Self-Aligning Return Address Stack

1. IEEE 7th International Computing on Networking, Architecture, and Storage Self-Aligning Return Address Stack

2. Big Picture of RAS • Abstract on Paper • Introduction on Paper • SARAS • Comparison Target • TOS Only RAS • TOS&data Checkpointing RAS • FSC RAS • CATOS RAS • Evaluation on Paper Contents

3. BTB PC RETURN? 4 + Predicted next PC Pop Return Address Push Return Address TOS Big Picture of RAS

4. RAS has been widely used in modern high-performance microprocessor. • But speculative execution frequently corrupts the RAS. • Making repair mechanisms necessary. • In this paper, based on analysis of RAS activities after misprediction and current RAS repair mechanisms, Self-Aligning Return-Address Stack (SARAS) is proposed. Abstract on Paper

5. SARAS is composed of a classical RAS, a self-aligning queue(AQ) and a top-of-stack counter. • The Self-aligning queue records the contents popped from RAS for recovery. • The top-of-stack counter tracks the latest correct position of the TOS Abstract on Paper

6. To mitigate the negative impacts of increased branch penalties, a variety of branch predictors, each aimed at a different type of branch, are employed to obtain higher branch prediction accuracy. • RAS is designed for return address prediction. • In theory RAS can obtain 100% prediction. • Unfortunately, a simple RAS suffers from overflows and corruptions for some reason. • Nested depth in program cause overflow and contributory underflow. • RAS must be updated for speculatively fetched instructions while mispredictions are detected much later. Introduction on Paper

7. The mis-speculated operations of RAS can be simply divided into two cases. • Only move the TOS improperly • Affect both the TOS and the valid contents in RAS TOS TOS TOS TOS TOS Recovery But miss Predict TOS Introduction on Paper

8. If a call is fetched, its return target is pushed on RAS. • If a return is encountered, besides outputting the speculative return address, SARAS saves the popped entries and its indices into AQ. • Once a branch is mispredicted, if the AQ is not empty, namely stack corruption occurs. • The RAS is recovered by AQ while the TOS pointer is updated with the TOS counter immediately. SARAS

9. TOS counter is initialized to zero. • When a call or return completes, the TOS counter is respectively increased or decreased by one. • And then, the TOS pointer is updated with the TOS counter. SARAS

10. The AQ, implemented as a FIFO circular buffer, is proposed to track the in-flight return instructions. • It was managed by a head and a tail. • The head points to the earliest uncompleted return instruction while the tail points to the next allocated place. Tail 0 Head 1 2 SARAS

11. Each entry in AQ contains the popped entry and its own index in stack. • The head and tail are initialized zero. • When a return is fetched, the predicted target popped from RAS, including its position, is written to the entry pointed by the tail. Then, the tail is increased by one. • When a return completes, the head is increased by one • Each time a branch is mispredicted, the head is decreased by one. The contents from the tail to the head are written to the original entries of RAS according to the saved indeces. Tail 3 2 1 0 0 TOS Head 1 TOS Counter Tail 1 Head SARAS

12. Tail 3 2 1 0 3 2 1 0 0 Tail Head 1 Head TOS TOS Counter TOS Counter 1 1 TOS Tail 3 2 1 0 3 2 1 0 Tail 0 Head 1 Head 1 TOS Counter TOS Counter 1 TOS 1 TOS Tail Tail 3 2 1 0 3 2 1 0 0 0 TOS Head Head 1 1 TOS Counter TOS Counter 1 1 TOS SARAS

13. Tail 3 2 1 0 0 TOS Head 1 TOS Counter 1 Tail 3 2 1 0 0 TOS 1 TOS Counter Head 1 3 2 1 0 0 1 TOS TOS Counter Tail 1 Head SARAS

14. Tail 3 2 1 0 3 2 1 0 1 Tail Head 1 Head TOS TOS Counter TOS Counter 1 1 TOS Tail 3 2 1 0 3 2 1 0 Tail 1 Head 1 1 TOS Counter TOS Counter Head 1 1 TOS TOS 3 2 1 0 3 2 1 0 Tail 1 Head 1 1 TOS TOS Tail TOS Counter TOS Counter 1 1 Head SARAS

15. 3 2 1 0 TOS • When a branch misprediction is detected, the current TOS is restored immediately by the backup TOS value TOS TOS TOS Mis-Prediction 2 1 TOS Only RAS

16. 3 2 1 0 TOS • When a branch misprediction is detected, the current TOS is restored immediately by the backup TOS value associated with the mispredicted branch. TOS TOS Mis-Prediction 2 TOS 1 TOS Only RAS

17. 3 2 1 0 TOS • When a branch misprediction is detected, the current TOS is restored immediately by the backup TOS value associated with the mispredicted branch. TOS TOS TOS Mis-Prediction 2 1 TOS&data checkpointing RAS

18. 3 2 1 0 TOS • When a branch misprediction is detected, the current TOS is restored immediately by the backup TOS value associated with the mispredicted branch. TOS TOS Mis-Prediction 2 TOS 1 TOS&data checkpointing RAS

19. The noncheckpointed RAS entries are still responsible for a large number of mispredictions. • The extreme is to do full-stack checkpointing, called FSC for short. TOS TOS TOS TOS Mis-Prediction FSC RAS

20. For a conditional branch, and other branch types that do not update the RAS, the checkpointed TOS is aligned. • For a mispredicted call, however, the checkpointed TOS is not aligned because a call correctly pushes its return address in the RAS even if its target address is mispredicted. CATOS RAS

21. Evaluation on Paper

22. 32 16 32 8 16 Entry Evaluation on Paper

23. The End