs that entered the pipeline after and optionally
 including the misspeculated uop (depending on the 
\family typewriter
\size small
keep_misspec_uop
\family default
\size default
 argument).
 Because this method moves all affected ROBs to the free state, they are
 instantly taken out of consideration for future pipeline stages and will
 be dropped on the next cycle.
\end_layout

\begin_layout Standard
We must be extremely careful to annul all uops in an x86 macro-op; otherwise
 half the x86 instruction could be executed twice once refetched.
 Therefore, if the first uop to annul is not also the first uop in the x86
 macro-op, we may have to scan backwards in the ROB until we find the first
 uop of the macro-op.
 In this way, we ensure that we can annul the entire macro-op.
 All uops comprising the macro-op are guaranteed to still be in the ROB
 since none of the uops can commit until the entire macro-op can commit.
 Note that this does not apply if the final uop in the macro-op is a branch
 and that branch uop itself is being retained as occurs with mispredicted
 branches.
\end_layout

\begin_layout Standard
The first uop to annul is determined in the 
\family typewriter
\size footnotesize
annul()
\family default
\size default
 method by scanning backwards in time from the excepting uop until a uop
 with its SOM (start of macro-op) bit is set, as described in Section 
\begin_inset LatexCommand \ref{sec:UopIntro}

\end_inset

.
 This SOM uop represents the boundary between x86 instructions, and is where
 we start annulment.
 The end of the range of uops to annul is at the tail of the reorder buffer.
\end_layout

\begin_layout Standard
We have to reconstruct the speculative RRT as it existed just before the
 first uop to be annulled was renamed.
 This is done by calling the 
\family typewriter
\size footnotesize
pseudocommit()
\family default
\size default
 method of each annulled uop to implement the 
\begin_inset Quotes eld
\end_inset

fast flush with pseudo-commit
\begin_inset Quotes erd
\end_inset

 algorithm as follows.
 First, we overwrite the speculative RRT with the committed RRT.
 We then 
\emph on
simulate
\emph default
 the commitment of all non-speculative ROBs up to the first uop to be annulled
 by updating the speculative RRT as if it were the commit RRT.
 This brings the speculative RRT to the same state as if all in flight nonspecul
ative operations before the first uop to be annulled had actually committed.
 Fetching is then resumed at the correct RIP, where new uops are renamed
 using the recovered speculative RRT.
\end_layout

\begin_layout Standard
Other methods of RRT reconstruction (like backwards walk with saved checkpoint
 values) are difficult to impossible because of the requirement that flag
 rename tables be restored even if some of the required physical registers
 with attached flags have since been freed.
 Technically RRT checkpointing could be used but due to the load/store replay
 mechanism in use, this would require a checkpoint at every load and store
 as well as branches.
 Hence, the forward walk method seems to offer the best performance in practice
 and is quite simple.
 The Pentium 4 is believed to use a similar method of recovering from some
 types of mis-speculations.
\end_layout

\begin_layout Standard
After reconstructing the RRT, for each ROB to annul, we broadcast the ROB
 index to the appropriate cluster's issue queue, allowing the issue queue
 to purge the slot of the ROB being annulled.
 Finally, for each annulled uop, we free any resources allocated to it (i.e.,
 the ROB itself, the destination physical register, the load/store queue
 entry (if any) and so on.
 Any updates to the branch predictor and return address stack made during
 the speculative execution of branches are also rolled back.
\end_layout

\begin_layout Standard
Finally, the fetch unit is restarted at the correct RIP and uops enter the
 pipeline and are renamed according to the recovered rename tables and allocated
 resource maps.
\end_layout

\begin_layout Chapter
\begin_inset LatexCommand \label{sec:IssuingLoads}

\end_inset

Load Issue
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:AddressGeneration}

\end_inset

Address Generation
\end_layout

\begin_layout Standard
Loads and stores both have their physical addresses computed using the 
\family typewriter
\size footnotesize
ReorderBufferEntry::addrgen()
\family default
\size default
 method, by adding the 
\family typewriter
\size footnotesize
ra
\family default
\size default
 and 
\family typewriter
\size footnotesize
rb
\family default
\size default
 operands.
 If the load or store is one of the special unaligned fixup forms (
\family typewriter
\size footnotesize
ld.lo
\family default
\size default
, 
\family typewriter
\size footnotesize
ld.hi
\family default
\size default
, 
\family typewriter
\size footnotesize
st.lo
\family default
\size default
, 
\family typewriter
\size footnotesize
st.hi
\family default
\size default
) described in Section 
\begin_inset LatexCommand \ref{sub:UnalignedLoadsAndStores}

\end_inset

, the address is re-aligned according to the type of instruction.
\end_layout

\begin_layout Standard
At this point, the 
\family typewriter
\size footnotesize
check_and_translate()
\family default
\size default
 method is used to translate the virtual address into a mapped physical
 address using the page tables and TLB.
 The function of this method varies significantly between userspace-only
 PTLsim and full system PTLsim/X.
 In userspace-only PTLsim, the shadow page access tables (Section 
\begin_inset LatexCommand \ref{sec:AddressSpaceSimulation}

\end_inset

) are used to do access checks; the same virtual address is then returned
 to use as a physical address.
 In full system PTLsim/X, the real x86 page tables are used to produce the
 physical address, significantly more involved checks are done, and finally
 a pointer into PTLsim's mapping of all physical pages is returned (see
 Section 
\begin_inset LatexCommand \ref{sub:FullSystemPageTranslation}

\end_inset

).
\end_layout

\begin_layout Standard
If the virtual address is invalid or not present for the specified access
 type, 
\family typewriter
\size footnotesize
check_and_translate()
\family default
\size default
 will return a null pointer.
 At this point, 
\family typewriter
\size footnotesize
handle_common_load_store_exceptions()
\family default
\size default
 is called to take action as follows.
\end_layout

\begin_layout Standard
If a given load or store accesses an unaligned address but is not one of
 the special 
\family typewriter
\size footnotesize
ld.lo
\family default
\size default
/
\family typewriter
\size footnotesize
ld.hi
\family default
\size default
/
\family typewriter
\size footnotesize
st.lo
\family default
\size default
/
\family typewriter
\size footnotesize
st.hi
\family default
\size default
 uops described in Section 
\begin_inset LatexCommand \ref{sub:UnalignedLoadsAndStores}

\end_inset

, the processor responds by first setting the 
\begin_inset Quotes eld
\end_inset


\family typewriter
\size footnotesize
unaligned
\family default
\size default

\begin_inset Quotes erd
\end_inset

 bit in the original 
\family typewriter
\size footnotesize
TransOp
\family default
\size default
 in the basic block cache, then it annuls all uops after and including the
 problem load, and finally restarts the fetch unit at the RIP address of
 the load or store itself.
 When the load or store uop is refetched, it is transformed into a pair
 of 
\family typewriter
\size footnotesize
ld.lo
\family default
\size default
/
\family typewriter
\size footnotesize
ld.hi
\family default
\size default
 or 
\family typewriter
\size footnotesize
st.lo
\family default
\size default
/
\family typewriter
\size footnotesize
st.hi
\family default
\size default
 uops in accordance with Section 
\begin_inset LatexCommand \ref{sub:UnalignedLoadsAndStores}

\end_inset

.
 This refetch approach is required rather than a simple replay operation
 since a replay would require allocating two entries in the issue queue
 and potentially two ROBs, which is not possible with the PTLsim design
 once uops have been renamed.
\end_layout

\begin_layout Standard
If a load or store would cause a page fault for any reason, the 
\family typewriter
\size footnotesize
check_and_translate()
\family default
\size default
 function will fill in the 
\family typewriter
\size footnotesize
exception
\family default
\size default
 and 
\family typewriter
\size footnotesize
pfec
\family default
\size default
 (Page Fault Error Code) variables.
 These two variables are then placed into the low and high 32 bits, respectively
, of the 64-bit result in the destination physical register or store buffer,
 in place of the actual data.
 The load or store is then aborted and execution returns to the 
\family typewriter
\size footnotesize
ReorderBufferEntry::issue()
\family default
\size default
 method, causing the result to be marked with an exception (
\family typewriter
\size footnotesize
EXCEPTION_PageFaultOnRead
\family default
\size default
 or 
\family typewriter
\size footnotesize
EXCEPTION_PageFaultOnWrite
\family default
\size default
).
\end_layout

\begin_layout Standard
One x86-specific complication arises at this point.
 If a load (or store) uop is the high part (
\family typewriter
\size footnotesize
ld.hi
\family default
\size default
 or 
\family typewriter
\size footnotesize
st.hi
\family default
\size default
) of an unaligned load or store pair, but the actual user address did not
 overlap any of the high 64 bits accessed by the 
\family typewriter
\size footnotesize
ld.hi
\family default
\size default
 or 
\family typewriter
\size footnotesize
st.hi
\family default
\size default
 uop, the load or store should be completely ignored, even if the high part
 overlapped onto an invalid page.
 This is because it is perfectly legal to do an unaligned load or store
 at the very end of a page such that the next 64 bit chunk is not mapped
 to a valid page; the x86 architecture mandates that the load or store execute
 correctly as far as the user program is concerned.
\end_layout

\begin_layout Section
Store Queue Check and Store Dependencies
\end_layout

\begin_layout Standard
After doing these exception checks, the load/store queue (LSQ) is scanned
 backwards in time from the current load's entry to the LSQ's head.
 If a given LSQ entry corresponds to a store, the store's address has been
 resolved and the memory range needed by the load overlaps the memory range
 touched by the store, the load effectively has a dependency on the earlier
 store that must be resolved before the load can issue.
 The meaning of 
\begin_inset Quotes eld
\end_inset

overlapping memory range
\begin_inset Quotes erd
\end_inset

 is defined more specifically in Section 
\begin_inset LatexCommand \ref{sec:StoreMerging}

\end_inset

.
\end_layout

\begin_layout Standard
In some cases, the addresses of one or more prior stores that a load may
 depend on may not have been resolved by the time the load issues.
 Some processors will stall the load uop until 
\emph on
all
\emph default
 prior store addresses are known, but this can decrease performance by incorrect
ly preventing independent loads from starting as soon as their address is
 available.
 For this reason, the PTLsim processor model aggressively issues loads as
 soon as possible unless the load is predicted to frequently alias another
 store currently in the pipeline.
 This load/store aliasing prediction technique is described in Section 
\begin_inset LatexCommand \ref{sub:AliasCheck}

\end_inset

.
\end_layout

\begin_layout Standard
In either of the cases above, in which an overlapping store is identified
 by address but that store's data is not yet available for forwarding to
 the load, or where a prior store's address has not been resolved but is
 
\emph on
predicted
\emph default
 to overlap the load, the load effectively has a data flow dependency on
 the earlier store.
 This dependency is represented by setting the load's fourth 
\family typewriter
\size small
rs
\family default
\size default
 operand (
\family typewriter
\size small
operands[RS]
\family default
\size default
 in the 
\family typewriter
\size small
ReorderBufferEntry
\family default
\size default
) to the store the load is waiting on.
 After adding this dependency, the 
\family typewriter
\size small
replay()
\family default
\size default
 method is used to force the load back to the dispatched state, where it
 waits until the prior store is resolved.
 After the load is re-issued for a second time, the store queue is scanned
 again to make sure no intervening stores arrived in the meantime.
 If a different match is found this time, the load is replayed a third time.
 In practice, loads are rarely replayed more than once.
\end_layout

\begin_layout Section
Data Extraction
\end_layout

\begin_layout Standard
Once the prior store a load depends on (if any) is ready and all the exception
 checks above have passed, it is time to actually obtain the load's data.
 This process can be complicated since some bytes in the region accessed
 by the load could come from the data cache while other bytes may be forwarded
 from a prior store.
 If one or more bytes need to be obtained from the data cache, the L1 cache
 is probed (via the 
\family typewriter
\size footnotesize
caches.probe_cache_and_sfr()
\family default
\size default
 function) to see if the required line is present.
 If so, and the combination of the forwarded store (if any) and the L1 line
 fills in all bytes required by the load, the final data can be extracted.
\end_layout

\begin_layout Standard
To extract the data, the load unit creates a 64-bit temporary buffer by
 overlaying the bytes touched by the prior store (if any) on top of the
 bytes obtained from the cache (i.e., the bytes at the mapped address returned
 by the 
\family typewriter
\size footnotesize
addrgen()
\family default
\size default
 function).
 The correct word is then extracted and sign extended (if required) from
 this buffer to form the result of the load.
 Unaligned loads (described in Section 
\begin_inset LatexCommand \ref{sub:UnalignedLoadsAndStores}

\end_inset

) are somewhat more complex in that both the low and high 64 bit chunks
 from the 
\family typewriter
\size footnotesize
ld.lo
\family default
\size default
 and 
\family typewriter
\size footnotesize
ld.hi
\family default
\size default
 uops, respectively, are placed into a 128-bit buffer from which the final
 result is extracted.
\end_layout

\begin_layout Standard
For simulation purposes only, the data to load is immediately accessed and
 recorded by 
\family typewriter
\size footnotesize
issueload()
\family default
\size default
 regardless of whether or not there is a cache miss.
 This makes the loaded data significantly easier to track.
 In a real processor, the data extraction process obviously only happens
 after the missing line actually arrives, however our implementation in
 no way affects performance.
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:CacheMissHandling}

\end_inset

Cache Miss Handling
\end_layout

\begin_layout Standard
If no combination of the prior store's forwarded bytes and data present
 in the L1 cache can fulfill a load, this is miss and lower cache levels
 must be accessed.
 This process is described in Sections 
\begin_inset LatexCommand \ref{sec:InitiatingCacheMiss}

\end_inset

 and 
\begin_inset LatexCommand \ref{sec:FillingCacheMiss}

\end_inset

.
 As far as the core is concerned, the load is completed at this point even
 if the data has not yet arrived.
 The issue queue entry for the load can be released since the load is now
 officially in progress and cannot be replayed.
 Once the loaded data has arrived, the cache subsystem calls the 
\family typewriter
\size footnotesize
OutOfOrderCoreCacheCallbacks::dcache_wakeup()
\family default
\size default
 function, which marks both the physical register and LSQ entry of the load
 as ready, and places the load's ROB into the 
\emph on
completed
\emph default
 state.
 This allows the processor to wake up dependents of the load on the next
 cycle.
\end_layout

\begin_layout Chapter
Stores
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:StoreMerging}

\end_inset

Store to Store Forwarding and Merging
\end_layout

\begin_layout Standard
In the PTLsim out of order model, a given store may merge its data with
 that of a previous store in program order.
 This ensures that loads which may need to forward data from a store always
 reference exactly one store queue entry, rather than having to merge data
 from multiple smaller prior stores to cover the entire byte range being
 loaded.
 In this model, physical memory is divided up into 8 byte (64 bit) chunks.
 As each store issues, it scans the store queue backwards in program order
 to find the most recent prior store to the same 8 byte aligned physical
 address.
 If there is a match, the current store depends on the matching prior store,
 and cannot complete and forward its data to other consuming loads and stores
 until the prior store in question also completes.
 This ensures that the current store's data can be composited on top of
 the older store's data to form a single up to date 8-byte chunk.
 As described in Section 
\begin_inset LatexCommand \ref{sec:LoadStoreQueueEntry}

\end_inset

, each store queue entry contains a byte mask to indicate which of the 8
 bytes in each chunk are currently modified by stores in flight versus those
 bytes which must come from the data cache.
\end_layout

\begin_layout Standard
Technically there are more efficient approaches, such as allowing stores
 to issue in any order so long as they do not overlap on the basis of individual
 bytes.
 However, no modern processor allows such arbitrary forwarding since the
 circuit complexity involved with scanning the store queue for partial address
 matches would be prohibitive and slow.
 Instead, most processors only support store to load forwarding when a single
 larger prior store covers the entire byte range accessed by a smaller or
 same sized load; all other combinations stall the load until the overlapping
 prior stores commit to the data cache.
 
\end_layout

\begin_layout Standard
The store inheritance scheme used by PTLsim (described first) is an improvement
 to the more common 
\begin_inset Quotes eld
\end_inset

stall on size mismatch
\begin_inset Quotes erd
\end_inset

 scheme above, but may incur more store dependency replays (since stores
 now depend on other stores when they target the same 8-byte chunk) compared
 to a stall on size mismatch scheme.
 As a case study, the Pentium 4 processor (Prescott core) implements a combinati
on of these approaches.
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:SplitPhaseStores}

\end_inset

Split Phase Stores
\end_layout

\begin_layout Standard
The 
\family typewriter
\size footnotesize
ReorderBufferEntry::issuestore()
\family default
\size default
 function is responsible for issuing all store uops.
 Stores are unusual in that they can issue even if their 
\family typewriter
\size footnotesize
rc
\family default
\size default
 operand (the value to store) is not ready at the same time as the 
\family typewriter
\size small
ra
\family default
\size default
 and 
\family typewriter
\size small
rb
\family default
\size default
 operands forming the effective address.
 This property is useful since it allows a store to establish an entry in
 the store queue as soon as the effective address can be generated, even
 if the data to store is not ready.
 By establishing addresses in the store queue as soon as possible, we can
 avoid performance losses associated with the unnecessary replay of loads
 that may depend on a store whose address is unavailable at the time the
 load issues.
 In effect, this means that each store uop may actually issue twice.
\end_layout

\begin_layout Standard
In the first phase issue, which occurs as soon as the 
\family typewriter
\size footnotesize
ra
\family default
\size default
 and 
\family typewriter
\size footnotesize
rb
\family default
\size default
 operands become ready, the store uop computes its effective physical address,
 checks that address for all exceptions (such as alignment problems and
 page faults) and writes the address into the corresponding 
\family typewriter
\size footnotesize
LoadStoreQueueEntry
\family default
\size default
 structure before setting its the 
\family typewriter
\size footnotesize
addrvalid
\family default
\size default
 bit as described in Section 
\begin_inset LatexCommand \ref{sec:LoadStoreQueueEntry}

\end_inset

.
 If an exception is detected at this point, the 
\family typewriter
\size footnotesize
invalid
\family default
\size default
 bit in the store queue entry is set and the destination physical register's
 
\family typewriter
\size footnotesize
FLAG_inv
\family default
\size default
 flag is set so any attempt to commit the store will fail.
\end_layout

\begin_layout Subsection
\begin_inset LatexCommand \label{sub:AliasCheck}

\end_inset

Load Queue Search (Alias Check)
\end_layout

\begin_layout Standard
The load queue is then searched to find any loads after the current store
 in program order which have already issued but have done so without forwarding
 data from the current store.
 These loads erroneously issued before the current store (now known to overlap
 the load's address) was able to forward the correct data to the offending
 load(s).
 This situation is known as 
\emph on
aliasing
\emph default
, and is effectively a mis-speculation requiring us to reissue any uops
 depending on the store.
 The redispatch method (Section 
\begin_inset LatexCommand \ref{sec:Redispatch}

\end_inset

) is used to re-execute only those uops dependent (either directly or indirectly
) on the store.
\end_layout

\begin_layout Standard
Since the redispatch process required to correct aliasing violations is
 expensive and may result in infinite loops, it is desirable to predict
 in advance which loads and stores are likely to alias each other such that
 loads predicted to alias are never issued when prior stores in the store
 queue still have unknown addresses.
 This works because in most out of order processors, statistically speaking,
 very few loads alias stores compared to normal loads from the cache.
 When an aliasing mis-speculation occurs, an entry is added to a small fully
 associative structure (typically 
\begin_inset Formula $\le16$
\end_inset

 entries) called the Load Store Alias Predictor (LSAP).
 This structure is indexed by a portion of the address of the load instruction
 that aliased.
 This allows the load unit to avoid issuing any load uop that matches any
 address in the LSAP if any prior store addresses are still unresolved;
 if this is the case, a dependency is created on the first unresolved store
 such that the load is replayed (and the load and store queues are again
 scanned) once that store resolves.
 Similar methods of aliasing prediction are used by the Pentium 4 (Prescott
 core only) and Alpha 21264.
\end_layout

\begin_layout Subsection
Store Queue Search (Merge Check)
\end_layout

\begin_layout Standard
At this point the store queue is searched for prior stores to the same 8-byte
 block as described above in Section 
\begin_inset LatexCommand \ref{sec:StoreMerging}

\end_inset

; if the store depends on a prior store, the scheduler structures are updated
 to add an additional dependency (in 
\family typewriter
\size small
operands[RS]
\family default
\size default
) on this prior store before the store is replayed in accordance with Section
 
\begin_inset LatexCommand \ref{sec:Scheduling}

\end_inset

 to wait for the prior store to complete.
 If no prior store is found, or the prior store is ready, the current store
 is marked as a second phase store by setting the 
\family typewriter
\size small
load_store_second_phase
\family default
\size default
 flag in its ROB entry.
 Finally, the store is replayed in accordance with Section 
\begin_inset LatexCommand \ref{sec:Scheduling}

\end_inset

.
\end_layout

\begin_layout Standard
In the second phase of store uop scheduling, the store uop is only re-issued
 when all four operands (
\family typewriter
\size small
ra
\family default
\size default
 + 
\family typewriter
\size small
rb
\family default
\size default
 address, 
\family typewriter
\size small
rc
\family default
\size default
 data and 
\family typewriter
\size small
rs
\family default
\size default
 source store queue entry) are valid.
 The second phase repeats the scan of the load and store queues described
 above to catch any loads and stores that may have issued between the first
 and second phase issues; the store is replayed a third time if necessary.
 Otherwise, the 
\family typewriter
\size small
rc
\family default
\size default
 operand data is merged with the data from the prior store (if any) store
 queue entry, and the combined data and bytemask is written into the current
 store's store queue entry.
 Finally, the entry's 
\family typewriter
\size small
dataready
\family default
\size default
 bit is set to make the entry available for forwarding to other waiting
 loads and stores.
\end_layout

\begin_layout Standard
The first and second phases may be combined into a single issue without
 replay if both the address and data operands of the store are all ready
 at the same time and the prior store (if any) the current store inherits
 from has already successfully issued.
\end_layout

