Running Scarab With the Trace Frontend

Scarab supports simulation using execution traces that can be generated once using a PIN tool. The trace frontend is generally much faster than the default execution-driven PIN frontend, but it does not support simulation on the wrongpath. After each branch misprediction, the pipeline frontend simply stalls until the branch resolves.

Compiling the trace generator PIN tools

export PIN_ROOT=/path/to/pin/root/directory
cd scarab/src/pin/pin_trace
make

Generating an instruction trace

By running a program directly (optional fast-forwarding)

Now, we can invoke the tool to generate traces of any single-threaded program that can be instrumented with PIN using the command below. Note that the trace files are compressed using bzip2, so the default file extension for a trace is .bz2.

$PIN_ROOT/pin -t /path/to/scarab/src/pin/pin_trace/obj-intel64/gen_trace.so -trace_len <num_instructions_in_trace> -o /path/to/output/trace.bz2 [-fast_forward <num_fast_forwarded_insts> -- <program command with all args>

Using Scarab checkpoints

The checkpoint loader tool (in utils/checkpoint/loader) can be used to generate a trace starting at a specific checkpoint:

/path/to/checkpoint/loader  --run_external_pintool <checkpoint_path> /path/to/scarab/src/pin/pin_trace/obj-intel64/gen_trace.so --pintool_args "-start_rip <Starting RIP in the checkpoint> -trace_len {num_instructions_in_trace} -o /path/to/output/trace.bz2 "'

Using Intel Pinballs

Instead of Scarab checkpoints, you can use Pinballs to generate traces at specific program points. The only knob specific to this PIN tool is "-o" which determines the output path for the generated trace. For example:

$PIN_ROOT/pin -xyzzy -reserve_memory /pinball_directory/pinball.address -t /path/to/scarab/src/pin/pin_trace/obj-intel64/gen_trace.so -replay -replay:basename /pinball_directory/pinball -o /path/to/output/trace.bz2 -- $PIN_ROOT/extras/pinplay/bin/intel64/nullapp

Running Scarab using a trace

The launcher scripts in the bin directory currently do not support the trace frontend, so you should run the scarab binary directly. Here are the following arguments that you need to pass:

--frontend trace                       # enables the trace frontend
--fetch_off_path_ops 0                 # Fetching off path ops should be turned off
--cbp_trace_r0 /path/to/trace.bz2    

For example:

./scarab --frontend trace --fetch_off_path_ops 0 --cbp_trace_r0 /path/to/trace.bz2

For multi-core runs, you need to set the number of cores using --num_cores and set --cbp_trace_r[core_id] for each core.