Re: Reverse engineering of Intel branch predictors

On Tue, 12 Nov 2024 19:00:02 +0000, Stefan Monnier wrote:

Hmm... but in order not to have bubbles, your prediction structure still
needs to give you a predicted target address (rather than a predicted
index number), right?

Yes, but you use the predicted index number to find the predicted
target IP.

Hmm... but that would require fetching that info from memory.
Can you do that without introducing bubbles?

>
In many/most (dynamic) cases, they have already been fetched and all
that is needed is muxing the indexed field out of Instruction Buffer.

>
I guess for small jump table that would work well, indeed, but for
something like a bytecode interpreter, even if you can compact it to
have only 16bit per entry, that still spans 512B.  Is your IB large
enough for that?

For something like a bytecode interpreter, the prediction accuracy
of the jump predictor is going to be epically bad.

If you're lucky it's in the L1 Icache, but that still takes a couple
cycles to get, doesn't it?

My 1-wide machine fetches 4-words per cycle.
My 6-wide machine fetches 3 ½-cache-lines per cycle.

>
Even with a 256B cache line width, it would take 2 cycles to get a 512B
jump table into your IB, after which you still have to select (and
compute, if the table is compacted) the corresponding target address,
and only after that can you start fetching (which itself will suffer
the L1 latency), so we're up to a 5-6 cycle bubble, no?

a) line size is 512-bits or 64-bytes.
b) yes accessing the jump table when it is not in IB takes several
..extra cycles
c) JTT performs range comparison, memory LD [IP+Ri<<sc], IP+=data<<2
d) the cycle count should be 4-5 cycles or a bit faster than if SW
..executed the same semantic content.
The LD does not have to be under the shadow of the range comparison
as the data can be thrown away if the range comparison fails and we
go to default.

>
>
        Stefan