\begin_layout Chapter
Forwarding, Wakeup and Writeback
\end_layout

\begin_layout Section
Forwarding and the Clustered Bypass Network
\end_layout

\begin_layout Standard
Immediately after each uop is issued and the 
\family typewriter
\size footnotesize
ReorderBufferEntry::issue()
\family default
\size default
 method actually generates its result, the 
\family typewriter
\size footnotesize
cycles_left
\family default
\size default
 field of the ROB is set to the expected latency of the uop (e.g.
 between 1 and 5 cycles).
 The uop is then moved to the 
\emph on
issued
\emph default
 state and placed on the 
\family typewriter
\size footnotesize
rob_issued_list
\family default
\size default
.
 Every cycle, the 
\family typewriter
\size footnotesize
complete()
\family default
\size default
 method iterates through each ROB in issued state and decrements its 
\family typewriter
\size footnotesize
cycles_left
\family default
\size default
 field.
 If 
\family typewriter
\size footnotesize
cycles_left
\family default
\size default
 becomes zero, the corresponding uop has completed execution.
 The ROB is moved to the 
\emph on
completed
\emph default
 state (on 
\family typewriter
\size footnotesize
rob_completed_list
\family default
\size default
) and its physical register or store queue entry is moved to the 
\family typewriter
\size small
bypass
\family default
\size default
 state so newly dispatched uops do not try to wait for it.
\end_layout

\begin_layout Standard
The 
\family typewriter
\size footnotesize
transfer()
\family default
\size default
 function is also called every cycle.
 This function examines the list of ROBs in the 
\emph on
completed
\emph default
 state and is responsible for broadcasting the completed ROB's tag (ROB
 index) to the issue queues.
 Because of clustering (Section 
\begin_inset LatexCommand \ref{sec:Clustering}

\end_inset

), some issue queues will receive the broadcast later than others.
 Specifically, the ROB's 
\family typewriter
\size footnotesize
forward_cycle
\family default
\size default
 field determines which issue queues and remote clusters are visible 
\family typewriter
\size footnotesize
forward_cycle
\family default
\size default
 cycles after the uop completed.
 The 
\family typewriter
\size footnotesize
forward()
\family default
\size default
 method, called by 
\family typewriter
\size footnotesize
transfer()
\family default
\size default
 for each uop in the 
\emph on
completed
\emph default
 state, indexes into a lookup table 
\family typewriter
\size footnotesize
forward_at_cycle_lut[
\family default
\size default
\emph on
cluster
\family typewriter
\size footnotesize
\emph default
][
\family default
\size default
\emph on
forward_cycle
\family typewriter
\size footnotesize
\emph default
]
\family default
\size default
 to get a bitmap of which remote clusters are accessible 
\family typewriter
\size footnotesize
forward_cycle
\family default
\size default
 cycles after he uop completed, relative to the original cluster.the uop
 issued in.
 The 
\family typewriter
\size small
IssueQueue::broadcast()
\family default
\size default
 method (Section 
\begin_inset LatexCommand \ref{sec:Scheduling}

\end_inset

) is then called for each applicable cluster to wake up any operands of
 uops in that cluster waiting on the newly completed uop.
\end_layout

\begin_layout Standard
The 
\family typewriter
\size footnotesize
MAX_FORWARDING_LATENCY
\family default
\size default
 constant (in 
\family typewriter
\size footnotesize
ooohwdef.h
\family default
\size default
) specifies the maximum number of cycles between any two clusters.
 After the ROB has progressed through 
\family typewriter
\size small
MAX_FORWARDING_LATENCY
\family default
\size default
 cycles in the 
\emph on
completed
\emph default
 state, it is moved to the 
\family typewriter
\size footnotesize
ready-to-writeback
\family default
\size default
 state, effectively meaning the result has arrived at the physical register
 file and is eligible for writeback in the next cycle.
\end_layout

\begin_layout Section
Writeback
\end_layout

\begin_layout Standard
Every cycle, the 
\family typewriter
\size footnotesize
writeback()
\family default
\size default
 function scans the list of ROBs in the 
\emph on
ready-to-writeback
\emph default
 state and selects at most 
\family typewriter
\size footnotesize
WRITEBACK_WIDTH
\family default
\size default
 results to write to the physical register file.
 The 
\family typewriter
\size footnotesize
forward()
\family default
\size default
 method is first called one final time to catch the corner case in which
 a dependent uop was dispatched while producer uop was waiting in the 
\emph on
ready-to-writeback
\emph default
 state.
\end_layout

\begin_layout Standard
As mentioned in Section 
\begin_inset LatexCommand \ref{sec:Issue}

\end_inset

, for simulation purposes only, each uop puts its result directly into its
 assigned physical register at the time of issue, even though the data technical
ly does not appear there until writeback.
 This is done to simplify the simulator implementation; it is assumed that
 any data 
\begin_inset Quotes eld
\end_inset

read
\begin_inset Quotes erd
\end_inset

 from physical registers before writeback is in fact being read from the
 bypass network instead.
 Therefore, no actual data movement occurs in the 
\family typewriter
\size footnotesize
writeback()
\family default
\size default
 function; its sole purpose is to place the uop's physical register into
 the written state (via the 
\family typewriter
\size footnotesize
PhysicalRegister::writeback()
\family default
\size default
 method) and to move the ROB into its terminal state, 
\emph on
ready-to-commit
\emph default
.
\end_layout

\begin_layout Chapter
\begin_inset LatexCommand \label{sec:CommitStage}

\end_inset

Commitment
\end_layout

\begin_layout Section
Introduction
\end_layout

\begin_layout Standard
The commit stage examines uops from the head of the ROB, blocks until all
 uops comprising a given x86 instruction are ready to commit, commits the
 results of those uops to the architectural state and finally frees the
 resources associated with each uop.
\end_layout

\begin_layout Section
Atomicity of x86 instructions
\end_layout

\begin_layout Standard
The x86 architecture specifies 
\emph on
atomic execution
\emph default
 for all distinct x86 instructions.
 This means that since each x86 instruction may be comprised of multiple
 uops; none of these uops may commit until 
\emph on
all
\emph default
 uops in the instruction are ready to commit.
 In PTLsim, this is accomplished by checking if the uop at the head of the
 ROB (next to commit) has its SOM (start of macro-op) bit set.
 If so, the ROB is scanned forwards from the SOM uop to the next uop in
 program order with its EOM (end of macro-op) bit set.
 If all uops in this range are ready to commit and exception-free, the SOM
 uop is allowed to commit, effectively unlocking the ROB head pointer until
 the next uop with a SOM bit set is encountered.
 However, any exception in any uop comprising the x86 instruction at the
 head of the ROB causes the pipeline to be flushed and an exception to be
 taken.
 Similarly, external interrupts are only acknowledged at the boundary between
 x86 instructions (i.e.
 after the EOM uop of each instruction).
\end_layout

\begin_layout Section
Commitment
\end_layout

\begin_layout Standard
As each uop commits, it may update several components of the architectural
 state.
 
\end_layout

\begin_layout Standard
Integer ALU and floating point uops obviously update their destination architect
ural register (
\emph on
rd
\emph default
).
 In PTLsim, this is done by simply updating the committed register rename
 table (
\family typewriter
\size footnotesize
commitrrt
\family default
\size default
) rather than actually copying register values.
 However, the old physical register mapped to architectural register 
\emph on
rd
\emph default
 will normally become inaccessible after the Commit RRT mapping for 
\emph on
rd
\emph default
 is overwritten with the committing uop's physical register index.
 The old physical register previously mapped to 
\emph on
rd
\emph default
 can then be freed.
 Technically physical registers allocated to intermediate uops (such as
 those used to hold temporary values) can be immediately freed without updating
 any Commit RRT entries, but for consistency we do not do this.
\end_layout

\begin_layout Standard
In PTLsim, a physical register is freed by moving it to the 
\family typewriter
\size footnotesize
PHYSREG_FREE
\family default
\size default
 state.
 Unfortunately for various reasons related to long pipelines and the renaming
 of x86 flags, register reclamation is not so simple, but this will be discussed
 below in Section 
\begin_inset LatexCommand \ref{sub:PhysicalRegisterRecyclingComplications}

\end_inset

.
\end_layout

\begin_layout Standard
Some uops may also commit to a subset of the x86 flags, as specified in
 the uop encoding.
 For these uops, in theory no rename tables need updating, since the flags
 can be directly masked into the 
\family typewriter
\size footnotesize
REG_flags
\family default
\size default
 architectural pseudo-register.
 Should the pipeline be flushed, the rename table entries for the ZAPS,
 CF, OF flag sets will all be reset to point to the 
\family typewriter
\size footnotesize
REG_flags
\family default
\size default
 pseudo-register anyway.
 However, for the speculation recovery scheme described in Section 
\begin_inset LatexCommand \ref{sec:SpeculationRecovery}

\end_inset

, the 
\family typewriter
\size footnotesize
REG_zf
\family default
\size default
, 
\family typewriter
\size footnotesize
REG_cf
\family default
\size default
, and 
\family typewriter
\size footnotesize
REG_of
\family default
\size default
 commit RRT entries are updated as well to match the updates done to the
 speculative RRT.
\end_layout

\begin_layout Standard
Branches and jumps update the 
\family typewriter
\size footnotesize
REG_rip
\family default
\size default
 pseudo architectural register, while all other uops simply increment 
\family typewriter
\size footnotesize
REG_rip
\family default
\size default
 by the number of bytes in the x86 instruction being committed.
 The number of bytes (1-15) is stored in a 4-bit 
\family typewriter
\size footnotesize
bytes
\family default
\size default
 field of each uop in each x86 instruction.
\end_layout

\begin_layout Standard
Stores commit to the architectural state by writing directly to the data
 cache, which in PTLsim is equivalent to writing into real physical memory.
 Remember that a series of stores into a given 64-bit chunk of memory are
 merged within the store queue to the store uop's corresponding STQ entry
 as the store uop issues, so the commit unit always writes 64 bits to the
 cache at a time.
 The byte mask associated with the STQ entry of the store uop is used to
 only update the modified bytes in each chunk of memory in program order.
\end_layout

\begin_layout Section
Additional Commit Actions for Full System Use
\end_layout

\begin_layout Standard
In full system PTLsim/X, several additional actions must be taken at commit
 time:
\end_layout

\begin_layout Itemize
Self modifying code checks must be done using 
\family typewriter
\size footnotesize
smc_isdirty(mfn)
\family default
\size default
, as described in Section 
\begin_inset LatexCommand \ref{sec:SelfModifyingCode}

\end_inset

.
\end_layout

\begin_layout Itemize
Stores must set the dirty bit on the target physical page, using the 
\family typewriter
\size footnotesize
smc_setdirty(mfn)
\family default
\size default
 function (so as to properly notify subsequent instructions of self modifying
 code).
\end_layout

\begin_layout Itemize
The x86 page table accessed and dirty bits must be updated whenever a load
 or store commits, using the 
\family typewriter
\size footnotesize
Context.update_pte_acc_dirty()
\family default
\size default
 function.
\end_layout

\begin_layout Itemize
If an interrupt is pending, and we have just committed the last uop in an
 atomic x86 instruction, we can now safely service it.
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sub:PhysicalRegisterRecyclingComplications}

\end_inset

Physical Register Recycling Complications
\end_layout

\begin_layout Subsection
Problem Scenarios
\end_layout

\begin_layout Standard
In some processor designs, it is not always possible to immediately free
 the physical register mapped to a given architectural register when that
 old architectural register mapping is overwritten during commit as described
 above.
 Out of order x86 processors must maintain three separate rename table entries
 for the ZAPS, CF, OF flags in addition to the register rename table entry,
 any or all of which may be updated when uops rename and retire, depending
 on the uop's flag renaming semantics (see Section 
\begin_inset LatexCommand \ref{sub:FlagsManagement}

\end_inset

), For this reason, even though a given physical register value may become
 inaccessible and hence dead at commit time, the flags associated with that
 physical register are frequently still referenced within the pipeline,
 so the physical register itself must remain allocated.
\end_layout

\begin_layout Standard
Consider the following specific example, with uops listed in program order:
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
sub rax = rax,rbx
\family default
\size default

\newline
Assign RRT[
\family typewriter
\size footnotesize
rax
\family default
\size default
] = phys reg r0
\newline
Assign RRT[
\family typewriter
\size footnotesize
flags
\family default
\size default
] = 
\emph on
r0
\emph default
 (since SUB all updates flags)
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
mov rax = rcx
\family default
\size default

\newline
Assign RRT[
\family typewriter
\size footnotesize
rax
\family default
\size default
] = phys reg r1
\newline

\emph on
No flags renamed:
\emph default
 MOV never updates flags, so RRT[
\family typewriter
\size small
flags
\family default
\size default
] is still 
\emph on
r0
\emph default
.
\end_layout

\begin_layout Itemize

\family typewriter
\size footnotesize
br.e target
\family default
\size default

\newline
Depends on flags attached to 
\emph on
r0
\emph default
, even though actual architectural register (
\family typewriter
\size footnotesize
rax
\family default
\size default
) for 
\emph on
r0
\emph default
 has already been overwritten in the commit RRT by the MOV's commit.
 We cannot free 
\emph on
r0
\emph default
 since the BR uop might not have issued yet.
\end_layout

\begin_layout Standard
This situation only happens with instruction sets like x86 (and SPARC or
 even PowerPC to some extent) which support writing flags (particularly
 multiple independent flags) and data in a single instruction.
\end_layout

\begin_layout Subsection
Reference Counting
\end_layout

\begin_layout Standard
For these reasons, we need to prevent U2's register from being freed if
 it is still referenced by anything still in the pipeline; the normal reorder
 buffer mechanism cannot always handle this situation in a very long pipeline.
\end_layout

\begin_layout Standard
One solution (the one used by PTLsim) is to give each physical register
 a reference counter.
 Physical registers can be referenced from three structures: as operands
 to ROBs, from the speculative RRT, and from the committed RRT.
 As each uop operand is renamed, the counter for the corresponding physical
 register is incremented by calling the 
\family typewriter
\size footnotesize
PhysicalRegister::addref()
\family default
\size default
 method.
 As each uop commits, the counter for each of its operands is decremented
 via the 
\family typewriter
\size footnotesize
PhysicalRegister::unref() 
\family default
\size default
method.
 Similarly, 
\family typewriter
\size footnotesize
unref() 
\family default
\size default
and 
\family typewriter
\size footnotesize
addref() 
\family default
\size default
are used whenever an entry in the speculative RRT or commit RRT is updated.
 During mis-speculation recovery (see Section 
\begin_inset LatexCommand \ref{sec:SpeculationRecovery}

\end_inset

), 
\family typewriter
\size footnotesize
unref() 
\family default
\size default
is also used to unlock the operands of uops slated for annulment.
 Finally, 
\family typewriter
\size footnotesize
unref() 
\family default
\size default
and 
\family typewriter
\size footnotesize
addref() 
\family default
\size default
are used when loads and stores need to add a new dependency on a waiting
 store queue entry (see Sections 
\begin_inset LatexCommand \ref{sec:IssuingLoads}

\end_inset

 and 
\begin_inset LatexCommand \ref{sec:SplitPhaseStores}

\end_inset

).
\end_layout

\begin_layout Standard
As we update the committed RRT during the commit stage, the old register
 R mapped to the destination architectural register A of the uop being committed
 is examined.
 The register R is only moved to the 
\emph on
free
\emph default
 state iff its reference counter is zero.
 Otherwise, it is moved to the 
\emph on
pendingfree
\emph default
 state.
 The hardware examines the counters of 
\emph on
pendingfree
\emph default
 physical registers every cycle and moves physical registers to the 
\emph on
free
\emph default
 state only when their counters become zero and they are in the 
\emph on
pendingfree
\emph default
 state.
\end_layout

\begin_layout Subsection
Hardware Implementation
\end_layout

\begin_layout Standard
The hardware implementation of this scheme is straightforward and low complexity.
 The counters can have a very small number of bits since it is very unlikely
 a given physical register would be referenced by all 100+ uops in the ROB;
 3 bits should be enough to handle the typical maximum of < 8 uops sharing
 a given operand.
 Counter overflows can simply stall renaming or flush the pipeline since
 they are so rare.
\end_layout

\begin_layout Standard
The counter table can be updated in bulk each cycle by adding/subtracting
 the appropriate sum or just adding zero if the corresponding register wasn't
 used.
 Since there are several stages between renaming and commit, the same counter
 is never both incremented and decremented in the same cycle, so race conditions
 are not an issue.
 
\end_layout

\begin_layout Standard
In real processors, the Pentium 4 uses a scheme similar to this one but
 uses bit vectors instead.
 For smaller physical register files, this may be a better solution.
 Each physical register has a bit vector with one bit per ROB entry.
 If a given physical register P is still used by ROB entry E in the pipeline,
 P's bit vector bit R is set.
 Register P cannot be freed until all bits in its vector are zero.
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:PipelineFlushesAndBarriers}

\end_inset

Pipeline Flushes and Barriers
\end_layout

\begin_layout Standard
In some cases, the entire pipeline must be empty after a given uop commits.
 For instance, a 
\emph on
barrier
\emph default
 uop, represented by any 
\family typewriter
\size footnotesize
br.p
\family default
\size default
 (branch private) uop, will stall the frontend when first renamed, and when
 committed (at which point it is the only uop in the pipeline), it will
 call 
\family typewriter
\size footnotesize
flush_pipeline() 
\family default
\size default
to restart fetching at the appropriate RIP.
 Exceptions have a similar effect when they reach the commit stage.
 After doing this, the current architectural registers must be copied into
 the externally visible 
\family typewriter
\size footnotesize
ctx.commitarf[]
\family default
\size default
 array, since normally the architectural registers are scattered throughout
 the physical register file.
 Fortunately, the commit stage also updates 
\family typewriter
\size footnotesize
ctx.commitarf[]
\family default
\size default
 in parallel with the commit RRT, even though the 
\family typewriter
\size small
commitarf
\family default
\size default
 array is never actually read by the out of order core.
 Interrupts are a special case of barriers, the difference being they can
 be serviced after 
\emph on
any
\emph default
 x86 instruction commits its last uop.
\end_layout

\begin_layout Standard
At this point, the 
\family typewriter
\size footnotesize
handle_barrier()
\family default
\size default
, 
\family typewriter
\size footnotesize
handle_exception()
\family default
\size default
 or 
\family typewriter
\size footnotesize
handle_interrupt()
\family default
\size default
 function is called to actually communicate with the world outside the out
 of order core.
 In the case of 
\family typewriter
\size footnotesize
handle_barrier()
\family default
\size default
, generally this involves executing native code inside PTLsim to redirect
 execution into or out of the kernel, or to service a very complex x86 instructi
on (e.g.
 
\family typewriter
\size footnotesize
cpuid
\family default
\size default
, floating point save or restore, etc).
 For 
\family typewriter
\size footnotesize
handle_exception()
\family default
\size default
, on userspace-only PTLsim, the simulation is stopped and the user is notified
 that a genuine user visible (non-speculative) exception reached the commit
 stage.
 In contrast, on full system PTLsim/X, exceptions are little more than jumps
 into kernel space; this is described in detail in Chapter 
\begin_inset LatexCommand \ref{sec:PTLsimXArchitectureDetails}

\end_inset

.
\end_layout

\begin_layout Standard
If execution can continue after handling the barrier or exception, the 
\family typewriter
\size footnotesize
external_to_core_state()
\family default
\size default
 function is called to completely reset the out of order core using the
 state stored in 
\family typewriter
\size footnotesize
ctx.commitarf[]
\family default
\size default
.
 This involves allocating a fixed physical register for each of the 64 architect
ural registers in 
\family typewriter
\size footnotesize
ctx.commitarf[]
\family default
\size default
, setting the speculative and committed rename tables to their proper cold
 start values, and resetting all reference counts on physical registers
 as appropriate.
 If the processor is configured with multiple physical register files (Section
 
\begin_inset LatexCommand \ref{sec:PhysicalRegisters}

\end_inset

), the initial physical register for each architectural register is allocated
 in the first physical register file only (this is configurable by modifying
 
\family typewriter
\size footnotesize
external_to_core_state()
\family default
\size default
).
 At this point, the main simulation loop can resume as if the processor
 had just restarted from scratch.
\end_layout

\begin_layout Chapter
\begin_inset LatexCommand \label{sec:CacheHierarchy}

\end_inset

Cache Hierarchy
\end_layout

\begin_layout Standard
The PTLsim cache hierarchy model is highly flexible and can be used to model
 a wide variety of contemporary cache structures.
 The cache subsystem (defined in 
\family typewriter
\size small
dcache.h
\family default
\size default
 and implemented by 
\family typewriter
\size small
dcache.cpp
\family default
\size default
) by default consists of four levels:
\end_layout

\begin_layout Itemize

\series bold
L1 data cache
\series default
 is directly probed by all loads and stores
\end_layout

\begin_layout Itemize

\series bold
L1 instruction cache
\series default
 services all instruction fetches
\end_layout

\begin_layout Itemize

\series bold
L2 cache
\series default
 is shared between data and instructions, with data paths to both L1 caches
\end_layout

\begin_layout Itemize

\series bold
L3 cache
\series default
 is also shared and is optionally present
\end_layout

\begin_layout Itemize

\series bold
Main memory
\series default
 is considered infinite in size but still has configurable characteristics
\end_layout

\begin_layout Standard
These cache levels are listed in order from highest level (closer to the
 core) to lowest level (far away).
 The cache hierarchy is assumed to be 
\emph on
inclusive
\emph default
, i.e.
 any data in higher levels is assumed to always be present in lower levels.
 Additionally, the cache levels are generally 
\emph on
write-through
\emph default
, meaning that every store updates all cache levels, rather than waiting
 for a dirty line to be evicted.
 PTLsim supports a 48-bit virtual address space and 40-bit physical addresses
 (full system PTLsim/X only) in accordance with the x86-64 standard.
\end_layout

\begin_layout Section
General Configurable Parameters
\end_layout

\begin_layout Standard
All caches support configuration of:
\end_layout

\begin_layout Itemize
Line size in bytes.
 Any power of two size is acceptable, however the line size of a lower cache
 level must be the same or larger than any line size of a higher level cache.
 For example, it is illegal to have 128 byte L1 lines with 64 byte L2 lines.
\end_layout

\begin_layout Itemize
Set count may be any power of two number.
 The total cache size in bytes is of course (line size) 
\begin_inset Formula $\times$
\end_inset

 (set count)
\begin_inset Formula $\times$
\end_inset

 (way count)
\end_layout

\begin_layout Itemize
Way count (associativity) may be any number from 1 (direct mapped) up to
 the set count (fully associative).
 Note that simulation performance (and clock speed in a real processor)
 will suffer if the associativity is too great, particularly for L1 caches.
\end_layout

\begin_layout Itemize
Latency in cycles from a load request to the arrival of the data.
\end_layout

\begin_layout Standard
In 
\family typewriter
\size footnotesize
dcache.h
\family default
\size default
, the two base classes 
\family typewriter
\size small
CacheLine
\family default
\size default
 and 
\family typewriter
\size small
CacheLineWithValidMask
\family default
\size default
 are interchangeable, depending on the model being used.
 The 
\family typewriter
\size small
CacheLine
\family default
\size default
 class is a standard cache line with no actual data (since the bytes in
 each line are simply held in memory for simulation purposes).
 
