Analyzing, understanding, and validating the performance of modern processors present significant challenges. These stem from two primary issues. First, it is difficult to construct precise “performance tests” that can test minimal microarchitectural hypotheses. Second, it is difficult to make sense of performance measurements: hardware teams are drowning in low-level events that they struggle to map back to the tested programs, and software developers and security researchers are limited by the coarse resolution of performance counters. This paper addresses both challenges with a unified programming language approach that we prototype in a framework named HT.

To overcome the test-construction problem, our insight is that a broad range of microarchitectural effects are triggered by a specific software address layout. We introduce a DSL that makes it possible to specify desired microarchitectural effects (such as branch predictor aliasing) of a program through specifying its address layout, separately from its functional behavior. This separation is achieved using an SMT solver to compute a suitable instruction and data layout.

To overcome the observability challenge, we systematically link high-level software patterns down to raw hardware simulation outputs. We introduce flexible event-tracing constructs designed to construct custom, multi-cycle higher-level events from (single-cycle) low-level event logs, effectively acting as the bridge that connects software execution patterns to low-level hardware events.

We demonstrate HT’s utility on XiangShan, a production-grade open-source RISC-V processor, through three case studies: analyzing the performance impact of the Zicond RISC-V extension, reliably reproducing subtle microarchitectural security attacks, and characterizing the branch prediction behavior of Lua, an interpreted language.