\end_layout

\begin_layout Standard
The 
\family typewriter
\size small
CacheLineWithValidMask
\family default
\size default
 class adds a bitmask specifying which bytes within the cache line contain
 valid data and which are unknown.
 This is useful for implementing 
\begin_inset Quotes eld
\end_inset

no stall on store
\begin_inset Quotes erd
\end_inset

 semantics, in which stores simply allocate a new way in the appropriate
 set but only set the valid bits for those bytes actually modified by the
 store.
 The rest of the cache line not touched by the store can be brought in later
 without stalling the processor (unless a load tries to access them); this
 is PTLsim's default model.
 Additionally, this technique may be used to implement sectored cache lines,
 in which the line fill bus is smaller than the cache line size.
 This means that groups of bytes within the line may be filled over subsequent
 cycles rather than all at once.
\end_layout

\begin_layout Standard
The 
\family typewriter
\size small
AssociativeArray
\family default
\size default
 template class in 
\family typewriter
\size small
logic.h
\family default
\size default
 forms the basis of all caches in PTLsim.
 To construct a cache in which specific lines can be locked into place,
 the 
\family typewriter
\size small
LockableAssociativeArray
\family default
\size default
 template class may be used instead.
 Finally, the 
\family typewriter
\size small
CommitRollbackCache
\family default
\size default
 template class is useful for creating versions of PTLsim with cache level
 commit/rollback support for out of order commit, fault recovery and advanced
 speculation techniques.
\end_layout

\begin_layout Standard
The various caches are defined in 
\family typewriter
\size small
dcache.h
\family default
\size default
 by specializations of these template classes.
 The classes are 
\family typewriter
\size small
L1Cache
\family default
\size default
, 
\family typewriter
\size small
L1ICache
\family default
\size default
, 
\family typewriter
\size small
L2Cache
\family default
\size default
 and 
\family typewriter
\size small
L3Cache
\family default
\size default
.
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:InitiatingCacheMiss}

\end_inset

Initiating a Cache Miss
\end_layout

\begin_layout Standard
As described in Section 
\begin_inset LatexCommand \ref{sec:IssuingLoads}

\end_inset

, in the out of order core model, the 
\family typewriter
\size small
issueload()
\family default
\size default
 function determines if some combination of a prior store's forwarded bytes
 (if any) and data present in the L1 cache can fulfill a load.
 If not, this is a miss and lower cache levels must be accessed.
 In this case, a 
\family typewriter
\size small
LoadStoreInfo
\family default
\size default
 structure (defined in 
\family typewriter
\size small
dcache.h
\family default
\size default
) is prepared with various metadata about the load, including which ROB
 entry and physical register to wake up when the load arrives, its size,
 alignment, sign extension properties, prefetch properties and so on.
 The 
\family typewriter
\size small
issueload_slowpath()
\family default
\size default
 function (defined in 
\family typewriter
\size small
dcache.cpp
\family default
\size default
) is then called with this information, the physical address to load and
 any data inherited from a prior store still in the pipeline.
 The 
\family typewriter
\size small
issueload_slowpath()
\family default
\size default
 function moves the load request out of the core pipeline and into the cache
 hierarchy.
 
\end_layout

\begin_layout Standard
The 
\emph on
Load Fill Request Queue
\emph default
 (LFRQ) is a structure used to hold information about any outstanding loads
 that have missed any cache level.
 The LFRQ allows a configurable number of loads to be outstanding at any
 time and provides a central control point between cache lines arriving
 from the L2 cache or lower levels and the movement of the requested load
 data into the processor core to dependent instructions.
 The 
\family typewriter
\size small
LoadFillReq
\family default
\size default
 structure, prepared by 
\family typewriter
\size small
issueload_slowpath()
\family default
\size default
, contains all the data needed to return a filled load to the core: the
 physical address of the load, the data and bytemask already known so far
 (e.g.
 forwarded from a prior store) and the 
\family typewriter
\size small
LoadStoreInfo
\family default
\size default
 metadata described above.
\end_layout

\begin_layout Standard
The 
\emph on
Miss Buffer
\emph default
 (MB) tracks all outstanding cache lines, rather than individual loads.
 Each MB slot uses a bitmap to track one or more LFRQ entries that need
 to be awakened when the missing cache line arrives.
 After adding the newly created 
\family typewriter
\size small
LoadFillReq
\family default
\size default
 entry to the LFRQ, the 
\family typewriter
\size small
MissBuffer::initiate_miss()
\family default
\size default
 method uses the missing line's physical address to allocate a new slot
 in the miss buffer array (or simply uses an existing slot if a miss was
 already in progress on a given line).
 In any case, the MB's wakeup bitmap is updated to reflect the new LFRQ
 entry referring to that line.
 Each MB entry contains a 
\family typewriter
\size small
cycles
\family default
\size default
 field, indicating the number of cycles remaining for that miss buffer before
 it can be moved up the cache hierarchy until it reaches the core.
 Each entry also contains two bits (
\family typewriter
\size small
icache
\family default
\size default
 and 
\family typewriter
\size small
dcache
\family default
\size default
) indicating which L1 caches to which the line should eventually be delivered;
 this is required because a single L2 line (and corresponding miss buffer)
 may be referenced by both the L1 data and instruction caches.
 
\end_layout

\begin_layout Standard
In 
\family typewriter
\size small
initiate_miss()
\family default
\size default
, the L2 and L3 caches are probed to see if they contain the required line.
 If the L2 has the line, the miss buffer is placed into the 
\family typewriter
\size small
STATE_DELIVER_TO_L1
\family default
\size default
 state, indicating that the line is now in progress to the L1 cache.
 Similarly, an L2 miss but L3 hit results in the 
\family typewriter
\size small
STATE_DELIVER_TO_L2
\family default
\size default
 state, and a miss all the way to main memory results in 
\family typewriter
\size small
STATE_DELIVER_TO_L3
\family default
\size default
.
\end_layout

\begin_layout Standard
In the very unlikely event that either the LFRQ slot or miss buffer are
 full, an exception is returned to out of order core, which typically replays
 the affected load until space in these structures becomes available.
 For prefetch requests, only a miss buffer is allocated; no LFRQ slot is
 needed.
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:FillingCacheMiss}

\end_inset

Filling a Cache Miss
\end_layout

\begin_layout Standard
The 
\family typewriter
\size small
MissBuffer::clock()
\family default
\size default
 method implements all synchronous state transitions.
 For each active miss buffer, the 
\family typewriter
\size small
cycles
\family default
\size default
 counter is decremented, and if it becomes zero, the MB's current state
 is examined.
 If a given miss buffer was in the 
\family typewriter
\size small
STATE_DELIVER_TO_L3
\family default
\size default
 state (i.e.
 in progress from main memory) and the cycle counter just became zero, a
 line in the L3 cache is validated with the incoming data (this may involve
 evicting another line in the same set to make room).
 The MB is then moved to the next state up the cache hierarchy (i.e.
 
\family typewriter
\size small
STATE_DELIVER_TO_L2
\family default
\size default
 in this example) and its cycles field is updated with the latency of the
 cache level it is now leaving (e.g.
 
\family typewriter
\size small
L3_LATENCY
\family default
\size default
 in this example).
 
\end_layout

\begin_layout Standard
This process continues with successive levels until the MB is in the 
\family typewriter
\size small
STATE_DELIVER_TO_L1
\family default
\size default
 state and its cycles field has been decremented to zero.
 If the MB's 
\family typewriter
\size small
dcache
\family default
\size default
 bit is set, the L1 corresponding line is validated and the 
\family typewriter
\size small
lfrq.wakeup()
\family default
\size default
 method is called to invoke a new state machine to wake up any loads waiting
 on the recently filled line (as known from the MB's 
\family typewriter
\size small
lfrqmap
\family default
\size default
 bitmap).
 If the MB's 
\family typewriter
\size small
icache
\family default
\size default
 bit was set, the line is validated in the L1 instruction cache, and the
 
\family typewriter
\size footnotesize
PerCoreCacheCallbacks::icache_wakeup()
\family default
\size default
 callback is used to notify the out of order core's fetch stage that it
 may probe the cache for the missing line again.
 In any case, the miss buffer is then returned to the unused state.
\end_layout

\begin_layout Standard
Each LFRQ slot can be in one of three states: 
\emph on
free
\emph default
, 
\emph on
waiting
\emph default
 and 
\emph on
ready
\emph default
.
 LFRQ slots remain in the 
\emph on
waiting
\emph default
 state as long as they are referenced by a miss buffer; once the 
\family typewriter
\size small
lfrq.wakeup()
\family default
\size default
 method is called, all slots affiliated with that miss buffer are moved
 to the 
\emph on
ready
\emph default
 state.
 The 
\family typewriter
\size small
LoadFillRequestQueue::clock()
\family default
\size default
 method finds up to 
\family typewriter
\size small
MAX_WAKEUPS_PER_CYCLE
\family default
\size default
 LFRQ slots in the 
\emph on
ready
\emph default
 state and wakes them up by calling the 
\family typewriter
\size footnotesize
PerCoreCacheCallbacks::dcache_wakeup()
\family default
\size default
 callback with the saved 
\family typewriter
\size small
LoadStoreInfo
\family default
\size default
 metadata.
 The out of order core handles this callback as described in Section 
\begin_inset LatexCommand \ref{sec:CacheMissHandling}

\end_inset

.
\end_layout

\begin_layout Standard
For simulation purposes only, the value to be loaded is immediately recorded
 as soon as the load issues, independent of the cache hit or miss status.
 In real hardware, the LFRQ entry data would be used to extract the correct
 bytes from the newly arrived line and perform sign extension and alignment.
 If the original load required bytes from a mixture of its source store
 buffer and the data cache, the SFR data and mask fields in the LFRQ entry
 would be used to perform this merging operation.
 The data would then be written into the physical register specified by
 the 
\family typewriter
\size small
LoadStoreInfo
\family default
\size default
 metadata and that register would be marked as ready before sending a signal
 to the issue queues to wake up dependent operations.
\end_layout

\begin_layout Standard
In some cases, the out of order core may need to annul speculatively executed
 loads.
 The cache subsystem is notified of this through the 
\family typewriter
\size small
annul_lfrq_slot()
\family default
\size default
 function called by the core.
 This function clears the specified LFRQ slot in each miss buffer's lfrqmap
 entry (since that slot should no longer be awakened now that it has been
 annulled), and frees the LFRQ entry itself.
\end_layout

\begin_layout Section
\begin_inset LatexCommand \label{sec:TranslationLookasideBuffers}

\end_inset

Translation Lookaside Buffers
\end_layout

\begin_layout Standard
The following section applies to full system PTLsim/X only.
 The userspace version of PTLsim does not model TLBs since doing so would
 be inaccurate: it is physically impossible to model TLB miss delays without
 actually walking real page tables and encountering the associated cache
 misses.
 For more information, please see Section 
\begin_inset LatexCommand \ref{sub:FullSystemPageTranslation}

\end_inset

 concerning page translation in PTLsim/X.
\end_layout

\begin_layout Chapter
\begin_inset LatexCommand \label{sec:BranchPrediction}

\end_inset

Branch Prediction
\end_layout

\begin_layout Section
Introduction
\end_layout

\begin_layout Standard
PTLsim provides a variety of branch predictors in 
\family typewriter
\size small
branchpred.cpp
\family default
\size default
.
 The branch prediction subsystem is relatively independent of the core simulator
 and can be treated as a black box, so long as it implements the interfaces
 in 
\family typewriter
\size small
branchpred.h
\family default
\size default
.
\end_layout

\begin_layout Standard
The branch prediction subsystem always contains at least three distinct
 predictors for the three main classes of branches:
\end_layout

\begin_layout Itemize

\emph on
Conditional Branch Predictor
\emph default
 returns a boolean (taken or not taken) for each conditional branch (
\family typewriter
\size small
br.cc
\family default
\size default
 uop)
\end_layout

\begin_layout Itemize

\emph on
Branch Target Buffer
\emph default
 (BTB) predicts indirect branch (
\family typewriter
\size small
jmp
\family default
\size default
 uop) targets
\end_layout

\begin_layout Itemize

\emph on
Return Address Stack
\emph default
 (RAS) predicts return instructions (i.e.
 specially marked indirect 
\family typewriter
\size small
jmp
\family default
\size default
 uops) based on prior calls
\end_layout

\begin_layout Itemize
Unconditional branches (
\family typewriter
\size small
bru
\family default
\size default
) are never predicted since their destination is explicitly encoded.
\end_layout

\begin_layout Standard
All these predictors are accessed by the core through the 
\family typewriter
\size small
BranchPredictorInterface
\family default
\size default
 object.
 Based on the opcode and other uop information, the core determines the
 type flags of each branch uop:
\end_layout

\begin_layout Itemize

\family typewriter
\size small
BRANCH_HINT_UNCOND
\family default
\size default
 for unconditional branches.
 These are never predicted since the destination is implied.
\end_layout

\begin_layout Itemize

\family typewriter
\size small
BRANCH_HINT_COND
\family default
\size default
 for conditional branches.
\end_layout

\begin_layout Itemize

\family typewriter
\size small
BRANCH_HINT_INDIRECT
\family default
\size default
 for indirect branches, including returns.
\end_layout

\begin_layout Itemize

\family typewriter
\size small
BRANCH_HINT_CALL
\family default
\size default
 for calls (both direct and indirect).
 This implies that the return address of the call should be a should be
 pushed on the RAS.
\end_layout

\begin_layout Itemize

\family typewriter
\size small
BRANCH_HINT_RET
\family default
\size default
 for returns (indirect branches).
 This implies that the return address should be taken from the top RAS stack
 entry, not the BTB.
\end_layout

\begin_layout Standard
Multiple flags may be present for each uop (for instance, 
\family typewriter
\size small
BRANCH_HINT_RET
\family default
\size default
 and 
\family typewriter
\size small
BRANCH_HINT_INDIRECT
\family default
\size default
 are both used for the 
\family typewriter
\size small
jmp
\family default
\size default
 uop terminating an x86 
\family typewriter
\size small
ret
\family default
\size default
 instruction).
\end_layout

\begin_layout Standard
To make a prediction at fetch time, the core calls the 
\family typewriter
\size small
BranchPredictorInterface::predict()
\family default
\size default
 method, passing it a 
\family typewriter
\size small
PredictorUpdate
\family default
\size default
 structure.
 This structure is carried along with each uop until it retires, and contains
 all the information needed to eventually update the branch predictor at
 the end of the pipeline.
 The contents will vary depending on the predictor chosen, but in general
 this structure contains pointers into internal predictor counter tables
 and various flags.
 The 
\family typewriter
\size small
predict() 
\family default
\size default
method fills in this structure.
\end_layout

\begin_layout Standard
As each uop commits, the 
\family typewriter
\size small
BranchPredictorInterface::update()
\family default
\size default
 method is passed the uop's saved 
\family typewriter
\size small
PredictorUpdate
\family default
\size default
 structure and the branch outcome (expected target RIP versus real target
 RIP) so the branch predictor can be updated.
 In PTLsim, predictor updates only occur at retirement to avoid corruption
 caused by speculative instructions.
\end_layout

\begin_layout Section
Conditional Branch Predictor
\end_layout

\begin_layout Standard
The PTLsim conditional branch predictor is the most flexible predictor,
 since it can be easily replaced.
 The default predictor implemented in 
\family typewriter
\size small
branchpred.cpp
\family default
\size default
 is a selection based predictor.
 In essence, two separate predictors are maintained.
 The 
\emph on
history predictor
\emph default
 hashes a shift register of previously predicted branches into a table slot;
 this slot returns whether or not the branch with that history is predicted
 as taken.
 PTLsim supports various combinations of the history and branch address
 to provide 
\emph on
gshare
\emph default
 based semantics.
 The 
\emph on
bimodal predictor
\emph default
 is simpler; it uses 2-bit saturating counters to predict if a given branch
 is likely to be taken.
 Finally, a 
\emph on
selection predictor
\emph default
 specifies which of the two predictors is more accurate and should be used
 for future predictions.
 This style of predictor, sometimes called a 
\emph on
McFarling predictor
\emph default
, has been described extensively in the literature and variations are used
 by most modern processors.
\end_layout

\begin_layout Standard
Through the 
\family typewriter
\size small
CombinedPredictor
\family default
\size default
 template class, the user can specify the sizes of all the tables (history,
 bimodal, selector), the history depth, the method in which the global history
 and branch address are combined and so on.
 Alternatively, the conditional branch predictor can be replaced with something
 entirely different if desired.
\end_layout

\begin_layout Section
Branch Target Buffer
\end_layout

\begin_layout Standard
The Branch Target Buffer (BTB) is essentially a small cache that maps indirect
 branch RIP addresses (i.e., 
\family typewriter
\size small
jmp
\family default
\size default
 uops) into predicted target RIP addresses.
 It is set associative, with a user configurable number of sets and ways.
 In PTLsim, the BTB does not take into account any indirect branch history
 information.
 The BTB is a nearly universal structure in branch prediction; see the literatur
e for more information.
\end_layout

\begin_layout Section
Return Address Stack
\end_layout

\begin_layout Standard
The Return Address Stack (RAS) predicts the target address of indirect jumps
 marked with the 
\family typewriter
\size small
BRANCH_HINT_RET
\family default
\size default
 flag.
 Whenever the 
\family typewriter
\size small
BRANCH_HINT_RET
\family default
\size default
 flag is passed to the predict() method, the top RAS stack entry is returned
 as the predicted target, overriding anything in the BTB.
\end_layout

\begin_layout Standard
Unlike the conditional branch predictor and BTB, the RAS updated speculatively
 in the frontend pipeline, before the outcome of calls and returns are known.
 This allows better performance when closely spaced calls and returns must
 be predicted as they are fetched, before either the call or corresponding
 return have actually executed.
 However, when called with the 
\family typewriter
\size small
BRANCH_HINT_RET
\family default
\size default
 flag, the 
\family typewriter
\size small
predict()
\family default
\size default
 method only returns the RIP at the top of the RAS, but does not push or
 pop the RAS.
 This must be done after the corresponding 
\family typewriter
\size small
bru
\family default
\size default
 or 
\family typewriter
\size small
jmp
\family default
\size default
 (for direct and\InsetSpace ~
or indirect calls, respectively) or 
\family typewriter
\size small
jmp
\family default
\size default
 (for returns) uop is actually allocated in the ROB.
 
\end_layout

\begin_layout Standard
This approach is required since the RAS is speculatively updated: if uops
 must be annulled (because of branch mispredictions or mis-speculations),
 the annulment occurs by walking backwards in the ROB until the excepting
 uop is encountered.
 However, if the RAS were updated during the fetch stage, some uops may
 not be in the ROB yet and hence the rollback logic cannot undo speculative
 changes made to the RAS by these uops.
 This causes the RAS to get out of alignment and performance suffers.
\end_layout

\begin_layout Standard
To solve this problem, the RAS is only updated in the allocate stage immediately
 after fetch.
 In the out of order core's 
\family typewriter
\size small
rename()
\family default
\size default
 function, the 
\family typewriter
\size small
BranchPredictorInterface::updateras()
\family default
\size default
 method is called to either push or pop an entry from the RAS (calls push
 entries, returns pop entries).
 Unlike the conditional branch predictor and BTB, this is the only place
 the RAS is updated, rather than performing updates at commit time.
\end_layout

\begin_layout Standard
If uops must be annulled, the 
\family typewriter
\size small
ReorderBufferEntry::annul()
\family default
\size default
 method calls the 
\family typewriter
\size small
BranchPredictorInterface::annulras()
\family default
\size default
 method with the 
\family typewriter
\size small
PredictorUpdate
\family default
\size default
 structure for each uop it encounters in reverse program order.
 This method effectively undoes whatever change was made to the RAS when
 the 
\family typewriter
\size small
updateras()
\family default
\size default
 method was called with the same 
\family typewriter
\size small
PredictorUpdate
\family default
\size default
 information during renaming and allocation.
 This is possible because 
\family typewriter
\size small
updateras()
\family default
\size default
 saves checkpoint information (namely, the old RAS top of stack and the
 value at that stack slot) before updating the RAS; this allows the RAS
 state to be rolled backwards in time as uops are annulled in reverse program
 order.
 At the end of the annulment process when fetching is restarted at the correct
 RIP, the RAS state should be identical to the state that existed before
 the last uop to be annulled was originally fetched.
\end_layout

\begin_layout Part
\begin_inset LatexCommand \label{part:Appendices}

\end_inset

Appendices
\end_layout

\begin_layout Chapter
\begin_inset LatexCommand \label{sec:UopReference}

\end_inset

PTLsim uop Reference
\end_layout

\begin_layout Standard
The following sections document the semantics and encoding of each micro-operati
on (uop) supported by the PTLsim processor core.
 The 
\family typewriter
\size small
opinfo[]
\family default
\size default
 table in 
\family typewriter
\size small
ptlhwdef.cpp
\family default
\size default
 and constants in 
\family typewriter
\size small
ptlhwdef.h
\family default
\size default
 give actual numerical values for the opcodes and other fields described
 below.
\end_layout

\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
\InsetSpace ~

\family sans
\series default
\size default

\newline

\size larger
Merging Rules
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="2" columns="3">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
op
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 (ra 
\emph on
op
\emph default
 rb)
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Merging Rules:
\end_layout

\begin_layout Standard

\family sans
The x86 compatible ALUs implement operations on 1, 2, 4 or 8 byte quantities.
 Unless otherwise indicated, all operations take a 2-bit size shift field
 (
\family typewriter
\size small
sz
\family sans
\size default
) used to determine the effective size in bytes of the operation as follows:
\end_layout

\begin_layout Itemize

\family sans
\series bold
sz = 0:
\series default
 Low byte of 
\emph on
rd
\emph default
 is set to the 8-bit result; high 7 bytes of 
\emph on
rd
\emph default
 are set to corresponding bytes of 
\emph on
ra
\emph default
.
\end_layout

\begin_layout Itemize

\family sans
\series bold
sz = 1:
\series default
 Low two bytes of 
\emph on
rd
\emph default
 is set to the 16-bit result; high 6 bytes of 
\emph on
rd
\emph default
 are set to corresponding bytes of 
\emph on
ra
\emph default
.
\end_layout

\begin_layout Itemize

\family sans
\series bold
sz = 2:
\series default
 Low four bytes of 
\emph on
rd
\emph default
 is set to the 32-bit result; high 4 bytes of 
\emph on
rd
\emph default
 are cleared to zero in accordance with x86-64 zero extension semantics.
 The 
\emph on
ra
\emph default
 operand is unused and should be 
\family typewriter
\size small
REG_zero
\family sans
\size default
.
\end_layout

\begin_layout Itemize

\family sans
\series bold
sz = 3:
\series default
 All 8 bytes of 
\emph on
rd
\emph default
 are set to the 64-bit result.
 
\emph on
ra
\emph default
 is unused and should be 
\family typewriter
\size small
REG_zero
\family sans
\size default
.
\end_layout

\begin_layout Standard

\family sans
Flags are calculated based on the 
\emph on
sz
\emph default
-byte value produced by the ALU, not the final 64-bit result in 
\emph on
rd
\emph default
.
\end_layout

\begin_layout Standard
\begin_inset VSpace bigskip
\end_inset


\family sans
\size larger
Other Pseudo-Operators
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
The descriptions in this reference use various pseudo-operators to describe
 the semantics of each uop.
 These operators are described below.
\end_layout

\begin_layout Standard

\family sans
\series bold
EvalFlags(
\emph on
ra
\emph default
)
\end_layout

\begin_layout Standard

\family sans
The 
\emph on
EvalFlags
\emph default
 pseudo-operator evaluates the ZAPS, CF, OF flags attached to the source
 operand 
\emph on
ra
\emph default
 in accordance with the type of condition code evaluation specified by the
 uop.
 The operator returns 1 if the evaluation is true; otherwise 0 is returned.
\end_layout

\begin_layout Standard

\family sans
\series bold
SignExt(
\emph on
ra
\emph default
, N)
\end_layout

\begin_layout Standard

\family sans
The 
\emph on
SignExt
\emph default
 operator sign extends the ra operand by the number of bits specified by
 N.
 Specifically, bit 
\emph on
ra
\emph default
[N] is copied to all high order bits from bit 63 down to bit 
\emph on
N
\emph default
.
 If N is not specified, it is assumed to mean the number of bits in the
 effective size of the uop's result (as described under Merging Rules).
\end_layout

\begin_layout Standard

\family sans
\series bold
MergeWithSFR(mem, sfr)
\end_layout

\begin_layout Standard

\family sans
The 
\emph on
MergeWithSFR
\emph default
 pseudo-operator is described in the reference page for load uops.
\end_layout

\begin_layout Standard

\family sans
\series bold
MergeAlign(mem, sfr)
\end_layout

\begin_layout Standard

\family sans
The 
\emph on
MergeAlign
\emph default
 pseudo-operator is described in the reference page for load uops.
\end_layout

\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
mov and or xor andnot ornot nand nor eqv
\family sans
\series default
\size default

\newline

\size larger
Logical Operations
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="10" columns="3">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="block" valignment="top" width="0">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
mov
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 rb
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
and
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 ra & rb
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
or
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 ra | rb
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
xor
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 ra ^ rb
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
andnot
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 (~ra) & rb
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
ornot
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 (~ra) | rb
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
nand
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 ~(ra & rb)
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
nor
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 ~(ra | rb)
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
eqv
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 ~(ra ^ rb)
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
All operations merge the ALU result with 
\emph on
ra
\emph default
 and generate flags in accordance with the standard x86 merging rules described
 previously.
\end_layout

\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
add sub addadd addsub subadd subsub addm subm addc subc
\family sans
\series default
\size default

\newline

\size larger
Add and Subtract
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="9" columns="3">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
add
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 ra + rb
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
sub
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 ra - rb
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
adda
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb,rc*S
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 ra + rb + (rc << S)
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
adds
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb,rc*S
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 ra - rb + (rc << S)
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
addm
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb,rc
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 (ra + rb) & rc
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
subm
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb,rc
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 (ra - rb) & rc
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
addc
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb,rc
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 (ra + rb) + rc.cf
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
subc
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb,rc
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 (ra - rb) - rc.cf
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
All operations merge the ALU result with 
\emph on
ra
\emph default
 and generate flags in accordance with the standard x86 merging rules described
 previously.
\end_layout

\begin_layout Itemize

\family sans
The 
\family typewriter
\size small
adda
\family sans
\size default
 and 
\family typewriter
\size small
adds
\family sans
\size default
 uops are useful for small shifts and x86 three-operand 
\family typewriter
\size small
LEA
\family sans
\size default
-style address generation.
\end_layout

\begin_layout Itemize

\family sans
The 
\family typewriter
\size small
addc
\family sans
\size default
 and 
\family typewriter
\size small
subc
\family sans
\size default
 uops use only the carry flag field of their rc operand; the value is unused.
\end_layout

\begin_layout Itemize

\family sans
The 
\family typewriter
\size small
addm
\family sans
\size default
 and 
\family typewriter
\size small
subm
\family sans
\size default
 uops mask the result by the immediate in 
\emph on
rc
\emph default
.
 They are used in microcode for modular stack arithmetic.
\end_layout

\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
sel
\family sans
\series default
\size default

\newline

\size larger
Conditional Select
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="2" columns="3">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
sel.
\emph on
cc
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb,(rc)
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 (EvalFlags(rc)) ? rb : ra
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
\series bold
\emph on
cc
\series default
\emph default
 is any valid condition code flag evaluation
\end_layout

\begin_layout Itemize

\family sans
The 
\family typewriter
\size small
sel
\family sans
\size default
 uop merges the selected operand with 
\emph on
ra
\emph default
 in accordance with the standard x86 merging rules described previously
\end_layout

\begin_layout Itemize

\family sans
The 64-bit result and all flags are treated as a single value for selection
 purposes, i.e.
 the flags attached to the selected input are passed to the output
\end_layout

\begin_layout Itemize

\family sans
If one of the (ra, rb) operands is not valid (has 
\family typewriter
\size small
FLAG_INV
\family sans
\size default
 set) but the selected operand is valid, the result is valid.
 This is an exception to the invalid bit propagation rule only when the
 selected input is valid.
 If the 
\emph on
rc
\emph default
 operand is invalid, the result is always invalid.
\end_layout

\begin_layout Itemize

\family sans
If any of the inputs are waiting (
\family typewriter
\size small
FLAG_WAIT
\family sans
\size default
 is set), the uop does not issue, even if the selected input was ready.
 This is a pipeline simplification.
\end_layout

\begin_layout Itemize

\family sans
set rd = (a),b
\end_layout

\begin_layout Itemize

\family sans
sel rd = b,0,1,c
\end_layout

\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
set
\family sans
\series default
\size default

\newline

\size larger
Conditional Set
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="2" columns="3">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
set.
\emph on
cc
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb,(rc)
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 EvalFlags(rc) ? rb : 0
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
\series bold
\emph on
cc
\series default
\emph default
 is any valid condition code flag evaluation
\end_layout

\begin_layout Itemize

\family sans
The value 0 or 1 is zero extended to the operation size and merged with
 
\emph on
rb
\emph default
 in accordance with the standard x86 merging rules described previously
 (except that 
\family typewriter
\size small
set
\family sans
\size default
 uses 
\emph on
rb
\emph default
 as the merge target instead of 
\emph on
ra
\emph default
)
\end_layout

\begin_layout Itemize

\family sans
Flags attached to 
\emph on
ra
\emph default
 (condition code) are passed through to the output
\end_layout

\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
set.sub set.and
\family sans
\series default
\size default

\newline

\size larger
Conditional Compare and Set 
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="3" columns="3">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
set.sub.
\emph on
cc
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb,rc
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = rc 
\begin_inset Formula $\leftarrow$
\end_inset

 EvalFlags(ra - rb) ? 1 : 0
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
set.and.
\emph on
cc
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb,rc
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = rc 
\begin_inset Formula $\leftarrow$
\end_inset

 EvalFlags(ra & rb) ? 1 : 0
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
The 
\family typewriter
\size small
set.sub
\family sans
\size default
 and 
\family typewriter
\size small
set.and
\family sans
\size default
 uops take the place of a 
\family typewriter
\size small
sub
\family sans
\size default
 or 
\family typewriter
\size small
and
\family sans
\size default
 uop immediately consumed by a 
\family typewriter
\size small
set
\family sans
\size default
 uop; this is intended to shorten the critical path if uop merging is performed
 by the processor
\end_layout

\begin_layout Itemize

\family sans
\series bold
\emph on
cc
\series default
\emph default
 is any valid condition code flag evaluation
\end_layout

\begin_layout Itemize

\family sans
The value 0 or 1 is zero extended to the operation size and then merged
 with 
\emph on
rc
\emph default
 in accordance with the standard x86 merging rules described previously
 (except that 
\family typewriter
\size small
set.sub
\family sans
\size default
 and 
\family typewriter
\size small
set.and
\family sans
\size default
 use 
\emph on
rc
\emph default
 as the merge target instead of 
\emph on
ra
\emph default
)
\end_layout

\begin_layout Itemize

\family sans
Flags generated as the result of the comparison are passed through with
 the result
\end_layout

\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
br
\family sans
\series default
\size default

\newline

\size larger
Conditional Branch
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="2" columns="3">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
br
\emph on
.cc
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rip = (ra,rb),riptaken,ripseq
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rip = EvalFlags(ra) ? riptaken : ripseq
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
\series bold
\emph on
cc
\series default
\emph default
 is any valid condition code flag evaluation
\end_layout

\begin_layout Itemize

\family sans
The 
\family typewriter
\size small
rip
\family sans
\size default
 (user-visible instruction pointer register) is reset to one of two immediates.
 If the flags evaluation is true, the 
\emph on
riptaken
\emph default
 immediate is selected; otherwise the 
\emph on
ripseq
\emph default
 immediate is selected.
\end_layout

\begin_layout Itemize

\family sans
If the flag evaluation is false (i.e., ripseq is selected), the 
\family typewriter
\size small
BranchMispredict
\family sans
\size default
 internal exception is raised.
 The processor should annul all uops after the branch and restart fetching
 at the RIP specified by the result (in this case, 
\emph on
ripseq
\emph default
).
\end_layout

\begin_layout Itemize

\family sans
Branches are always assumed to be taken.
 If the branch is predicted as not taken (i.e.
 future uops come from the next sequential RIP after the branch), it is
 the responsibility of the decoder or frontend to swap the 
\emph on
riptaken
\emph default
 and 
\emph on
ripseq
\emph default
 immediates and invert the condition of the branch.
 All condition encodings can be inverted by inverting bit 0 of the 4-bit
 condition specifier.
\end_layout

\begin_layout Itemize

\family sans
The destination register should always be 
\family typewriter
\size small
REG_rip
\family sans
\size default
; otherwise this uop is undefined.
\end_layout

\begin_layout Itemize

\family sans
If the target RIP falls within an unmapped page, not present page or a page
 marked as no-execute (NX), the 
\family typewriter
\size small
PageFaultOnExec
\family sans
\size default
 exception is taken.
\end_layout

\begin_layout Itemize

\family sans
No flags are generated by this uop
\end_layout

\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
br.sub br.and
\family sans
\series default
\size default

\newline

\size larger
Compare and Conditional Branch
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="3" columns="3">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
br
\emph on
.cc
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rip = ra,rb,riptaken,ripseq
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rip = EvalFlags(ra - rb) ? riptaken : ripseq
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
br
\emph on
.cc
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rip = ra,rb,riptaken,ripseq
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rip = EvalFlags(ra & rb) ? riptaken : ripseq
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
The 
\family typewriter
\size small
br.sub
\family sans
\size default
 and 
\family typewriter
\size small
br.and
\family sans
\size default
 uops take the place of a 
\family typewriter
\size small
sub
\family sans
\size default
 or 
\family typewriter
\size small
and
\family sans
\size default
 uop immediately consumed by a 
\family typewriter
\size small
br
\family sans
\size default
 uop; this is intended to shorten the critical path if uop merging is performed
 by the processor
\end_layout

\begin_layout Itemize

\family sans
\series bold
\emph on
cc
\series default
\emph default
 is any valid condition code flag evaluation
\end_layout

\begin_layout Itemize

\family sans
The 
\family typewriter
\size small
rip
\family sans
\size default
 (user-visible instruction pointer register) is reset to one of two immediates.
 If the flags evaluation is true, the 
\emph on
riptaken
\emph default
 immediate is selected; otherwise the 
\emph on
ripseq
\emph default
 immediate is selected
\end_layout

\begin_layout Itemize

\family sans
If the flag evaluation is false (i.e., ripseq is selected), the 
\family typewriter
\size small
BranchMispredict
\family sans
\size default
 internal exception is raised.
 The processor should annul all uops after the branch and restart fetching
 at the RIP specified by the result (in this case, 
\emph on
ripseq
\emph default
)
\end_layout

\begin_layout Itemize

\family sans
Branches are always assumed to be taken.
 If the branch is predicted as not taken (i.e.
 future uops come from the next sequential RIP after the branch), it is
 the responsibility of the decoder or frontend to swap the 
\emph on
riptaken
\emph default
 and 
\emph on
ripseq
\emph default
 immediates and invert the condition of the branch.
 All condition encodings can be inverted by inverting bit 0 of the 4-bit
 condition specifier.
\end_layout

\begin_layout Itemize

\family sans
The destination register should always be 
\family typewriter
\size small
REG_rip
\family sans
\size default
; otherwise this uop is undefined
\end_layout

\begin_layout Itemize

\family sans
If the target RIP falls within an unmapped page, not present page or a page
 marked as no-execute (NX), the 
\family typewriter
\size small
PageFaultOnExec
\family sans
\size default
 exception is taken.
\end_layout

\begin_layout Itemize

\family sans
Flags generated as the result of the comparison are passed through with
 the result
\end_layout

\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
jmp
\family sans
\series default
\size default

\newline

\size larger
Indirect Jump
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="2" columns="3">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
jmp
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rip = ra,riptaken
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rip = ra
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
The 
\family typewriter
\size small
rip
\family sans
\size default
 (user-visible instruction pointer register) is reset to the target address
 specified by 
\emph on
ra
\end_layout

\begin_layout Itemize

\family sans
If the 
\emph on
ra
\emph default
 operand does not match the 
\emph on
riptaken
\emph default
 immediate, the 
\family typewriter
\size small
BranchMispredict
\family sans
\size default
 internal exception is raised.
 The processor should annul all uops after the branch and restart fetching
 at the RIP specified by the result (in this case, 
\emph on
ra
\emph default
)
\end_layout

\begin_layout Itemize

\family sans
Indirect jumps are always assumed to match the predicted target in 
\emph on
riptaken
\emph default
.
 If some other target is predicted, it is the responsibility of the decoder
 or frontend to set the 
\emph on
riptaken
\emph default
 immediate to that predicted target
\end_layout

\begin_layout Itemize

\family sans
The destination register should always be 
\family typewriter
\size small
REG_rip
\family sans
\size default
; otherwise this uop is undefined
\end_layout

\begin_layout Itemize

\family sans
If the target RIP falls within an unmapped page, not present page or a marked
 as no-execute (NX), the 
\family typewriter
\size small
PageFaultOnExec
\family sans
\size default
 exception is taken.
\end_layout

\begin_layout Itemize

\family sans
No flags are generated by this uop
\end_layout

\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
jmpp
\family sans
\series default
\size default

\newline

\size larger
Indirect Jump Within Microcode
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="2" columns="3">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
jmpp
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
null = ra,riptaken
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
internalrip = ra
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
The 
\family typewriter
\size small
jmpp
\family sans
\size default
 uop redirects uop fetching into microcode not accessible as x86 instructions.
 The target address (inside PTLsim, not x86 space) is specified by 
\emph on
ra
\end_layout

\begin_layout Itemize

\family sans
If the 
\emph on
ra
\emph default
 operand does not match the 
\emph on
riptaken
\emph default
 immediate, the 
\family typewriter
\size small
BranchMispredict
\family sans
\size default
 internal exception is raised.
 The processor should annul all uops after the branch and restart fetching
 at the RIP specified by the result (in this case, 
\emph on
ra
\emph default
)
\end_layout

\begin_layout Itemize

\family sans
Indirect jumps are always assumed to match the predicted target in 
\emph on
riptaken
\emph default
.
 If some other target is predicted, it is the responsibility of the decoder
 or frontend to set the 
\emph on
riptaken
\emph default
 immediate to that predicted target
\end_layout

\begin_layout Itemize

\family sans
The destination register should always be 
\family typewriter
\size small
REG_rip
\family sans
\size default
; otherwise this uop is undefined
\end_layout

\begin_layout Itemize

\family sans
The user visible rip register is not updated after this uop issues; otherwise
 it would point into PTLsim space not accessible to x86 code.
 Updating is resumed after a normal 
\family typewriter
\size small
jmp
\family sans
\size default
 issues to return to user code.
 It is the responsibility of the decoder to move the user address to return
 to into some temporary register (traditionally 
\family typewriter
\size small
REG_sr2
\family sans
\size default
 but this is not required).
\end_layout

\begin_layout Itemize

\family sans
No flags are generated by this uop
\end_layout

\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
bru
\family sans
\series default
\size default

\newline

\size larger
Unconditional Branch
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="2" columns="3">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
bru
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rip = riptaken
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rip = riptaken
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
The 
\family typewriter
\size small
rip
\family sans
\size default
 (user-visible instruction pointer register) is reset to the specified immediate.
 The processor may redirect fetching from the new RIP
\end_layout

\begin_layout Itemize

\family sans
No exceptions are possible with unconditional branches
\end_layout

\begin_layout Itemize

\family sans
If the target RIP falls within an unmapped page, not present page or a marked
 as no-execute (NX), the 
\family typewriter
\size small
PageFaultOnExec
\family sans
\size default
 exception is taken.
\end_layout

\begin_layout Itemize

\family sans
No flags are generated by this uop
\end_layout

\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
brp
\family sans
\series default
\size default

\newline

\size larger
Unconditional Branch Within Microcode
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="2" columns="3">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
bru
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
null = riptaken
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
internalrip = riptaken
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
The 
\family typewriter
\size small
brp
\family sans
\size default
 uop redirects uop fetching into microcode not accessible as x86 instructions.
 The target address (inside PTLsim, not x86 space) is specified by the 
\emph on
riptaken
\emph default
 immediate
\end_layout

\begin_layout Itemize

\family sans
The 
\family typewriter
\size small
rip
\family sans
\size default
 (user-visible instruction pointer register) is reset to the specified 
\emph on
riptaken
\emph default
 immediate.
 The processor may redirect fetching from the new RIP
\end_layout

\begin_layout Itemize

\family sans
No exceptions are possible with unconditional branches
\end_layout

\begin_layout Itemize

\family sans
The user visible rip register is not updated after this uop issues; otherwise
 it would point into PTLsim space not accessible to x86 code.
 Updating is resumed after a normal 
\family typewriter
\size small
jmp
\family sans
\size default
 uop issues to return to user code.
 It is the responsibility of the decoder to move the user address to return
 to into some temporary register (traditionally 
\family typewriter
\size small
REG_sr2
\family sans
\size default
 but this is not required).
\end_layout

\begin_layout Itemize

\family sans
No flags are generated by this uop
\end_layout

\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
chk
\family sans
\series default
\size default

\newline

\size larger
Check Speculation
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="2" columns="3">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
chk
\emph on
.cc
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,recrip,extype
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = EvalCheck(ra) ? 0 : recrip
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
The 
\family typewriter
\size small
chk
\family sans
\size default
 uop verifies 
\emph on
certain
\emph default
 properties about ra.
 If this verification check passes, no action is taken.
 If the check fails, 
\family typewriter
\size small
chk
\family sans
\size default
 signals an exception of the user specified type in the 
\emph on
rc
\emph default
 immediate.
 The result of the 
\family typewriter
\size small
chk
\family sans
\size default
 uop in this case is the user specified RIP to recover at after the check
 failure is handled in microcode.
 This recovery RIP is saved in the 
\family typewriter
\size small
recoveryrip
\family sans
\size default
 internal register.
\end_layout

\begin_layout Itemize

\family sans
This mechanism is intended to allow simple inlined uop sequences to branch
 into microcode if certain conditions fail, since normally inlined uop sequences
 cannot contain embedded branches.
 One example use is in the 
\family typewriter
\size small
REP
\family sans
\size default
 series of instructions to ensure that the count is not zero on entry (a
 special corner case).
\end_layout

\begin_layout Itemize

\family sans
Unlike most conditional uops, the 
\family typewriter
\size small
chk
\family sans
\size default
 uop directly checks the numerical value of 
\emph on
ra
\emph default
 against zero, and ignores any attached flags.
 Therefore, the 
\series bold
\emph on
cc
\series default
\emph default
 condition code flag evaluation type is restricted to the subset (e, ne,
 be, nbe, l, nl, le, nle).
\end_layout

\begin_layout Itemize

\family sans
No flags are generated by this uop
\end_layout

\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
ld ld.lo ld.hi ldx ldx.lo ldx.hi
\family sans
\series default
\size default

\newline

\size larger
Load
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="4" columns="3">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="block" valignment="top" width="50col%">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
ld
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = [ra,rb],sfra
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = MergeWithSFR(mem[ra + rb], sfra)
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
ld.lo
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = [ra+rb],sfra
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = MergeWithSFR(mem[floor(ra + rb), 8], sfra)
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
ld.hi
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = [ra+rb],rc,sfra
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = MergeAlign(
\newline
\InsetSpace ~
\InsetSpace ~
MergeWithSFR(mem[(floor(ra + rb), 8) + 8], sfra), rc)
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
\emph on
The PTLsim load unit model is described in substantial detail in Section
 
\begin_inset LatexCommand \ref{sec:IssuingLoads}

\end_inset

; this section only gives an overview of the load uop semantics.
\end_layout

\begin_layout Itemize

\family sans
The 
\family typewriter
\size small
ld
\family sans
\size default
 family of uops loads values from the virtual address specified by the sum
 
\emph on
ra
\emph default
 + 
\emph on
rb
\emph default
.
 The 
\family typewriter
\size small
ld
\family sans
\size default
 form zero extends the loaded value, while the 
\family typewriter
\size small
ldx
\family sans
\size default
 form sign extends the loaded value to 64 bits.
\end_layout

\begin_layout Itemize

\family sans
All values are zero or sign extended to 64 bits; no subword merging takes
 place as with ALU uops.
 The decoder is responsible for following the load with an explicit 
\family typewriter
\size small
mov
\family sans
\size default
 uop to merge 8-bit and 16-bit loads with their old destination register.
\end_layout

\begin_layout Itemize

\family sans
The 
\emph on
sfra
\emph default
 operand specifies the store forwarding register (a.k.a.
 store buffer) to merge with data from the cache to form the final result.
 The inherited SFR may be determined dynamically by querying a store queue
 or can be predicted statically.
\end_layout

\begin_layout Itemize

\family sans
If the load misses the cache, the 
\family typewriter
\size small
FLAG_WAIT
\family sans
\size default
 flag of the result is set.
\end_layout

\begin_layout Itemize

\family sans
Load uops do not generate any other condition code flags
\end_layout

\begin_layout Standard

\family sans
\series bold
Unaligned Load Support:
\end_layout

\begin_layout Itemize

\family sans
The processor supports unaligned loads via a pair of 
\family typewriter
\size small
ld.lo
\family sans
\size default
 and 
\family typewriter
\size small
ld.hi
\family sans
\size default
 uops; an overview can be found in Section 
\begin_inset LatexCommand \ref{sub:UnalignedLoadsAndStores}

\end_inset

.
 The alignment type of the load is stored in the uop's cond field (0 = 
\family typewriter
\size small
ld
\family sans
\size default
, 1 = 
\family typewriter
\size small
ld.lo
\family sans
\size default
, 2 = 
\family typewriter
\size small
ld.hi
\family sans
\size default
).
\end_layout

\begin_layout Itemize

\family sans
The 
\family typewriter
\size small
ld.lo
\family sans
\size default
 uop rounds down its effective address 
\begin_inset Formula $\left\lfloor ra+rb\right\rfloor $
\end_inset

 to the nearest 64-bit boundary and performs the load.
 The 
\family typewriter
\size small
ld.hi
\family sans
\size default
 uop rounds 
\begin_inset Formula $\left\lceil ra+rb+8\right\rceil $
\end_inset

 up to the next 64-bit boundary, performs a load at that address, then takes
 as its third rc operand the first (
\family typewriter
\size small
ld.lo
\family sans
\size default
) load's result.
 The two loads are concatenated into a 128-bit word and the final unaligned
 data is extracted (and sign extended if the 
\family typewriter
\size small
ldx
\family sans
\size default
 form was used).
 
\end_layout

\begin_layout Itemize

\family sans
Special corner case for when the actual user address (
\emph on
ra
\emph default
 + 
\emph on
rb
\emph default
) did not actually require any bytes in the 8-byte range loaded by the 
\family typewriter
\size small
ld.hi
\family sans
\size default
 uop (i.e.
 the load was contained entirely within the low 64-bit aligned chunk).
 Since it is perfectly legal to do an unaligned load to the very end of
 the page such that the next 64 bit chunk is not mapped to a valid page,
 the 
\family typewriter
\size small
ld.hi
\family sans
\size default
 uop does not actually access memory; the entire result is extracted from
 the prior 
\family typewriter
\size small
ld.lo
\family sans
\size default
 result in the 
\emph on
rc
\emph default
 operand.
\end_layout

\begin_layout Standard

\family sans
\series bold
Exceptions:
\end_layout

\begin_layout Itemize

\family typewriter
\size small
UnalignedAccess
\family sans
\size default
 if the address (
\emph on
ra
\emph default
 + 
\emph on
rb
\emph default
) is not aligned to an integral multiple of the size in bytes of the load.
 Unaligned loads (
\family typewriter
\size small
ld.lo
\family sans
\size default
 and 
\family typewriter
\size small
ld.hi
\family sans
\size default
) do not generate this exception.
 Since x86 automatically corrects alignment problems, microcode must handle
 this exception as described in Section 
\begin_inset LatexCommand \ref{sub:UnalignedLoadsAndStores}

\end_inset

.
\end_layout

\begin_layout Itemize

\family typewriter
\size small
PageFaultOnRead
\family sans
\size default
 if the virtual address (
\emph on
ra
\emph default
 + 
\emph on
rb
\emph default
) falls on a page not accessible to the caller in the current operating
 mode, or a page marked as not present.
\end_layout

\begin_layout Itemize

\family sans
Various other exceptions and replay conditions may exist depending on the
 specific processor core model.
\end_layout

\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
st
\family sans
\series default
\size default

\newline

\size larger
Store
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="4" columns="3">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
st
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
sfrd = [ra,rb],rc,sfra
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
sfrd = MergeWithSFR((ra + rb), sfra, rc)
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
st.lo
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
sfrd = [ra+rb],rc,sfra
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
sfrd = MergeWithSFR(floor(ra + rb, 8), sfra, rc)
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
st.hi
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
sfrd = [ra+rb],rc,sfra
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
sfrd = MergeWithSFR(floor(ra + rb, 8) + 8, sfra, rc)
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
\emph on
The PTLsim store unit model is described in substantial detail in Section
 
\begin_inset LatexCommand \ref{sec:StoreMerging}

\end_inset

; this section only gives an overview of the store uop semantics.
\end_layout

\begin_layout Itemize

\family sans
The 
\family typewriter
\size small
st
\family sans
\size default
 family of uops prepares values to be stored to the virtual address specified
 by the sum 
\emph on
ra
\emph default
 + 
\emph on
rb
\emph default
.
\end_layout

\begin_layout Itemize

\family sans
The 
\emph on
sfra
\emph default
 operand specifies the store forwarding register (a.k.a.
 store buffer) to merge the data to be stored (the 
\emph on
rc
\emph default
 operand) into.
 The inherited SFR may be determined dynamically by querying a store queue
 or can be predicted statically, as described in 
\emph on

\begin_inset LatexCommand \ref{sec:StoreMerging}

\end_inset

.
\end_layout

\begin_layout Itemize

\family sans
Store uops only generate the SFR for tracking purposes; the cache is only
 written when the SFR is committed.
\end_layout

\begin_layout Itemize

\family sans
The store uop may issue as soon as the 
\emph on
ra
\emph default
 and 
\emph on
rb
\emph default
 operands are ready, even if the 
\emph on
rc
\emph default
 and 
\emph on
sfra
\emph default
 operands are not known.
 The store must be replayed once these operands become known, in accordance
 with Section 
\begin_inset LatexCommand \ref{sec:SplitPhaseStores}

\end_inset

.
\end_layout

\begin_layout Itemize

\family sans
Store uops do not generate any other condition code flags
\end_layout

\begin_layout Standard

\family sans
\series bold
Unaligned Store Support:
\end_layout

\begin_layout Itemize

\family sans
The processor supports unaligned stores via a pair of 
\family typewriter
\size small
st.lo
\family sans
\size default
 and 
\family typewriter
\size small
st.hi
\family sans
\size default
 uops; an overview can be found in Section 
\begin_inset LatexCommand \ref{sub:UnalignedLoadsAndStores}

\end_inset

.
 The alignment type of the load is stored in the uop's cond field (0 = 
\family typewriter
\size small
st
\family sans
\size default
, 1 = 
\family typewriter
\size small
st.lo
\family sans
\size default
, 2 = 
\family typewriter
\size small
st.hi
\family sans
\size default
).
\end_layout

\begin_layout Itemize
Stores are handled in a similar manner, with 
\family typewriter
\size small
st.lo
\family default
\size default
 and 
\family typewriter
\size small
st.hi
\family default
\size default
 rounding down and up to store parts of the unaligned value in adjacent
 64-bit blocks.
 
\end_layout

\begin_layout Itemize

\family sans
The 
\family typewriter
\size small
st.lo
\family sans
\size default
 uop rounds down its effective address 
\begin_inset Formula $\left\lfloor ra+rb\right\rfloor $
\end_inset

 to the nearest 64-bit boundary and stores the appropriately aligned portion
 of the 
\family typewriter
\size small
rc
\family sans
\size default
 operand that actually falls within that range of 8 bytes.
 The 
\family typewriter
\size small
ld.hi
\family sans
\size default
 uop rounds 
\begin_inset Formula $\left\lceil ra+rb+8\right\rceil $
\end_inset

 up to the next 64-bit boundary and similarly stores the appropriately aligned
 portion of the 
\family typewriter
\size small
rc
\family sans
\size default
 operand that actually falls within that high range of 8 bytes.
\end_layout

\begin_layout Itemize

\family sans
Special corner case for when the actual user address (
\emph on
ra
\emph default
 + 
\emph on
rb
\emph default
) did not actually touch any bytes in the 8-byte range normally written
 by the 
\family typewriter
\size small
st.hi
\family sans
\size default
 uop (i.e.
 the store was contained entirely within the low 64-bit aligned chunk).
 Since it is perfectly legal to do an unaligned store to the very end of
 the page such that the next 64 bit chunk is not mapped to a valid page,
 the 
\family typewriter
\size small
st.hi
\family sans
\size default
 uop does not actually do anything in this case (the bytemask of the generated
 SFR is set to zero and no exceptions are checked).
\end_layout

\begin_layout Standard

\family sans
\series bold
Exceptions:
\end_layout

\begin_layout Itemize

\family typewriter
\size small
UnalignedAccess
\family sans
\size default
 if the address (
\emph on
ra
\emph default
 + 
\emph on
rb
\emph default
) is not aligned to an integral multiple of the size in bytes of the store.
 Unaligned stores (
\family typewriter
\size small
st.lo
\family sans
\size default
 and 
\family typewriter
\size small
st.hi
\family sans
\size default
) do not generate this exception.
 Since x86 automatically corrects alignment problems, microcode must handle
 this exception as described in Section 
\begin_inset LatexCommand \ref{sub:UnalignedLoadsAndStores}

\end_inset

.
\end_layout

\begin_layout Itemize

\family typewriter
\size small
PageFaultOnWrite
\family sans
\size default
 if the virtual address (
\emph on
ra
\emph default
 + 
\emph on
rb
\emph default
) falls on a write protected page, a page not accessible to the caller in
 the current operating mode, or a page marked as not present.
\end_layout

\begin_layout Itemize

\family typewriter
\size small
LoadStoreAliasing
\family sans
\size default
 if a prior load is found to alias the store (see Section 
\begin_inset LatexCommand \ref{sub:AliasCheck}

\end_inset

).
\end_layout

\begin_layout Itemize

\family sans
Various other exceptions and replay conditions may exist depending on the
 specific processor core model.
\end_layout

\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
ldp ldxp
\family sans
\series default
\size default

\newline

\size larger
Load from Internal Microcode Space
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="3" columns="3">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
ldp
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = [ra,rb]
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = MSR[ra+rb]
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
ldxp
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = [ra+rb]
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = SignExt(MSR[ra+rb])
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
The 
\family typewriter
\size small
ldp
\family sans
\size default
 and 
\family typewriter
\size small
ldxp
\family sans
\size default
 uops load values from the internal PTLsim address space not accessible
 to x86 code.
 Typically this address space is mapped to internal machine state registers
 (MSRs) and microcode scratch space.
 The internal address to access is specified by the sum 
\emph on
ra
\emph default
 + 
\emph on
rb
\emph default
.
 The 
\family typewriter
\size small
ldp
\family sans
\size default
 form zero extends the loaded value, while the 
\family typewriter
\size small
ldxp
\family sans
\size default
 form sign extends the loaded value to 64 bits.
\end_layout

\begin_layout Itemize

\family sans
Load uops do not generate any other condition code flags
\end_layout

\begin_layout Itemize

\family sans
Internal loads may not be unaligned, and never stall or generate exceptions.
\end_layout

\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
stp
\family sans
\series default
\size default

\newline

\size larger
Store to Internal Microcode Space
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="2" columns="3">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
stp
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
null = [ra,rb],rc
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
MSR[ra+rb] = rc
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
The 
\family typewriter
\size small
stp
\family sans
\size default
 uop stores a value to the internal PTLsim address space not accessible
 to x86 code.
 Typically this address space is mapped to internal machine state registers
 (MSRs) and microcode scratch space.
 The internal address to store is specified by the sum 
\emph on
ra
\emph default
 + 
\emph on
rb
\emph default
 and the value to store is specified by 
\emph on
rc
\emph default
.
\end_layout

\begin_layout Itemize

\family sans
Store uops do not generate any other condition code flags
\end_layout

\begin_layout Itemize

\family sans
Internal stores may not be unaligned, and never stall or generate exceptions.
\end_layout

\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
shl shr sar rotl rotr rotcl rotcr
\family sans
\series default
\size default

\newline

\size larger
Shifts and Rotates
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="8" columns="3">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
shl
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb,rc
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 (ra << rb)
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
shr
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb,rc
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 (ra >> rb)
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
sar
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb,rc
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 SignExt(ra >> rb)
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
rotl
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb,rc
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 (ra 
\emph on
rotateleft
\emph default
 rb)
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
rotr
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb,rc
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 (ra 
\emph on
rotateright
\emph default
 rb)
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
rotcl
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb,rc
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 ({rc.cf, ra} 
\emph on
rotateleft
\emph default
 rb)
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
rotcr
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb,rc
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 ({rc.cf, ra} 
\emph on
rotateright
\emph default
 rb)
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
The shift and rotate instructions have some of the most bizarre semantics
 in the entire x86 instruction set: they may or may not modify flags depending
 on the rotation count operand, which we may not even know until the instruction
 issues.
 This is introduced in Section 
\begin_inset LatexCommand \ref{sec:ShiftRotateProblems}

\end_inset

.
\end_layout

\begin_layout Itemize

\family sans
The specific rules are as follows:
\end_layout

\begin_deeper
\begin_layout Itemize

\family sans
If the count 
\begin_inset Formula $rb=0$
\end_inset

 is zero, no flags are modified
\end_layout

\begin_layout Itemize

\family sans
If the count 
\begin_inset Formula $rb=1$
\end_inset

, both OF and CF are modified, but ZAPS is preserved
\end_layout

\begin_layout Itemize

\family sans
If the count 
\begin_inset Formula $rb>1$
\end_inset

, only the CF is modified.
 (Technically the value in OF is undefined, but on K8 and P4, it retains
 the old value, so we try to be compatible).
\end_layout

\begin_layout Itemize

\family sans
Shifts also alter the ZAPS flags while rotates do not.
\end_layout

\end_deeper
\begin_layout Itemize

\family sans
For constant counts (immediate 
\emph on
rb
\emph default
 values), the semantics are easy to determine in advance.
\end_layout

\begin_layout Itemize

\family sans
For variable counts (
\emph on
rb
\emph default
 comes from register), things are more complex.
 Since the shift needs to determine its output flags at runtime based on
 both the shift count and the input flags (CF, OF, ZAPS), we need to specify
 the latest versions in program order of all the existing flags.
 However, this would require three operands to the shift uop not even counting
 the value and count operands.
 Therefore, we use a 
\family typewriter
\size small
collcc
\family sans
\size default
 (collect condition code flags, see Section 
\begin_inset LatexCommand \ref{sub:FlagsManagement}

\end_inset

) uop to get all the most up to date flags into one result, using three
 operands for ZAPS, CF, OF.
 This forms a zero word with all the correct flags attached, which is then
 forwarded as the 
\emph on
rc
\emph default
 operand to the shift.
 This may add additional scheduling constraints in the case that one of
 the operands to the shift itself sets the flags, but this is fairly rare.
 Conveniently, this also lets us directly implement the 65-bit 
\family typewriter
\size small
rotcl
\family sans
\size default
/
\family typewriter
\size small
rotcr
\family sans
\size default
 uops in hardware with little additional complexity.
\end_layout

\begin_layout Itemize

\family sans
All operations merge the ALU result with 
\emph on
ra
\emph default
 and generate flags in accordance with the standard x86 merging rules described
 previously.
\end_layout

\begin_layout Itemize

\family sans
The specific flags attached to the result depend on the input conditions
 described above.
 The user should always assume these uops always produce the latest version
 of each of the ZAPS, CF, OF flag sets.
\end_layout

\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
mask
\family sans
\series default
\size default

\newline

\size larger
Masking, Insertion and Extraction
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="2" columns="3">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
mask
\emph on
.x|z
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb,[ms,mc,ds]
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
See semantics below
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
The 
\family typewriter
\size small
mask
\family sans
\size default
 uop and its variants are used for generalized bit field extraction, insertion,
 sign and zero extension using the 18-bit control field in the immediate
\end_layout

\begin_layout Itemize

\family sans
These uops are used extensively within PTLsim microcode, but are also useful
 if the processor supports dynamically merging a chain of 
\family typewriter
\size small
shr
\family sans
\size default
, 
\family typewriter
\size small
and
\family sans
\size default
, 
\family typewriter
\size small
or
\family sans
\size default
 uops.
\end_layout

\begin_layout Itemize

\family sans
The condition code flags (ZAPS, CF, OF) are the flags logically generated
 by the final AND operation.
\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Control Field Format
\end_layout

\begin_layout Standard

\family sans
The 18-bit 
\emph on
rc
\emph default
 immediate has the following three 6-bit fields:
\end_layout

\begin_layout Standard
\noindent
\align center

\family sans
\begin_inset Tabular
<lyxtabular version="3" rows="2" columns="3">
<features>
<column alignment="center" valignment="top" leftline="true" width="0">
<column alignment="center" valignment="top" leftline="true" width="0">
<column alignment="center" valignment="top" leftline="true" rightline="true" width="0">
<row topline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
DS
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
MC
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" rightline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
MS
\end_layout

\end_inset
</cell>
</row>
<row topline="true" bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
12
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
6
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" rightline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
0
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Itemize

\family sans
The 
\family typewriter
\size small
mask
\family sans
\size default
 uop and its variants are used for generalized bit field extraction, insertion,
 sign and zero extension using the 18-bit control field in the immediate
\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Operation:
\end_layout

\begin_layout LyX-Code

\size small
M = 1'[(ms+mc-1):ms]
\end_layout

\begin_layout LyX-Code

\size small
T = (ra & ~M) | ((rb >>> ds) & M)
\end_layout

\begin_layout LyX-Code

\size small
if (Z) {
\end_layout

\begin_layout LyX-Code

\size small
  # Zero extend
\end_layout

\begin_layout LyX-Code

\size small
  rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 (T & 1'[(ms+mc-1):0])
\end_layout

\begin_layout LyX-Code

\size small
else if (X) {
\end_layout

\begin_layout LyX-Code

\size small
  # Sign extend
\end_layout

\begin_layout LyX-Code

\size small
  rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 (T[ms+mc-1]) ? (T | 1'[63:(ms+mc)]) : (T & 1'[(ms+mc-1):0])
\end_layout

\begin_layout LyX-Code

\size small
} else {
\end_layout

\begin_layout LyX-Code

\size small
  rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 T
\end_layout

\begin_layout LyX-Code

\size small
}
\end_layout

\begin_layout LyX-Code

\end_layout

\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
bswap
\family sans
\series default
\size default

\newline

\size larger
Byte Swap
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="2" columns="3">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
bswap
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 ByteSwap(rb)
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
The 
\family typewriter
\size small
bswap
\family sans
\size default
 uop reverses the endianness of the 
\emph on
rb
\emph default
 operand.
 The uop's effective result size determines the range of bytes which are
 reversed.
\end_layout

\begin_layout Itemize

\family sans
This uop's semantics are identical to the x86 
\family typewriter
\size small
bswap
\family sans
\size default
 instruction.
\end_layout

\begin_layout Itemize

\family sans
This uop does not generate any condition code flags.
\end_layout

\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
collcc
\family sans
\series default
\size default

\newline

\size larger
Collect Condition Codes
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="2" columns="3">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="block" valignment="top" width="50col%">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
collcc
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb,rc
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd.zaps = ra.zaps 
\newline
rd.cf = rb.cf
\newline
rd.of = rc.of
\newline
rd = rd.flags
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
The 
\family typewriter
\size small
collcc
\family sans
\size default
 uop collects the condition code flags from three potentially distinct source
 operands into a single output with the combined condition code flags in
 both its appended flags and data.
\end_layout

\begin_layout Itemize

\family sans
This uop is useful for collecting all flags before passing them as input
 to another uop which only supports one source of flags (for instance, the
 shift and rotate uops).
\end_layout

\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
movccr movrcc
\family sans
\series default
\size default

\newline

\size larger
Move Condition Code Flags Between Register Value and Flag Parts
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="3" columns="3">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="block" valignment="top" width="50col%">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
movccr
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra.flags
\newline
rd.flags = 0
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
movrcc
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd.flags = ra
\newline
rd = ra
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
The 
\family typewriter
\size small
movccr
\family sans
\size default
 uop takes the condition code flag bits attached to 
\emph on
ra
\emph default
 and copies them into the 64-bit register part of the result.
\end_layout

\begin_layout Itemize

\family sans
The 
\family typewriter
\size small
movrcc
\family sans
\size default
 uop takes the low bits of the 
\emph on
ra
\emph default
 operand and moves those bits into the condition code flag bits attached
 to the result.
\end_layout

\begin_layout Itemize

\family sans
The bits moved consist of the ZF, PF, SF, CF, OF flags
\end_layout

\begin_layout Itemize

\family sans
The WAIT and INV flags of the result are always cleared since the uop would
 not even issue if these were set in 
\emph on
ra
\emph default
.
\end_layout

\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
andcc orcc ornotcc xorcc
\family sans
\series default
\size default

\newline

\size larger
Logical Operations on Condition Codes
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="5" columns="3">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
andcc
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd.flags = ra.flags & rb.flags
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
orcc
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd.flags = ra.flags | rb.flags
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
ornotcc
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd.flags = ra.flags | (~rb.flags)
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
xorcc
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd.flags = ra.flags ^ rb.flags
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
These uops are used to perform logical operations on the condition code
 flags attached to 
\emph on
ra
\emph default
 and 
\emph on
rb
\emph default
.
\end_layout

\begin_layout Itemize

\family sans
If the 
\emph on
rb
\emph default
 operand is an immediate, the immediate data is used instead of the flags
 normally attached to a register operand.
\end_layout

\begin_layout Itemize

\family sans
The 64-bit value of the output is always set to zero.
\end_layout

\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
mull mulh
\family sans
\series default
\size default

\newline

\size larger
Integer Multiplication
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="3" columns="3">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
mull
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 lowbits(ra 
\begin_inset Formula $\times$
\end_inset

 rb)
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
mulh
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 highbits(ra 
\begin_inset Formula $\times$
\end_inset

 rb)
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
These uops multiply 
\emph on
ra
\emph default
 and 
\emph on
rb
\emph default
, then retain only the low 
\emph on
N
\emph default
 bits or high 
\emph on
N
\emph default
 bits of the result (where N is the uop's effective result size in bits).
 This result is then merged into 
\emph on
ra
\emph default
.
\end_layout

\begin_layout Itemize

\family sans
The condition code flags generated by these uops correspond to the normal
 x86 semantics for integer multiplication (
\family typewriter
\size small
imul
\family sans
\size default
); the flags are calculated relative to the effective result size.
\end_layout

\begin_layout Itemize

\family sans
The 
\emph on
rb
\emph default
 operand may be an immediate
\end_layout

\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
bt bts btr btc
\family sans
\series default
\size default

\newline

\size larger
Bit Testing and Manipulation
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="5" columns="3">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="block" valignment="top" width="50col%">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
bt
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd.cf = ra[rb] 
\newline
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 (rd.cf) ? -1 : +1
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
bts
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd.cf = ra[rb]
\newline
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 ra | (1 << rb)
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
btr
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd.cf = ra[rb]
\newline
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 ra & (~(1 << rb))
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
btc
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd.cf = ra[rb]
\newline
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 ra ^ (1 << rb)
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
These uops test a given bit in 
\emph on
ra
\emph default
 and then atomically modify (set, reset or complement) that bit in the result.
\end_layout

\begin_layout Itemize

\family sans
The CF flag of the output is set to the original value in bit position 
\emph on
rb
\emph default
 of 
\emph on
ra
\emph default
.
 Other condition code flag bits in the output are undefined.
\end_layout

\begin_layout Itemize

\family sans
The 
\family typewriter
\size small
bt
\family sans
\size default
 (bit test) uop is special: it generates a value of -1 or +1 if the tested
 bit is 1 or 0, respectively.
 This is used in microcode for setting up an increment for the 
\family typewriter
\size small
rep
\family sans
\size default
 x86 instructions.
\end_layout

\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
ctz clz
\family sans
\series default
\size default

\newline

\size larger
Count Trailing or Leading Zeros
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="3" columns="3">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="block" valignment="top" width="50col%">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
ctz
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd.zf = (rb == 0)
\newline
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 (rb) ? LSBIndex(rb) : 0
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
clz
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd.zf = (rb == 0)
\newline
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 (rb) ? MSBIndex(rb) : 0
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
These uops find the bit index of the first '1' bit in 
\emph on
rb
\emph default
, starting from the lowest bit 0 (for 
\family typewriter
\size small
ctz
\family sans
\size default
) or the highest bit of the data type (for 
\family typewriter
\size small
clz
\family sans
\size default
).
\end_layout

\begin_layout Itemize

\family sans
The result is zero (technically, undefined) if ra is zero.
\end_layout

\begin_layout Itemize

\family sans
The ZF flag of the result is 1 if 
\emph on
rb
\emph default
 was zero, or 0 if 
\emph on
rb
\emph default
 was nonzero.
 Other condition code flags are undefined.
\end_layout

\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
ctpop
\family sans
\series default
\size default

\newline

\size larger
Count Population of '1' Bits
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="2" columns="3">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="block" valignment="top" width="50col%">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
ctpop
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd.zf = (ra == 0)
\newline
rd = PopulationCount(ra)
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
The 
\family typewriter
\size small
ctpop
\family sans
\size default
 uop counts the number of '1' bits in the 
\emph on
ra
\emph default
 operand.
\end_layout

\begin_layout Itemize

\family sans
The ZF flag of the result is 1 if 
\emph on
ra
\emph default
 was zero, or 0 if 
\emph on
ra
\emph default
 was nonzero.
 Other condition code flags are undefined.
\end_layout

\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
\InsetSpace ~

\family sans
\series default
\size default

\newline

\size larger
Floating Point Format and Merging
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
All floating point uops use the same encoding to specify the precision and
 vector format of the operands.
 The uop's 
\emph on
size
\emph default
 field is encoded as follows:
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
00:
\family sans
\series default
\size default
 Single precision scalar floating point (
\family typewriter
\size small
\emph on
op
\series bold
\emph default
fp
\family sans
\series default
\size default
 mnemonic).
 The operation is only performed on the low 32 bits (in IEEE single precision
 format) of the 64-bit inputs; the high 32 bits of the ra operand are copied
 to the high 32 bits of the output.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
01:
\family sans
\series default
\size default
 Single precision vector floating point (
\family typewriter
\size small
\emph on
op
\series bold
\emph default
fv
\family sans
\series default
\size default
 mnemonic).
 The operation is performed on both 32 bit halves (in IEEE single precision
 format) of the 64-bit inputs in parallel
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
1x:
\family sans
\series default
\size default
 Double precision scalar floating point (
\family typewriter
\size small
\emph on
op
\series bold
\emph default
fd
\family sans
\series default
\size default
 mnemonic).
 The operation is performed on the full 64 bit inputs (in IEEE double precision
 format)
\end_layout

\begin_layout Standard

\family sans
Most floating point operations merge the result with the 
\emph on
ra
\emph default
 operand to prepare the destination.
 Since a full 64-bit result is generated with the vector and double formats,
 the 
\emph on
ra
\emph default
 operand is not needed and may be specified as zero to reduce dependencies.
\end_layout

\begin_layout Standard

\family sans
Exceptions to this encoding are listed where appropriate.
\end_layout

\begin_layout Standard

\family sans
Unless otherwise noted, all operations update the internal floating point
 status register (FPSR, equivalent to the MXCSR register in x86 code) by
 ORing in any exceptions that occur.
 If the uop is encoded to generate an actual exception on excepting conditions,
 the 
\family typewriter
\size small
FLAG_INV
\family sans
\size default
 flag is attached to the output to cause an exception at commit time.
\end_layout

\begin_layout Standard

\family sans
No condition code flags are generated by floating point uops unless otherwise
 noted.
\end_layout

\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
addf subf mulf divf minf maxf
\family sans
\series default
\size default

\newline

\size larger
Floating Point Arithmetic
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="7" columns="3">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
addf
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 ra + rb
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
subf
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 ra - rb
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
mulf
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 ra 
\begin_inset Formula $\times$
\end_inset

 rb
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
divf
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 ra / rb
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
minf
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 (ra < rb) ? ra : rb
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
maxf
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 (ra >= rb) ? ra : rb
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
These uops do arithmetic on floating point numbers in various formats as
 specified in the 
\emph on
Floating Point Format and Merging
\emph default
 page.
\end_layout

\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
maddf msubf
\family sans
\series default
\size default

\newline

\size larger
Fused Multiply Add and Subtract
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="3" columns="3">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
maddf
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb,rc
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 (ra 
\begin_inset Formula $\times$
\end_inset

 rb) + rc
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
msubf
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb,rc
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 (ra 
\begin_inset Formula $\times$
\end_inset

 rb) - rc
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
The 
\family typewriter
\size small
maddf
\family sans
\size default
 and 
\family typewriter
\size small
msubf
\family sans
\size default
 uops perform fused multiply and accumulate operations on three operands.
\end_layout

\begin_layout Itemize

\family sans
The full internal precision is preserved between the multiply and add operations
; rounding only occurs at the end.
\end_layout

\begin_layout Itemize

\family sans
These uops are primarily used by microcode to calculate floating point division,
 square root and reciprocal.
\end_layout

\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
sqrtf rcpf rsqrtf
\family sans
\series default
\size default

\newline

\size larger
Square Root, Reciprocal and Reciprocal Square Root
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="4" columns="3">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
sqrtf
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 sqrt(rb)
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
rcpf
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 1 / rb
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
rsqrtf
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 1 / sqrt(rb)
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
These uops perform the specified unary operation on rb and merge the result
 into ra (for a single precision scalar mode only)
\end_layout

\begin_layout Itemize

\family sans
The 
\family typewriter
\size small
rcpf
\family sans
\size default
 and 
\family typewriter
\size small
rsqrtf
\family sans
\size default
 uops are approximates - they do not provide the full precision results.
 These approximations are in accordance with the standard x86 SSE/SSE2 semantics.
\end_layout

\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
cmpf
\family sans
\series default
\size default

\newline

\size larger
Compare Floating Point
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="2" columns="3">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
cmpf
\emph on
.type
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 CompareFP(ra, rb, type) ? -1 : 0
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
This uop performs the specified comparison of 
\emph on
ra
\emph default
 and 
\emph on
rb
\emph default
.
 If the comparison is true, the result is set to all '1' bits; otherwise
 it is zero.
 The result is then merged into ra.
\end_layout

\begin_layout Itemize

\family sans
The 
\emph on
cond
\emph default
 field in the uop encoding holds the comparison type.
 The set of compare types matches the x86 SSE/SSE2 CMPxx instructions.
\end_layout

\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
cmpccf
\family sans
\series default
\size default

\newline

\size larger
Compare Floating Point and Generate Condition Codes
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="2" columns="3">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
cmpccf
\emph on
.type
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd.flags = CompareFPFlags(ra, rb)
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
This uop performs all comparisons of 
\emph on
ra
\emph default
 and 
\emph on
rb
\emph default
 and produces x86 condition code flags (ZF, PF, CF) to represent the result.
\end_layout

\begin_layout Itemize

\family sans
The semantics of the generated condition code flags exactly matches the
 x86 SSE/SSE2 instructions 
\family typewriter
\size small
COMISS
\family sans
\size default
/
\family typewriter
\size small
COMISD
\family sans
\size default
/
\family typewriter
\size small
UCOMISS
\family sans
\size default
/
\family typewriter
\size small
UCOMISD
\family sans
\size default
.
\end_layout

\begin_layout Itemize

\family sans
Unlike most encodings, the 
\emph on
size
\emph default
 field holds the comparison type of the two values as follows:
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size small
00:
\family sans
\series default
\size default
 
\family typewriter
\size small
cmpccfp
\family sans
\size default
: single precision ordered compare (same semantics as x86 SSE 
\family typewriter
\size small
COMISS
\family sans
\size default
)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
01:
\family sans
\series default
\size default
 
\family typewriter
\size small
cmpccfp.u
\family sans
\size default
: single precision unordered compare (same semantics as x86 SSE 
\family typewriter
\size small
UCOMISS
\family sans
\size default
)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
10:
\family sans
\series default
\size default
 
\family typewriter
\size small
cmpccfd
\family sans
\size default
: double precision ordered compare (same semantics as x86 SSE2 
\family typewriter
\size small
COMISD
\family sans
\size default
)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
11:
\family sans
\series default
\size default
 
\family typewriter
\size small
cmpccfd.u
\family sans
\size default
: double precision ordered compare (same semantics as x86 SSE2 
\family typewriter
\size small
UCOMISD
\family sans
\size default
)
\end_layout

\end_deeper
\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
cvtf.i2s.ins cvtf.i2s.p cvtf.i2d.lo cvtf.i2d.hi
\family sans
\series default
\size default

\newline

\size larger
Convert 32-bit Integer to Floating Point
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="5" columns="4">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="block" valignment="top" width="50col%">
<column alignment="block" valignment="top" width="10col%">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Used By
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
cvtf.i2s.ins
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 Int32ToFloat(rb)
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
CVTSI2SS
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
cvtf.i2s.p
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = zero,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd[31:0] = Int32ToFloat(rb[31:0])
\newline
rd[63:32] = Int32ToFloat(rb[63:32])
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
CVTPI2PS
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
cvtf.i2d.lo
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = zero,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = Int32ToDouble(rb[31:0])
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
CVTSI2SD
\newline
CVTPI2PD
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
cvtf.i2d.hi
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = zero,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = Int32ToDouble(rb[63:32])
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
CVTPI2PD
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
These uops convert 32-bit integers to single or double precision floating
 point
\end_layout

\begin_layout Itemize

\family sans
The semantics of these instructions are identical to the semantics of the
 x86 SSE/SSE2 instructions shown in the table
\end_layout

\begin_layout Itemize

\family sans
The uop 
\emph on
size
\emph default
 field is not used by these uops
\end_layout

\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
cvtf.q2s.ins cvtf.q2d
\family sans
\series default
\size default

\newline

\size larger
Convert 64-bit Integer to Floating Point
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="3" columns="4">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="block" valignment="top" width="50col%">
<column alignment="block" valignment="top" width="10col%">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Used By
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
cvtf.q2s.ins
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 Int64ToFloat(rb)
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
CVTSI2SS
\family sans
\size default

\newline
(x86-64)
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
cvtf.q2d
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = Int64ToDouble(ra)
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
CVTPI2PS
\newline

\family sans
\size default
(x86-64)
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
These uops convert 64-bit integers to single or double precision floating
 point
\end_layout

\begin_layout Itemize

\family sans
The semantics of these instructions are identical to the semantics of the
 x86 SSE/SSE2 instructions shown in the table
\end_layout

\begin_layout Itemize

\family sans
The uop 
\emph on
size
\emph default
 field is not used by these uops
\end_layout

\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
cvtf.s2i cvt.s2q cvtf.s2i.p
\family sans
\series default
\size default

\newline

\size larger
Convert Single Precision Floating Point to Integer
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="4" columns="4">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="block" valignment="top" width="50col%">
<column alignment="block" valignment="top" width="10col%">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Used By
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
cvtf.s2i
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = FloatToInt32(ra[31:0])
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
CVTSS2SI
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
cvtf.s2i.p
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd[31:0] = FloatToInt32(ra[31:0])
\newline
rd[63:32] = FloatToInt32(ra[63:32])
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
CVTPS2PI
\newline
CVTPS2DQ
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
cvtf.s2q
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = FloatToInt64(ra)
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
CVTSS2SI
\family default
\size default

\newline

\family sans
(x86-64)
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
These uops convert single precision floating point values to 32-bit or 64-bit
 integers
\end_layout

\begin_layout Itemize

\family sans
The semantics of these instructions are identical to the semantics of the
 x86 SSE/SSE2 instructions shown in the table
\end_layout

\begin_layout Itemize

\family sans
Unlike most encodings, the 
\emph on
size
\emph default
 field holds the rounding type of the result as follows:
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size small
x0:
\family sans
\series default
\size default
 normal IEEE rounding (as determined by FPSR)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
x1:
\family sans
\series default
\size default
 truncate to zero
\end_layout

\end_deeper
\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
cvtf.d2i cvtf.d2q cvtf.d2i.p
\family sans
\series default
\size default

\newline

\size larger
Convert Double Precision Floating Point to Integer
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="4" columns="4">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="block" valignment="top" width="50col%">
<column alignment="block" valignment="top" width="10col%">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Used By
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
cvtf.d2i
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = DoubleToInt32(ra)
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
CVTSD2SI
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
cvtf.d2i.p
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd[63:32] = DoubleToInt32(ra)
\newline
rd[31:0] = DoubleToInt32(rb)
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
CVTPD2PI
\newline
CVTPD2DQ
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
cvtf.d2q
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = DoubleToInt64(ra)
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
CVTSD2SI
\family default
\size default

\newline

\family sans
(x86-64)
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
These uops convert double precision floating point values to 32-bit or 64-bit
 integers
\end_layout

\begin_layout Itemize

\family sans
The semantics of these instructions are identical to the semantics of the
 x86 SSE/SSE2 instructions shown in the table
\end_layout

\begin_layout Itemize

\family sans
Unlike most encodings, the 
\emph on
size
\emph default
 field holds the rounding type of the result as follows:
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size small
x0:
\family sans
\series default
\size default
 normal IEEE rounding (as determined by FPSR)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size small
x1:
\family sans
\series default
\size default
 truncate to zero
\end_layout

\end_deeper
\begin_layout Standard

\newpage

\family typewriter
\series bold
\size large
cvtf.d2s.ins cvtf.d2s.p cvtf.s2d.lo cvtf.s2d.hi
\family sans
\series default
\size default

\newline

\size larger
Convert Between Double Precision and Single Precision Floating Point
\family default

\lyxline

\end_layout

\begin_layout Standard
\begin_inset Tabular
<lyxtabular version="3" rows="5" columns="4">
<features>
<column alignment="left" valignment="top" width="0">
<column alignment="left" valignment="top" width="0">
<column alignment="block" valignment="top" width="50col%">
<column alignment="block" valignment="top" width="10col%">
<row bottomline="true">
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Mnemonic
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Syntax
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Operation
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
\series bold
Used By
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
cvtf.d2s.ins
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = ra 
\begin_inset Formula $\leftarrow$
\end_inset

 DoubleToFloat(rb)
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
CVTSD2SS
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
cvtf.d2s.p
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = ra,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd[63:32] = DoubleToFloat(ra)
\newline
rd[31:0] = DoubleToFloat(rb)
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
CVTPD2PS
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
cvtf.s2d.lo
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = zero,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = FloatToDouble(rb[31:0])
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
CVTSS2SD
\newline
CVTPS2PD
\end_layout

\end_inset
</cell>
</row>
<row>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\series bold
\size small
cvtf.s2d.hi
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
rd = zero,rb
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family sans
rd = FloatToDouble(rb[63:32])
\end_layout

\end_inset
</cell>
<cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
\begin_inset Text

\begin_layout Standard

\family typewriter
\size small
CVTPS2PD
\end_layout

\end_inset
</cell>
</row>
</lyxtabular>

\end_inset


\end_layout

\begin_layout Standard
\begin_inset VSpace medskip
\end_inset


\family sans
\series bold
Notes:
\end_layout

\begin_layout Itemize

\family sans
These uops convert single precision floating point values to double precision
 floating point values
\end_layout

\begin_layout Itemize

\family sans
The semantics of these instructions are identical to the semantics of the
 x86 SSE/SSE2 instructions shown in the table
\end_layout

\begin_layout Itemize

\family sans
The uop 
\emph on
size
\emph default
 field is not used by these uops
\end_layout

\begin_layout Chapter
\begin_inset LatexCommand \label{sec:PerformanceCounters}

\end_inset

Performance Counters
\end_layout

\begin_layout Standard
PTLsim maintains hundreds of performance and statistical counters and data
 points as it simulates user code.
 In Section 
\begin_inset LatexCommand \ref{sec:StatisticsInfrastructure}

\end_inset

, the basic mechanisms and data structures through which PTLsim collects
 these data were disclosed, and a guide to extending the existing set of
 collection points was presented.
\end_layout

\begin_layout Standard
This section is a reference listing of all the current performance counters
 present in PTLsim by default.
 The sections below are arranged in a hierarchical tree format, just as
 the data are represented in PTLsim's data store.
 The types of data collected closely match the performance counters available
 on modern Intel and AMD x86 processors, as described in their respective
 reference manuals.
\end_layout

\begin_layout Section
General
\end_layout

\begin_layout Standard
As described in Section 
\begin_inset LatexCommand \ref{sec:StatisticsInfrastructure}

\end_inset

, PTLsim maintains a hierarchical tree of statistical data, defined in 
\family typewriter
\size footnotesize
stats.h
\family default
\size default
.
 The data store contains a potentially large number of snapshots of this
 tree, numbered starting at 0.
 The final snapshot, taken just before simulation completes, is labeled
 as 
\begin_inset Quotes eld
\end_inset

final
\begin_inset Quotes erd
\end_inset

.
 Each snapshot branch contains all of the data structures described in the
 next few sections.
 Snapshots are enabled with the 
\family typewriter
\size footnotesize
-snapshot-cycles
\family default
\size default
 configuration option (Section 
\begin_inset LatexCommand \ref{sec:ConfigurationOptions}

\end_inset

); if they are disabled, only the 
\begin_inset Quotes eld
\end_inset

0
\begin_inset Quotes erd
\end_inset

 and 
\begin_inset Quotes eld
\end_inset

final
\begin_inset Quotes erd
\end_inset

 snapshots are provided.
\end_layout

\begin_layout Section
Summary
\end_layout

\begin_layout Standard
The 
\family typewriter
\size footnotesize
summary 
\family default
\size default
toplevel branch summarizes information about the simulation run across all
 cores:
\end_layout

\begin_layout Standard

\family typewriter
\series bold
\size footnotesize
summary:
\family default
\series default
\size default
 general information
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
cycles: 
\family default
\series default
\size default
total number of simulated cycles completed
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
insns: 
\family default
\series default
\size default
total number of complete x86 instructions committed
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
uops: 
\family default
\series default
\size default
total number of uops committed
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
basic_blocks: 
\family default
\series default
\size default
total number of basic blocks executed
\end_layout

\begin_layout Standard

\family typewriter
\series bold
\size footnotesize
snapshot_uuid: 
\family default
\series default
\size default
the universally unique ID (UUID) of this snapshot.
 This number starts from 0 and increases to infinity.
\end_layout

\begin_layout Standard

\family typewriter
\series bold
\size footnotesize
snapshot_name: 
\family default
\series default
\size default
name of this snapshot, if any.
 Named snapshots can be taken by the 
\family typewriter
\size footnotesize
ptlcall_snapshot()
\family default
\size default
 call within the virtual machine, or by the 
\family typewriter
\size footnotesize
-snapshot-now
\family default
\size default
 
\emph on
name 
\emph default
command.
\end_layout

\begin_layout Section
Simulator
\end_layout

\begin_layout Standard
The 
\family typewriter
\size footnotesize
simulator 
\family default
\size default
toplevel branch represents information about PTLsim itself:
\end_layout

\begin_layout Standard

\family typewriter
\series bold
\size footnotesize
version: 
\family default
\series default
\size default
PTLsim version information
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
build_timestamp: 
\family default
\series default
\size default
the date and time PTLsim (specifically, 
\family typewriter
\size footnotesize
ptlsim.o
\family default
\size default
) was last built
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
svn_revision: 
\family default
\series default
\size default
Subversion revision number for this PTLsim version
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
svn_timestamp: 
\family default
\series default
\size default
Date and time of Subversion commit for this version
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
build_hostname: 
\family default
\series default
\size default
machine name on which PTLsim was compiled
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
build_compiler: 
\family default
\series default
\size default
gcc compiler version used to build PTLsim
\end_layout

\begin_layout Standard

\family typewriter
\series bold
\size footnotesize
run: 
\family default
\series default
\size default
runtime environment information
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
timestamp: 
\family default
\series default
\size default
time (in POSIX seconds-since-epoch format) this instance of PTLsim was started
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
hostname: 
\family default
\series default
\size default
machine name on which PTLsim is running
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
kernel_version: 
\family default
\series default
\size default
Linux kernel version PTLsim is running under.
 For PTLsim/X, this is the domain 0 kernel version
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
hypervisor_version: 
\family default
\series default
\size default
PTLsim/X Xen hypervisor version
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
executable: 
\family default
\series default
\size default
the executable file being run under simulation (userspace PTLsim only)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
args: 
\family default
\series default
\size default
the arguments to the executable file (userspace PTLsim only)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
native_cpuid: 
\family default
\series default
\size default
CPUID (brand/model/revision) of the host machine running PTLsim
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
native_hz: 
\family default
\series default
\size default
core frequency (cycles per second) of the host machine
\end_layout

\begin_layout Standard

\family typewriter
\series bold
\size footnotesize
config: 
\family default
\series default
\size default
the configuration options last passed to PTLsim for this run
\end_layout

\begin_layout Standard

\family typewriter
\series bold
\size footnotesize
performance: 
\family default
\series default
\size default
PTLsim internal performance data
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
rate: 
\family default
\series default
\size default
operations per wall-clock second (i.e.
 in outside world, not inside the virtual machine), averaged over entire
 run.
 These are the status lines PTLsim prints on the console and in the log
 file as it runs.
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
cycles_per_second: 
\family default
\series default
\size default
simulated cycles completed per second
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
issues_per_second: 
\family default
\series default
\size default
uops issued per second
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
user_commits_per_second: 
\family default
\series default
\size default
x86 instructions committed per second
\end_layout

\end_deeper
\begin_layout Section
Decoder
\end_layout

\begin_layout Standard
The 
\family typewriter
\size footnotesize
decoder
\family default
\size default
 toplevel branch represents the x86-to-uop decoder, basic block cache, code
 page cache and other common structures:
\end_layout

\begin_layout Standard

\family typewriter
\series bold
\size footnotesize
throughput:
\family default
\series default
\size default
 total decoded entities
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
basic_blocks:
\family default
\series default
\size default
 total basic blocks (uop sequence terminated by a branch) decoded
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
x86_insns:
\series default
 
\family default
\size default
total x86 instructions decoded
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
uops: 
\family default
\series default
\size default
total uops produced from all decoded x86 instructions
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
bytes: 
\family default
\series default
\size default
total bytes in all decoded x86 instructions
\end_layout

\begin_layout Standard

\family typewriter
\series bold
\size footnotesize
bb_decode_type: 
\family default
\series default
\size default
predominant decoder type used for each basic block
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
all_insns_fast: 
\family default
\series default
\size default
number of basic blocks all instructions in the basic block were in the simple
 regular subset of x86 and could be decoded entirely by the fast decoder
 (
\family typewriter
\size footnotesize
decode-fast.cpp
\family default
\size default
)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
some_insns_complex: 
\family default
\series default
\size default
number of basic blocks in which one or more instructions required complex
 decoding
\end_layout

\begin_layout Standard

\family typewriter
\series bold
\size footnotesize
page_crossings: 
\family default
\series default
\size default
alignment of instructions within page
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
within_page: 
\family default
\series default
\size default
number of basic blocks in which all bytes in the basic block fell within
 a single page
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
crosses_page: 
\family default
\series default
\size default
number of basic blocks in which some bytes crossed a page boundary (i.e.
 required two MFN invalidate locators)
\end_layout

\begin_layout Standard

\family typewriter
\series bold
\size footnotesize
bbcache: 
\family default
\series default
\size default
basic block cache accesses
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
count: 
\family default
\series default
\size default
basic blocks currently in the cache (i.e.
 at the time the stats snapshot was made)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
inserts: 
\family default
\series default
\size default
total insert operations
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
invalidates: 
\family default
\series default
\size default
invalidation operations by type
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
smc: 
\family default
\series default
\size default
self modifying code required page to be invalidated
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
dma: 
\family default
\series default
\size default
DMA into page with existing translations required page to be invalidated
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
spurious: 
\series default
exec_page_fault 
\family default
\size default
assist determined the page has now been made executable
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
reclaim: 
\family default
\series default
\size default
garbage collector discarded unused LRU basic blocks
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
dirty: 
\family default
\series default
\size default
page was already dirty when new translation was to be made
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
empty: 
\family default
\series default
\size default
page was empty (has no basic blocks)
\end_layout

\end_deeper
\begin_layout Standard

\family typewriter
\series bold
\size footnotesize
pagecache: 
\family default
\series default
\size default
physical code page cache
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
count: 
\family default
\series default
\size default
physical pages currently in the cache (i.e.
 at the time the stats snapshot was made)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
inserts: 
\family default
\series default
\size default
total physical page insert operations
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
invalidates: 
\family default
\series default
\size default
invalidation operations by type
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
smc: 
\family default
\series default
\size default
self modifying code required page to be invalidated
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
dma: 
\family default
\series default
\size default
DMA into page with existing translations required page to be invalidated
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
spurious: 
\series default
exec_page_fault 
\family default
\size default
assist determined the page has now been made executable
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
reclaim: 
\family default
\series default
\size default
garbage collector discarded unused LRU basic blocks
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
dirty: 
\family default
\series default
\size default
page was already dirty when new translation was to be made
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
empty: 
\family default
\series default
\size default
page was empty (has no basic blocks)
\end_layout

\end_deeper
\begin_layout Standard

\family typewriter
\series bold
\size footnotesize
reclaim_rounds: 
\family default
\series default
\size default
number of times the memory manager attempted to reclaim unused basic blocks
 (possibly with several attempts until enough memory was available)
\end_layout

\begin_layout Section
Out of Order Core
\end_layout

\begin_layout Standard
The out of order core is represented by the 
\family typewriter
\size footnotesize
ooocore
\family default
\size default
 toplevel branch of the statistics data store tree:
\end_layout

\begin_layout Standard

\family typewriter
\series bold
\size footnotesize
cycles:
\family default
\series default
\size default
 total number of processor cycles simulated
\end_layout

\begin_layout Standard

\family typewriter
\series bold
\size footnotesize
fetch:
\family default
\series default
\size default
 fetch stage statistics
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
stop:
\family default
\series default
\size default
 totals up the reasons why fetching finally stopped in each cycle
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
stalled: 
\family default
\series default
\size default
fetch unit was already stalled in the previous cycle
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
icache_miss:
\series default
 
\family default
\size default
an instruction cache miss prevented further fetches
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
fetchq_full:
\series default
 
\family default
\size default
the uop fetch queue is full
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
bogus_rip:
\series default
 
\family default
\size default
speculative execution redirected the fetch unit to an inaccessible (or non-execu
table) page.
 The fetch unit remains stalled in this state until the mis-speculation
 is resolved.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
microcode_assist:
\series default
 
\family default
\size default
microcode assist must wait for pipeline to empty
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
branch_taken:
\family default
\series default
\size default
 taken branches to non-sequential addresses always stop fetching
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
full_width:
\family default
\series default
\size default
 the maximum fetch width was utilized without encountering any of the events
 above
\end_layout

\end_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
opclass:
\series default
 
\family default
\size default
histogram of how many uops of various operation classes passed through the
 fetch unit.
 The operation classes are defined in 
\family typewriter
\size footnotesize
ptlhwdef.h
\family default
\size default
 and assigned to various opcodes in 
\family typewriter
\size footnotesize
ptlhwdef.cpp
\family default
\size default
.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
width:
\family default
\series default
\size default
 histogram of the fetch width actually used on each cycle
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
blocks:
\family default
\series default
\size default
 blocks of x86 instructions fetched (typically the processor can read at
 most e.g.
 16 bytes out of a 64 byte instruction cache line per cycle)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
uops:
\family default
\series default
\size default
 total number of uops fetched
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
user_insns:
\family default
\series default
\size default
 total number of x86 instructions fetched
\end_layout

\begin_layout Standard

\family typewriter
\series bold
\size footnotesize
frontend:
\family default
\series default
\size default
 frontend pipeline (decode, allocate, rename) statistics
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
status:
\family default
\series default
\size default
 totals up the reasons why frontend processing finally stopped in each cycle
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
complete:
\family default
\series default
\size default
 all uops were successfully allocated and renamed
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
fetchq_empty:
\family default
\series default
\size default
 no more uops were available for allocation
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
rob_full:
\family default
\series default
\size default
 reorder buffer (ROB) was full
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
physregs_full:
\family default
\series default
\size default
 physical register file was full even though an ROB slot was free
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
ldq_full:
\family default
\series default
\size default
 load queue was full (too many loads in the pipeline) even though physical
 registers were available
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
stq_full:
\family default
\series default
\size default
 store queue was full (too many stores in the pipeline)
\end_layout

\end_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
width:
\family default
\series default
\size default
 histogram of the frontend width actually used on each cycle
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
renamed:
\family default
\series default
\size default
 summarizes the type of renaming that occurred for each uop (of the destination,
 not the operands)
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
none:
\family default
\series default
\size default
 uop did not rename its destination (primarily for stores and branches)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
reg:
\family default
\series default
\size default
 uop renamed destination architectural register
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
flags:
\family default
\series default
\size default
 uop renamed one or more of the ZAPS, CF, OF flag sets but had no destination
 architectural register
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
reg_and_flags:
\family default
\series default
\size default
 uop renamed one or more of the ZAPS, CF, OF flag sets as well as a destination
 architectural register
\end_layout

\end_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
alloc:
\family default
\series default
\size default
 summarizes the type of resource allocation that occurred for each uop (in
 addition to its ROB slot):
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
reg:
\family default
\series default
\size default
 uop was allocated a physical register
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
ldreg:
\family default
\series default
\size default
 uop was a load and was allocated both a physical register and a load queue
 entry
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
sfr:
\family default
\series default
\size default
 uop was a store and was allocated a store forwarding register (SFR), a.k.a.
 store queue entry
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
br:
\family default
\series default
\size default
 uop was a branch and was allocated branch-related resources (possibly including
 a destination physical register)
\end_layout

\end_deeper
\begin_layout Standard

\family typewriter
\series bold
\size footnotesize
dispatch:
\family default
\series default
\size default
 dispatch unit statistics
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
source:
\family default
\series default
\size default
 totals up where each operand to each uop currently resided at the time
 the uop was dispatched.
 These statistics are broken out by cluster.
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
waiting:
\family default
\series default
\size default
 how many operands were waiting (i.e.
 not yet ready)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
bypass:
\family default
\series default
\size default
 how many operands would come from the bypass network if the uop were immediatel
y issued
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
physreg:
\family default
\series default
\size default
 how many operands were already written back to physical registers
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
archreg:
\family default
\series default
\size default
 how many operands would be obtained from architectural registers
\end_layout

\end_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
cluster:
\family default
\series default
\size default
 tracks the number of uops issued to each cluster (or issue queue) in the
 processor.
 This list will vary depending on the processor configuration.
 The value 
\emph on
none
\emph default
 means that no cluster could accept the uop because all issue queues were
 full.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
redispatch:
\family default
\series default
\size default
 statistics on the redispatch speculation recovery rmechanism (Section 
\begin_inset LatexCommand \ref{sec:SpeculationRecovery}

\end_inset

)
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
trigger_uops
\family default
\series default
\size default
 measures how many uops triggered redispatching because of a mis-speculation.
 This number does not count towards the statistics below.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
deadlock_flushes
\family default
\series default
\size default
 measures how many times the pipeline must be flushed to resolve a deadlock.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
dependent_uops
\family default
\series default
\size default
 is a histogram of how many uops depended on each trigger uop, not including
 the trigger uop itself.
\end_layout

\end_deeper
\begin_layout Standard

\family typewriter
\series bold
\size footnotesize
issue:
\family default
\series default
\size default
 issue statistics
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
result:
\family default
\series default
\size default
 histogram of the final disposition of issuing each uop
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
no-fu:
\family default
\series default
\size default
 no functional unit was available within the uop's assigned cluster even
 though it was already issued
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
replay:
\family default
\series default
\size default
 uop attempted to execute but could not complete, so it must remain in the
 issue queue to be replayed.
 This event generally occurs when a load or store detects a previously unknown
 forwarding dependency on a prior store, when the data to actually store
 is not yet available, or when insufficient resources are available to complete
 the memory operation.
 Details are given in Sections 
\begin_inset LatexCommand \ref{sec:IssuingLoads}

\end_inset

 and 
\begin_inset LatexCommand \ref{sec:SplitPhaseStores}

\end_inset

.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
misspeculation:
\family default
\series default
\size default
 uop mis-speculated and now all uops after and including the issued uop
 must be annulled.
 This generally occurs with loads (Section 
\begin_inset LatexCommand \ref{sec:IssuingLoads}

\end_inset

) and stores (Section 
\begin_inset LatexCommand \ref{sub:AliasCheck}

\end_inset

) when unaligned accesses or load-store aliasing occurs.
 This event is handled in accordance with Section 
\begin_inset LatexCommand \ref{sec:SpeculationRecovery}

\end_inset

.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
refetch:
\family default
\series default
\size default
 uop and all subsequent uops must be re-fetched to be decoded differently.
 For example, unaligned loads and stores take this path so they can be cracked
 into two parts after being refetched.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
branch_mispredict:
\family default
\series default
\size default
 uop was a branch and mispredicted, such that all uops after (but not including)
 the branch uop must be annulled.
 See Section 
\begin_inset LatexCommand \ref{sec:SpeculationAndRecovery}

\end_inset

 for details.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
exception:
\family default
\series default
\size default
 uop caused an exception (though this may not be a user visible error due
 to speculative execution)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
complete:
\family default
\series default
\size default
 uop completed successfully.
 Note that this does 
\emph on
not
\emph default
 mean the result is immediately ready; for loads it simply means the request
 was issued to the cache.
\end_layout

\end_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
source:
\family default
\series default
\size default
 totals up where each operand to each uop was read from as it was issued
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
bypass:
\family default
\series default
\size default
 how many operands came directly off the bypass network
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
physreg:
\family default
\series default
\size default
 how many operands were read from physical registers
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
archreg:
\family default
\series default
\size default
 how many operands were read from committed architectural registers
\end_layout

\end_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
width:
\family default
\series default
\size default
 histogram of the issue width actually used on each cycle in each cluster.
 This object is further broken down by cluster, since various clusters have
 different issue width and policies.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
opclass:
\family default
\series default
\size default
 histogram of how many uops of various operation classes were issued.
 The operation classes are defined in 
\family typewriter
\size footnotesize
ptlhwdef.h
\family default
\size default
 and assigned to various opcodes in 
\family typewriter
\size footnotesize
ptlhwdef.cpp
\family default
\size default
.
\end_layout

\begin_layout Standard

\family typewriter
\series bold
\size footnotesize
writeback:
\family default
\series default
\size default
 writeback stage statistics
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
total_writebacks:
\family default
\series default
\size default
 total number of results written back to the physical register file
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
transient:
\family default
\series default
\size default
 transient versus persistent values
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
transient:
\family default
\series default
\size default
 the result technically does not have to be written back to the physical
 register file at all, since all consumers sourced the value off the bypass
 network and the result is no longer available since the destination architectur
al register pointing to it has since been renamed.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
persistent:
\family default
\series default
\size default
 all values which do not meet the conditions above and hence must still
 be written back
\end_layout

\end_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
width:
\family default
\series default
\size default
 histogram of the writeback width actually used on each cycle in each cluster.
 This object is further broken down by cluster, since various clusters have
 different issue width and policies.
\end_layout

\begin_layout Standard

\family typewriter
\series bold
\size footnotesize
commit:
\family default
\series default
\size default
 commit unit statistics
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
uops:
\family default
\series default
\size default
 total number of uops committed
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
insns:
\family default
\series default
\size default
 total number of complete x86 instructions committed
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
result:
\family default
\series default
\size default
 histogram of the final disposition of attempting to commit each uop
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
none:
\family default
\series default
\size default
 one or more uops comprising the x86 instruction at the head of the ROB
 were not yet ready to commit, so commitment is terminated for that cycle
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
ok:
\family default
\series default
\size default
 result was successfully committed
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
exception:
\family default
\series default
\size default
 result caused a genuine user visible exception.
 In userspace PTLsim, this will terminate the simulation.
 In full system PTLsim/X, this is a normal and frequent event.
 Floating point state dirty faults are counted under this category.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
skipblock:
\family default
\series default
\size default
 This occurs in rare cases when the processor must skip over the currently
 executing instruction (such as in pathological cases of the 
\family typewriter
\size footnotesize
rep
\family default
\size default
 x86 instructions).
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
barrier:
\family default
\series default
\size default
 the processor encountered a barrier instruction, such as a system call,
 assist or pipeline flush.
 The frontend has already been stopped and fetching has been redirected
 to the code to handle the barrier; this condition simply commits the barrier
 instruction itself.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
smc:
\family default
\series default
\size default
 self modifying code: the instruction attempting to commit has been modified
 since it was last decoded (see Section 
\begin_inset LatexCommand \ref{sec:SelfModifyingCode}

\end_inset

)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
stop:
\family default
\series default
\size default
 special case for when the simulation is to be stopped after committing
 a certain number of x86 instructions (e.g.
 via the 
\family typewriter
\size footnotesize
-stopinsns
\family default
\size default
 option in Section 
\begin_inset LatexCommand \ref{sec:ConfigurationOptions}

\end_inset

).
\end_layout

\end_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
setflags:
\family default
\series default
\size default
 how many uops updated the condition code flags as they committed
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
yes:
\family default
\series default
\size default
 how many uops updated at least one of the ZAPS, CF, OF flag sets (the 
\family typewriter
\size small
REG_flags
\family default
\size default
 internal architectural register)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
no:
\family default
\series default
\size default
 how many uops did not update any flags
\end_layout

\end_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
freereg:
\family default
\series default
\size default
 how many uops were able to free the old physical register mapped to their
 architectural destination register at commit time
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
pending:
\family default
\series default
\size default
 old physical register was still referenced within the pipeline or by one
 or more rename table entries
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
free:
\family default
\series default
\size default
 old physical register could be immediately freed
\end_layout

\end_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
free_regs_recycled:
\family default
\series default
\size default
 how many physical registers were recycled (garbage collected) later than
 normal because of one of the conditions above
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
width:
\family default
\series default
\size default
 histogram of the issue width actually used on each cycle in each cluster.
 This object is further broken down by cluster, since various clusters have
 different issue width and policies.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
opclass:
\family default
\series default
\size default
 histogram of how many uops of various operation classes were issued.
 The operation classes are defined in 
\family typewriter
\size footnotesize
ptlhwdef.h
\family default
\size default
 and assigned to various opcodes in 
\family typewriter
\size small
ptlhwdef.cpp
\family default
\size default
.
\end_layout

\begin_layout Standard

\family typewriter
\series bold
\size footnotesize
branchpred:
\family default
\series default
\size default
 branch predictor statistics
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
predictions:
\family default
\series default
\size default
 total number of branch predictions of any type
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
updates:
\family default
\series default
\size default
 total number of branch predictor updates of any type
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
cond:
\family default
\series default
\size default
 conditional branch (
\family typewriter
\size footnotesize
br.cc 
\family default
\size default
uop) prediction outcomes, broken down into correct predictions and misprediction
s
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
indir:
\family default
\series default
\size default
 indirect branch (
\family typewriter
\size footnotesize
jmp 
\family default
\size default
uop) prediction outcomes, broken down into correct predictions and misprediction
s
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
return:
\family default
\series default
\size default
 return (
\family typewriter
\size footnotesize
jmp 
\family default
\size default
uop with 
\family typewriter
\size footnotesize
BRANCH_HINT_RET 
\family default
\size default
flag) prediction outcomes, broken down into correct predictions and mispredictio
ns
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
summary:
\series default
 
\family default
\size default
summary of all prediction outcomes of the three types above, broken down
 into correct predictions and mispredictions
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
ras:
\series default
 
\family default
\size default
return address stack (RAS) operations
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
push:
\series default
 
\family default
\size default
RAS pushes on calls
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
push_overflows:
\series default
 
\family default
\size default
RAS pushes on calls in which the RAS overflowed
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
pop:
\series default
 
\family default
\size default
RAS pops on returns
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
pop_underflows:
\series default
 
\family default
\size default
RAS pops on returns in which the RAS was empty
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
annuls:
\series default
 
\family default
\size default
annulment operations in which speculative updates to the RAS were rolled
 back
\end_layout

\end_deeper
\begin_layout Section
Cache Subsystem
\end_layout

\begin_layout Standard
The cache subsystem is listed under the 
\family typewriter
\size footnotesize
ooocore/dcache
\family default
\size default
 branch.
\end_layout

\begin_layout Standard

\family typewriter
\series bold
\size footnotesize
load:
\family default
\series default
\size default
 load unit statistics
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
issue:
\family default
\series default
\size default
 histogram of the final disposition of issuing each load uop
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
complete:
\family default
\series default
\size default
 cache hit
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
miss:
\family default
\series default
\size default
 L1 cache miss, and possibly lower levels as well (Sections 
\begin_inset LatexCommand \ref{sec:CacheMissHandling}

\end_inset

 and 
\begin_inset LatexCommand \ref{sec:InitiatingCacheMiss}

\end_inset

)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
exception:
\family default
\series default
\size default
 load generated an exception (typically a page fault), although the exception
 may still be speculative (Section 
\begin_inset LatexCommand \ref{sec:IssuingLoads}

\end_inset

)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
ordering:
\family default
\series default
\size default
 load was misordered with respect to stores (Section 
\begin_inset LatexCommand \ref{sub:AliasCheck}

\end_inset

)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
unaligned:
\family default
\series default
\size default
 load was unaligned and will need to be re-executed as a pair of low and
 high loads (Sections 
\begin_inset LatexCommand \ref{sub:UnalignedLoadsAndStores}

\end_inset

 and 
\begin_inset LatexCommand \ref{sec:IssuingLoads}

\end_inset

)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
replay:
\family default
\series default
\size default
 histogram of events in which a load needed to be replayed (Section 
\begin_inset LatexCommand \ref{sec:IssuingLoads}

\end_inset

)
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
sfr-addr-and-data-not-ready:
\series default
 
\family default
\size default
load was predicted to forward data from a prior store (Section 
\begin_inset LatexCommand \ref{sub:AliasCheck}

\end_inset

), but neither the address nor the data of that store has resolved yet
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
sfr-addr-not-ready:
\series default
 
\family default
\size default
load was predicted to forward data from a prior store, but the address of
 that store has not resolved yet
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
sfr-data-not-ready:
\series default
 
\family default
\size default
load address matched a prior store in the store queue, but the data that
 store should write has not resolved yet
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
missbuf-full:
\series default
 
\family default
\size default
load missed the cache but the miss buffer and/or LFRQ (Section 
\begin_inset LatexCommand \ref{sec:InitiatingCacheMiss}

\end_inset

) was full at the time
\end_layout

\end_deeper
\end_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
hit:
\series default
 
\family default
\size default
histogram of the cache hierarchy level each load finally hit
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
L1:
\series default
 
\family default
\size default
L1 cache hit
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
L2:
\series default
 
\family default
\size default
L1 cache miss, L2 cache hit
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
L3:
\series default
 
\family default
\size default
L1 and L2 cache miss, L3 cache hit
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
mem:
\series default
 
\family default
\size default
all caches missed; value read from main memory
\end_layout

\end_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
forward:
\series default
 
\family default
\size default
histogram of which sources were used to fill each load
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
cache:
\series default
 
\family default
\size default
how many loads obtained all their data from the cache
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
sfr:
\series default
 
\family default
\size default
how many loads obtained all their data from a prior store in the pipeline
 (i.e.
 load completely overlapped that store)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
sfr-and-cache:
\series default
 
\family default
\size default
how many loads obtained their data from a combination of the cache and a
 prior store
\end_layout

\end_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
dependency:
\series default
 
\family default
\size default
histogram of how loads related to previous stores
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
independent:
\series default
 
\family default
\size default
load was independent of any store currently in the pipeline
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
predicted-alias-unresolved:
\series default
 
\family default
\size default
load was stalled because the load store alias predictor (LSAP) predicted
 that an earlier store would overlap the load's address address even though
 that earlier store's address was unresolved (Section 
\begin_inset LatexCommand \ref{sub:AliasCheck}

\end_inset

)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
stq-address-match:
\series default
 
\family default
\size default
load depended on an earlier store still found in the store queue
\end_layout

\end_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
type:
\series default
 
\family default
\size default
histogram of the type of each load uop
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
aligned:
\series default
 
\family default
\size default
normal aligned loads
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
unaligned:
\series default
 
\family default
\size default
special unaligned load uops 
\family typewriter
\size small
ld.lo
\family default
\size default
 or 
\family typewriter
\size small
ld.hi
\family default
\size default
 (Section 
\begin_inset LatexCommand \ref{sub:UnalignedLoadsAndStores}

\end_inset

)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
internal:
\series default
 
\family default
\size default
loads from PTLsim space by microcode
\end_layout

\end_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
size:
\series default
 
\family default
\size default
histogram of the size in bytes of each load uop
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
transfer-L2-to-L1:
\series default
 
\family default
\size default
histogram of the types of L2 to L1 line transfers that occurred (Section
 
\begin_inset LatexCommand \ref{sec:CacheHierarchy}

\end_inset

)
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
full-L2-to-L1:
\series default
 
\family default
\size default
all bytes in cache line were transferred from L2 to L1 cache
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
partial-L2-to-L1:
\series default
 
\family default
\size default
some bytes in the L1 line were already valid (because of stores to those
 bytes), but the remaining bytes still need to be fetched
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
L2-to-L1I:
\series default
 
\family default
\size default
all bytes in the L2 line were transferred into the L1 instruction cache
\end_layout

\end_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
dtlb:
\series default
 
\family default
\size default
data cache translation lookaside buffer hit versus miss rate (Section 
\begin_inset LatexCommand \ref{sec:TranslationLookasideBuffers}

\end_inset

)
\end_layout

\begin_layout Standard

\family typewriter
\series bold
\size footnotesize
fetch:
\series default
 
\family default
\size default
instruction fetch unit statistics (Section 
\begin_inset LatexCommand \ref{sec:FetchStage}

\end_inset

)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
hit:
\series default
 
\family default
\size default
histogram of the cache hierarchy level each fetch finally hit
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
L1:
\series default
 
\family default
\size default
L1 cache hit
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
L2:
\series default
 
\family default
\size default
L1 cache miss, L2 cache hit
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
L3:
\series default
 
\family default
\size default
L1 and L2 cache miss, L3 cache hit
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
mem:
\series default
 
\family default
\size default
all caches missed; value read from main memory
\end_layout

\end_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
itlb:
\series default
 
\family default
\size default
instruction cache translation lookaside buffer hit versus miss rate (Section
 
\begin_inset LatexCommand \ref{sec:TranslationLookasideBuffers}

\end_inset

)
\end_layout

\begin_layout Standard

\family typewriter
\series bold
\size footnotesize
prefetches:
\series default
 
\family default
\size default
prefetch engine statistics
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
in-L1:
\series default
 
\family default
\size default
requested data already in L1 cache
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
in-L2:
\series default
 
\family default
\size default
requested data already in L2 cache (and possibly also in L1 cache)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
required:
\series default
 
\family default
\size default
prefetch was actually required (data was not cached or was in L3 or lower
 levels)
\end_layout

\begin_layout Standard

\family typewriter
\series bold
\size footnotesize
missbuf:
\series default
 
\family default
\size default
miss buffer performance (Sections 
\begin_inset LatexCommand \ref{sec:InitiatingCacheMiss}

\end_inset

 and 
\begin_inset LatexCommand \ref{sec:FillingCacheMiss}

\end_inset

)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
inserts:
\series default
 
\family default
\size default
total number of lines inserted into the miss buffer
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
delivers:
\series default
 
\family default
\size default
total number of lines delivered to various cache hierarchy levels from the
 miss buffer
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
mem-to-L3:
\series default
 
\family default
\size default
deliver line from main memory to the L3 cache
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
L3-to-L2:
\series default
 
\family default
\size default
deliver line to the L3 cache to the L2 cache
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
L2-to-L1D:
\series default
 
\family default
\size default
deliver line from the L2 cache to the L1 data cache
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
L2-to-L1I:
\series default
 
\family default
\size default
deliver line from the L2 cache to the L1 instruction cache
\end_layout

\end_deeper
\begin_layout Standard

\family typewriter
\series bold
\size footnotesize
lfrq:
\series default
 
\family default
\size default
load fill request queue (LFRQ) performance (Sections 
\begin_inset LatexCommand \ref{sec:InitiatingCacheMiss}

\end_inset

 and 
\begin_inset LatexCommand \ref{sec:FillingCacheMiss}

\end_inset

)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
inserts:
\series default
 
\family default
\size default
total number of loads inserted into the LFRQ
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
wakeups:
\series default
 
\family default
\size default
total number of loads awakened from the LFRQ
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
annuls:
\series default
 
\family default
\size default
total number of loads annulled in the LFRQ (after they were annulled in
 the processor core)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
resets:
\series default
 
\family default
\size default
total number of LFRQ resets (all entries cleared)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
total-latency:
\series default
 
\family default
\size default
total latency in cycles of all loads passing through the LFRQ
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
average-miss-latency:
\series default
 
\family default
\size default
average load latency, weighted by cache level hit and latency to that level
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
width:
\series default
 
\family default
\size default
histogram of how many loads were awakened per cycle by the LFRQ
\end_layout

\begin_layout Standard

\family typewriter
\series bold
\size footnotesize
store:
\series default
 
\family default
\size default
store unit statistics
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
issue:
\series default
 
\family default
\size default
histogram of the final disposition of issuing each store uop
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
complete:
\series default
 
\family default
\size default
store completed without problems
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
exception:
\series default
 
\family default
\size default
store generated an exception (typically a page fault), although the exception
 may still be speculative (Section 
\begin_inset LatexCommand \ref{sec:StoreMerging}

\end_inset

)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
ordering:
\series default
 
\family default
\size default
store detected that a later load in program order aliased the store but
 was issued earlier than the store (Section 
\begin_inset LatexCommand \ref{sub:AliasCheck}

\end_inset

)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
unaligned:
\series default
 
\family default
\size default
store was unaligned and will need to be re-executed as a pair of low and
 high stores (Sections 
\begin_inset LatexCommand \ref{sub:UnalignedLoadsAndStores}

\end_inset

)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
replay:
\series default
 
\family default
\size default
histogram of events in which a store needed to be replayed (Sections 
\begin_inset LatexCommand \ref{sec:SplitPhaseStores}

\end_inset

 and 
\begin_inset LatexCommand \ref{sec:StoreMerging}

\end_inset

)
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
wait-sfraddr-sfrdata:
\series default
 
\family default
\size default
neither the address nor the data of a prior store this store inherits some
 of its data from was ready
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
wait-sfraddr:
\series default
 
\family default
\size default
the data of a prior store was ready but its address was still unavailable
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
wait-sfrdata:
\series default
 
\family default
\size default
the address of a prior store was ready but its data was still unavailable
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
wait-storedata-sfraddr-sfrdata:
\series default
 
\family default
\size default
the actual data value to store was not ready (Section 
\begin_inset LatexCommand \ref{sec:SplitPhaseStores}

\end_inset

), in addition to having neither the data nor the address of a prior store
 (Section 
\begin_inset LatexCommand \ref{sec:StoreMerging}

\end_inset

)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
wait-storedata-sfraddr:
\series default
 
\family default
\size default
the actual data value to store was not ready (Section 
\begin_inset LatexCommand \ref{sec:SplitPhaseStores}

\end_inset

), in addition to not having the address of the prior store (Section 
\begin_inset LatexCommand \ref{sec:StoreMerging}

\end_inset

)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
wait-storedata-sfrdata:
\series default
 
\family default
\size default
the actual data value to store was not ready (Section 
\begin_inset LatexCommand \ref{sec:SplitPhaseStores}

\end_inset

), in addition to not having the data from the prior store (Section 
\begin_inset LatexCommand \ref{sec:StoreMerging}

\end_inset

)
\end_layout

\end_deeper
\end_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
forward:
\series default
 
\family default
\size default
histogram of which sources were used to construct the merged store buffer:
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
zero:
\series default
 
\family default
\size default
no prior store overlapping the current store was found in the pipeline
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
sfr:
\series default
 
\family default
\size default
data from a prior store in the pipeline was merged with the value to be
 stored to form the final store buffer
\end_layout

\end_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
type:
\series default
 
\family default
\size default
histogram of the type of each store uop
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
aligned:
\series default
 
\family default
\size default
normal aligned store
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
unaligned:
\series default
 
\family default
\size default
special unaligned store uops 
\family typewriter
\size small
st.lo
\family default
\size default
 or 
\family typewriter
\size small
st.hi
\family default
\size default
 (Section 
\begin_inset LatexCommand \ref{sub:UnalignedLoadsAndStores}

\end_inset

)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
internal:
\series default
 
\family default
\size default
stores to PTLsim space by microcode
\end_layout

\end_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
size:
\series default
 
\family default
\size default
histogram of the size in bytes of each store uop
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
commit:
\series default
 
\family default
\size default
histogram of how stores are committed
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
direct:
\series default
 
\family default
\size default
store committed directly to the data cache in the commit stage (Section
 
\begin_inset LatexCommand \ref{sec:CommitStage}

\end_inset

)
\end_layout

\end_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
commits:
\series default
 
\family default
\size default
total number of committed uops
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
usercommits:
\series default
 
\family default
\size default
total number of committed x86 instructions
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
issues:
\series default
 
\family default
\size default
total number of uops issued.
 This includes uops issued more than once by through replay (Section 
\begin_inset LatexCommand \ref{sec:Scheduling}

\end_inset

).
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
ipc:
\series default
 
\family default
\size default
Instructions Per Cycle (IPC) statistics
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
commit-in-uops:
\series default
 
\family default
\size default
average number of uops committed per cycle
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
issue-in-uops:
\series default
 
\family default
\size default
average number of uops issued per cycle
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
commit-in-user-insns:
\series default
 
\family default
\size default
average number of x86 instructions committed per cycle
\newline

\series bold
\emph on

\newline
NOTE:
\series default
\emph default
 Because one x86 instruction may be broken up into numerous uops, it is
 
\series bold
\emph on
\bar under
never
\series default
\emph default
\bar default
 appropriate to compare IPC figures for committed x86 instructions per clock
 with IPC values from a RISC machine.
 Furthermore, different x86 implementations use varying numbers of uops
 per x86 instruction as a matter of encoding, so even comparing the uop
 based IPC between x86 implementations or RISC-like machines is inaccurate.
 Users are strongly advised to use relative performance measures instead
 (e.g.
 total cycles taken to complete a given benchmark).
\end_layout

\end_deeper
\begin_layout Standard

\family typewriter
\series bold
\size footnotesize
simulator:
\series default
 
\family default
\size default
describes the performance of PTLsim itself.
 Useful for tuning the simulator.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
total_time:
\series default
 
\family default
\size default
total time in seconds 
\emph on
(not simulated cycles!)
\emph default
 spent in various parts of the simulator.
 Please refer to the source code (in 
\family typewriter
\size footnotesize
ooocore.cpp
\family default
\size default
) for the range of code each time value corresponds to.
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
cputime:
\series default
 
\family default
\size default
PTLsim simulator performance
\end_layout

\begin_deeper
\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
fetch:
\family default
\series default
\size default
 seconds spent in fetch stage
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
decode:
\family default
\series default
\size default
 seconds spent decoding instructions (in decoder subsystem)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
rename:
\family default
\series default
\size default
 seconds spent in allocate and rename stage
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
frontend:
\family default
\series default
\size default
 seconds spent in frontend stages
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
dispatch:
\family default
\series default
\size default
 seconds spent in dispatch stage
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
issue:
\family default
\series default
\size default
 seconds spent in ALU issue stage, not including loads and stores
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
issueload:
\family default
\series default
\size default
 seconds spent issuing loads
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
issuestore:
\family default
\series default
\size default
 seconds spent issuing stores
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
complete:
\family default
\series default
\size default
 seconds spent in completion stage
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
transfer:
\family default
\series default
\size default
 seconds spent in transfer stage
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
writeback:
\family default
\series default
\size default
 seconds spent in writeback stage
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
commit:
\family default
\series default
\size default
 seconds spent in commit stage
\begin_inset Note Note
status collapsed

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
total-secs:
\series default
 
\family default
\size default
total seconds spent in simulation mode (native mode does not count towards
 this total)
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
cycles-per-sec:
\series default
 
\family default
\size default
average number of processor cycles simulated per second
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
issues-per-sec:
\series default
 
\family default
\size default
average number of uops issued in the simulator per second
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
commits-per-sec:
\series default
 
\family default
\size default
average number of uops committed in the simulator per second
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
user-commits-per-sec:
\series default
 
\family default
\size default
average number of x86 instructions committed in the simulator per second
\end_layout

\end_inset


\end_layout

\end_deeper
\begin_layout Section
External Events
\end_layout

\begin_layout Itemize

\family typewriter
\series bold
\size footnotesize
assists: 
\family default
\series default
\size default
histogram of microcode assists invoked from any core
\end_layout

\begin_layout Itemize

\series bold
traps:
\series default
 histogram of x86 interrupt vectors (traps) invoked from any core (PTLsim/X
 only)
\end_layout

\begin_layout Standard

\newpage

\end_layout

\begin_layout Bibliography

\bibitem {XenSource}

\begin_inset ERT
status inlined

\begin_layout Standard


\backslash
href{http://www.xensource.com/xen/}{
\end_layout

\end_inset


\emph on
XenSource Community Web Site.
\emph default

\begin_inset ERT
status inlined

\begin_layout Standard

}
\end_layout

\end_inset


\end_layout

\begin_layout Bibliography

\bibitem {XenCambridge}

\begin_inset ERT
status inlined

\begin_layout Standard


\backslash
href{http://www.cl.cam.ac.uk/Research/SRG/netos/xen/}{
\end_layout

\end_inset


\emph on
Xen page at Cambridge.
\emph default

\begin_inset ERT
status inlined

\begin_layout Standard

}
\end_layout

\end_inset


\end_layout

\begin_layout Bibliography

\bibitem {Xen2Overview}

\begin_inset ERT
status inlined

\begin_layout Standard


\backslash
href{http://www.cl.cam.ac.uk/netos/papers/2004-xen-ols.pdf}{
\end_layout

\end_inset


\emph on
Xen and the Art of Virtualization.

\emph default
 I.
 Pratt et al.
 Ottowa Linux Symposium 2004.
\begin_inset ERT
status inlined

\begin_layout Standard

}
\end_layout

\end_inset


\end_layout

\begin_layout Bibliography

\bibitem {XenCambridge}

\begin_inset ERT
status inlined

\begin_layout Standard


\backslash
href{http://www.cl.cam.ac.uk/Research/SRG/netos/xen/}{
\end_layout

\end_inset


\emph on
Xen page at Cambridge.
\emph default

\begin_inset ERT
status inlined

\begin_layout Standard

}
\end_layout

\end_inset


\end_layout

\begin_layout Bibliography

\bibitem {Xen2Overview}

\begin_inset ERT
status inlined

\begin_layout Standard


\backslash
href{http://www.cl.cam.ac.uk/netos/papers/2004-xen-ols.pdf}{
\end_layout

\end_inset


\emph on
Xen and the Art of Virtualization.

\emph default
 I.
 Pratt et al.
 Ottowa Linux Symposium 2004.
\begin_inset ERT
status inlined

\begin_layout Standard

}
\end_layout

\end_inset


\end_layout

\begin_layout Bibliography

\bibitem {Xen3}

\begin_inset ERT
status inlined

\begin_layout Standard


\backslash
href{http://www.cl.cam.ac.uk/netos/papers/2006-xen-fosdem.ppt}{
\end_layout

\end_inset


\emph on
Xen 3.0 Virtualization.

\emph default
 I.
 Pratt et al.
 FOSDEM 2006.
\begin_inset ERT
status inlined

\begin_layout Standard

}
\end_layout

\end_inset


\end_layout

\begin_layout Bibliography

\bibitem {XenIntroWiki}

\begin_inset ERT
status inlined

\begin_layout Standard


\backslash
href{http://wiki.xensource.com/xenwiki/XenIntro}{
\end_layout

\end_inset


\emph on
Introduction to Xen 3.0.
\emph default

\begin_inset ERT
status inlined

\begin_layout Standard

}
\end_layout

\end_inset


\end_layout

\begin_layout Bibliography

\bibitem {XenPerformance}

\begin_inset ERT
status inlined

\begin_layout Standard


\backslash
href{http://www.cl.cam.ac.uk/Research/SRG/netos/xen/performance.html}{
\end_layout

\end_inset


\emph on
Xen Performance Study.
\emph default

\begin_inset ERT
status inlined

\begin_layout Standard

}
\end_layout

\end_inset


\end_layout

\begin_layout Bibliography

\bibitem {QEMU}

\begin_inset ERT
status inlined

\begin_layout Standard


\backslash
href{http://www.qemu.org/qemu-tech.html}{
\end_layout

\end_inset


\emph on
QEMU Internals.

\emph default
 F.
 Bellard.
 Tech Report, 2006.
\begin_inset ERT
status inlined

\begin_layout Standard

}
\end_layout

\end_inset


\end_layout

\begin_layout Bibliography

\bibitem {Bochs}

\begin_inset ERT
status inlined

\begin_layout Standard


\backslash
href{http://bochs.sourceforge.net/}{
\end_layout

\end_inset


\emph on
Bochs IA-32 Emulator Project.
\emph default

\begin_inset ERT
status inlined

\begin_layout Standard

}
\end_layout

\end_inset


\end_layout

\begin_layout Bibliography

\bibitem {VMware}

\begin_inset ERT
status inlined

\begin_layout Standard


\backslash
href{http://www.usenix.org/event/usenix01/sugerman/sugerman.pdf}{
\end_layout

\end_inset


\emph on
Virtualizing I/O Devices on VMware Workstation's Hosted Virtual Machine
 Monitor.

\emph default
 J.
 Sugerman et al.
\begin_inset ERT
status inlined

\begin_layout Standard

}
\end_layout

\end_inset


\end_layout

\begin_layout Bibliography

\bibitem {Simics}

\begin_inset ERT
status inlined

\begin_layout Standard


\backslash
href{http://www.simics.com}{
\end_layout

\end_inset


\emph on
Simics.
\emph default

\begin_inset ERT
status inlined

\begin_layout Standard

}
\end_layout

\end_inset


\end_layout

\begin_layout Bibliography

\bibitem {SimNow}

\begin_inset ERT
status inlined

\begin_layout Standard


\backslash
href{http://www.hotchips.org/archives/hc16/2_Mon/15_HC16_Sess4_Pres1_bw.pdf}{
\end_layout

\end_inset


\emph on
SimNow: Fast Platform Simulation Purely in Software.

\emph default
 R.
 Bedichek (AMD).
 Hot Chips 2004.
\begin_inset ERT
status inlined

\begin_layout Standard

}
\end_layout

\end_inset


\end_layout

\begin_layout Bibliography

\bibitem {Intel-VT}

\begin_inset ERT
status inlined

\begin_layout Standard


\backslash
href{http://download.intel.com/design/Pentium4/manuals/25366820.pdf}{
\end_layout

\end_inset


\emph on
IA-32 Intel Architecture Software Developer's Manual, Volume 3A: System
 Programming Guide, Part 1,
\emph default
 Chapter 19, 
\begin_inset Quotes eld
\end_inset

Introduction to Virtual Machine Extensions
\begin_inset Quotes erd
\end_inset

.
\begin_inset ERT
status inlined

\begin_layout Standard

}
\end_layout

\end_inset


\end_layout

\begin_layout Bibliography

\bibitem {AMD-SVM}

\begin_inset ERT
status inlined

\begin_layout Standard


\backslash
href{http://www.amd.com/us-en/assets/content_type/white_papers_and_tech_docs/24593.
pdf}{
\end_layout

\end_inset


\emph on
AMD64 Architecture Programmer's Manual, Volume 2: System Programming,
\emph default
 Chapter 15, 
\begin_inset Quotes eld
\end_inset

Secure Virtual Machine
\begin_inset Quotes erd
\end_inset

.
\begin_inset ERT
status inlined

\begin_layout Standard

}
\end_layout

\end_inset


\end_layout

\begin_layout Bibliography
\paragraph_spacing single

\bibitem {TransmetaPatent.TBit}
E.
 Kelly et al.
 
\emph on
Translated memory protection apparatus for an advanced microprocessor.

\emph default
 U.S.
 Patent 6199152, filed 22 Aug 1996.
 Assn.
 Transmeta Corp.
\end_layout

\begin_layout Bibliography
\paragraph_spacing single

\bibitem {TransmetaPatent.SubPageTBit}
J.
 Banning et al.
 
\emph on
Fine grain translation discrimination.

\emph default
 U.S.
 Patent 6363336, filed 13 Oct 1999.
 Assn.
 Transmeta Corp.
\end_layout

\begin_layout Bibliography
\paragraph_spacing single

\bibitem {TransmetaPatent.SelfRevalTrans}
J.
 Banning et al.
 
\emph on
Translation consistency checking for modified target instructions by comparing
 to original copy.

\emph default
 U.S.
 Patent 6594821, filed 30 Mar 2000.
 Assn.
 Transmeta Corp.
\end_layout

\begin_layout Bibliography
\paragraph_spacing single

\bibitem {IBMDaisyIEEE}
K.
 Ebcioglu et al.
 
\emph on
Dynamic Binary Translation and Optimization
\emph default
.
 IEEE Trans.
 Computers, June 2001.
\end_layout

\begin_layout Bibliography
\paragraph_spacing single

\bibitem {IBMDaisyTechReport}
K.
 Ebcioglu, E.
 Altman.
 
\emph on
DAISY: Dynamic Compilation for 100% Architectural Compatibility.

\emph default
 IBM Research Report RC 20538, 5 Aug 1996.
\end_layout

\begin_layout Bibliography
\paragraph_spacing single

\bibitem {IBMDaisyManual}
E.
 Altman, K.
 Ebcioglu.
 
\emph on
DAISY Dynamic Binary Translation Software.

\emph default
 Software Manual for DAISY Open Source Release, 2000.
\end_layout

\end_body
\end_document
